@morlay/dsh-subagent 0.0.5 → 0.0.7

package/dist/index.d.mts

@@ -1,16 +1,18 @@
+import { Context, Volatile } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
-import { Scoped } from "@deepseek-ai/dsh-scope";
-import { ObjectJsonSchema, ToolRestriction } from "@deepseek-ai/dsh-tools";
-import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
-import { ContentBlock, HarnessError, MessageId, ReasoningEffortId, createUserMessage } from "@deepseek-ai/dsh-llm";
+import { ContentBlock, HarnessError, MessageId, ReasoningEffortId } from "@deepseek-ai/dsh-llm";
 import { Agent, AgentOptions, CreateAgentOptions } from "@deepseek-ai/dsh-agent";
 import { Session, SessionEvent, SessionId, SessionLogOffset } from "@deepseek-ai/dsh-session";
-import { Branded } from "@deepseek-ai/dsh-brand";
-import { Context, Service, Volatile } from "@deepseek-ai/cordis";
+import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { PromptContentPart } from "@deepseek-ai/dsh-attachment/types";
+import { Branded } from "@deepseek-ai/dsh-brand";
 import { MessageId as MessageId$1 } from "@deepseek-ai/dsh-llm/brand";
-import { SessionId as SessionId$1, SessionSeq as SessionSeq$1 } from "@deepseek-ai/dsh-session/types";
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/control-types.d.ts
+import { SessionId as SessionId$1, SessionSeq } from "@deepseek-ai/dsh-session/types";
+import { ObjectJsonSchema, ToolRestriction } from "@deepseek-ai/dsh-tools";
+import { Scoped } from "@deepseek-ai/dsh-scope";
+import { ChunkedList } from "@deepseek-ai/dsh-chunked-list";
+import { SandboxMode } from "@deepseek-ai/dsh-sandbox";
+//#region src/vendor/dsh-subagent/control-types.d.ts
 /**
  * Client-minted identity of one browser prompt, persisted on the exact accepted
  * message. It carries the Session Controller's `session-request-id` brand so a
@@ -18,7 +20,7 @@ import { SessionId as SessionId$1, SessionSeq as SessionSeq$1 } from "@deepseek-
  * vocabulary; that package depends on this one, so the brand is spelled here
  * rather than imported.
  */
-type SubagentPromptRequestId = Branded<'session-request-id'>;
+type SubagentPromptRequestId = Branded<"session-request-id">;
 /** Shared child fields for recursive catalog listing. */
 type SubagentCatalogRow = {
   /** The durable child session id, stable across Activations. */
@@ -27,15 +29,20 @@ type SubagentCatalogRow = {
    * Whether recursive catalog listing observed a resident Session. This
    * does not encode a durable outcome or guarantee continuation delivery.
    */
-  readonly activity: 'running' | 'inactive';
+  readonly activity: "running" | "inactive";
 } & ({
   /** A terminal one-shot child. */
-  readonly mode: 'one-shot';
+  readonly mode: "one-shot";
+  /** Optional durable creation label from the parent catalog. */
+  readonly label?: string;
+} | {
+  /** An external execution without a local child Session. */
+  readonly mode: "external";
   /** Optional durable creation label from the parent catalog. */
   readonly label?: string;
 } | {
   /** A resumable conversation. */
-  readonly mode: 'continuable';
+  readonly mode: "continuable";
   /** Durable creation label from the parent catalog. */
   readonly label: string;
 });
@@ -44,11 +51,11 @@ type SubagentCatalogRow = {
  * unknown catalog modes or unreadable child catalogs.
  */
 type SubagentListEntry = (SubagentCatalogRow & {
-  readonly kind: 'child';
+  readonly kind: "child";
   /** Whether the child catalog contains a direct child. */
   readonly hasChildren: boolean;
 }) | {
-  readonly kind: 'diagnostic';
+  readonly kind: "diagnostic";
   /** The candidate's session id. */
   readonly id: SessionId$1;
   /**
@@ -57,19 +64,21 @@ type SubagentListEntry = (SubagentCatalogRow & {
    * stops that branch. `unsupported` means the parent catalog records an
    * unknown child mode; its readable catalog is still traversed.
    */
-  readonly reason: 'corrupt' | 'unsupported' | 'unavailable';
+  readonly reason: "corrupt" | "unsupported" | "unavailable";
 };
 /** Durable parent/child browsing address; unknown mode is resolved when child history is read. */
 type SubagentAddress = {
   readonly parentSessionId: SessionId$1;
   readonly childSessionId: SessionId$1;
 } & ({
-  readonly mode: 'one-shot';
+  readonly mode: "one-shot";
 } | {
-  readonly mode: 'continuable';
+  readonly mode: "continuable";
 } | {
-  readonly mode: 'unknown';
+  readonly mode: "unknown";
 });
+/** One Agent inbox destination, as the prompt request selects it. */
+type SubagentDelivery = SubagentPromptRequest["delivery"];
 /** One human message addressed to a continuable direct child. */
 interface SubagentPromptRequest {
   /** Identity persisted on the accepted message, minted before the call. */
@@ -77,9 +86,9 @@ interface SubagentPromptRequest {
   readonly parentSessionId: SessionId$1;
   readonly childSessionId: SessionId$1;
   /** Required discriminator retained from the browser control address. */
-  readonly mode: 'continuable';
+  readonly mode: "continuable";
   /** Whether this message queues a later turn or targets the nearest step. */
-  readonly delivery: 'queue' | 'steer';
+  readonly delivery: "queue" | "steer";
   /**
    * Browser prompt parts delivered as the child's user message. The Host
    * admits and persists image parts before delivery, so the wire never
@@ -101,195 +110,78 @@ interface SubagentInterruptReceipt {
  * Failure details the control surface answers with. Prompts and interrupts
  * share these failures with the Client Remote result.
  */
-declare module '@deepseek-ai/dsh-workspace/types' {
+declare module "@deepseek-ai/dsh-workspace/types" {
   interface SessionActivityKindMap {
     /** A subagent session delegated from this session (at any depth) is inside a turn. */
     subagent: true;
   }
 }
-declare module '@deepseek-ai/dsh-typert-protocol' {
+declare module "@deepseek-ai/dsh-typert-protocol" {
   interface RemoteErrorDetailsMap {
     /** A browser-supplied zone is neither UTC nor a canonical IANA name. */
-    'subagent/invalid-time-zone': {
+    "subagent/invalid-time-zone": {
       readonly value: string;
     };
     /** No live Agent carries the addressed parent session. */
-    'subagent/parent-unavailable': {
+    "subagent/parent-unavailable": {
       readonly parentSessionId: SessionId$1;
     };
     /** The addressed child cannot take a continuation. */
-    'subagent/not-resumable': {
+    "subagent/not-resumable": {
       readonly childSessionId: SessionId$1;
     };
     /** The claimed parent does not own the addressed child. */
-    'subagent/unauthorized': {
+    "subagent/unauthorized": {
       readonly childSessionId: SessionId$1;
     };
     /** Image admission or model image-capability refusal. */
-    'subagent/attachment-invalid': {
+    "subagent/attachment-invalid": {
       readonly reason: string;
     };
     /** The child exists but its inbox cannot admit the message now. */
-    'subagent/delivery-unavailable': {
+    "subagent/delivery-unavailable": {
       readonly childSessionId: SessionId$1;
     };
   }
 }
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/descriptor.d.ts
-declare module '@deepseek-ai/dsh-session/types' {
-  interface SessionEventMap {
-    /**
-     * Durable identity and lifecycle mode of a session-backed subagent child,
-     * appended once by the establishing provider inside the child's initial
-     * turn, before its first request. Continuable records also carry their
-     * resumable composition. Log-only: it carries no `surfaceOp`, never enters
-     * model history, and survives compaction.
-     */
-    'subagent/descriptor': SubagentDescriptorData;
-  }
-}
-/**
- * The current descriptor format version, stamped into every appended
- * `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
- * Supporting another composition input is a deliberate version change, never
- * an implicit extra field.
- */
-export declare const SUBAGENT_DESCRIPTOR_VERSION = 3;
-/** Fields shared by every supported `subagent/descriptor` payload. */
-interface SubagentDescriptorBase {
-  /** Descriptor format version ({@link SUBAGENT_DESCRIPTOR_VERSION}). */
-  readonly version: number;
-  /** Whether the child is a terminal one-shot run or a resumable conversation. */
-  readonly mode: 'one-shot' | 'continuable';
-  /** The `ctx.subagents` provider name that established the child. */
-  readonly provider: string;
-}
-/** A session-backed subagent that cannot be cold-resumed after its run. */
-interface OneShotSubagentDescriptorData extends SubagentDescriptorBase {
-  readonly mode: 'one-shot';
-  /**
-   * The initial delegation's short `description`, kept as the child's durable
-   * creation label so enumeration can identify the conversation without
-   * replaying parent tool results or exposing the child prompt.
-   */
-  readonly label?: string;
-}
-/** A session-backed subagent whose declared composition supports cold resume. */
-interface ContinuableSubagentDescriptorData extends SubagentDescriptorBase {
-  readonly mode: 'continuable';
-  /** The initial delegation's short `description`, used for durable enumeration. */
-  readonly label: string;
-  /** Resolved child `agentOptions.provider`, when one was declared. */
-  readonly agentProvider?: string;
-  /** Resolved child `agentOptions.model`, when one was declared. */
-  readonly agentModel?: string;
-  /** Resolved child `agentOptions.reasoningEffort`, when one was declared. */
-  readonly agentReasoningEffort?: ReasoningEffortId;
-  /** Per-child persona that shadows the deployment persona on resume. */
-  readonly persona?: string;
-  /** Child tool scoping reapplied on resume. */
-  readonly toolFilter?: ToolRestriction;
-}
-/** The supported durable subagent identity and optional continuation composition. */
-type SubagentDescriptorData = OneShotSubagentDescriptorData | ContinuableSubagentDescriptorData;
-/** Fields shared by descriptor snapshot inputs. */
-interface SubagentDescriptorInputBase {
-  /** Whether the child is a terminal one-shot run or a resumable conversation. */
-  readonly mode: 'one-shot' | 'continuable';
-  /** The `ctx.subagents` provider name that will establish the child. */
-  readonly provider: string;
-}
-/** Input for a one-shot child's durable identity. */
-interface OneShotSubagentDescriptorInput extends SubagentDescriptorInputBase {
-  readonly mode: 'one-shot';
-  /** Optional initial delegation `description` used as the durable creation label. */
-  readonly label?: string;
-}
-/** Input for a continuable child's durable identity and resumable composition. */
-interface ContinuableSubagentDescriptorInput extends SubagentDescriptorInputBase {
-  readonly mode: 'continuable';
-  /** Initial delegation `description` used for durable enumeration. */
-  readonly label: string;
-  /** Requested child `agentOptions.provider`. */
-  readonly agentProvider?: string;
-  /** Requested child `agentOptions.model`. */
-  readonly agentModel?: string;
-  /** Requested child `agentOptions.reasoningEffort`. */
-  readonly agentReasoningEffort?: ReasoningEffortId;
-  /** Requested per-child persona. */
-  readonly persona?: string;
-  /** Requested child tool scoping. */
-  readonly toolFilter?: ToolRestriction;
-}
-/** Inputs {@link snapshotSubagentDescriptor} validates and detaches. */
-type SubagentDescriptorInput = OneShotSubagentDescriptorInput | ContinuableSubagentDescriptorInput;
-/**
- * Validate and detach descriptor inputs into the durable payload, before any
- * Task or provider work begins — the same detached lossless-JSON boundary the
- * session log itself enforces, applied early so a synchronous validation
- * failure rejects the tool call without creating a Task.
