dsh-model-switch 0.4.25 → 0.4.26

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## v0.4.26
+
+Two coordinated changes: automatic session naming now survives a failing title route (the auxiliary call is retried and then falls through the candidate routes instead of leaving the deterministic fallback title in place forever), and official DSH `0.2.1-rc.2` is declared compatible — that release replaced the shared title call with a provider-prepared one and replaced the Subagent start surface with its activation API, so both seams are now handled per installed line.
+
+- **Session naming: one failing route no longer owns the title (`src/session-title.ts`).** Evidence from the five sessions that showed a `session/title-llm-request` and no provider title: all five routed to `ark/ark-code-latest`, each fired 1–5 ms after the main request header on the same account, and each session's main loop carried that account's `RATE_LIMIT` (`RequestBurstTooFast` / `AccountQuotaExceeded`) or `TRANSPORT` failures — the auxiliary call has no retry and no fallback, so one rejected call left the deterministic fallback. The row now tries the resolved route first (session provider group's title pair → deployment-wide pair → the row's own pair → the session's logged route, deduplicated) and **only moves on after a failure**: a max-token failure gets one widened-budget retry on the same route (`min(4 × maxOutputTokens, 4096)`), other failures fall through to the next candidate, and when every candidate fails the row logs one warning naming the routes and rethrows, so the official fallback still applies. The configured route stays the first choice and nothing is persisted.
+- **DSH 0.2.1 naming line (`executeSessionTitleLlm`).** `0.2.1-rc.2` removed `generateSessionTitleWithLlm` / `registerSessionTitleLlmProvider` and split the shared policy: the new `executeSessionTitleLlm(ctx, config, request, id, prepared)` returns assembled blocks plus the terminal finish reason, each provider owns its system instruction, input framing, reasoning-effort selection, and output interpretation, and `targetWords` / `targetCjkCharacters` moved into the provider's own config. The row detects the installed line at runtime and mirrors the shipped 0.2.1 provider exactly: same system instruction (including the best-effort line and, for all-prompts, the current-title stability rules anchored on a provider-sourced `currentTitle`), same JSON framing, the route's least supported reasoning effort, and the same finish-reason / whole-line-emphasis / empty-output acceptance rules. `cordis.patch.yml` also disables the `optional-session-title-all-prompts` row that 0.2.1's experimental session-titles bundle inserts (unknown-row warning on profiles without it, like the optional auto-review row).
+- **DSH 0.2.1 compatibility review (0.2.0-rc.2 → 0.2.1-rc.2, public API only).**
+  - **Naming:** the service keeps `register` / `ensureFallback` / the `first-prompt` gate and only adds an optional `currentTitle` to the provider request; `onMainRequest` dropped one boundary-freshness condition. The provider request shape this row returns is unchanged.
+  - **Auto review:** the official gate now resolves the reviewing agent's directory through `ctx.workingDirectory.ensure(...)` and injects `workingDirectory`; `dsh-base` 0.2.1 mounts the `working-directory` row, so the official `apply` runs unchanged under this row's scoped `llm`.
+  - **Compaction and presets:** `dsh-compaction-basic` and `dsh-agent-preset` are byte-identical to 0.2.0, so the wholesale preset copies and the compaction engine need no re-sync.
+  - **Unchanged surfaces this plugin calls:** `llm.stream(GenerateOptions)` (with `prepareCall` added beside it), `web.registerSearchProvider`, `tools/pre-execute` (`exec.agent` kept), session `snapshotEvents` / `requestHeader` / `requestContext` / `append`, and the composer's `conversation.input.model` seat.
+  - **Subagents:** `@deepseek-ai/dsh-subagent` replaced `start()` / `startContinuable()` with `startActivation(spec)` plus a provider registry. The routed runtime therefore cannot override the new entry point; this row mounts the untouched official runtime (fail-closed) and logs one explicit notice. Recorded in `docs/seam-gap.md` for a later upstream proposal.
+- **Verification.** `pnpm run check` green (`tsc` + `tsdown`, 52 test files / 437 tests, pack gate). New coverage: both auxiliary-LLM lines end to end, route-candidate ordering and dedup, max-token widening, fall-through, all-candidate failure reporting, cancelled requests staying silent, provider-prepared prompt/framing/anchor/effort selection, and the replaced-Subagent notice. Both official lines were also exercised end to end against the **real published packages** (0.2.1 `executeSessionTitleLlm`, 0.1.7 `generateSessionTitleWithLlm`): registration through the real policy validator, route selection, the `session/title-llm-request` record, the official system prompt, the least reasoning effort (0.2.1), and title acceptance all agree. **Lab plane:** `DSH_HOME=~/.dsh-lab` with the npm-installed `0.2.1-rc.2` runtime and the packed `dsh-model-switch-0.4.26.tgz` — profile composition `exit 0` with the naming, compaction, auto-review, and subagent rows composed from this plugin, and the Web Host booted on port 3082 serving the auth-gated page. **Residual (honest):** the 3082 capability RPC was not exercised from a browser (no browser automation is available in this environment), the Ark route probe is blocked by that account's weekly quota (`AccountQuotaExceeded`; the API reports the reset at `2026-10-19 00:00 +0800`), and the live desktop is still `0.2.0-rc.2`, so the 0.2.1 claim rests on the package-surface review, the unit suite, the real-package line checks, and the lab boot; the naming differential on a live 0.2.1 desktop is re-checked after the app update.
+
 ## v0.4.25
 
 Three coordinated changes: Provider groups now cover all four per-session capabilities (compaction, auto review, session naming, and subagents) with mid-session provider-switch following; capability switches stay disabled until the model catalog has loaded (and while any row save is in flight) so clicks are never silently dropped; and send-time switch compaction (`compactOnSwitch` / `src/switch-compact.ts`) has been removed completely.

package/PRODUCT.md

@@ -13,9 +13,9 @@
 - **Plan Review:** intercepts the official `plan-review` composer takeover with a header execution-model picker and right-aligned Discuss in chat / Reject / Set as goal and run / Confirm actions. Confirm commits the selected model before answering; a refused commit leaves the review pending and retryable. Reject carries optional human feedback as the answer's own `custom` text, which plan mode reports to the model. **Set as goal and run** arms this Plan as the session's goal through the released `remote.goals.create` — replacing an unfinished goal with `get` + `clear` first so the new Plan receives a fresh round cap — and only then answers, so `dsh-goal-round-driver` carries the Plan after plan mode exits. The goal is set before the answer, a refusal keeps the review pending and retryable, and a deployment that mounts no goal service disables the action with an explicit reason; the plugin stores no goal state, schedules no rounds, and owns no part of the goal domain. The card body carries only the official two-part summary (first line, first paragraph); the full plan opens in the right sidebar through ui-plan's registered preview opener, which this card drives because a composer-takeover entry cannot declare the official actions slot. Discuss in chat withdraws the takeover through the Host's own verb — `dismiss()` where the Host publishes it, `cancel()` on the older generation — and names the Host when neither seam exists, so a settled review is never a dead end. The same runtime reservation applies.
