@steerable/agent-shell 0.6.27 → 0.6.29

package/dist/local-backend/subagent-profiles.js

@@ -1,5 +1,6 @@
 /**
- * 内置 subagent_type 画像集（CC `.claude/agents` parity）。
+ * 内置 subagent_type 画像集（CC `.claude/agents` parity）以及
+ * ChatAgent → 提及子代理画像的映射（`@` 委派 W1）。
  *
  * 桌面不再向 sidecar 传裸 `subagent: true`——命名画像让每个委派带
  * 工具域 / 轮次上限 / 并发性 / 系统提示，模型按画像 description 选择
@@ -11,7 +12,11 @@
  * - per-profile model 刻意不设：跟随父模型；模型路由留给设置面。
  * - 画像系统提示是种进子 loop 的第一条 system 消息（子代理看不到
  *   主对话的系统提示，画像提示就是它的全部角色设定）。
+ * - W2 落地前 toolFilter 必须与父本轮工具面取交集（子 ⊆ 父）。
  */
+import { isToolAllowed, mergeAgentCapabilities, normalizeToolPolicy, resolveSkillExcludes, } from './agent-capability.js';
+import { buildSystemPrompt } from './prompt-builder.js';
+import { loadSkills } from './skill-loader.js';
 /** 只读工具域：探索与调研画像共享的「摸不到写操作」基线。 */
 const READ_ONLY_TOOLS = [
     'local_read_file',
@@ -21,10 +26,10 @@ const READ_ONLY_TOOLS = [
     'web_fetch',
     'mcp_list_tools',
 ];
+const READ_ONLY_TOOL_SET = new Set(READ_ONLY_TOOLS);
 export const BUILTIN_SUBAGENT_PROFILES = {
     explore: {
         toolFilter: READ_ONLY_TOOLS,
-        maxRounds: 12,
         concurrent: true,
         description: '只读代码侦察。搜索、读文件、定位「在哪里/是什么」类问题；不做任何修改，返回带路径:行号的发现。',
         systemPrompt: [
@@ -37,7 +42,6 @@ export const BUILTIN_SUBAGENT_PROFILES = {
     },
     research: {
         toolFilter: [...READ_ONLY_TOOLS, 'local_write_file'],
-        maxRounds: 16,
         concurrent: true,
         description: '深度调研。多轮 web 搜索/抓取并交叉验证，给出带来源 URL 的结论；可把报告写入文件。',
         systemPrompt: [
@@ -52,7 +56,6 @@ export const BUILTIN_SUBAGENT_PROFILES = {
     coder: {
         // 不设 toolFilter：全工具域。写操作串行（concurrent: false），避免两个
         // 实现代理同时改同一批文件。
-        maxRounds: 16,
         concurrent: false,
         description: '全工具实现代理。改代码、跑命令、自验结果；适合自包含的实现/修复任务。',
         systemPrompt: [
@@ -72,3 +75,176 @@ export const BUILTIN_SUBAGENT_PROFILES = {
 export function builtinSubagentParam() {
     return { profiles: BUILTIN_SUBAGENT_PROFILES };
 }
+/**
+ * 画像名：优先稳定 ASCII slug，否则英文名 slugify，再否则 `agent-<id>`。
+ *
+ * @param agent 被提及的智能体。
+ * @returns 可作为 `subagent_type` enum 的画像名。
+ */
+export function profileNameForAgent(agent) {
+    const slug = agent.slug?.trim() ?? '';
+    if (isStableProfileName(slug))
+        return slug;
+    const fromName = slugifyProfileName(agent.name);
+    if (fromName)
+        return fromName;
+    const fromId = agent.id.replace(/[^a-zA-Z0-9]/g, '').slice(0, 16);
+    return fromId ? `agent-${fromId}` : 'agent';
+}
+function isStableProfileName(value) {
+    return /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(value);
+}
+function slugifyProfileName(raw) {
+    return raw
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 40);
+}
+/**
+ * W2 过渡期：子策略放行的工具与父本轮工具面取交集。
+ * 交集等于父全集时不设 filter（子继承父的工具域）。
+ *
+ * @param childPolicy 子智能体自己的工具策略。
+ * @param parentToolNames 父本轮已经广告给模型的工具名。
+ * @returns 子代理 toolFilter；`undefined` 表示不比父更窄。
+ */
+export function resolveChildToolFilter(childPolicy, parentToolNames) {
+    const policy = normalizeToolPolicy(childPolicy);
+    const allowed = parentToolNames.filter((name) => isToolAllowed(policy, name));
+    // `all` 且交集等于父全集 → 不设 filter，子代理继承父的工具域。