- * @param input - the caller-collected composition fields.
- * @returns the versioned, detached descriptor payload.
- * @throws when a field is not losslessly JSON-serializable.
- */
-export declare function snapshotSubagentDescriptor(input: OneShotSubagentDescriptorInput): OneShotSubagentDescriptorData;
-/**
- * Validate and detach a continuable descriptor input.
- * @param input - the caller-collected continuable composition fields.
- * @returns the versioned, detached continuable descriptor payload.
- * @throws when a field is not losslessly JSON-serializable.
- */
-export declare function snapshotSubagentDescriptor(input: ContinuableSubagentDescriptorInput): ContinuableSubagentDescriptorData;
-/**
- * Fold a persisted child log to its supported descriptor. The first
- * `subagent/descriptor` event is authoritative — the establishing provider
- * appends exactly one, so a later same-type event cannot rewrite the declared
- * composition.
- * @param events - the loaded child session events.
- * @returns the descriptor, or `undefined` when the log has none or its
- *   version is not {@link SUBAGENT_DESCRIPTOR_VERSION} (the child cannot be
- *   classified by this runtime).
- * @throws when a current-version persisted payload does not match its complete
- *   declared schema.
- */
-export declare function foldSubagentDescriptor(events: readonly SessionEvent[]): SubagentDescriptorData | undefined;
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/types.d.ts
+//#region src/vendor/dsh-subagent/types.d.ts
 /** Identifies one accepted subagent run across its lifecycle event pair. */
-export type SubagentRunId = Branded<'SubagentRunId'>;
+export type SubagentRunId = Branded<"SubagentRunId">;
 /**
  * Brand a string as a {@link SubagentRunId}.
  * @param id - the raw run id.
  * @returns the same string, branded.
  */
 export declare function SubagentRunId(id: string): SubagentRunId;
-/** What a caller asks for when starting a continuable background child. */
-interface ContinuableStartSpec {
-  /** The `ctx.subagents` provider whose continuable-creation capability establishes the child. */
+/** One managed child execution and its result delivery policy. */
+interface SubagentActivationSpec {
+  /** Registered backend to use. */
   readonly provider: string;
-  /** The initial delegation's short `description`, persisted as the child's creation label. */
+  /** Short task label retained in cataloged child membership. */
   readonly label: string;
-  /**
-   * Optional caller-reserved child identity. Omission preserves the manager's
-   * UUID allocation; supplying one lets a durable parent record provisioning
-   * before child materialization without a second identity handshake.
-   */
+  /** Optional reserved identity for a local child; external backends allocate their own ids. */
   readonly childId?: SessionId;
-  /**
-   * The delegation request. The manager reserves the stable child id, resolves
-   * the durable descriptor, and composes the child itself.
-   */
-  readonly request: Omit<SubagentStartRequest, 'label' | 'signal' | 'outputSchema'>;
-  /** Caller cancellation, owning the operation only until inbox acceptance. */
+  /** Task, parent, and backend-supported execution options. */
+  readonly request: Omit<SubagentStartRequest, "label" | "signal">;
+  /** Cancellation before publication; callers own later cancellation through dispose. */
   readonly signal: AbortSignal;
+  /** Parent delivery notifies the model; caller delivery only returns the result. Local children always enter the parent catalog. */
+  readonly delivery: "parent" | "caller";
 }
-/** Identities returned once a continuable child accepted its initial prompt. */
-interface ContinuableStart {
-  /** The durable child session id, stable across activations. */
+/** A managed execution; disposal addresses this exact activation, never a later resume. */
+interface SubagentActivation {
+  /** Stable identity of the child. */
   readonly childId: SessionId;
-  /** The accepted initial prompt's inbox message id. */
-  readonly messageId: MessageId;
+  /** Accepted inbox message, when the backend has a local inbox. */
+  readonly messageId?: MessageId;
+  /**
+   * Execution result after teardown settles and notifications are sent; capture failures reject.
+   * Teardown failures are reported by dispose() without replacing a captured result.
+   */
+  readonly result: Promise<SubagentResult>;
+  /** Stop and release this activation and its owned descendants; rejects on teardown failure. */
+  dispose(): Promise<void>;
 }
 /**
  * Authority under which one interrupt request is admitted. `user` carries the
@@ -297,10 +189,10 @@ interface ContinuableStart {
  * the exact live Agent object whose recorded lineage must contain the caller.
  */
 type SubagentInterruptAuthority = {
-  readonly kind: 'user';
+  readonly kind: "user";
   readonly parentSessionId: SessionId;
 } | {
-  readonly kind: 'ancestor';
+  readonly kind: "ancestor";
   readonly agent: Agent;
 };
 /** Options for one model-authored message between adjacent Agents. */
@@ -310,22 +202,19 @@ interface SubagentSendMessageOptions {
 }
 /**
  * Observe-only identifying detail for a published subagent run, carried by
- * `subagent/start`. One-shot runs and continuable Activation epochs share this
- * payload, so an observer sees the same vocabulary for both.
+ * `subagent/start`. Local and external activations share this payload.
  */
 interface SubagentRunInfo {
   /** Unique identity shared with the paired terminal event. */
   readonly runId: SubagentRunId;
   /**
-   * Provider name recorded when the child was first created. The provider may
-   * be absent when an accepted one-shot run becomes ready or a persisted
-   * Activation cold-resumes, because neither lifecycle depends on continued
-   * registration.
+   * Provider name recorded when the child was first created, retained even
+   * after that provider is unregistered.
    */
   readonly provider: string;
   /** The child agent's id. */
   readonly id: SessionId;
-  /** Snapshot of whether `SubagentRun.localAgent` was present when start fulfilled. */
+  /** Whether this activation owns a local Agent, fixed at publication. */
   readonly local: boolean;
 }
 /**
@@ -339,10 +228,10 @@ interface SubagentRunEndInfo {
   readonly provider: string;
   /** The child agent's id. */
   readonly id: SessionId;
-  /** Snapshot of whether `SubagentRun.localAgent` was present when start fulfilled. */
+  /** Whether this activation owns a local Agent, fixed at publication. */
   readonly local: boolean;
   /** The terminal stop reason. */
-  readonly stopReason: SubagentResult['stopReason'];
+  readonly stopReason: SubagentResult["stopReason"];
   /**
    * The child's final assistant output, selected by the same rule as
    * {@link SubagentResult.output}; absent on infrastructure rejection or when
@@ -351,39 +240,39 @@ interface SubagentRunEndInfo {
   readonly lastAssistantMessage?: readonly ContentBlock[];
 }
 /**
- * Which START-TIME features a provider supports. Checked by the service before delegating to
- * {@link SubagentProvider.start}: a request that needs a capability the chosen provider lacks
- * is rejected with a typed error rather than accepted-then-ignored (the "fail loud, no silent
- * degradation" rule). These flags describe the ONE-SHOT
- * {@link SubagentProvider.start} path, where the provider composes the child;
- * continuable children are composed by the continuation manager itself and are
- * gated by {@link SubagentProvider.prepareContinuable} instead. Each flag
- * corresponds one-to-one to a {@link SubagentStartRequest} option: `depthLimit`
- * to `maxDepth`; the other names match.
+ * Start-time options supported by a registered backend. The manager checks
+ * every requested option before preparing a local child or starting an external
+ * execution. depthLimit controls maxDepth; the remaining flag names match
+ * SubagentStartRequest fields.
  */
 interface SubagentCapabilities {
   readonly agentOptions: boolean;
+  /** Supports selecting a preset independently of the parent's composition. */
+  readonly agentPreset: boolean;
   readonly outputSchema: boolean;
   readonly depthLimit: boolean;
-  readonly toolFilter: boolean;
-  readonly persona: boolean;
 }
 /**
- * What a caller asks for when starting a ONE-SHOT subagent. The tool layer
- * builds this from the model's `{ description, prompt }` plus its own config;
- * the service validates {@link SubagentCapabilities} against the named provider
- * and resolves the durable descriptor before dispatching to
- * {@link SubagentProvider.start}.
+ * Task and optional capabilities supplied to a backend. startActivation carries
+ * these fields in request while owning its label, cancellation, and delivery
+ * policy separately.
  */
 interface SubagentStartRequest {
+  /** Initial child directory; relative paths resolve against the parent's current directory. Omitted inherits that directory at start. */
+  readonly cwd?: string;
+  /**
+   * Independent preset id; omission joins the parent's current generation.
+   * Requires a provider with `capabilities.agentPreset` that does not inherit
+   * parent context.
+   */
+  readonly agentPreset?: string;
   /** Optional short display label persisted with a session-backed child. */
   readonly label?: string;
   /** Content delivered as the child's user message. */
   readonly prompt: ContentBlock[];
   /**
-   * The spawning agent. In-process providers derive workspace, lineage, and
-   * delegation depth from its durable session state. ACP reads only its cwd,
-   * and only when no deployment `cwd` override is configured.
+   * The spawning agent. Its effective directory supplies the default cwd;
+   * in-process children retain its origin, lineage, and delegation depth.
    */
   readonly parent: Agent;
   /**
@@ -415,30 +304,11 @@ interface SubagentStartRequest {
    * start otherwise.
    */
   readonly maxDepth?: number;
-  /**
-   * Optional child tool scoping. Requires {@link SubagentCapabilities.toolFilter};
-   * rejected at start otherwise. In-process backends apply it as a scoped
-   * `tools.restrict()` in the child's creation window: the named tools vanish
-   * from the child's prompt AND refuse to execute (one visibility), with loud
-   * unknown-name validation.
-   */
-  readonly toolFilter?: ToolRestriction;
-  /**
-   * Optional per-child persona. Requires {@link SubagentCapabilities.persona};
-   * rejected at start otherwise. In-process backends register it as a scoped
-   * `deployment:persona-prefix` section on the child, SHADOWING the deployment's
-   * persona for this child alone — same template semantics as the deployment
-   * persona (strict `{{…}}` interpolation against the registered variables).
-   */
-  readonly persona?: string;
 }
-/**
- * Provider-facing one-shot request after {@link SubagentRuntime.start} resolves
- * the durable child descriptor.
- */
+/** Provider-facing request with an absolute directory selected before startup. */
 interface ResolvedSubagentStartRequest extends SubagentStartRequest {
-  /** Detached descriptor a session-backed provider persists in the child log. */
-  readonly descriptor: SubagentDescriptorData;
+  /** Absolute child directory captured from the parent or explicit request. */
+  readonly cwd: string;
 }
 /**
  * What the continuation manager asks a provider for while materializing one
@@ -448,6 +318,8 @@ interface ResolvedSubagentStartRequest extends SubagentStartRequest {
  * history.
  */
 interface ContinuableCreateRequest {
+  /** Absolute initial directory captured before provider preparation. */
+  readonly cwd: string;
   /** The reserved durable child session id, for provider diagnostics. */
   readonly sessionId: SessionId;
   /** The delegating parent agent whose history a seeding provider reads. */
@@ -480,15 +352,15 @@ interface ContinuableCreateSpec {
  */
 interface SubagentStopReasonMap {
   /** The child finished its turn normally. */
-  completed: 'completed';
+  completed: "completed";
   /** Cancelled through the request signal or disposal. */
-  aborted: 'aborted';
+  aborted: "aborted";
   /** Model or transport failure. */
-  error: 'error';
+  error: "error";
   /** The child hit its token ceiling before finishing. */
-  'max-tokens': 'max-tokens';
+  "max-tokens": "max-tokens";
   /** The child declined the task. */
-  refusal: 'refusal';
+  refusal: "refusal";
 }
 /** The union over {@link SubagentStopReasonMap} — widens automatically as backends merge in variants. */
 type SubagentStopReason = SubagentStopReasonMap[keyof SubagentStopReasonMap];
@@ -523,27 +395,15 @@ interface SubagentResult {
   readonly stopReason: SubagentStopReason;
 }
 /**
- * ONE-SHOT child handle returned after publication. Prompt submission, turn
- * work, and infrastructure faults after that boundary belong to {@link result}.