 - **Auto review:** the reviewer model for the official `@deepseek-ai/dsh-experimental-auto-review` per-call gate, off by default — both fields empty means reviews follow the session's own model. On pins a deployment-wide provider/model, and each review resolves its route per session: the session's provider group's reviewer pair → the flat card pair → the session's own model. Session correlation rides an outer `{ prepend: true }` `tools/pre-execute` listener on the review scope (`exec.agent.session`), so parallel sessions on different providers never interfere and mid-session provider switches take effect on the very next review.
 - **Compaction:** the summarization model behind `/compact` and DSH's automatic compaction, off by default — both fields empty means compaction follows the conversation target model. On pins a deployment-wide provider/model, and each summarization call resolves its route per session: the session's provider group's compaction pair → the flat card pair → the official row's `modelPolicies` / conversation-target default. When a per-session route applies, the child context's `llm` wrapper updates `options.provider`/`options.model` in place on `purpose === 'compaction'` calls so `summarizeWithLlm` returns and durably records the exact route that wrote the summary in `compaction/summary`.
-- **Session naming:** the model behind DSH's automatic session titles, off by default — both fields empty means naming follows the session's own model, which is the official behavior. On pins a deployment-wide provider/model that each session re-resolves per request: provider group → flat pair → the session's own model. The route is read through on every naming request, so a save applies to the very next request with no restart and never interrupts an in-flight request; the exact pair used is recorded in the session's own `session/title-llm-request` event by the official naming implementation, so the record and the request always agree. The plugin replaces the official `session-title-llm` row (one registered naming provider per context) and mirrors the cadence that row declared; naming cadence and title policy remain DSH's.
+- **Session naming:** the model behind DSH's automatic session titles, off by default — both fields empty means naming follows the session's own model, which is the official behavior. On pins a deployment-wide provider/model that each session re-resolves per request: provider group → flat pair → the session's own model. The route is read through on every naming request, so a save applies to the very next request with no restart and never interrupts an in-flight request; the exact pair used is recorded in the session's own `session/title-llm-request` event by the official naming implementation, so the record and the request always agree. The first candidate is used unless its call fails: a max-token failure gets one widened output-budget retry on the same route, any other failure falls through to the next candidate (provider group → flat pair → the row's own pair → the session's own model), and only when every candidate fails does naming keep DSH's deterministic fallback title, after one warning that names the routes tried. A fallback neither writes settings nor changes the stored route. The plugin replaces the official `session-title-llm` row (one registered naming provider per context), mirrors the cadence that row declared, and follows whichever official auxiliary title call the installed DSH line publishes; naming cadence and title policy remain DSH's.
 
-Model choices are capability-driven. Invalid, unavailable, or unsupported selections remain visible to configuration surfaces and fail loudly at use; routing never silently falls back.
+Model choices are capability-driven. Invalid, unavailable, or unsupported selections remain visible to configuration surfaces and fail loudly at use; routing never silently falls back. The one exception is the session-naming per-call route fallback above: it engages only after the pinned route's call failed, is reported once when every candidate fails, and never changes the stored route.
 
 ## Preset modes
 

package/README.md

@@ -148,10 +148,10 @@ dsh plugin --profile web add --force dsh-model-switch
 A packed tarball installs the same build without a registry:
 
 ```sh
-dsh plugin --profile web add --force ./dsh-model-switch-0.4.17.tgz
+dsh plugin --profile web add --force ./dsh-model-switch-0.4.26.tgz
 ```
 
-Then install only the provider adapters you use. This release was checked against official DeepSeek Harness `0.1.7-rc.2` and verified on `0.2.0-rc.2`:
+Then install only the provider adapters you use. This release was checked against official DeepSeek Harness `0.1.7-rc.2` and verified on `0.2.0-rc.2` and `0.2.1-rc.2`:
 
 ```sh
 dsh plugin --profile web add --force \

package/README.zh.md

@@ -180,7 +180,7 @@ DeepSeek 薄适配器调用官方公开 `DeepSeekSearchProvider`，复用用户
 
 DSH Host peer 和开发依赖接受 `>=0.1.7-alpha.2`，包括 rc.1 和后续版本。开发锁文件解析到 rc.2。Cordis 接受 `>=4.0.4 <5.0.0`。
 
-已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。
+已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，路由版运行时在新 Host 上不可用，本插件改为挂载未经改动的官方运行时并输出一条明确提示（记录于 `docs/seam-gap.md`）。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。
 
 `package.json#dsh.compatibility.dshReleases` 中的已验证版本是证据，不是允许列表。新增验证声明前要审查公开 API 变化并测试新 Host 版本。
 

package/cordis.patch.yml

@@ -34,6 +34,15 @@
   name: '@deepseek-ai/dsh-session-title-first-prompt-llm'
   disabled: true
 
+# DSH 0.2.1's optional experimental session-titles bundle disables the row above
+# and inserts its own all-prompts provider row. Model Switch owns this seam as
+# well, so that row is disabled by its id too; a profile that never enabled the
+# bundle has no such row and the non-insert target is skipped with a warning,
+# exactly like the optional auto-review row above.
+- id: optional-session-title-all-prompts
+  name: '@deepseek-ai/dsh-session-title-all-prompts-llm'
+  disabled: true
+
 # The Web surface moves the agent plane (tools, compaction, delegation) into
 # per-session agent presets: session /compact and official automatic compaction
 # run against the compaction service inside each preset's isolated `compaction`

package/lib/auto-review.js

@@ -1,4 +1,4 @@
-import { n as sessionProviderOf, t as resolveCapabilityRoute } from "./session-route-BCQFzqRP.js";
+import { i as sessionProviderOf, r as resolveCapabilityRoute } from "./session-route-BjNPlliu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region lib/types/auto-review.js
 /**

package/lib/compaction.js

@@ -1,4 +1,4 @@
-import { n as sessionProviderOf, t as resolveCapabilityRoute } from "./session-route-BCQFzqRP.js";
+import { i as sessionProviderOf, r as resolveCapabilityRoute } from "./session-route-BjNPlliu.js";
 //#region lib/types/compaction.js
 /** Official compaction row this module supersedes. */
 const OFFICIAL_COMPACTION_ROW = "compaction-basic";

package/lib/session-route-BjNPlliu.js

@@ -0,0 +1,172 @@
+import { t as groupOf } from "./provider-group-CwadImhH.js";
+//#region lib/types/session-route.js
+/**
+* Per-session capability route derivation.