+    // allowlist / denylist 始终下发交集清单，即使碰巧等于父全集——画像
+    // roster 要让模型看见该子代理真正收窄后的工具面。
+    if (policy.mode === 'all')
+        return undefined;
+    return allowed;
+}
+function isReadOnlyToolDomain(toolNames) {
+    return toolNames.every((name) => READ_ONLY_TOOL_SET.has(name));
+}
+function profileDescription(agent) {
+    const summary = (agent.rolePrompt || agent.description || '')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, 80);
+    return summary ? `${agent.name} — ${summary}` : agent.name;
+}
+/**
+ * 把本轮被 `@` 的智能体译成 sidecar 画像（含 W1 夹紧）。
+ *
+ * @param delegates 被 `@` 的智能体，按提及顺序（含被点名的父代理本身）。
+ * @param parentToolNames 父本轮模型可见工具名。
+ * @returns 画像名 → 画像。
+ */
+export async function buildMentionSubagentProfiles(delegates, parentToolNames) {
+    const roster = await buildMentionDelegateRoster(delegates, parentToolNames);
+    return Object.fromEntries(roster.map((row) => [row.profileName, row.profile]));
+}
+/**
+ * 与 {@link buildMentionSubagentProfiles} 同源，额外带显示名供派发指令使用。
+ *
+ * @param delegates 被 `@` 的智能体，按提及顺序（含被点名的父代理本身）。
+ * @param parentToolNames 父本轮模型可见工具名。
+ * @returns 提及顺序的画像花名册。
+ */
+export async function buildMentionDelegateRoster(delegates, parentToolNames) {
+    const roster = [];
+    const used = new Set();
+    for (const agent of delegates) {
+        let profileName = profileNameForAgent(agent);
+        if (used.has(profileName)) {
+            const suffix = agent.id.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8);
+            profileName = suffix ? `${profileName}-${suffix}` : `${profileName}-dup`;
+        }
+        used.add(profileName);
+        roster.push({
+            agentId: agent.id,
+            name: agent.name,
+            profileName,
+            profile: await buildOneMentionProfile(agent, parentToolNames),
+        });
+    }
+    return roster;
+}
+async function buildOneMentionProfile(agent, parentToolNames) {
+    const toolFilter = resolveChildToolFilter(agent.toolPolicy, parentToolNames);
+    const domain = toolFilter ?? parentToolNames;
+    const readOnly = isReadOnlyToolDomain(domain);
+    const capability = mergeAgentCapabilities([agent]);
+    const excludeSkillNames = capability.allowExternalSkills
+        ? ['plan-mode']
+        : resolveSkillExcludes(capability, await loadSkills({ ignoreConditions: true }), ['plan-mode']);
+    const personaPreamble = agent.rolePrompt
+        ? `【当前角色】${agent.name}\n${agent.rolePrompt}`
+        : '';
+    const built = await buildSystemPrompt({
+        personaPreamble,
+        identityName: agent.name,
+        pinnedSkillNames: capability.pinnedSkills,
+        ignoreConditions: capability.loadAllSkills,
+        excludeSkillNames,
+        toolNames: domain,
+    });
+    return {
+        ...(toolFilter ? { toolFilter } : {}),
+        concurrent: readOnly,
+        description: profileDescription(agent),
+        systemPrompt: built.prompt,
+    };
+}
+/**
+ * 注入本轮最后一条用户消息的强制派发指令。
+ *
+ * 被点名的父代理自己也在名单里（`isSelf`）：它要起一个独立副本去跑那份
+ * 子任务，而不是顺手自己做——否则 `requiredProfiles` 完成门会一直把回合
+ * 退回来。
+ *
+ * @param delegates 被点名的子代理（显示名 + 画像名 + 实际工具面 + 是否是自己）。
+ * @returns 派发指令正文。
+ */