- * Consumers await that result and must always {@link dispose} to cancel
- * remaining work and reach quiescence. A run is one disposable foreground
- * delegation with one result; continuable conversations have no run — the
- * continuation manager holds their `AgentHandle` directly and orders every
- * turn through the child's own inbox.
+ * Backend execution handle owned directly by the activation registry.
+ * A result may become available before resource release; the manager always
+ * disposes the handle and awaits cleanup. Backend startup failures clean up
+ * partial resources before rejecting, while accepted execution failures settle
+ * through result.
  */
 interface SubagentRun {
-  /**
-   * Parent-scoped run id. For a local run, this MUST equal the published child
-   * session id, whose `parentSession` records `request.parent.session.id`; a
-   * remote provider mints an id unique in the parent namespace.
-   */
+  /** Provider-minted id, unique across all parents, providers, and local Sessions in this runtime. */
   readonly id: SessionId;
-  /**
-   * The exact published in-process child, or `undefined` for a remote run.
-   * When present, its id is {@link id}; the provider retains no ownership
-   * implication beyond the run's ordinary {@link dispose} contract.
-   */
-  readonly localAgent: Agent | undefined;
   /**
    * Resolves with the child's terminal {@link SubagentResult} when the run
    * settles. Does NOT reject on a child-level failure — a model/transport
@@ -578,7 +438,7 @@ interface SubagentProvider {
    */
   readonly inheritsParentContext: boolean;
   /**
-   * Optional static provider-owned provider/model route for one-shot Agent
+   * Optional static provider-owned provider/model route for child Agent
    * options. Consumers merge tool/model overrides over these values before
    * preflight; providers whose route derives from the parent omit it. The value
    * is detached immutable data and requires `agentOptions` support.
@@ -588,24 +448,21 @@ interface SubagentProvider {
     model: string;
   }>;
   /**
-   * Establish a ONE-SHOT child and return its handle after publication.
+   * Establish one external execution and return its owned handle.
    * The service has already validated that every requested start-time
-   * capability is supported and resolved `request.descriptor`, so a
-   * session-backed implementation appends that descriptor inside the child's
-   * initial turn. Before fulfillment, the provider owns setup and cleans any
-   * unpublished partial resources before rejecting. Ownership transfers on
+   * capability is supported. Before fulfillment, the provider owns setup and
+   * cleans any unpublished partial resources before rejecting. Ownership transfers on
    * fulfillment; subsequent turn or infrastructure failure settles through
    * the returned run. Distinct starts may overlap; cancellation, failure,
    * result settlement, and disposal remain independent for each run.
    */
-  start(request: ResolvedSubagentStartRequest): Promise<SubagentRun>;
+  start?(request: ResolvedSubagentStartRequest): Promise<SubagentRun>;
   /**
    * OPTIONAL (continuable-creation capability): contribute the detached
    * creation inputs that distinguish this provider's continuable children —
    * only whether the child session is seeded with parent history. Method
-   * presence IS the capability: the service rejects continuable starts on
-   * providers without it, while a provider that has it may still serve
-   * ordinary one-shot delegations.
+   * presence selects local activation execution. Providers without it execute
+   * through start and do not accept subsequent messages.
    *
    * This is the provider's ONLY participation in a continuable child. The
    * continuation manager owns identity reservation, composition, Agent
@@ -617,19 +474,22 @@ interface SubagentProvider {
   prepareContinuable?(request: ContinuableCreateRequest): Promise<ContinuableCreateSpec>;
 }
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/projection-types.d.ts
+//#region src/vendor/dsh-subagent/projection-types.d.ts
 /** One current direct-child discovery row materialized from parent facts. */
 type SubagentCatalogEntry = {
   readonly id: SessionId$1;
   readonly createdAt: number;
 } & ({
-  readonly mode: 'one-shot';
+  readonly mode: "one-shot";
   readonly label?: string;
 } | {
-  readonly mode: 'continuable';
+  readonly mode: "external";
+  readonly label?: string;
+} | {
+  readonly mode: "continuable";
   readonly label: string;
 } | {
-  readonly mode: 'unknown';
+  readonly mode: "unknown";
   readonly label?: string;
 });
 /** Durable active-turn timing for one descriptor-backed child session. */
@@ -657,7 +517,7 @@ interface SubagentTimingProjection {
  */
 type SubagentIdentityProjection = {
   /** A terminal one-shot child. */
-  mode: 'one-shot';
+  mode: "one-shot";
   /** Optional durable creation label from the child's descriptor. */
   label?: string;
   /**
@@ -666,16 +526,16 @@ type SubagentIdentityProjection = {
    * OWN log suffix — where a descriptor is immutable once appended — and
    * not from a fork seed's replayed ancestor descriptor.
    */
-  seq: SessionSeq$1;
+  seq: SessionSeq;
 } | {
   /** A resumable conversation. */
-  mode: 'continuable';
+  mode: "continuable";
   /** Durable creation label from the child's descriptor. */
   label: string;
   /** Seq of the folded descriptor event; see the one-shot arm for the own-suffix proof. */
-  seq: SessionSeq$1;
+  seq: SessionSeq;
 };
-declare module '@deepseek-ai/dsh-session-projection/types' {
+declare module "@deepseek-ai/dsh-session-projection/types" {
   interface SessionProjectionMap {
     /** Direct children in parent catalog event order, excluding fork-inherited facts. */
     subagentCatalog: SubagentCatalogEntry[];
@@ -694,7 +554,7 @@ declare module '@deepseek-ai/dsh-session-projection/types' {
   }
 }
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/list-children.d.ts
+//#region src/vendor/dsh-subagent/list-children.d.ts
 /** One catalog descendant with its direct parent and edge distance from the requested root. */
 type SubagentDescendantListEntry = SubagentListEntry & {
   /** Parent whose catalog contains this child. */
@@ -703,26 +563,15 @@ type SubagentDescendantListEntry = SubagentListEntry & {
   readonly depth: number;
 };
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/util/chunked-list/lib/types/index.d.ts
-/**
- * Newest chunk of an immutable list; `undefined` represents the empty list.
- * Values within each chunk follow insertion order. Callers treat nodes, arrays,
- * and stored values as immutable; operations share values and older chunks.
- */
-interface ChunkedList<T> {
-  readonly values: readonly T[];
-  readonly previous?: ChunkedList<T> | undefined;
-}
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/catalog.d.ts
+//#region src/vendor/dsh-subagent/catalog.d.ts
 type KnownCatalogMode = {
-  readonly mode: 'one-shot';
+  readonly mode: "one-shot";
   readonly label?: string;
 } | {
-  readonly mode: 'continuable';
+  readonly mode: "continuable";
   readonly label: string;
 };
-/** Parent catalog v0 records known modes; v1 also retains children with unknown mode. */
+/** Parent catalog v0 records local modes, v1 adds unknown children, and v2 records external executions. */
 type SubagentCatalogEvent = {
   readonly childId: SessionId;
   readonly childCreatedAt: number;
@@ -731,16 +580,20 @@ type SubagentCatalogEvent = {
 } & KnownCatalogMode) | ({
   readonly version: 1;
 } & (KnownCatalogMode | {
-  readonly mode: 'unknown';
+  readonly mode: "unknown";
   readonly label?: string;
-})));
-declare module '@deepseek-ai/dsh-session/types' {
+})) | {
+  readonly version: 2;
+  readonly mode: "external";
+  readonly label?: string;
+});
+declare module "@deepseek-ai/dsh-session/types" {
   interface SessionEventMap {
     /**
      * A direct child's identity and available discovery fields.
      * @param data - versioned parent-owned catalog entry.
      */
-    'subagent/catalog': SubagentCatalogEvent;
+    "subagent/catalog": SubagentCatalogEvent;
   }
 }
 /** Host fold state for one parent catalog. */
@@ -748,17 +601,17 @@ interface SubagentCatalogState {
   readonly inheritedEventCount: SessionLogOffset;
   readonly head?: ChunkedList<SubagentCatalogEvent> | undefined;
 }
-declare module '@deepseek-ai/dsh-session-projection/types' {
+declare module "@deepseek-ai/dsh-session-projection/types" {
   interface SessionProjectionStateMap {
     subagentCatalog: SubagentCatalogState;
   }
 }
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/out-of-process.d.ts
+//#region src/vendor/dsh-subagent/out-of-process.d.ts
 /**
  * The capability advertisement of an out-of-process backend: NONE. A child in
  * another process cannot honor parent-enforced start features
- * (`agentOptions`/`outputSchema`/`maxDepth`/`toolFilter`/`persona`), so the service rejects a
+ * (`agentOptions`/`agentPreset`/`outputSchema`/`maxDepth`), so the service rejects a
  * request needing any of them before `start` runs — never accepted-then-ignored.
  */
 export declare const NO_START_CAPABILITIES: SubagentCapabilities;
@@ -781,31 +634,6 @@ export declare function assertPositiveFinite(prefix: string, name: string, value
  * @returns `cwd`, validated.
  */
 export declare function assertUsableCwd(prefix: string, label: string, cwd: string): string;
-/**
- * Validate a configured `cwd` override ONCE, at plugin load: reject the empty
- * string (`path.resolve('')` is the process cwd — it would silently
- * reintroduce the launch-directory fallback this resolution removes),
- * interpret a relative path against the harness launch directory, and require
- * an enterable directory.
- * @param prefix - the consuming plugin's diagnostic prefix.
- * @param cwd - the configured override, or `undefined` when the config omits it.
- * @returns the validated absolute override, or `undefined` when omitted.
- */
-export declare function validateConfiguredCwd(prefix: string, cwd: string | undefined): string | undefined;
-/**
- * Resolve the child's working directory at start: the deployment override
- * when configured (already validated at load), else the parent session's
- * workspace cwd (validated here, its earliest resolvable point). Fails loud
- * when neither exists — falling back to the harness process cwd would
- * silently bind the child to the server's launch directory instead of the
- * delegating session's workspace (one server process serves many sessions,
- * each with its own cwd).
- * @param prefix - the consuming plugin's diagnostic prefix.
- * @param configured - the load-validated override, or `undefined`.
- * @param parentCwd - the delegating parent session's workspace cwd, if any.
- * @returns the absolute child working directory.
- */
-export declare function resolveChildCwd(prefix: string, configured: string | undefined, parentCwd: string | undefined): string;
 /** Inputs to {@link settleRunResult}. */
 export interface RunResultSettlement {
   /** The turn attempt (typically racing local cancellation); returns the terminal result. */
@@ -837,7 +665,7 @@ export declare function settleRunResult(parts: RunResultSettlement): Promise<Sub
 /** Inputs to {@link subprocessRunHandle}. */
 export interface SubprocessRunHandleParts {
   /** The parent-scoped run id. */
-  id: SubagentRun['id'];
+  id: SubagentRun["id"];
   /** The flattened, never-rejecting result (the seam contract). */
   result: Promise<SubagentResult>;
   /** The request's cancellation signal (the listener is removed on dispose). */
@@ -855,11 +683,11 @@ export interface SubprocessRunHandleParts {
  * local cancellation — there is no assumption the child cooperates — and then
  * awaits the backend's teardown to actual exit.