+*
+* Model Switch stores one deployment-wide route per capability (the flat
+* settings fields) plus, per provider, a saved provider group. Nothing is
+* written when a session changes provider: this module DERIVES the route a
+* capability should use for one session from (a) the session's own provider and
+* (b) the stored group table. Two sessions on different providers therefore
+* resolve independently, and no session's actions rewrite another session's
+* route.
+*
+* The session's provider is read from durable, official state in this order:
+* the `modelSelection` session projection (`pending` before `lastUsed`, so a
+* selection the user just made counts), then the latest logged request-context
+* route, then the latest `request/header` route. Every read is optional: a
+* session with no observable provider, an unregistered projection, or a
+* profile without the projection package all resolve to the deployment default,
+* which is exactly the pre-derivation behavior.
+*
+* All functions are pure except the readers, which never throw and never write.
+*/
+/** Flat deployment-default fields per capability, in group-storage field names. */
+const CAPABILITY_FIELDS = Object.freeze({
+	compaction: {
+		provider: "compactProvider",
+		model: "compactModel"
+	},
+	autoReview: {
+		provider: "autoReviewProvider",
+		model: "autoReviewModel"
+	},
+	title: {
+		provider: "titleProvider",
+		model: "titleModel"
+	},
+	subagent: {
+		provider: "subagentProvider",
+		model: "subagentModel"
+	}
+});
+/** A non-blank string; blank values behave exactly like an absent field. */
+function present(value) {
+	return typeof value === "string" && value.trim() !== "";
+}
+/** Read one capability's pair from a flat route record; undefined unless both halves are present. */
+function pairOf(source, fields) {
+	if (source === void 0) return void 0;
+	const record = source;
+	const provider = record[fields.provider];
+	const model = record[fields.model];
+	if (!present(provider) || !present(model)) return void 0;
+	return {
+		provider,
+		model
+	};
+}
+/**
+* The deployment-wide route for one capability: the flat settings pair.
+* @param settings - live Model Switch settings; undefined means none are reachable.
+* @param capability - capability whose flat pair is read.
+* @returns The complete pair, or undefined when the capability stays at its official/derived default.
+*/
+function deploymentRoute(settings, capability) {
+	return pairOf(settings, CAPABILITY_FIELDS[capability]);
+}
+/**
+* The route a subagent spawn should use for one parent-session provider.
+*
+* A saved group for that provider pins the spawn; otherwise the flat Subagent
+* card pins it, but only in `fixed` mode — `follow-main` IS the official inherit
+* path, expressed by leaving the request untouched rather than by naming it.
+* @param settings - live Model Switch settings.
+* @param provider - the delegating session's provider, when one is observable.
+* @returns The complete route, or undefined for official inherit.
+*/
+function subagentRouteOf(settings, provider) {
+	const group = groupRoute(settings, provider, "subagent");
+	if (group !== void 0) {
+		const effort = groupOf(settings?.providerGroups, provider ?? "")?.subagentReasoningEffort;
+		return present(effort) ? {
+			...group,
+			reasoningEffort: effort
+		} : group;
+	}
+	if (settings?.subagentMode !== "fixed") return void 0;
+	const fixed = deploymentRoute(settings, "subagent");
+	if (fixed === void 0) return void 0;
+	return present(settings.subagentReasoningEffort) ? {
+		...fixed,
+		reasoningEffort: settings.subagentReasoningEffort
+	} : fixed;
+}
+/**
+* One provider's saved route for one capability.
+* @param settings - live Model Switch settings carrying the group table.
+* @param provider - the session's provider; blank or unknown resolves to undefined.
+* @param capability - capability whose group pin is read.
+* @returns The complete group pair, or undefined when the group pins nothing here.
+*/
+function groupRoute(settings, provider, capability) {
+	if (!present(provider)) return void 0;
+	return pairOf(groupOf(settings?.providerGroups, provider), CAPABILITY_FIELDS[capability]);
+}
+/**
+* The route one capability should use for one session.
+*
+* A saved provider group for the session's provider wins; otherwise the flat
+* deployment default applies. An unknown session provider skips every group, so
+* a session Model Switch cannot attribute keeps the deployment default.
+* @param settings - live Model Switch settings.
+* @param provider - the session's provider, when one is observable.
+* @param capability - capability being resolved.
+* @returns The complete pair, or undefined for the capability's official default.
+*/
+function resolveCapabilityRoute(settings, provider, capability) {
+	return groupRoute(settings, provider, capability) ?? deploymentRoute(settings, capability);
+}
+/**
+* Read the provider from the durable model-selection projection.
+* @param ctx - context that may expose `sessionProjections`.
+* @param session - the session whose selection is read.
+* @returns The pending provider, else the last-used provider, else undefined.
+*/
+function projectionProvider(ctx, session) {
+	let state;
+	try {
+		state = ctx.get("sessionProjections", false)?.stateOf(session, "modelSelection");
+	} catch {
+		state = void 0;
+	}
+	if (state === void 0) return void 0;
+	if (present(state.pending?.provider)) return state.pending.provider;
+	if (present(state.lastUsed?.provider)) return state.lastUsed.provider;
+}
+/**
+* The provider one session is using, from official durable state.
+*
+* Preferred source is the session's own model selection (it covers a switch the
+* client has sent but no request has consumed yet); the logged request-context
+* and request-header routes cover profiles without the projection package and
+* replayed sessions that never emitted a selection.
+* @param ctx - context used for the optional projection read.
+* @param session - the session to resolve; undefined resolves to undefined.
+* @returns The provider, or undefined when nothing durable names one.
+*/
+function sessionProviderOf(ctx, session) {
+	if (session === void 0) return void 0;
+	const selected = projectionProvider(ctx, session);
+	if (selected !== void 0) return selected;
+	try {
+		const context = session.requestContext()?.provider;
+		if (present(context)) return context;
+		const header = session.requestHeader()?.config.provider;
+		if (present(header)) return header;
+	} catch {
+		return;
+	}
+}
+/**
+* The subagent route one exact session's spawns should use.