+export function buildDelegateDispatchInstruction(delegates) {
+    const names = delegates.map((row) => row.name).join('、');
+    const roster = delegates
+        .map((row) => {
+        const tools = row.toolFilter?.length
+            ? `本轮可用工具：${row.toolFilter.join('、')}`
+            : '本轮可用工具与你相同';
+        const self = row.isSelf ? '就是你自己的画像，起一个独立副本去跑；' : '';
+        return `- **${row.name}**（subagent_type=\`${row.profileName}\`）：${self}${tools}`;
+    })
+        .join('\n');
+    const hasSelf = delegates.some((row) => row.isSelf);
+    return [
+        `用户点名了 **${names}**。本轮你必须把活交给它们，用 \`delegate_subagent\`（\`subagent_type\` 填画像名），每人至少一份子任务。`,
+        '',
+        roster,
+        '',
+        '- 子任务**彼此独立**时：一句话说明分工，紧接着在**同一轮**把全部调用发出，并把可并行的排在一起。',
+        '- 子任务**有依赖**时：按依赖顺序分轮派发，并把前一轮的结论写进后一轮的 `task`。',
+        '- 每份 `task` 必须自包含（目标、输入、交付形式、验收标准）——子代理看不到本对话。',
+        '- 禁止只写分工然后停手；也禁止漏掉任何一位被点名的代理。',
+        ...(hasSelf
+            ? [
+                '- 名单里包含你自己时同样要发 `delegate_subagent`：那是一个看不到本对话的独立副本，自己顺手做不算完成派发。',
+            ]
+            : []),
+        '- 若某子代理注明了本轮可用工具，不要尝试让它调用未列出的工具。',
+    ].join('\n');
+}
+/**
+ * 内置画像 + 本轮提及画像。被 `@` 超过 4 个时抬高池的并行上限。
+ *
+ * 提及画像同时作为 `requiredProfiles` 下发：强制派发此前只是提示词里的
+ * 一句话，模型跑了别的工具再叙述「已启动」就能蒙过所有既有纪律检查。
+ *
+ * @param mentionProfiles 本轮提及转出的画像；空对象则与 {@link builtinSubagentParam} 相同。
+ * @returns 下发给 sidecar 的 `subagent` 参数。
+ */
+export function mergeTurnSubagentParam(mentionProfiles) {
+    const mentionNames = Object.keys(mentionProfiles);
+    return {
+        profiles: { ...BUILTIN_SUBAGENT_PROFILES, ...mentionProfiles },
+        ...(mentionNames.length > 4 ? { maxParallel: mentionNames.length } : {}),
+        ...(mentionNames.length > 0 ? { requiredProfiles: mentionNames } : {}),
+    };
+}

package/dist/local-backend/turn-timeline.d.ts

@@ -5,12 +5,22 @@
 export type PersistedTurnBlock = {
     type: 'reasoning';
     content: string;
+    sealed?: boolean;
+    startedAtMs?: number;
+    durationMs?: number;
 } | {
     type: 'text';
     content: string;
+    sealed?: boolean;
 } | {
     type: 'tools';
     actions: Array<Record<string, unknown>>;
 };
-export declare function appendTimelineDelta(blocks: PersistedTurnBlock[], type: 'text' | 'reasoning', delta: string): void;
-export declare function syncTimelineTools(blocks: PersistedTurnBlock[], actions: Array<Record<string, unknown>>): void;
+export declare function appendTimelineDelta(blocks: PersistedTurnBlock[], type: 'text' | 'reasoning', delta: string, now?: number): void;
+/**
+ * Close the current reasoning/text segment so the next same-kind delta
+ * starts a new block. Mirrors apps/web `sealLastBlock`.
+ */
+export declare function sealLastTimelineBlock(blocks: PersistedTurnBlock[], now?: number): void;
+export declare function freezeTimelineReasoning(blocks: PersistedTurnBlock[], now?: number): void;
+export declare function syncTimelineTools(blocks: PersistedTurnBlock[], actions: Array<Record<string, unknown>>, now?: number): void;

package/dist/local-backend/turn-timeline.js

@@ -2,17 +2,44 @@
  * Call-order display blocks persisted on assistant message metadata.
  * Keep this JSON compatible with apps/web `turn-timeline.ts`.