  * @param parts - the run identity, result, cancellation wiring, and teardown.
- * @returns the seam run handle (`localAgent` is `undefined` for remote runs).
+ * @returns the external run handle.
  */
 export declare function subprocessRunHandle(parts: SubprocessRunHandleParts): SubagentRun;
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/assistant-output.d.ts
+//#region src/vendor/dsh-subagent/assistant-output.d.ts
 /**
  * Incremental fold of the selection rule, for backends that observe a child's
  * output as it streams: session-event backends {@link push} each event, and
@@ -895,484 +723,98 @@ export declare class AssistantOutputFold {
  */
 export declare function finalAssistantOutput(events: readonly SessionEvent[]): readonly ContentBlock[] | undefined;
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/error.d.ts
-/** Typed failure for the subagent seam. */
-export declare class SubagentError extends HarnessError {
-  constructor(message: string, code: string, options?: ErrorOptions);
-}
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/brand.d.ts
-/**
- * Identifies a background job. The registry generates `<kind>-N`; predictable
- * ids rely on owner authorization rather than secrecy.
- */
-type JobId = Branded<'JobId'>;
-/**
- * Brand a string as a {@link JobId}.
- * @param id - the raw job-id string (the registry generates `<kind>-N`).
- * @returns the same string, branded; no validation is performed.
- */
-declare function JobId(id: string): JobId;
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/view.d.ts
-/**
- * Job lifecycle: `running`, optionally `stopping`, then exactly one terminal
- * status. Producer-specific facts belong in {@link JobView.progress} and
- * {@link JobView.detail}.
- */
-type JobStatus = 'running' | 'stopping' | 'completed' | 'killed' | 'failed';
-declare module '@deepseek-ai/dsh-workspace/types' {
-  interface SessionActivityKindMap {
-    /** A background job owned by this session is running or stopping. */
-    job: true;
+//#region src/vendor/dsh-subagent/descriptor.d.ts
+declare module "@deepseek-ai/dsh-session/types" {
+  interface SessionEventMap {
+    /**
+     * Durable identity and lifecycle mode of a session-backed subagent child,
+     * appended once inside the child's initial turn, before its first
+     * request. Continuable records also carry their
+     * resumable composition. Log-only: it carries no `surfaceOp`, never enters
+     * model history, and survives compaction.
+     */
+    "subagent/descriptor": SubagentDescriptorData;
   }
 }
 /**
- * Producer-defined job kinds. Plugins extend this map by declaration merging;
- * the registry treats every value as an opaque id namespace.
- */
-interface JobKindMap {
-  bash: 'bash';
-  subagent: 'subagent';
-}
-/** The merge-extensible union of registered producer kind names. */
-type JobKind = JobKindMap[keyof JobKindMap];
-/**
- * Stream label of one output chunk. `stdout` and `stderr` reach the model's
- * consuming read; `log` marks producer narration (a workflow's phase lines)
- * that only observers see. Consumers treat an unrecognized label like an
- * absent one.
- */
-type JobChannel = 'stdout' | 'stderr' | 'log';
-/** One chunk of a job's output ring: absolute offset, text, channel, and loss marker. */
-interface JobChunk {
-  /** Absolute offset of the chunk's first byte; offsets never move once assigned. */
-  readonly at: number;
-  /** Chunk text exactly as appended (possibly tail-trimmed by retention). */
-  readonly text: string;
-  /** Stream label, when the producer supplied one. */
-  readonly channel?: JobChannel;
-  /** Bytes immediately before this chunk were lost, at the producer or to retention. */
-  readonly gapBefore?: true;
-}
-/**
- * Read-only projection of one job — a fresh object per call, never live
- * registry state. The model tools, the browser roster, and the observation
- * stream all consume this one shape.
- */
-interface JobView {
-  /** The registry-issued id (`<kind>-N`). */
-  readonly id: JobId;
-  /**
-   * The producer kind the job was registered with: a Host-registered
-   * `JobKind`, carried as an open string because a browser bundle or a Remote
-   * codec sees only the `JobKindMap` merges its own program compiles.
-   */
-  readonly kind: string;
-  /** The producer-supplied one-line label. */
-  readonly label: string;
-  /** Owning session; absent for an unowned job, which every caller can see. */
-  readonly owner?: SessionId$1;
-  /** Producer-owned cap for complete model-facing notices and reads, in UTF-8 bytes. */
-  readonly outputLimitBytes?: number;
-  /** Current lifecycle state. */
-  readonly status: JobStatus;
-  /** The producer's live progress line (`3/10`, the current phase); cleared at settlement. */
-  readonly progress?: string;
-  /** Terminal reason (`exit code: 3`); a recorded kill reason is merged in. */
-  readonly detail?: string;
-  /** Epoch ms when the job was registered. */
-  readonly startedAt: number;
-  /** Epoch ms when the job settled; absent while live. */
-  readonly finishedAt?: number;
-  /**
-   * The output ring's absolute coordinates and the complete-stream files
-   * behind it. `total` is the offset the next chunk starts at (0 while
-   * nothing was written); `earliest` is the oldest retained byte, greater
-   * than zero exactly when retention dropped the head. `spillPaths` lists the
-   * spill files the job's pull sources currently keep, in source order and
-   * deduplicated, and is absent while no source keeps one: it outlives any
-   * chunk, so a reader below `earliest` can still name where the bytes went.
-   */
-  readonly output: {
-    readonly total: number;
-    readonly earliest: number;
-    readonly spillPaths?: readonly string[];
-  };
-}
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/types.d.ts
-/** Terminal result supplied by a producer through {@link JobHooks.done}. */
-interface JobOutcome {
-  /** How the job ended: finished (`completed`), cancelled (`killed`), or broke (`failed`). */
-  status: 'completed' | 'killed' | 'failed';
-  /**
-   * Terminal reason rendered into status lines (`exit code: 3`, `max-tokens`).
-   * When the job settles `killed` after a {@link JobRegistry.kill} with a
-   * reason, the registry appends that reason.
-   */
-  detail?: string;
-  /**
-   * Return value for jobs whose result is a value rather than a stream (a
-   * workflow's rendered result, a subagent's report). The output ring carries
-   * the stream; this is handed out once by the model's next {@link JobRegistry.read}.
-   */
-  result?: string;
-}
-/** One incremental read from a {@link JobOutputSource}. */
-interface JobSourceRead {
-  /** Text captured since the requested offset (the whole retained tail when lossy). */
-  text: string;
-  /** Whole-stream offset to resume from on the next read. */
-  nextOffset: number;
-  /** True when the requested offset slid out of the source's retained window. */
-  lossy: boolean;
-  /**
-   * Host path of a file holding the complete stream, when the source
-   * currently keeps an intact one. Reported on every read, so the registry
-   * tracks it as source metadata: a later read without it withdraws the file.
-   */
-  spillPath?: string;
-}
-/**
- * A pull source the registry pumps into the job's output ring — the subprocess
- * `readFrom` family. The registry owns the cadence and drains every source one
- * last time before settlement closes the ring, so a producer folds nothing
- * into its `done`.
- */
-interface JobOutputSource {
-  /** Stream label attached to every chunk this source yields. */
-  channel?: JobChannel;
-  /**
-   * Read everything captured since `fromByte` without consuming it.
-   * @param fromByte - whole-stream offset to resume from (a prior read's `nextOffset`; 0 first).
-   * @returns the delta text, the next offset, the lossy flag, and the spill path the source currently keeps.
-   */
-  read(fromByte: number): JobSourceRead;
-}
-/** Options for one {@link JobHandle.append}. */
-interface JobAppendOptions {
-  /** Stream label for the chunk; omitted for producers without distinct streams. */
-  channel?: JobChannel;
-  /**
-   * Marks that producer-side bytes between the previous chunk and this one
-   * were lost, so an observer can render the discontinuity instead of a
-   * silent splice.
-   */
-  gapBefore?: true;
-}
-/**
- * Producer face of one registered job, handed to {@link JobSpec.run} and
- * valid for the job's whole life. All methods are synchronous. Writes staged
- * inside the starter call are retained and become visible with the
- * registration commit; after settlement — the producer's own outcome, a kill,
- * or a registry-forced teardown end — writes log and drop instead of
- * throwing, so a producer's trailing flush cannot break its own teardown path.
+ * The current descriptor format version, stamped into every appended
+ * `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
+ * Supporting another composition input is a deliberate version change, never
+ * an implicit extra field.
  */
-interface JobHandle {
-  /** The registry-issued id (`<kind>-N`). */
-  readonly id: JobId;
-  /**
-   * Append one chunk to the output ring. Offsets advance by the chunk's UTF-8
-   * byte length; an empty chunk is dropped without waking observers.
-   * @param text - the chunk text, exactly as produced.
-   * @param options - stream label and gap marker.
-   */
-  append(text: string, options?: JobAppendOptions): void;
-  /**
-   * Replace the live progress line (`3/10`, the current phase). Settlement
-   * clears it; the terminal reason travels in {@link JobOutcome.detail}.
-   * @param line - the new progress line.
-   */
-  updateProgress(line: string): void;
-}
-/** Hooks through which the runtime controls and observes producer work. */
-interface JobHooks {
-  /**
-   * Request termination. Must be synchronous, idempotent, and eventually settle
-   * {@link done}; throws propagate. The optional reason is forwarded verbatim.
-   */
-  cancel(reason?: string): void;
-  /**
-   * Resolves after the producer releases its resources, not merely when work
-   * finishes. Must not reject; the runtime converts a rejection to `failed`.
-   * If teardown cancellation throws, the runtime may force-fail only the
-   * registry record without claiming that the work stopped.
-   */
-  done: Promise<JobOutcome>;
+export declare const SUBAGENT_DESCRIPTOR_VERSION = 3;
+/** Fields shared by every supported `subagent/descriptor` payload. */
+interface SubagentDescriptorBase {
+  /** Descriptor format version ({@link SUBAGENT_DESCRIPTOR_VERSION}). */
+  readonly version: number;
+  /** Whether the child is a terminal one-shot run or a resumable conversation. */
+  readonly mode: "one-shot" | "continuable";
+  /** The `ctx.subagents` provider name that established the child. */
+  readonly provider: string;
 }
-/**
- * Producer declaration passed to {@link JobRegistry.start}. The runtime
- * preflights access and cleanup before invoking {@link run}; the producer owns
- * execution resources while the runtime owns identity, lifecycle state, and
- * the output ring.
- */
-interface JobSpec {
-  /** Producer kind — also the id prefix (`bash`, `subagent`, …). */
-  kind: JobKind;
-  /** One-line model-facing label (the command; the delegation description). */
-  label: string;
-  /**
-   * Owning session. Access is fenced by it, and the owner's live Agent must be
-   * the one currently registered under that id: its disposal cancels and
-   * awaits the job. Omitting the owner creates an unowned job, open to any
-   * caller until service disposal.
-   */
-  owner?: SessionId;
-  /**
-   * Optional UTF-8 byte cap for each complete model-facing completion notice or
-   * output read, including controller status metadata. Independent of ring
-   * retention: it bounds the consuming model surface, never observers.
-   */
-  outputLimitBytes?: number;
-  /**
-   * Pull sources the registry pumps into the ring at its own cadence.
-   * Producers that narrate their own progress use {@link JobHandle.append}
-   * instead; a job may use both.
-   */
-  output?: readonly JobOutputSource[];
+/** A session-backed subagent that cannot be cold-resumed after its run. */
+interface OneShotSubagentDescriptorData extends SubagentDescriptorBase {
+  readonly mode: "one-shot";
   /**
-   * Start the work after preflight and synchronously return its hooks. Called
-   * once with the job's producer face; a throw leaves nothing registered (the
-   * spent ordinal is skipped), and the producer must clean up any partially
-   * started resources.