+* @param ctx - context used for the optional session reads.
+* @param session - the delegating session; undefined keeps official inherit.
+* @param settings - live Model Switch settings.
+* @returns The complete route, or undefined for official inherit.
+*/
+function sessionSubagentRouteOf(ctx, session, settings) {
+	return subagentRouteOf(settings, sessionProviderOf(ctx, session));
+}
+//#endregion
+export { sessionSubagentRouteOf as a, sessionProviderOf as i, groupRoute as n, resolveCapabilityRoute as r, deploymentRoute as t };

package/lib/session-title.js

@@ -1,4 +1,4 @@
-import { n as sessionProviderOf, t as resolveCapabilityRoute } from "./session-route-BCQFzqRP.js";
+import { i as sessionProviderOf, n as groupRoute, t as deploymentRoute } from "./session-route-BjNPlliu.js";
 //#region lib/types/session-title.js
 /**
 * Model Switch-owned session-naming row.
@@ -10,16 +10,32 @@ import { n as sessionProviderOf, t as resolveCapabilityRoute } from "./session-r
 * saved group is named through that group's pair while every other session keeps
 * following its own model.
 *
-* The call itself stays inside the official implementation: the exported
-* `generateSessionTitleWithLlm` receives the session-resolved config and records
-* exactly that route in `session/title-llm-request`, so the durable record and
-* the actual request can never disagree. Nothing is remounted when settings
-* change — the route is read through on every naming request — so a settings
-* save can neither interrupt an in-flight naming request nor leave the profile
-* without a registered provider.
+* The call itself stays inside the official implementation: the auxiliary-LLM
+* package records exactly the route that was called in `session/title-llm-request`,
+* so the durable record and the actual request can never disagree. Nothing is
+* remounted when settings change — the route is read through on every naming
+* request — so a settings save can neither interrupt an in-flight naming request
+* nor leave the profile without a registered provider.
 *
-* `cordis.patch.yml` disables the official row (the seam allows one registered
-* provider per context), and this row mirrors the cadence the disabled row
+* Two official auxiliary-LLM lines are supported, selected at runtime from the
+* module surface, because the 0.2.1 release replaced the shared title call:
+* - Up to DSH 0.2.0 (`generateSessionTitleWithLlm`): the module owns the system
+*   prompt, input framing, and output validation; the shared policy carries the
+*   title-length targets.
+* - DSH 0.2.1+ (`executeSessionTitleLlm`): the provider owns the system prompt,
+*   the input, the reasoning-effort selection, and the output interpretation;
+*   the shared policy carries execution controls only. This row mirrors the
+*   official provider's wording and interpretation so a configured route keeps
+*   the official behavior.
+*
+* A naming request that fails is retried once with a widened output budget
+* (max-token failures only) and then falls through the remaining route
+* candidates — the session group's pair, the deployment-wide pair, the row's own
+* pair, then the session's logged route — so one unavailable model or provider
+* cannot leave the session on its deterministic fallback title forever.
+*
+* `cordis.patch.yml` disables the official rows (the seam allows one registered
+* provider per context), and this row mirrors the cadence a disabled row
 * declared, so a profile that restated the row as all-prompts keeps its cadence.
 *
 * @module dsh-model-switch/session-title
@@ -54,6 +70,43 @@ const TITLE_CADENCES = Object.freeze([Object.freeze({
 	automatic: "all-prompts",
 	firstPromptOnly: false
 })]);
+/** Execution controls both official auxiliary-LLM lines validate; defaults mirror the shipped official rows. */
+const EXECUTION_DEFAULTS = Object.freeze({
+	maxInputBytes: 4096,
+	maxOutputTokens: 64,
+	timeoutMs: 6e4
+});
+/** Provider-owned title-length targets: required by the pre-0.2.1 line and moved into providers by 0.2.1. */
+const TARGET_DEFAULTS = Object.freeze({
+	targetWords: 5,
+	targetCjkCharacters: 10
+});
+/** Execution keys accepted by both lines; provider-owned keys are excluded on purpose. */
+const EXECUTION_KEYS = Object.freeze([
+	"maxInputBytes",
+	"maxOutputTokens",
+	"timeoutMs",
+	"provider",
+	"model"
+]);
+/**
+* Read one call entry point without assuming it exists.
+*
+* The module namespace of a host line that does not export the name can throw on
+* access (mocked namespaces do), so a missing entry point reads as undefined
+* instead of failing the row.
+* @param module - the loaded auxiliary-LLM package.
+* @param key - the call entry point to read.
+* @returns The callable, or undefined when this line does not expose it.
+*/
+function titleCallOf(module, key) {
+	try {
+		const value = module[key];
+		return typeof value === "function" ? value : void 0;
+	} catch {
+		return;
+	}
+}
 /**
 * The cadence one official package name declares.
 * @param pkg - the disabled row's package name.
@@ -128,42 +181,341 @@ function forwardedConfig(entry) {
 */
 function officialTitlePackage(entry) {
 	const pkg = entry.options?.name;
-	return typeof pkg === "string" && pkg.trim() !== "" ? pkg : void 0;
+	if (typeof pkg !== "string" || pkg.trim() === "") return void 0;
+	return pkg;
+}
+/** A positive integer, or undefined for anything else (blank, fractional, negative, non-number). */
+function positiveInteger(value) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) return void 0;
+	return value;
 }
 /**
-* Read live Model Switch settings without requiring the host row.
+* Split one untrusted stored policy into the halves both official lines accept.
 *
-* The host is read structurally instead of injected so this row keeps mirroring
-* the official naming behavior when the `model-switch` row is disabled: an
-* unreachable host resolves to the row's own policy rather than to a pinned
-* route.
-* @param ctx - this row's context.
-* @returns The settings, or undefined when the host is unavailable.
+* Execution controls pass through untouched (an invalid value still fails the
+* official validator). Absent execution fields fall back to the shipped
+* official defaults, because a profile that mounts no official row has no
+* policy to forward and this row must still run. Title-length targets are read
+* here for the system instruction: the pre-0.2.1 line wants them in its shared
+* config, while 0.2.1 moved them into each provider.
+* @param forwarded - the disabled official row's stored config.
+* @returns The execution subset and the title-length targets.