  */
-export function appendTimelineDelta(blocks, type, delta) {
+function freezeOpenReasoning(blocks, now = Date.now()) {
+    const last = blocks[blocks.length - 1];
+    if (!last || last.type !== 'reasoning' || last.durationMs != null)
+        return;
+    if (last.startedAtMs == null)
+        return;
+    last.durationMs = Math.max(0, now - last.startedAtMs);
+}
+export function appendTimelineDelta(blocks, type, delta, now = Date.now()) {
     if (!delta)
         return;
     const last = blocks[blocks.length - 1];
-    if (last && last.type === type) {
+    if (last && last.type === type && !last.sealed) {
         last.content += delta;
         return;
     }
+    freezeOpenReasoning(blocks, now);
+    if (type === 'reasoning') {
+        blocks.push({ type, content: delta, startedAtMs: now });
+        return;
+    }
     blocks.push({ type, content: delta });
 }
-export function syncTimelineTools(blocks, actions) {
+/**
+ * Close the current reasoning/text segment so the next same-kind delta
+ * starts a new block. Mirrors apps/web `sealLastBlock`.
+ */
+export function sealLastTimelineBlock(blocks, now = Date.now()) {
+    const last = blocks[blocks.length - 1];
+    if (!last || last.type === 'tools' || last.sealed)
+        return;
+    freezeOpenReasoning(blocks, now);
+    last.sealed = true;
+}
+export function freezeTimelineReasoning(blocks, now = Date.now()) {
+    freezeOpenReasoning(blocks, now);
+}
+export function syncTimelineTools(blocks, actions, now = Date.now()) {
     let placed = 0;
     for (const block of blocks) {
         if (block.type === 'tools')
@@ -37,6 +64,7 @@ export function syncTimelineTools(blocks, actions) {
         last.actions.push(...added);
     }
     else {
+        freezeOpenReasoning(blocks, now);
         blocks.push({ type: 'tools', actions: added });
     }
 }

package/dist/sidecar/supervisor.d.ts

@@ -11,6 +11,8 @@
  */
 import { EventEmitter } from 'node:events';
 import type { SidecarApplyEditsResult, SidecarChatStreamHandlers, SidecarChatStreamRequest, SidecarHealthSnapshot, SidecarMethodOptions, SidecarModelCatalog, SidecarReverseHandler, SidecarSandboxPosture, SidecarSessionBranches, SidecarSessionForkOutcome, SidecarSessionMessages, SidecarSessionTree, SidecarSkillModule, SidecarStartOptions, SidecarToolResult } from './types.js';
+export declare const RUST_SIDECAR_ENV = "STEERABLE_RUST_SIDECAR";
+export declare const RUST_SIDECAR_BIN_ENV = "STEERABLE_RUST_SIDECAR_BIN";
 /**
  * Tool names carried by a `tool.list` reply.
  *
@@ -216,3 +218,9 @@ export declare class SidecarSupervisor extends EventEmitter {
  * launcher (W1.3.3) spawns the same interpreter the sidecar uses.
  */
 export declare function resolveSidecarPython(pythonExecutable?: string): string;
+export declare function rustSidecarEnabled(): boolean;
+/**
+ * Resolve the optional Rust sidecar binary. Missing binary with the flag
+ * on is a silent fallback to Python (`python -m steerable_sidecar`).
+ */
+export declare function resolveRustSidecarBin(explicit?: string): string | undefined;

package/dist/sidecar/supervisor.js

@@ -25,6 +25,8 @@ const READY_PREFIX = '__SIDECAR_READY__:';
 const DEFAULT_BOOT_TIMEOUT_MS = 15_000;
 const DEFAULT_HEALTH_INTERVAL_MS = 5_000;
 const DEFAULT_RESTART_AFTER_FAILED_PINGS = 3;
+export const RUST_SIDECAR_ENV = 'STEERABLE_RUST_SIDECAR';
+export const RUST_SIDECAR_BIN_ENV = 'STEERABLE_RUST_SIDECAR_BIN';
 // Only /usr/bin/sandbox-exec is trusted — a PATH-relative lookup could
 // resolve to an attacker-planted binary (codex's rule).