-   * @param job - the issued id plus the ring append and progress writers.
+   * The initial delegation's short `description`, kept as the child's durable
+   * creation label so enumeration can identify the conversation without
+   * replaying parent tool results or exposing the child prompt.
    */
-  run(job: JobHandle): JobHooks;
-}
-/** Output and post-read state returned by the consuming {@link JobRegistry.read}. */
-interface JobRead {
-  /** Ring chunks appended since the model cursor, in offset order; every channel included. */
-  chunks: readonly JobChunk[];
-  /** True when the cursor fell below the oldest retained byte, so bytes are missing before `chunks`. */
-  lossy: boolean;
-  /** The producer's {@link JobOutcome.result}, handed out by the first read after settlement only. */
-  result?: string;
-  /** The job's state at read time. */
-  job: JobView;
+  readonly label?: string;
 }
-/** Result of one non-consuming {@link JobRegistry.readAt}. */
-interface JobOutputRead {
-  /** Retained chunks overlapping `[from, total)`, in offset order. */
-  chunks: readonly JobChunk[];
-  /**
-   * Offset to resume from — the ring's current `total`. Always a chunk
-   * boundary: appends land whole and trimming only advances chunk starts, and
-   * consumers concatenate `chunks` under that assumption, so a provider
-   * serving partial chunks would silently duplicate text.
-   */
-  next: number;
-  /** True when `from` fell below the oldest retained byte, so bytes are missing before `chunks`. */
-  lossy: boolean;
+/** A session-backed subagent whose declared composition supports cold resume. */
+interface ContinuableSubagentDescriptorData extends SubagentDescriptorBase {
+  readonly mode: "continuable";
+  /** The initial delegation's short `description`, used for durable enumeration. */
+  readonly label: string;
+  /** Resolved child `agentOptions.provider`, when one was declared. */
+  readonly agentProvider?: string;
+  /** Resolved child `agentOptions.model`, when one was declared. */
+  readonly agentModel?: string;
+  /** Resolved child `agentOptions.reasoningEffort`, when one was declared. */
+  readonly agentReasoningEffort?: ReasoningEffortId;
+  /** Per-child persona that shadows the deployment persona on resume. */
+  readonly persona?: string;
+  /** Child tool scoping reapplied on resume. */
+  readonly toolFilter?: ToolRestriction;
 }
+/** The supported durable subagent identity and optional continuation composition. */
+type SubagentDescriptorData = OneShotSubagentDescriptorData | ContinuableSubagentDescriptorData;
+/** Continuable composition fields before the snapshot stamps their format version. */
+type ContinuableSubagentDescriptorInput = Omit<ContinuableSubagentDescriptorData, "version">;
 /**
- * Why a job settled: its producer finished (`producer`), a
- * {@link JobRegistry.kill} ran first (`kill`), or owner or service teardown
- * cancelled it (`teardown`) — a settlement whose owner has no reader left.
- */
-type JobSettleCause = 'producer' | 'kill' | 'teardown';
-/**
- * One lifecycle or output event. Lifecycle events carry the job's projection
- * after the commit they announce; `output` carries only the id and the new
- * total, so an observer schedules a {@link JobRegistry.readAt} from its own
- * cursor and the registry never pushes payloads.
+ * Validate and detach a continuable descriptor input.
+ * @param input - the caller-collected continuable composition fields.
+ * @returns the versioned, detached continuable descriptor payload.
+ * @throws when a field is not losslessly JSON-serializable.
  */
-type JobEvent = {
-  /** Registration commit, progress line change, stopping transition, or removal from the visible set. */
-  readonly type: 'registered' | 'progress' | 'stopping' | 'removed';
-  readonly job: JobView;
-} | {
-  readonly type: 'settled';
-  readonly job: JobView;
-  readonly cause: JobSettleCause;
-  /**
-   * Whether this settlement released a live {@link JobRegistry.wait}. That
-   * waiter's caller receives the terminal projection as its own result, so
-   * a completion reporter treats an awaited settlement as already delivered
-   * and reports only the unawaited ones. A wait that timed out or was
-   * aborted before the settlement does not count.
-   */
-  readonly awaited: boolean;
-} | {
-  readonly type: 'output';
-  readonly id: JobId;
-  /** Owning session, absent for an unowned job. */
-  readonly owner?: SessionId;
-  /** The ring's total after the append (or at settlement, which ends the stream). */
-  readonly total: number;
-};
+export declare function snapshotSubagentDescriptor(input: ContinuableSubagentDescriptorInput): ContinuableSubagentDescriptorData;
 /**
- * Who a subscription hears about. `{ owner }` delivers that session's jobs
- * plus every unowned job (the set that session can see). `{ owners: 'scope' }`
- * delivers the owners composed under the subscribing context — one registry
- * serves every composition in the process, and a mount under one preset must
- * not hear another preset's agents. `{ owners: 'all' }` delivers everything.
+ * Fold a persisted child log to its supported descriptor. The first
+ * `subagent/descriptor` event is authoritative — the establishing provider
+ * appends exactly one, so a later same-type event cannot rewrite the declared
+ * composition.
+ * @param events - the loaded child session events.
+ * @returns the descriptor, or `undefined` when the log has none or its
+ *   version is not {@link SUBAGENT_DESCRIPTOR_VERSION} (the child cannot be
+ *   classified by this runtime).
+ * @throws when a current-version persisted payload does not match its complete
+ *   declared schema.
  */
-type JobEventFilter = {
-  readonly owner: SessionId;
-} | {
-  readonly owners: 'all' | 'scope';
-};
-/** Event callback; contained by the registry, never awaited. */
-type JobEventListener = (event: JobEvent) => void;
-/** The registry's event stream. */
-interface JobEvents {
-  /**
-   * Register an effect-scoped listener. Events are dispatched synchronously
-   * after the commit they announce; a job's first event is `registered`, and
-   * a `settled` event follows the release of every waiter. No listener runs
-   * after service disposal.
-   * @param filter - which owners' events to deliver.
-   * @param listener - receives each matching event.
-   * @returns disposer that unregisters the listener.
-   */
-  subscribe(filter: JobEventFilter, listener: JobEventListener): () => void;
-}
+export declare function foldSubagentDescriptor(events: readonly SessionEvent[]): SubagentDescriptorData | undefined;
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/index.d.ts
-declare module '@deepseek-ai/cordis' {
-  interface Context {
-    jobs: JobRegistry;
-  }
-}
-/**
- * Abstract background job registry. Subclass, implement the abstract members,
- * and load the subclass as a plugin — it registers as `ctx.jobs` (one
- * implementation per context; loading a second throws, which is cordis'
- * standard duplicate-service behavior).
- *
- * Implementations must honor these semantics:
- * - Registrations outlive producer and controller fibers. Owner and
- *   service disposal cancel live work and await compliant producers; a
- *   throwing teardown cancel force-fails only the record. Such settlements
- *   announce `cause: 'teardown'`, because a job whose owner is being destroyed
- *   has no reader left.
- * - Owned-job access is fenced by the owner's session id. Ids are
- *   predictable, so authorization — not secrecy — is the boundary.
- * - Settlement is first-wins: one terminal record, released waiters, then one
- *   round of contained event delivery, even against a late producer outcome.
- *   The `settled` event follows every released waiter and reports whether it
- *   released one (`awaited`), so a completion reporter can skip settlements a
- *   waiting caller already collected.
- * - A settled record stays listed until its owner's disposal, service
- *   disposal, or an explicit {@link remove} by a caller that collected the
- *   terminal state itself and never handed the id out.
- * - {@link start} refuses work while no attached job controller serves the
- *   spec's owner, so a producer cannot start work that owner cannot collect
- *   or stop. One registry serves every composition in the process, so this
- *   question — and event delivery under `{ owners: 'scope' }` — is
- *   owner-relative rather than process-wide: registrations made from an
- *   unscoped context serve every owner, and registrations made under an agent
- *   composition's scope serve exactly the agents composed under it.
- * - Every job owns one output ring. Pull sources named by the spec are pumped
- *   by the registry and drained once more before settlement; pushed appends
- *   land whole. The model's consuming cursor and observers' absolute offsets
- *   read the same bytes and never disturb each other.
- * - Ring retention is bounded. Appends past the live cap drop the oldest
- *   retained bytes; a reader below the retained window gets a lossy read,
- *   never an error. Settlement trims retention to the settled cap and ends
- *   the stream; the ring has no separate lifecycle.
- */
-declare abstract class JobRegistry extends Service {
-  constructor(ctx: Context);
-  /** Lifecycle and output events, filtered per subscription. */
-  abstract readonly events: JobEvents;
-  /**
-   * Preflight access, validation, owner cleanup, and implementation-owned
-   * admission before starting and atomically registering work. Any preflight
-   * rejection leaves no job id or execution resource. A throwing starter
-   * leaves nothing registered; after it returns, registration cannot fail.
-   * @param spec - job identity, owner, output sources, and synchronous starter.
-   * @returns the registry-issued `<kind>-N` id.
-   */
-  abstract start(spec: JobSpec): JobId;
-  /**
-   * List caller-owned and unowned jobs in registration order.
-   * @param caller - reading session; omission sees only unowned jobs.
-   * @returns fresh projections.
-   */
-  abstract list(caller?: SessionId): JobView[];
-  /**
-   * Project one job without changing its cursor. Throws for an unknown or
-   * foreign job.
-   * @param id - job to look up.
-   * @param caller - reading session checked against the owner.
-   * @returns a fresh projection.
-   */
-  abstract get(id: JobId, caller?: SessionId): JobView;
-  /**
-   * Consume the ring from the model cursor and advance it to the current
-   * total. After settlement the first read also carries the producer's
-   * result. Throws for an unknown or foreign job.
-   * @param id - job to read.
-   * @param caller - reading session checked against the owner.
-   * @returns the chunks since the cursor, the lossy flag, the result once, and the post-read projection.
-   */
-  abstract read(id: JobId, caller?: SessionId): JobRead;
-  /**
-   * Read retained ring output without moving the model cursor. Resume with
-   * a previous read's `next`; an offset inside a retained chunk returns the
-   * whole chunk (its `at` may precede `from`). Throws for a negative or
-   * non-integer offset, or an unknown or foreign job.
-   * @param id - job to read.
-   * @param from - absolute byte offset to read from (0 for the retained head).
-   * @param caller - reading session checked against the owner.
-   * @returns retained chunks overlapping `[from, total)`, the resume offset, and the lossy flag.
-   */
-  abstract readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead;
-  /**
-   * Request cancellation, then mark the job stopping. A producer throw
-   * propagates without changing job state. A supplied reason is merged into
-   * terminal `detail` when the job settles `killed`. Throws for an unknown
-   * or foreign job.
-   * @param id - job to cancel.
-   * @param caller - killing session checked against the owner.
-   * @param reason - cancellation reason forwarded verbatim to the producer.
-   * @returns `requested` for live work, otherwise `already-finished`.
-   */
-  abstract kill(id: JobId, caller?: SessionId, reason?: string): 'requested' | 'already-finished';
-  /**
-   * Wait for settlement or timeout without cancelling the job. Caller abort
-   * rejects only while the job is live; after settlement the terminal
-   * projection wins. Rejects for an invalid timeout or an unknown or foreign
-   * job.
-   * @param id - job to wait for.
-   * @param timeoutMs - positive finite wait bound in milliseconds.
-   * @param caller - waiting session checked against the owner.
-   * @param signal - optional cancellation of the wait itself.