 */
-function currentSettings(ctx) {
-	try {
-		return ctx.get("modelSwitch", false)?.currentSettings();
-	} catch {
-		return;
+function splitTitlePolicy(forwarded) {
+	const execution = {};
+	for (const key of EXECUTION_KEYS) {
+		const value = forwarded[key];
+		if (value !== void 0) execution[key] = value;
 	}
+	for (const [key, fallback] of Object.entries(EXECUTION_DEFAULTS)) if (execution[key] === void 0) execution[key] = fallback;
+	return {
+		execution,
+		targets: {
+			targetWords: positiveInteger(forwarded.targetWords) ?? TARGET_DEFAULTS.targetWords,
+			targetCjkCharacters: positiveInteger(forwarded.targetCjkCharacters) ?? TARGET_DEFAULTS.targetCjkCharacters
+		}
+	};
+}
+/**
+* Detect the 0.2.1+ auxiliary-LLM line.
+* @param module - the loaded auxiliary-LLM package.
+* @returns Whether the module exposes the provider-prepared call.
+*/
+function isModernTitleModule(module) {
+	return titleCallOf(module, "executeSessionTitleLlm") !== void 0;
+}
+/**
+* Validate the stored policy through the official validator of the installed line.
+* @param module - the loaded auxiliary-LLM package.
+* @param forwarded - the disabled official row's stored config.
+* @returns The validated execution config and title-length targets.
+* @throws when the official validator rejects the stored policy.
+*/
+function resolveNamingPolicy(module, forwarded) {
+	const split = splitTitlePolicy(forwarded);
+	const resolve = module.resolveSessionTitleLlmConfig;
+	if (isModernTitleModule(module)) return {
+		config: resolve(split.execution),
+		targets: split.targets
+	};
+	const config = resolve({
+		...split.execution,
+		...split.targets
+	});
+	return {
+		config,
+		targets: {
+			targetWords: config.targetWords ?? split.targets.targetWords,
+			targetCjkCharacters: config.targetCjkCharacters ?? split.targets.targetCjkCharacters
+		}
+	};
+}
+/**
+* Candidate routes for one naming request, most specific first and deduplicated.
+*
+* The stored session group's pair wins, then the deployment-wide pair, then the
+* row's own configured pair, then the session's logged route. The list is also
+* the fallback order: a failing candidate falls through to the next one.
+* @param settings - live Model Switch settings; undefined skips the stored pairs.
+* @param provider - the delegating session's provider, when one is observable.
+* @param policy - the validated row policy (its own pair is the third candidate).
+* @param requestRoute - the session's logged main-request route, when one exists.
+* @returns The ordered, deduplicated candidates; empty when only the row policy applies.
+*/
+function titleRouteCandidates(settings, provider, policy, requestRoute) {
+	const candidates = [];
+	const push = (route) => {
+		if (route === void 0) return;
+		if (candidates.some((candidate) => candidate.provider === route.provider && candidate.model === route.model)) return;
+		candidates.push(route);
+	};
+	push(groupRoute(settings, provider, "title"));
+	push(deploymentRoute(settings, "title"));
+	if (policy.provider !== void 0 && policy.model !== void 0) push({
+		provider: policy.provider,
+		model: policy.model
+	});
+	push(requestRoute);
+	return candidates;
+}
+/**
+* Whether a failure may be retried on another candidate.
+* A superseded or disposed request keeps no budget, and a deadline that fired is
+* the caller's bound, not the route's fault: both end the attempt loop.
+* @param error - the failure thrown by the auxiliary call.
+* @param request - the service-owned request whose signal bounds the work.
+* @returns Whether another candidate may be tried.
+*/
+function shouldTryNextCandidate(error, request) {
+	if (request.signal.aborted) return false;
+	return error?.code !== "SESSION_TITLE_TIMEOUT";
+}
+/**
+* Whether the failure is the model filling its output budget before finishing.
+* Official lines report this as `title output reached maxOutputTokens`; a widened
+* budget is the only retry that can succeed for it.
+* @param error - the failure thrown by the auxiliary call.
+* @returns Whether one widened-budget retry is worth trying.
+*/
+function isMaxTokensFailure(error) {
+	if (!(error instanceof Error)) return false;
+	return /maxoutputtokens|max[-_ ]tokens/iu.test(error.message);
+}
+/**
+* A widened output budget for the same route.
+* @param maxOutputTokens - the policy's configured budget.
+* @returns Four times the budget, capped at 4096 tokens.
+*/
+function widerTitleBudget(maxOutputTokens) {
+	return Math.min(maxOutputTokens * 4, 4096);
+}
+/** Asterisk emphasis wrapping a whole line, such as `**Title**`. */
+const EMPHASIS_WRAPPER = /^(?<marker>\*{1,3})(?<inner>\S(?:.*\S)?)\k<marker>$/u;
+/** OSC control sequences, such as a title hyperlink. */
+const OSC_SEQUENCE = /(?:\u001B\]|\u009D)(?:(?!\u0007|\u001B\\)[\s\S])*(?:\u0007|\u001B\\|$)/gu;
+/** Control-sequence-introducer escapes such as SGR color codes. */
+const CSI_SEQUENCE = /(?:\u001B\[|\u009B)[0-?]*[ -/]*[@-~]/gu;
+/** Remaining two-byte ESC control sequences. */
+const ESC_SEQUENCE = /\u001B[@-_]/gu;
+/** Non-whitespace C0/C1 control characters. */
+const CONTROL_CHARACTER = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/gu;
+/** Directional and invisible controls that can make a displayed title deceptive. */
+const DIRECTIONAL_CONTROL = /[\u200B\u200E\u200F\u202A-\u202E\u2060-\u2064\u2066-\u206F\uFEFF]/gu;
+/**
+* Normalize one accepted title exactly like the official service.
+* @param input - untrusted title text.
+* @returns A terminal-safe, whitespace-normalized one-line title, possibly empty.
+*/
+function normalizeTitleText(input) {
+	return input.replace(OSC_SEQUENCE, "").replace(CSI_SEQUENCE, "").replace(ESC_SEQUENCE, "").replace(CONTROL_CHARACTER, "").replace(DIRECTIONAL_CONTROL, "").replace(/\s+/gu, " ").trim();
+}
+/**
+* Take the title from model output: the first non-empty line, without asterisk
+* emphasis wrapping that whole line. Models that disregard the one-line
+* instruction put the title first and commentary after it.
+* @param text - joined text blocks of the auxiliary response.