 const SEATBELT_EXECUTABLE = '/usr/bin/sandbox-exec';
@@ -381,10 +383,19 @@ export class SidecarSupervisor extends EventEmitter {
     // Internal: boot
     // ------------------------------------------------------------------
     async boot() {
-        const py = this.resolvePythonBinary();
-        const entry = this.options.entryModule ?? 'steerable_sidecar';
-        const args = ['-m', entry, ...(this.options.args ?? [])];
-        const spawnPlan = await this.resolveSandboxedSpawn(py, args);
+        const rustBin = rustSidecarEnabled()
+            ? resolveRustSidecarBin(this.options.rustSidecarBin)
+            : undefined;
+        let spawnPlan;
+        if (rustBin) {
+            spawnPlan = await this.resolveSandboxedSpawn(rustBin, this.options.args ?? []);
+        }
+        else {
+            const py = this.resolvePythonBinary();
+            const entry = this.options.entryModule ?? 'steerable_sidecar';
+            const args = ['-m', entry, ...(this.options.args ?? [])];
+            spawnPlan = await this.resolveSandboxedSpawn(py, args);
+        }
         const child = spawn(spawnPlan.command, spawnPlan.args, {
             cwd: this.options.cwd,
             env: { ...process.env, ...this.options.env, ...spawnPlan.env },
@@ -416,8 +427,8 @@ export class SidecarSupervisor extends EventEmitter {
      * (`sandbox: false` / `STEERABLE_SIDECAR_SANDBOX=0`) is the only
      * unconfined path. Every exit records `sandboxPosture`.
      */
-    async resolveSandboxedSpawn(py, args) {
-        const plain = { command: py, args };
+    async resolveSandboxedSpawn(command, args) {
+        const plain = { command, args };
         const enabled = this.options.sandbox ?? process.env.STEERABLE_SIDECAR_SANDBOX !== '0';
         if (!enabled) {
             this.sandboxPosture = {
@@ -446,16 +457,16 @@ export class SidecarSupervisor extends EventEmitter {
                 .filter(Boolean);
         const webEgress = Boolean(this.options.sandboxWebEgress) && allowedHosts.length > 0;
         // 3.1b: egress-proxy 模式下 web_fetch 的 SSRF 预检在沙箱内解析 DNS，
-        // 只放行解析器 socket（无 IP 可达性）；webEgress 已含解析器，互斥。
+        // 但真正的出口走代理。Seatbelt 只放行 resolver socket，不放行 *:80/443。
         const allowResolver = Boolean(this.options.sandboxAllowResolver) && allowedHosts.length > 0 && !webEgress;
         if (process.platform === 'darwin') {
-            return this.wrapSeatbelt(py, args, writableRoots, allowedHosts, webEgress, allowResolver);
+            return this.wrapSeatbelt(command, args, writableRoots, allowedHosts, webEgress, allowResolver);
         }
         if (process.platform === 'linux') {
-            return this.wrapLinux(py, args, writableRoots);
+            return this.wrapLinux(command, args, writableRoots);
         }
         if (process.platform === 'win32') {
-            return this.wrapWindows(py, args, writableRoots);
+            return this.wrapWindows(command, args, writableRoots);
         }
         const posture = {
             backend: 'none',
@@ -470,21 +481,23 @@ export class SidecarSupervisor extends EventEmitter {
         this.options.onLogLine?.(message);
         throw new SidecarSandboxUnavailableError(message, posture, cause);
     }
-    async wrapSeatbelt(py, args, writableRoots, allowedHosts, webEgress, allowResolver) {
+    async wrapSeatbelt(command, args, writableRoots, allowedHosts, webEgress, allowResolver) {
         if (!existsSync(SEATBELT_EXECUTABLE)) {
             this.refuse({ backend: 'none', enforcement: 'none', reason: 'seatbelt_missing' }, 'sandbox: /usr/bin/sandbox-exec missing; refusing unsandboxed spawn');
         }
         try {
-            const profileArgs = [
-                '-m',
-                'steerable_sidecar.sandbox',
-                'profile',
+            const flags = [
                 ...writableRoots.flatMap((root) => ['--writable-root', root]),
                 ...allowedHosts.flatMap((h) => ['--allow-host', h]),
                 ...(webEgress ? ['--allow-web-egress'] : []),
                 ...(allowResolver ? ['--allow-resolver'] : []),
             ];
-            const { stdout } = await execFileAsync(py, profileArgs, { timeout: 10_000 });
+            const rustBin = rustSidecarEnabled()
+                ? resolveRustSidecarBin(this.options.rustSidecarBin)
+                : undefined;
+            const { stdout } = rustBin
+                ? await execFileAsync(rustBin, ['sandbox', 'profile', ...flags], { timeout: 10_000 })