-   * @returns projection at settlement or timeout.
-   */
-  abstract wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView>;
-  /**
-   * Drop one settled job's record from the visible set and announce
-   * `removed`. For a caller that collected the terminal state through its own
-   * {@link wait} and never handed the id to the model, such as a shell tool's
-   * foreground call. Throws for a job that is still live, unknown, or foreign.
-   * @param id - settled job to drop.
-   * @param caller - removing session checked against the owner.
-   */
-  abstract remove(id: JobId, caller?: SessionId): void;
-  /**
-   * Attach an effect-scoped controller that can read and stop jobs. It serves the
-   * owners its registering context's scope covers, and {@link start} refuses an
-   * owner no attached controller serves.
-   * @param name - diagnostic label; duplicate names remain independent.
-   * @returns disposer that detaches this controller.
-   */
-  abstract attachController(name: string): () => void;
-}
+//#region src/vendor/dsh-subagent/structured.d.ts
+/** The model-facing tool name a structured child must call to finish. */
+export declare const STRUCTURED_OUTPUT_TOOL = "structured_output";
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/run-settlement.d.ts
-/**
- * Await the child result, dispose the run, then return its task outcome. Result
- * and disposal failures become `failed`; when both fail, both details survive.
- * @param run - live run to settle and release.
- * @returns outcome after child resources are released.
- */
-export declare function settleRun(run: SubagentRun): Promise<JobOutcome>;
+//#region src/vendor/dsh-subagent/error.d.ts
+/** Typed failure for the subagent seam. */
+export declare class SubagentError extends HarnessError {
+  constructor(message: string, code: string, options?: ErrorOptions);
+}
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/depth.d.ts
-declare module '@deepseek-ai/dsh-agent' {
+//#region src/vendor/dsh-subagent/depth.d.ts
+declare module "@deepseek-ai/dsh-agent" {
   interface AgentOptions {
     /** Delegation depth: zero for a top-level agent and parent depth + 1 for a child. */
     subagentDepth?: number;
@@ -1395,124 +837,7 @@ export declare function delegationDepthOf(agent: Agent): number;
  */
 export declare function assertSubagentMaxDepth(maxDepth: unknown): void;
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/sandbox/sandbox/lib/types/index.d.ts
-/**
- * File-effect policy for confined processes. `read-only` permits only required
- * sinks such as `/dev/null`; `workspace-write` also permits the workspace and a
- * backend-defined temp area; `danger-full-access` bypasses confinement. Network
- * and process visibility are outside this vocabulary.
- */
-type SandboxMode = 'read-only' | 'workspace-write' | 'danger-full-access';
-/** A confining (non-`danger-full-access`) mode — the modes a {@link SandboxPolicy} can carry. */
-type ConfinedSandboxMode = Exclude<SandboxMode, 'danger-full-access'>;
-/**
- * The complete file-effect policy resolved for one capability call. The root
- * is carried even under modes that do not consume it so callers can resolve
- * policy once before choosing the enforcement path.
- */
-interface SandboxExecutionPolicy {
-  /** The file-effect mode this execution runs under. */
-  mode: SandboxMode;
-  /** Absolute root directory `workspace-write` may write under. */
-  workspaceRoot: string;
-  /**
-   * Opaque identity of the calling session (the branded `dsh-session`
-   * SessionId). Backends key per-session state off it (e.g. windows-acl gives
-   * each live session/workspace pair a random private temp directory and SID,
-   * while the workspace SID and standing grant remain per-workspace); absent
-   * for agentless calls, which fall back to per-call backend state.
-   */
-  sessionId?: SessionId;
-}
-/**
- * Enforcement completeness for this host. `partial` means an active backend or
- * older kernel ABI cannot govern every promised file effect; callers requiring
- * an absolute boundary must not treat it as `full`.
- */
-type SandboxEnforcement = 'full' | 'partial';
-/**
- * What one confined execution is allowed to touch — carried PER CALL, not
- * fixed on the provider: two consumers may confine under different policies
- * at the same instant (bash under `read-only` while a confined child agent
- * needs its state directory writable), and an approved escalated retry is a
- * new call with a wider policy. Defaulting/resolution is an explicit step at
- * the consumer boundary; the provider treats the policy as fully specified.
- */
-interface SandboxPolicy extends SandboxExecutionPolicy {
-  /** The file-effect mode this execution runs under. */
-  mode: ConfinedSandboxMode;
-}
-/**
- * Evidence that identifies a sandbox runner failing before it executes the
- * wrapped command. A consumer first applies {@link allowedExitCodes} when
- * present, removes {@link informationalLines} by case-insensitive exact line
- * equality, then matches {@link fatalSignatures} case-insensitively within
- * each remaining stderr line. Exit status alone never proves runner failure.
- */
-interface RunnerFailureRule {
-  /** Nonzero process exit codes on which this rule may match; omitted permits any nonzero exit. */
-  allowedExitCodes?: readonly number[];
-  /** Non-empty substrings identifying a fatal runner diagnostic on one stderr line. */
-  fatalSignatures: readonly string[];
-  /** Benign stderr lines excluded by exact full-line equality before fatal matching. */
-  informationalLines?: readonly string[];
-}
-/**
- * A {@link SandboxProvider.confine} result: the argv to spawn in place of
- * the caller's own, plus the enforcement completeness the selected backend
- * achieves for it.
- */
-interface ConfinedArgv {
-  /** The wrapped argv (runner, profile, separator, then the caller's argv). */
-  argv: string[];
-  /** How completely the selected backend enforces the policy's file effects. */
-  enforcement: SandboxEnforcement;
-  /**
-   * The selected backend's denial DIALECT: the case-insensitive stderr
-   * substrings a file effect denied by THIS backend produces (EROFS text
-   * under bwrap's read-only binds, EACCES under Landlock, EPERM under
-   * Seatbelt). A consumer that infers denials from a failed run's stderr
-   * matches against exactly these rather than a cross-backend union — the
-   * union claims denials a given backend never produces.
-   */
-  denialSignatures: readonly string[];
-  /**
-   * Structured runner-failure evidence rules. Consumers require a matching
-   * fatal stderr line (after informational exclusions) and any rule-specific
-   * exit-code gate before checking denial signatures: runner failure means the
-   * command never ran, while denial means confinement worked and blocked it.
-   */
-  runnerFailureRules: readonly RunnerFailureRule[];
-}
-declare module '@deepseek-ai/cordis' {
-  interface Context {
-    sandbox: SandboxProvider;
-  }
-}
-/**
- * Abstract process-sandbox service. {@link confine} must return enforcing argv
- * or fail closed at wrap or runner-execution time; silent unconfined passthrough
- * is forbidden. Functional probes arbitrate multi-runner chains and may be
- * skipped for a sole candidate, whose own refusal remains the fail-closed end.
- */
-declare abstract class SandboxProvider extends Service {
-  constructor(ctx: Context);
-  /**
-   * Wrap `argv` so it executes confined under `policy` on this host; the
-   * caller spawns the returned argv in place of its own.
-   * @param argv - the exact argv the caller is about to spawn (program plus
-   *   arguments), NOT a shell string — a shell-shaped consumer passes
-   *   `['bash', '-c', command]`.
-   * @param policy - the file-effect policy this execution runs under,
-   *   carried per call (see {@link SandboxPolicy}).
-   * @param signal - cancellation while the provider resolves the policy and runner.
-   * @returns the argv to spawn instead, plus the enforcement completeness
-   *   the selected backend achieves for it.
-   */
-  abstract confine(argv: readonly string[], policy: SandboxPolicy, signal?: AbortSignal): Promise<ConfinedArgv>;
-}
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/child-agent.d.ts
+//#region src/vendor/dsh-subagent/child-agent.d.ts
 /** Thrown when starting a child would exceed the requested depth cap. */
 export declare class SubagentDepthError extends Error {
   readonly attemptedDepth: number;
@@ -1557,55 +882,41 @@ export declare function resolveChildAgentOptions(parent: Agent, requested: Agent
  * survive persistence, the seed boundary that separates inherited parent
  * history from child work, and the composition the child runs under.
  *
- * The preset is read from the parent's LIVE scope chain rather than from its
- * header, because a parent that switched preset while blank runs on the newer
- * composition and its header still names the older one. Recording it is what
- * makes a child's history reconstructable: without it a cold read of the child
- * resolves the deployment default and rebuilds turns under a tool set the
- * child never had.
+ * Omitted selection uses the parent's live composition, including any switch
+ * made while the parent was blank.
  * @param parent - the delegating parent agent.
  * @param childDepth - the resolved delegation depth to persist.
  * @param isSeeded - whether this child inherits a parent-log prefix, including an explicitly empty one.
+ * @param selectedPreset - independent selection, or omission to inherit the parent.
  * @returns the `meta` for `ctx.agents.create()`.
  */
-export declare function childSessionMeta(parent: Agent, childDepth: number, isSeeded: boolean): NonNullable<CreateAgentOptions['meta']>;
+export declare function childSessionMeta(parent: Agent, childDepth: number, isSeeded: boolean, selectedPreset?: string): NonNullable<CreateAgentOptions["meta"]>;
 /** The scoped composition a child agent's creation window applies. */
 interface ChildComposition {
-  /** Per-child persona shadowing the deployment persona. */
+  /** Independently mounted preset; omission shares the parent's standing generation. */
+  readonly agentPreset?: string | undefined;
+  /** Historical descriptor persona reapplied only during cold resume. */
   readonly persona?: string | undefined;
-  /** Per-child tool scoping. */
+  /** Historical descriptor tool restriction reapplied only during cold resume. */
   readonly toolFilter?: ToolRestriction | undefined;
 }
 /**
- * Compose one child inside its creation window: join its parent's preset,
- * register the fixed delegation-scope statement, then apply the child's own
- * shadowing persona section and tool restriction, all owned by the child's
- * scope and therefore invisible to its parent and siblings. Creation and cold
- * resume both pass through here.
- *
- * The join comes first and the child's own registrations second, which is the
- * order the layering already implies — the nearest scope wins a name, and a
- * per-child restriction intersects with everything its chain admits — but
- * stating it here keeps the two steps from being read as independent.
- *
- * The join and the per-child registrations live in ONE call because a child
- * composed without the join is exactly the defect this function exists to
- * prevent: with every model-facing row on the agent plane, a child that joins
- * no preset sees an empty tool registry and none of its parent's prompt
- * sections. Taking the parent as a parameter is what makes that omission
- * unrepresentable at the call sites.
+ * Compose a child before publication and restore historical descriptor overrides.
+ * Explicit selection mounts the named preset; omission synchronously joins the
+ * parent's current generation. Registrations belong to the child's scope.
  * @param childCtx - the child agent's scoped creation context.
- * @param parent - the delegating parent whose composition the child joins.
- * @param composition - the per-child persona and tool filter to install.
+ * @param parent - the delegating parent used when no preset is selected.
+ * @param composition - independent preset and any overrides read from a historical descriptor.
+ * @returns A promise when mounting an independent preset; otherwise completes synchronously.
  */
-export declare function applyChildComposition(childCtx: Context, parent: Agent, composition: ChildComposition): void;
+export declare function applyChildComposition(childCtx: Context, parent: Agent, composition: ChildComposition): void | Promise<void>;
 /** Policy seeded onto a child session's log at the delegation boundary. */
 interface DelegatedPolicyOverrides {
   /**
    * The parent's current preset identity when it runs in Auto or Full access;
    * the child keeps it under the pinned `never` approval policy.