+* @returns The candidate title line.
+*/
+function titleFromOutput(text) {
+	const line = text.split(/\r?\n/u).map((item) => item.trim()).find((item) => item.length > 0) ?? "";
+	const groups = EMPHASIS_WRAPPER.exec(line)?.groups;
+	const marker = groups?.["marker"];
+	const inner = groups?.["inner"];
+	return marker === void 0 || inner === void 0 || inner.includes(marker) ? line : inner;
+}
+/**
+* Interpret one assembled 0.2.1+ response as a title.
+* Rejects terminal tool-call and max-token outcomes exactly like the official
+* provider, so the row keeps the official acceptance rules.
+* @param response - the assembled auxiliary response.
+* @returns A non-empty normalized title.
+* @throws when the finish reason, a tool-call block, or empty text makes the response unusable.
+*/
+function titleFromResponse(response) {
+	switch (response.finish.kind) {
+		case "stop": break;
+		case "tool-calls": throw new Error("session-title-llm: title output must contain text only");
+		case "max-tokens": throw new Error("session-title-llm: title output reached maxOutputTokens");
+		default: throw new Error(`session-title-llm: unsupported finish reason "${String(response.finish.kind)}"`);
+	}
+	if (response.blocks.some((block) => block.type === "tool-call")) throw new Error("session-title-llm: title output must contain text only");
+	const title = normalizeTitleText(titleFromOutput(response.blocks.filter((block) => block.type === "text").map((block) => block.text ?? "").join(" ")));
+	if (title.length === 0) throw new Error("session-title-llm: title model produced no text");
+	return title;
+}
+/**
+* Select the route's least supported reasoning effort for a title call, as the
+* official 0.2.1 provider does: naming is a short auxiliary task, and a full
+* reasoning budget can consume the whole output allowance.
+* @param model - the prepared model metadata.
+* @returns The first declared effort id, or undefined when the model has none.
+*/
+function selectTitleReasoningEffort(model) {
+	return model.reasoning?.efforts?.[0]?.id;
+}
+/**
+* The official 0.2.1+ system instruction, including the optional current-title anchor.
+* @param targets - title-length targets.
+* @param hasCurrentTitle - whether the request is anchored to an existing provider title.
+* @returns The system prompt text.
+*/
+function titleSystemPrompt(targets, hasCurrentTitle) {
+	return [
+		"Create a concise title for an AI coding-assistant session from the supplied human messages.",
+		"Return only the title on one line, **in plain text of natural language**, with no quotes, prefix, explanation, Markdown, XML, or terminal control codes. No code is allowed.",
+		"Use the language of the messages.",
+		`Aim for about ${targets.targetWords} words in non-CJK languages or ${targets.targetCjkCharacters} CJK characters.`,
+		"If the messages give little to name, still return a short best-effort title, such as Greeting, instead of explaining.",
+		...hasCurrentTitle ? [
+			"An existing title is supplied as currentTitle. If it still accurately describes the main topic or task, return it exactly unchanged.",
+			"Follow-up questions, additional details within the same topic, acknowledgements such as \"thanks\", and requests to continue do not by themselves justify a title change.",
+			"Do not reword, polish, shorten, or replace synonyms in an adequate title. Keeping its exact wording takes priority over the target length.",
+			"Change the title only when the messages materially change or expand the main topic or task so that the existing title is no longer accurate."
+		] : []
+	].join("\n");
+}
+/**
+* Frame the exact messages as JSON so user text cannot break structural delimiters.
+* @param messages - the selected human messages.
+* @param currentTitle - the accepted provider title to anchor on, when there is one.
+* @returns The framed user input.
+*/
+function frameTitleInput(messages, currentTitle) {
+	if (currentTitle === void 0) return `Generate the session title from this JSON array of human messages:\n${JSON.stringify(messages)}`;
+	return `Update the session title from this JSON object:\n${JSON.stringify({
+		currentTitle,
+		messages
+	})}`;
+}
+/**
+* The accepted provider title of one request, when the service supplied one.
+* Only a provider-sourced title anchors an update; a fallback title does not.
+* @param request - the service-owned naming request.
+* @returns The current title, or undefined when there is nothing to anchor on.
+*/
+function currentProviderTitle(request) {
+	const current = request.currentTitle;
+	if (current === void 0 || current.source?.kind !== "provider" || typeof current.title !== "string") return void 0;
+	return current.title;
+}
+/**
+* Run one candidate through the auxiliary-LLM line the profile installed.
+* @param ctx - this row's context, exposing `llm`.
+* @param module - the loaded auxiliary-LLM package.
+* @param plan - the profile's naming policy and cadence.
+* @param request - service-owned session, message revision, and cancellation.
+* @param attempt - one candidate route with its composed config.
+* @returns The official provider result.
+*/
+async function runTitleCall(ctx, module, plan, request, attempt) {
+	const messages = selectTitleMessages(request.messages, plan.cadence.firstPromptOnly);
+	const execute = titleCallOf(module, "executeSessionTitleLlm");
+	if (execute !== void 0) {
+		const anchor = plan.cadence.firstPromptOnly ? void 0 : currentProviderTitle(request);
+		const prepared = {
+			system: titleSystemPrompt(plan.targets, anchor !== void 0),
+			input: frameTitleInput(messages, anchor),
+			messageSeqs: messages.map((message) => message.seq),
+			selectReasoningEffort: selectTitleReasoningEffort
+		};
+		const response = await execute(ctx, attempt.config, request, plan.cadence.id, prepared);
+		return {
+			title: titleFromResponse(response),
+			messageSeqs: prepared.messageSeqs,
+			model: response.model
+		};
+	}
+	const legacy = titleCallOf(module, "generateSessionTitleWithLlm");
+	if (legacy === void 0) throw new Error(`model-switch: ${TITLE_LLM_PACKAGE} exposes no title call this row understands`);
+	return legacy(ctx, {
+		...plan.targets,
+		...attempt.config
+	}, request, messages, plan.cadence.id);
 }
 /**
 * Execute one naming request through the official implementation.
 *
 * The route is resolved from the session being titled — its provider selects the
-* saved group, and the flat settings pair is the deployment default — and is
-* handed to `generateSessionTitleWithLlm`, which frames the request, records the
-* exact route in `session/title-llm-request`, and validates the result.
+* saved group, the flat settings pair is the deployment default — and every
+* candidate is tried in order until one succeeds. A max-token failure first gets
+* one widened-budget retry on the same route; every other failure moves on.