+                : await execFileAsync(command, ['-m', 'steerable_sidecar.sandbox', 'profile', ...flags], { timeout: 10_000 });
             const profile = stdout.trim();
             if (!profile.includes('(deny default)')) {
                 throw new Error('generated profile is not a Seatbelt policy');
@@ -497,7 +510,7 @@ export class SidecarSupervisor extends EventEmitter {
             this.sandboxPosture = { backend: 'seatbelt', enforcement: 'partial', reason: 'active' };
             return {
                 command: SEATBELT_EXECUTABLE,
-                args: ['-p', profile, py, ...args],
+                args: ['-p', profile, command, ...args],
                 env: {
                     PYTHONDONTWRITEBYTECODE: '1',
                     // macOS denies a nested sandbox_apply once the outer profile allows
@@ -516,7 +529,7 @@ export class SidecarSupervisor extends EventEmitter {
             this.refuse({ backend: 'none', enforcement: 'none', reason: 'profile_failed' }, `sandbox: profile generation failed; refusing unsandboxed spawn: ${String(err)}`, err);
         }
     }
-    async wrapLinux(py, args, writableRoots) {
+    async wrapLinux(command, args, writableRoots) {
         // 3.1c：框架的 linux-wrap 只接受 --writable-root / --no-network——
         // bwrap 的 allowed_hosts 仅是接口兼容（不强制），Landlock 根本没有
         // per-host egress。所以 Linux 的按主机管控不在 layer-1：egress-proxy
@@ -524,17 +537,29 @@ export class SidecarSupervisor extends EventEmitter {
         // 都透传环境）+ sidecar 应用层域名名单强制，网络命名空间保持共享。
         // 这里如实记录，不假装接上了实际不强制的参数。
         const egressViaProxy = this.options.env?.STEERABLE_EGRESS_CONFINED === '1';
-        const wrapArgs = [
-            '-m',
-            'steerable_sidecar.sandbox',
-            'linux-wrap',
-            ...writableRoots.flatMap((root) => ['--writable-root', root]),
-            '--',
-            py,
-            ...args,
-        ];
+        const rustBin = rustSidecarEnabled()
+            ? resolveRustSidecarBin(this.options.rustSidecarBin)
+            : undefined;
+        const wrapArgs = rustBin
+            ? [
+                'sandbox',
+                'linux-wrap',
+                ...writableRoots.flatMap((root) => ['--writable-root', root]),
+                '--',
+                command,
+                ...args,
+            ]
+            : [
+                '-m',
+                'steerable_sidecar.sandbox',
+                'linux-wrap',
+                ...writableRoots.flatMap((root) => ['--writable-root', root]),
+                '--',
+                command,
+                ...args,
+            ];
         try {
-            const { stdout } = await execFileAsync(py, wrapArgs, { timeout: 15_000 });
+            const { stdout } = await execFileAsync(rustBin ?? command, wrapArgs, { timeout: 15_000 });
             const plan = JSON.parse(stdout.trim());
             if (!Array.isArray(plan.argv) || plan.argv.length < 1 || typeof plan.argv[0] !== 'string') {
                 throw new Error('linux-wrap did not return an argv');
@@ -562,7 +587,7 @@ export class SidecarSupervisor extends EventEmitter {
             this.refuse({ backend: 'none', enforcement: 'none', reason: 'wrap_failed' }, `sandbox: Linux process wrap failed; refusing unsandboxed spawn: ${String(err)}`, err);
         }
     }
-    wrapWindows(py, args, writableRoots) {
+    wrapWindows(command, args, writableRoots) {
         const helper = resolveWinSpawnHelperPath();
         if (!helper) {
             this.refuse({ backend: 'none', enforcement: 'none', reason: 'helper_missing' }, 'sandbox: win-spawn-helper.exe not found; refusing unsandboxed sidecar spawn');
@@ -590,7 +615,7 @@ export class SidecarSupervisor extends EventEmitter {
                 steerableDir,
                 ...extraRoots.flatMap((root) => ['--writable-root', root]),
                 '--',
-                py,
+                command,
                 ...args,
             ],
             env: {
@@ -930,3 +955,36 @@ export function resolveSidecarPython(pythonExecutable) {
     // Fallback to system python (developer machines).
     return process.platform === 'win32' ? 'python' : 'python3';
 }
+function envFlag(name) {
+    const raw = (process.env[name] ?? '').trim().toLowerCase();
+    return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on';
+}
+export function rustSidecarEnabled() {
+    return envFlag(RUST_SIDECAR_ENV);
+}
+/**
+ * Resolve the optional Rust sidecar binary. Missing binary with the flag
+ * on is a silent fallback to Python (`python -m steerable_sidecar`).