    */
-  readonly permissionPreset: 'auto' | 'danger-full-access' | undefined;
+  readonly permissionPreset: "auto" | "danger-full-access" | undefined;
   /** The parent session's explicit sandbox-mode override, or `undefined` without one. */
   readonly sandboxMode: SandboxMode | undefined;
   /**
@@ -1613,7 +924,7 @@ interface DelegatedPolicyOverrides {
    * otherwise: a delegated child acts only within the sandbox scope fixed at
    * delegation, so its asks are rejected deterministically.
    */
-  readonly approvalPolicy: 'never' | undefined;
+  readonly approvalPolicy: "never" | undefined;
 }
 /**
  * Capture the permission state to seed into one delegation. Call synchronously before
@@ -1638,12 +949,12 @@ export declare function captureDelegatedPolicyOverrides(parent: Agent): Delegate
  */
 export declare function appendDelegatedPolicyOverrides(childSession: Session, overrides: DelegatedPolicyOverrides): void;
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/continuation-messages.d.ts
-/** Durable attribution for one model-authored message between adjacent Agents. */
+//#region src/vendor/dsh-subagent/continuation-messages.d.ts
+/** Durable attribution for one model-authored message between Agents. */
 interface AgentMessageSource$1 {
-  readonly kind: 'agent-message';
+  readonly kind: "agent-message";
   /** A message another agent addressed to this one (`relay` context form). */
-  readonly form: 'relay';
+  readonly form: "relay";
   /** Session id of the Agent whose tool call produced the message. */
   readonly senderSessionId: SessionId;
 }
@@ -1655,23 +966,23 @@ interface AgentMessageSource$1 {
  * transcript that merged them would credit the child with words it never wrote.
  */
 interface SubagentSettledMessageSource$1 {
-  readonly kind: 'subagent-settled';
+  readonly kind: "subagent-settled";
   /** A runtime account shown without expanding the row (`notice` context form). */
-  readonly form: 'notice';
+  readonly form: "notice";
   /** One-line account of how the child ended. */
   readonly summary: string;
   /** Session id of the child that settled. */
   readonly senderSessionId: SessionId;
 }
-declare module '@deepseek-ai/dsh-llm' {
+declare module "@deepseek-ai/dsh-llm" {
   interface MessageSourceMap {
-    'agent-message': AgentMessageSource$1;
-    'subagent-settled': SubagentSettledMessageSource$1;
+    "agent-message": AgentMessageSource$1;
+    "subagent-settled": SubagentSettledMessageSource$1;
   }
 }
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/index.d.ts
-declare module '@deepseek-ai/cordis' {
+//#region src/vendor/dsh-subagent/index.d.ts
+declare module "@deepseek-ai/cordis" {
   interface Context {
     subagents: SubagentRuntime$1;
   }
@@ -1681,13 +992,13 @@ declare module '@deepseek-ai/cordis' {
      * @param provider - the registered provider.
      * @mode emit
      */
-    'subagent/provider-added'(provider: SubagentProvider): void;
+    "subagent/provider-added"(provider: SubagentProvider): void;
     /**
      * A provider left the registry. Accepted runs remain holder-owned.
      * @param name - the provider name that no longer resolves.
      * @mode emit
      */
-    'subagent/provider-removed'(name: string): void;
+    "subagent/provider-removed"(name: string): void;
     /**
      * A provider established a published child. For in-process providers,
      * `ctx.agents.get(info.id)` resolves during this notification.
@@ -1695,19 +1006,17 @@ declare module '@deepseek-ai/cordis' {
      * parent-scoped listener observes only its own delegations. Paired with
      * `subagent/end`.
      * @param info - the provider and published child identity.
-     * @dshScopeScan unsupported
      * @mode emit
      */
-    'subagent/start'(this: Scoped<SubagentRuntime$1>, info: SubagentRunInfo): void;
+    "subagent/start"(this: Scoped<SubagentRuntime$1>, info: SubagentRunInfo): void;
     /**
      * A published child settled. Scope-filtered dispatch uses the same delegating
      * parent carrier as `subagent/start`, so the lifecycle pair reaches the
      * same scoped audience.
      * @param info - the run identity and terminal outcome.
-     * @dshScopeScan unsupported
      * @mode emit
      */
-    'subagent/end'(this: Scoped<SubagentRuntime$1>, info: SubagentRunEndInfo): void;
+    "subagent/end"(this: Scoped<SubagentRuntime$1>, info: SubagentRunEndInfo): void;
   }
 }
 /** Host configuration for continuable subagent capacity. */
@@ -1717,7 +1026,7 @@ interface Config$1 {
   /** Default delegation depth for tools without an explicit limit; defaults to 1. */
   maxDepth: Volatile<number>;
 }
-/** Named provider registry with one-shot runs, durable discovery, and continuable-child operations. */
+/** Named provider registry with managed activations, durable discovery, and local child messaging. */
 declare class SubagentRuntime$1 extends TypertRemoteService {
   private config;
   static Config: z<Schemastery.ObjectS<NoInfer<{
@@ -1727,8 +1036,9 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
     maxDepth: z<number, number, "volatile-defined">;
     maxActiveSubagents: z<number, number, "volatile-defined">;
   }>>, "plain">;
+  static inject: string[];
   private providers;
-  private continuations;
+  private manager;
   /**
    * The contained lifecycle-edge publisher. Built here because scoped dispatch
    * keys its carrier by this exact service instance, whose own context filter
@@ -1741,17 +1051,30 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
    * @param configured - Explicit tool limit, or provider-managed for external delegation.
    * @returns The numeric limit, or undefined when the provider owns depth enforcement.
    */
-  resolveMaxDepth(configured?: number | 'provider-managed'): number | undefined;
+  resolveMaxDepth(configured?: number | "provider-managed"): number | undefined;
+  /**
+   * Start a local child under its reserved identity.
+   * @param spec - local task, reserved child id, and result recipient.
+   * @returns activation with its accepted initial message id.
+   */
+  startActivation(spec: SubagentActivationSpec & {
+    readonly childId: SessionId;
+  }): Promise<SubagentActivation & {
+    readonly messageId: MessageId;
+  }>;
   /**
-   * Establish one durable continuable child and deliver its initial prompt.
-   * Resolves when the child's inbox accepts that prompt, without waiting for the
-   * turn to start or for the message to reach the Session log; any earlier
-   * failure rejects with no ids and rolls back the child entirely.
-   * @param spec - provider, delegation request, and caller cancellation.
-   * @returns the durable child id and the accepted prompt's message id.
-   * @throws when continuation services are unavailable or materialization fails.
+   * Start a local or external child.
+   * @param spec - task, backend, and result recipient.
+   * @returns activation with a message id only for local children.
    */
-  startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+  startActivation(spec: SubagentActivationSpec): Promise<SubagentActivation>;
+  /**
+   * Join progressing descendants without cancelling them. Idle descendants whose
+   * inboxes require a later wake stay resident and do not delay host completion.
+   * @param parent - the exact parent whose descendant work is observed.
+   * @returns whether work was joined; hosts recheck parent idle after true.
+   */
+  waitForChildren(parent: Agent): Promise<boolean>;
   /**
    * Steer one model-authored message to the sender's direct parent or direct
    * continuable child. A running target admits it at the nearest step boundary;
@@ -1781,13 +1104,13 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
    */
   private [deliverSubagentPrompt];
   /**
-   * Interrupt one live continuable child's current turn under a human parent
+   * Interrupt one live child's current execution under a human parent
    * address or an exact live ancestor Agent. Fire-and-return: the cancel
    * signal is issued before this returns, but the target may keep running
    * until it observes the signal. Unclaimed pending inbox work, the Activation,
    * and published descendants are preserved; claimed work is not requeued.
-   * Once the interrupted driver is idle, a waking send resumes the parked FIFO
-   * queue. An absent target — including a one-shot or unknown id —
+   * Once the interrupted Agent is idle, a waking send resumes the parked FIFO
+   * queue. External backends stop their single execution. An absent target
    * is an accepted no-op, as is a manager-less composition, which cannot own a
    * live Activation.
    * @param targetSessionId - the durable child session id to interrupt.
@@ -1797,27 +1120,27 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
    */
   interrupt(targetSessionId: SessionId, authority: SubagentInterruptAuthority): void;
   /**
-   * Close continuable admission below exact live parent Agents, stop only their
+   * Close subagent admission below exact live parent Agents, stop only their
    * visible descendant Activations synchronously, then await admitted scoped
    * materializations and release those forests child-first. The scoped cutoff
    * lasts until each exact parent leaves the registry; unrelated parent trees
    * remain live.
    * @param parents - exact host-owned parent Agents entering teardown.
-   * @returns once every retained descendant Activation released its `AgentHandle`.
+   * @returns once every retained descendant activation released its execution handle.
    * @throws an aggregate error after all branches settle when any failed.
    */
-  drainContinuableDescendants(parents: readonly Agent[]): Promise<void>;
+  drainDescendants(parents: readonly Agent[]): Promise<void>;
   /**
-   * Release selected resident continuable direct children of one exact live
+   * Release selected resident direct children of one exact live
    * parent. Other children of the same parent remain admitted and resident.
    * Absent targets and a manager-less composition are accepted no-ops.
    * @param parent - exact live direct parent authorizing the selected release.
    * @param childIds - durable direct-child ids to release when resident.
-   * @returns once every selected Activation released its `AgentHandle`.
+   * @returns once every selected activation released its execution handle.
    * @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
    *   different parent or the supplied parent identity is stale.
    */
-  drainContinuableChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
+  drainChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
   /**
    * Read the parent's durable direct-child catalog without loading or resuming an Agent.
    * The service owns and releases the live-preferred Session observation.
@@ -1831,7 +1154,8 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
   /**
    * Recursively list reachable parent catalogs in stable pre-order, preserving
    * each catalog's event order. Each row carries its catalog parent and depth;
-   * one-shot and unknown-mode children remain traversal nodes. Unknown modes
+   * external children are leaves; one-shot and unknown-mode children remain
+   * traversal nodes. Unknown modes
    * produce unsupported diagnostics. Unreadable child catalogs produce corrupt
    * or unavailable diagnostics and stop only that branch. Root read failures,
    * missing services or projections, and cancellation reject the whole listing.
@@ -1877,11 +1201,12 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
    *   `subagent/unauthorized` when the address does not own the live target,
    *   otherwise `gateway/internal`.
    */
-  interruptByParent(childSessionId: SessionId, parentSessionId: SessionId, mode: 'continuable'): SubagentInterruptReceipt;
+  interruptByParent(childSessionId: SessionId, parentSessionId: SessionId, mode: "continuable"): SubagentInterruptReceipt;
   /**
    * Register a provider under its name. Registration is effect-scoped and HMR
    * safe; removing a provider blocks new starts but does not revoke runs that
-   * were already returned to their holders.
+   * were already returned to their holders. Providers without either execution
+   * method are rejected with UNSUPPORTED_CAPABILITY before registration.
    * @param provider - the trusted provider implementation.
    * @returns the exact Cordis effect disposer.
    */
@@ -1897,19 +1222,6 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
    * @returns the registered names.
    */
   list(): string[];
-  /**
-   * Establish a published child on the named provider. Capability and semantic
-   * checks run before delegation. Provider ownership lasts until its promise
-   * fulfills; a rejection therefore has no run for the caller to dispose and
-   * emits no run lifecycle events. Post-publication turn and infrastructure
-   * failures settle through the returned run.
-   * A catalog append failure disposes the run and handles its result rejection;
-   * the caller receives the catalog error even if disposal also fails.
-   * @param name - the provider to use.
-   * @param request - child label, prompt, parent, signal, and optional capabilities.
-   * @returns the published holder-owned run.