 * @param ctx - this row's context, exposing `llm`.
 * @param module - the loaded auxiliary-LLM module.
 * @param plan - the profile's fixed naming policy.
 * @param request - service-owned session, message revision, and cancellation.
 * @returns The official provider result.
+* @throws The last candidate failure when every candidate fails.
 */
 async function generateTitle(ctx, module, plan, request) {
-	const provider = sessionProviderOf(ctx, request.session);
-	const route = resolveCapabilityRoute(currentSettings(ctx), provider, "title");
-	return module.generateSessionTitleWithLlm(ctx, composeTitleRoute(plan.config, route), request, selectTitleMessages(request.messages, plan.cadence.firstPromptOnly), plan.cadence.id);
+	const candidates = titleRouteCandidates(currentSettings(ctx), sessionProviderOf(ctx, request.session), plan.config, request.route);
+	const attempts = candidates.length === 0 ? [{
+		route: void 0,
+		config: plan.config
+	}] : candidates.map((route) => ({
+		route,
+		config: composeTitleRoute(plan.config, route)
+	}));
+	let lastError;
+	for (const attempt of attempts) try {
+		return await runTitleCall(ctx, module, plan, request, attempt);
+	} catch (error) {
+		lastError = error;
+		if (!shouldTryNextCandidate(error, request)) break;
+		if (!isMaxTokensFailure(error)) continue;
+		const widened = {
+			route: attempt.route,
+			config: {
+				...attempt.config,
+				maxOutputTokens: widerTitleBudget(attempt.config.maxOutputTokens)
+			}
+		};
+		try {
+			return await runTitleCall(ctx, module, plan, request, widened);
+		} catch (retryError) {
+			lastError = retryError;
+			if (!shouldTryNextCandidate(retryError, request)) break;
+		}
+	}
+	const tried = attempts.map((attempt) => attempt.route === void 0 ? "the row policy" : `${attempt.route.provider}/${attempt.route.model}`).join(" → ");
+	if (!request.signal.aborted) ctx.logger.warn(`model-switch: session title generation failed on every candidate (${tried}): ${String(lastError)}`);
+	throw lastError;
+}
+/**
+* Read live Model Switch settings without requiring the host row.
+*
+* The host is read structurally instead of injected so this row keeps mirroring
+* the official naming behavior when the `model-switch` row is disabled: an
+* unreachable host resolves to the row's own policy rather than to a pinned
+* route.
+* @param ctx - this row's context.
+* @returns The settings, or undefined when the host is unavailable.
+*/
+function currentSettings(ctx) {
+	try {
+		return ctx.get("modelSwitch", false)?.currentSettings();
+	} catch {
+		return;
+	}
 }
 /**
 * Mount the Model Switch session-naming row for this profile.
@@ -180,7 +532,7 @@ async function apply(ctx) {
 	const cadence = titleCadence(entry === void 0 ? void 0 : officialTitlePackage(entry)) ?? TITLE_CADENCES[0];
 	if (cadence === void 0) return;
 	if (entry === void 0) ctx.logger.info("model-switch: no instantiated official session-title row to mirror; naming uses the first-prompt cadence");
-	/** The displaced row's naming policy, or the official defaults when it is absent. */
+	/** The displaced row's naming policy, or the shipped defaults when it is absent. */
 	const forwarded = entry === void 0 ? {} : forwardedConfig(entry);
 	let module;
 	try {
@@ -190,9 +542,9 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
-	let config;
+	let policy;
 	try {
-		config = module.resolveSessionTitleLlmConfig(forwarded);
+		policy = resolveNamingPolicy(module, forwarded);
 	} catch (cause) {
 		ctx.logger.error("model-switch: the official session-title row has no valid naming policy; naming keeps the deterministic fallback");
 		ctx.logger.error(cause);
@@ -200,7 +552,8 @@ async function apply(ctx) {
 	}
 	const plan = {
 		cadence,
-		config
+		config: policy.config,
+		targets: policy.targets
 	};
 	try {
 		ctx.sessionTitle.register({
@@ -214,4 +567,4 @@ async function apply(ctx) {
 	}
 }
 //#endregion
-export { TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, inject, name, officialTitleEntry, officialTitlePackage, selectTitleMessages, titleCadence };
+export { TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, frameTitleInput, inject, isMaxTokensFailure, isModernTitleModule, name, normalizeTitleText, officialTitleEntry, officialTitlePackage, resolveNamingPolicy, selectTitleMessages, selectTitleReasoningEffort, shouldTryNextCandidate, splitTitlePolicy, titleCadence, titleFromOutput, titleFromResponse, titleRouteCandidates, titleSystemPrompt, widerTitleBudget };

package/lib/subagent-runtime.js

@@ -1,4 +1,4 @@
-import { r as sessionSubagentRouteOf } from "./session-route-BCQFzqRP.js";
+import { a as sessionSubagentRouteOf } from "./session-route-BjNPlliu.js";
 import { ReasoningEffortId } from "@deepseek-ai/dsh-llm";
 import OfficialSubagentRuntime from "@deepseek-ai/dsh-subagent";
 //#region lib/types/subagent-runtime.js
@@ -144,9 +144,32 @@ async function mountWithStartupFallback(candidate, fallback) {
 		startupFailure(error, await ledger.disposeAll());
 	}
 }
+/**
+* Operator-facing notice for a Host whose Subagent runtime cannot be routed.
+*
+* DSH 0.2.1 replaced `start()`/`startContinuable()` with the activation API, so
+* this adapter's override point is gone; the row then mounts the untouched
+* official runtime instead of guessing a new seam.
+* @param error - the typed startup incompatibility that rejected the candidate.
+* @returns The notice logged once at startup.