+ */
+export function resolveRustSidecarBin(explicit) {
+    if (explicit) {
+        return existsSync(explicit) ? explicit : undefined;
+    }
+    const fromEnv = process.env[RUST_SIDECAR_BIN_ENV];
+    if (fromEnv) {
+        return existsSync(fromEnv) ? fromEnv : undefined;
+    }
+    const exe = process.platform === 'win32' ? 'steerable-sidecar.exe' : 'steerable-sidecar';
+    const relatives = [
+        join('..', '..', '..', '..', 'sidecar', 'rs', 'target', 'debug', exe),
+        join('..', '..', '..', '..', '..', 'sidecar', 'rs', 'target', 'debug', exe),
+        join('..', '..', '..', '..', 'sidecar', 'rs', 'target', 'release', exe),
+        join('..', '..', '..', '..', '..', 'sidecar', 'rs', 'target', 'release', exe),
+    ];
+    for (const rel of relatives) {
+        const candidate = join(__dirname, rel);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}

package/dist/sidecar/types.d.ts

@@ -21,6 +21,8 @@ export interface SidecarSandboxPosture {
 export interface SidecarStartOptions {
     /** Override the python binary; defaults to the bundled portable runtime. */
     pythonExecutable?: string;
+    /** Optional Rust sidecar binary; used when STEERABLE_RUST_SIDECAR is on. */
+    rustSidecarBin?: string;
     /** Override the entrypoint module; defaults to ``steerable_sidecar``. */
     entryModule?: string;
     /** Extra arguments appended after ``-m <entryModule>``. */
@@ -352,16 +354,26 @@ export interface SidecarChatStreamRequest {
     subagent?: boolean | {
         toolFilter?: string[];
         maxParallel?: number;
+        /** Child round / tool-error walls; default to the parent loop's. */
+        maxRounds?: number;
+        maxToolErrors?: number;
         profiles?: Record<string, {
             toolFilter?: string[];
             model?: string;
             maxRounds?: number;
+            maxToolErrors?: number;
             concurrent?: boolean;
             description?: string;
             /** Profile system prompt, seeded as the child loop's first message
              * (CC `.claude/agents` body parity). */
             systemPrompt?: string;
         }>;
+        /**
+         * Profiles that MUST each receive a delegation this turn (the host's
+         * `@` mentions). A `completed` turn that skipped one is retried — the
+         * dispatch instruction alone is prompt text a model can narrate past.
+         */
+        requiredProfiles?: string[];
     };
     /** A6 layered skill disclosure: the sidecar injects the catalog layer
      * (first-round pre_step, recorded as a hook_action event) and answers
@@ -495,7 +507,7 @@ export interface SidecarStreamChunk {
             enforcement: string;
         };
     };
-    /** CoreLoop notices: soft_timeout / budget_exhausted. */
+    /** CoreLoop notices: soft_timeout / budget_exhausted / round_end / hook_action. */
     notice?: {
         kind: string;
         [key: string]: unknown;
@@ -553,6 +565,12 @@ export interface SidecarChildEvent {
     status?: string;
     error?: string;
     profile?: string;
+    /**
+     * The child's own durable record (`<parent record>:child:<lineage id>`),
+     * present on `child_spawned` when the host wired a history store. Read it
+     * back to render the delegation's reasoning + tool calls.
+     */
+    recordId?: string;
 }
 export interface SidecarChatStreamHandlers {
     onChunk?: (chunk: SidecarStreamChunk) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steerable/agent-shell",
-  "version": "0.6.27",
+  "version": "0.6.29",
   "description": "Steerable framework — product-neutral desktop/headless agent host (Tier 5). Electron main + preload + headless HTTP server (BS) sharing one storage/sidecar/tooling core; scenario packs extend it through the @steerable/pack-sdk contract and are composed at build time by the consuming product.",
   "license": "Apache-2.0",
   "homepage": "https://steerableframework.com/",
@@ -49,9 +49,9 @@
     "electron-store": "^8.1.0",
     "he": "^1.2.0",
     "node-pty": "^1.1.0",
-    "@steerable/agent-harness": "0.6.27",
-    "@steerable/pack-sdk": "0.6.27",
-    "@steerable/agent-protocol": "0.6.27"
+    "@steerable/agent-harness": "0.6.29",
+    "@steerable/pack-sdk": "0.6.29",
+    "@steerable/agent-protocol": "0.6.29"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",