-   */
-  start(name: string, request: SubagentStartRequest): Promise<SubagentRun>;
   /**
    * Resolve one provider's detached continuable-creation contribution. Method
    * presence on the provider IS the capability, so a provider without it is
@@ -1918,8 +1230,8 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
   private prepareContinuable;
   /** Look up a provider for dispatch or fail loud. */
   private expectProvider;
-  /** Resolve the optional continuable-subagent manager or fail loud. */
-  private requireContinuations;
+  /** Resolve the subagent manager or fail loud. */
+  private requireManager;
   /**
    * Build the lifecycle observer for one continuable Activation's residency
    * epoch, so the manager publishes its edges without owning event dispatch.
@@ -1929,7 +1241,7 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
   private assertCapabilities;
 }
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/internal.d.ts
+//#region src/vendor/dsh-subagent/internal.d.ts
 /**
  * Process-stable symbol-keyed host delivery shared by the bundled runtime
  * entry and this unbundled internal subpath.
@@ -1938,7 +1250,7 @@ declare class SubagentRuntime$1 extends TypertRemoteService {
 declare const deliverSubagentPrompt: unique symbol;
 //#endregion
 //#region src/continuation-messages.d.ts
-/** Durable attribution for one model-authored message between adjacent Agents. */
+/** Durable attribution for one model-authored message between Agents. */
 interface AgentMessageSource {
   readonly kind: 'agent-message';
   /** A message another agent addressed to this one (`relay` context form). */
@@ -1984,7 +1296,7 @@ export interface Config {
    */
   localizedReturnGuidancePresets: string[];
 }
-/** Named provider registry with one-shot runs, durable discovery, and continuable-child operations. */
+/** Named provider registry with managed activations, durable discovery, and local child messaging. */
 export declare class SubagentRuntime extends TypertRemoteService {
   private config;
   static Config: z<Schemastery.ObjectS<NoInfer<{
@@ -1996,8 +1308,9 @@ export declare class SubagentRuntime extends TypertRemoteService {
     maxActiveSubagents: z<number, number, "volatile-defined">;
     localizedReturnGuidancePresets: z<string[], string[], "defined">;
   }>>, "plain">;
+  static inject: string[];
   private providers;
-  private continuations;
+  private manager;
   /**
    * The contained lifecycle-edge publisher. Built here because scoped dispatch
    * keys its carrier by this exact service instance, whose own context filter
@@ -2012,15 +1325,28 @@ export declare class SubagentRuntime extends TypertRemoteService {
    */
   resolveMaxDepth(configured?: number | 'provider-managed'): number | undefined;
   /**
-   * Establish one durable continuable child and deliver its initial prompt.
-   * Resolves when the child's inbox accepts that prompt, without waiting for the
-   * turn to start or for the message to reach the Session log; any earlier
-   * failure rejects with no ids and rolls back the child entirely.
-   * @param spec - provider, delegation request, and caller cancellation.
-   * @returns the durable child id and the accepted prompt's message id.
-   * @throws when continuation services are unavailable or materialization fails.
+   * Start a local child under its reserved identity.
+   * @param spec - local task, reserved child id, and result recipient.
+   * @returns activation with its accepted initial message id.
+   */
+  startActivation(spec: SubagentActivationSpec & {
+    readonly childId: SessionId;
+  }): Promise<SubagentActivation & {
+    readonly messageId: MessageId;
+  }>;
+  /**
+   * Start a local or external child.
+   * @param spec - task, backend, and result recipient.
+   * @returns activation with a message id only for local children.
    */
-  startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+  startActivation(spec: SubagentActivationSpec): Promise<SubagentActivation>;
+  /**
+   * Join progressing descendants without cancelling them. Idle descendants whose
+   * inboxes require a later wake stay resident and do not delay host completion.
+   * @param parent - the exact parent whose descendant work is observed.
+   * @returns whether work was joined; hosts recheck parent idle after true.
+   */
+  waitForChildren(parent: Agent): Promise<boolean>;
   /**
    * Steer one model-authored message to the sender's direct parent or direct
    * continuable child. A running target admits it at the nearest step boundary;
@@ -2050,13 +1376,13 @@ export declare class SubagentRuntime extends TypertRemoteService {
    */
   private [deliverSubagentPrompt];
   /**
-   * Interrupt one live continuable child's current turn under a human parent
+   * Interrupt one live child's current execution under a human parent
    * address or an exact live ancestor Agent. Fire-and-return: the cancel
    * signal is issued before this returns, but the target may keep running
    * until it observes the signal. Unclaimed pending inbox work, the Activation,
    * and published descendants are preserved; claimed work is not requeued.
-   * Once the interrupted driver is idle, a waking send resumes the parked FIFO
-   * queue. An absent target — including a one-shot or unknown id —
+   * Once the interrupted Agent is idle, a waking send resumes the parked FIFO
+   * queue. External backends stop their single execution. An absent target
    * is an accepted no-op, as is a manager-less composition, which cannot own a
    * live Activation.
    * @param targetSessionId - the durable child session id to interrupt.
@@ -2066,27 +1392,27 @@ export declare class SubagentRuntime extends TypertRemoteService {
    */
   interrupt(targetSessionId: SessionId, authority: SubagentInterruptAuthority): void;
   /**
-   * Close continuable admission below exact live parent Agents, stop only their
+   * Close subagent admission below exact live parent Agents, stop only their
    * visible descendant Activations synchronously, then await admitted scoped
    * materializations and release those forests child-first. The scoped cutoff
    * lasts until each exact parent leaves the registry; unrelated parent trees
    * remain live.
    * @param parents - exact host-owned parent Agents entering teardown.
-   * @returns once every retained descendant Activation released its `AgentHandle`.
+   * @returns once every retained descendant activation released its execution handle.
    * @throws an aggregate error after all branches settle when any failed.
    */
-  drainContinuableDescendants(parents: readonly Agent[]): Promise<void>;
+  drainDescendants(parents: readonly Agent[]): Promise<void>;
   /**
-   * Release selected resident continuable direct children of one exact live
+   * Release selected resident direct children of one exact live
    * parent. Other children of the same parent remain admitted and resident.
    * Absent targets and a manager-less composition are accepted no-ops.
    * @param parent - exact live direct parent authorizing the selected release.
    * @param childIds - durable direct-child ids to release when resident.
-   * @returns once every selected Activation released its `AgentHandle`.
+   * @returns once every selected activation released its execution handle.
    * @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
    *   different parent or the supplied parent identity is stale.
    */
-  drainContinuableChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
+  drainChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
   /**
    * Read the parent's durable direct-child catalog without loading or resuming an Agent.
    * The service owns and releases the live-preferred Session observation.
@@ -2100,7 +1426,8 @@ export declare class SubagentRuntime extends TypertRemoteService {
   /**
    * Recursively list reachable parent catalogs in stable pre-order, preserving
    * each catalog's event order. Each row carries its catalog parent and depth;
-   * one-shot and unknown-mode children remain traversal nodes. Unknown modes
+   * external children are leaves; one-shot and unknown-mode children remain
+   * traversal nodes. Unknown modes
    * produce unsupported diagnostics. Unreadable child catalogs produce corrupt
    * or unavailable diagnostics and stop only that branch. Root read failures,
    * missing services or projections, and cancellation reject the whole listing.
@@ -2150,7 +1477,8 @@ export declare class SubagentRuntime extends TypertRemoteService {
   /**
    * Register a provider under its name. Registration is effect-scoped and HMR
    * safe; removing a provider blocks new starts but does not revoke runs that
-   * were already returned to their holders.
+   * were already returned to their holders. Providers without either execution
+   * method are rejected with UNSUPPORTED_CAPABILITY before registration.
    * @param provider - the trusted provider implementation.
    * @returns the exact Cordis effect disposer.
    */
@@ -2166,19 +1494,6 @@ export declare class SubagentRuntime extends TypertRemoteService {
    * @returns the registered names.
    */
   list(): string[];
-  /**
-   * Establish a published child on the named provider. Capability and semantic
-   * checks run before delegation. Provider ownership lasts until its promise
-   * fulfills; a rejection therefore has no run for the caller to dispose and
-   * emits no run lifecycle events. Post-publication turn and infrastructure
-   * failures settle through the returned run.
-   * A catalog append failure disposes the run and handles its result rejection;
-   * the caller receives the catalog error even if disposal also fails.
-   * @param name - the provider to use.
-   * @param request - child label, prompt, parent, signal, and optional capabilities.
-   * @returns the published holder-owned run.
-   */
-  start(name: string, request: SubagentStartRequest): Promise<SubagentRun>;
   /**
    * Resolve one provider's detached continuable-creation contribution. Method
    * presence on the provider IS the capability, so a provider without it is
@@ -2187,8 +1502,8 @@ export declare class SubagentRuntime extends TypertRemoteService {
   private prepareContinuable;
   /** Look up a provider for dispatch or fail loud. */
   private expectProvider;
-  /** Resolve the optional continuable-subagent manager or fail loud. */
-  private requireContinuations;
+  /** Resolve the subagent manager or fail loud. */
+  private requireManager;
   /**
    * Build the lifecycle observer for one continuable Activation's residency
    * epoch, so the manager publishes its edges without owning event dispatch.
@@ -2198,4 +1513,4 @@ export declare class SubagentRuntime extends TypertRemoteService {
   private assertCapabilities;
 }
 //#endregion
-export { type AgentMessageSource, type ChildComposition, type ContinuableCreateRequest, type ContinuableCreateSpec, type ContinuableStart, type ContinuableStartSpec, type ContinuableSubagentDescriptorData, type ContinuableSubagentDescriptorInput, type DelegatedPolicyOverrides, type OneShotSubagentDescriptorData, type OneShotSubagentDescriptorInput, type ResolvedSubagentStartRequest, type SubagentAddress, type SubagentCapabilities, type SubagentCatalogEntry, type SubagentCatalogRow, type SubagentDescendantListEntry, type SubagentDescriptorData, type SubagentDescriptorInput, type SubagentIdentityProjection, type SubagentInterruptAuthority, type SubagentInterruptReceipt, type SubagentListEntry, type SubagentPromptReceipt, type SubagentPromptRequest, type SubagentPromptRequestId, type SubagentProvider, type SubagentResult, type SubagentRun, type SubagentRunEndInfo, type SubagentRunInfo, SubagentRuntime as default, type SubagentSendMessageOptions, type SubagentSettledMessageSource, type SubagentStartRequest, type SubagentStopReason, type SubagentStopReasonMap, type SubagentTimingProjection };
+export { type AgentMessageSource, type ChildComposition, type ContinuableCreateRequest, type ContinuableCreateSpec, type ContinuableSubagentDescriptorData, type ContinuableSubagentDescriptorInput, type DelegatedPolicyOverrides, type OneShotSubagentDescriptorData, type ResolvedSubagentStartRequest, type SubagentActivation, type SubagentActivationSpec, type SubagentAddress, type SubagentCapabilities, type SubagentCatalogEntry, type SubagentCatalogRow, type SubagentDelivery, type SubagentDescendantListEntry, type SubagentDescriptorData, type SubagentIdentityProjection, type SubagentInterruptAuthority, type SubagentInterruptReceipt, type SubagentListEntry, type SubagentPromptReceipt, type SubagentPromptRequest, type SubagentPromptRequestId, type SubagentProvider, type SubagentResult, type SubagentRun, type SubagentRunEndInfo, type SubagentRunInfo, SubagentRuntime as default, type SubagentSendMessageOptions, type SubagentSettledMessageSource, type SubagentStartRequest, type SubagentStopReason, type SubagentStopReasonMap, type SubagentTimingProjection };