+*/
+function routedRuntimeUnavailableNotice(error) {
+	return `model-switch: the routed Subagent runtime is unavailable on this DSH Host (${error.message}); delegation follows the official route instead`;
+}
+/** Log one notice without letting a missing logger service fail the startup. */
+function reportNotice(ctx, message) {
+	try {
+		ctx.logger.warn(message);
+	} catch {}
+}
 async function mountProfileRuntime(ctx) {
 	return (await mountWithStartupFallback(async (track) => {
-		assertOfficialRuntimeSurface();
+		try {
+			assertOfficialRuntimeSurface();
+		} catch (error) {
+			if (error instanceof StartupIncompatibilityError) reportNotice(ctx, routedRuntimeUnavailableNotice(error));
+			throw error;
+		}
 		assertRoutingSurface(ctx);
 		const candidate = ctx.plugin(ModelSwitchSubagentRuntime);
 		track(() => candidate.dispose());
@@ -186,4 +209,4 @@ var ModelSwitchSubagentRuntime = class extends OfficialSubagentRuntime {
 	}
 };
 //#endregion
-export { ModelSwitchSubagentRuntime, StartupIncompatibilityError, profileSubagentRuntime as default, profileSubagentRuntime, mountWithStartupFallback, routeSubagentRequest };
+export { ModelSwitchSubagentRuntime, StartupIncompatibilityError, profileSubagentRuntime as default, profileSubagentRuntime, mountWithStartupFallback, routeSubagentRequest, routedRuntimeUnavailableNotice };

package/lib/types/session-title.d.ts

@@ -8,25 +8,40 @@
  * saved group is named through that group's pair while every other session keeps
  * following its own model.
  *
- * The call itself stays inside the official implementation: the exported
- * `generateSessionTitleWithLlm` receives the session-resolved config and records
- * exactly that route in `session/title-llm-request`, so the durable record and
- * the actual request can never disagree. Nothing is remounted when settings
- * change — the route is read through on every naming request — so a settings
- * save can neither interrupt an in-flight naming request nor leave the profile
- * without a registered provider.
+ * The call itself stays inside the official implementation: the auxiliary-LLM
+ * package records exactly the route that was called in `session/title-llm-request`,
+ * so the durable record and the actual request can never disagree. Nothing is
+ * remounted when settings change — the route is read through on every naming
+ * request — so a settings save can neither interrupt an in-flight naming request
+ * nor leave the profile without a registered provider.
  *
- * `cordis.patch.yml` disables the official row (the seam allows one registered
- * provider per context), and this row mirrors the cadence the disabled row
+ * Two official auxiliary-LLM lines are supported, selected at runtime from the
+ * module surface, because the 0.2.1 release replaced the shared title call:
+ * - Up to DSH 0.2.0 (`generateSessionTitleWithLlm`): the module owns the system
+ *   prompt, input framing, and output validation; the shared policy carries the
+ *   title-length targets.
+ * - DSH 0.2.1+ (`executeSessionTitleLlm`): the provider owns the system prompt,
+ *   the input, the reasoning-effort selection, and the output interpretation;
+ *   the shared policy carries execution controls only. This row mirrors the
+ *   official provider's wording and interpretation so a configured route keeps
+ *   the official behavior.
+ *
+ * A naming request that fails is retried once with a widened output budget
+ * (max-token failures only) and then falls through the remaining route
+ * candidates — the session group's pair, the deployment-wide pair, the row's own
+ * pair, then the session's logged route — so one unavailable model or provider
+ * cannot leave the session on its deterministic fallback title forever.
+ *
+ * `cordis.patch.yml` disables the official rows (the seam allows one registered
+ * provider per context), and this row mirrors the cadence a disabled row
  * declared, so a profile that restated the row as all-prompts keeps its cadence.
  *
  * @module dsh-model-switch/session-title
  */
 import type { Context } from '@deepseek-ai/cordis';
 import type { Entry, Loader } from '@deepseek-ai/cordis-plugin-loader';
-import type { SessionTitleAutomaticMode, SessionTitleProviderId, SessionTitleUserMessage } from '@deepseek-ai/dsh-session-title';
-import type { ResolvedSessionTitleLlmConfig, SessionTitleLlmConfig } from '@deepseek-ai/dsh-session-title-llm';
-import { type CapabilityRoute } from './session-route.js';
+import type { SessionTitleAutomaticMode, SessionTitleProviderId, SessionTitleProviderRequest, SessionTitleUserMessage } from '@deepseek-ai/dsh-session-title';
+import { type CapabilityRoute, type RouteBearingSettings } from './session-route.js';
 /** Cordis plugin identity; matches the cordis.patch.yml insert row id. */
 export declare const name = "model-switch-session-title";
 /** The loader names the disabled row, and the seam services the call needs are awaited before the first naming request. */
@@ -44,6 +59,57 @@ export interface TitleCadence {
 }
 /** Both official cadence packages, in the order a profile may declare them. */
 export declare const TITLE_CADENCES: readonly TitleCadence[];
+/** Title-length targets that shape the system instruction. */
+export interface TitleLengthTargets {
+    readonly targetWords: number;
+    readonly targetCjkCharacters: number;
+}
+/** Route-bearing execution policy shared by both official auxiliary-LLM lines. */
+export interface TitleLlmPolicy {
+    readonly maxInputBytes: number;
+    readonly maxOutputTokens: number;
+    readonly timeoutMs: number;
+    readonly provider?: string;
+    readonly model?: string;
+}
+/** The model metadata `executeSessionTitleLlm` hands its reasoning selector. */
+export interface TitleModelMetadata {
+    readonly reasoning?: {
+        readonly efforts?: readonly {
+            readonly id: string;
+        }[];
+    };
+}
+/** Provider-owned preparation for one 0.2.1+ auxiliary title request. */
+export interface PreparedTitleCall {
+    readonly system: string;
+    readonly input: string;
+    readonly messageSeqs: readonly SessionTitleUserMessage['seq'][];
+    readonly selectReasoningEffort: (model: TitleModelMetadata) => string | undefined;
+}
+/** One content block of the assembled 0.2.1+ auxiliary response. */
+export interface TitleResponseBlock {
+    readonly type: string;
+    readonly text?: string;
+}
+/** The assembled 0.2.1+ auxiliary response this row interprets. */
+export interface TitleLlmResponse {
+    readonly blocks: readonly TitleResponseBlock[];
+    readonly finish: {
+        readonly kind: string;
+    };
+    readonly model: {
+        readonly provider: string;
+        readonly model: string;
+    };
+}
+/** The auxiliary-LLM module surface; the call entry point differs per DSH line. */
+type TitleLlmModule = typeof import('@deepseek-ai/dsh-session-title-llm');
+/** The untrusted policy split both lines consume. */
+export interface SplitTitlePolicy {
+    readonly execution: Record<string, unknown>;
+    readonly targets: TitleLengthTargets;
+}
 /**
  * The cadence one official package name declares.
  * @param pkg - the disabled row's package name.
@@ -61,7 +127,7 @@ export declare function titleCadence(pkg: string | undefined): TitleCadence | un
  * @param route - session-resolved naming route, or undefined for the row's own policy.
  * @returns A detached config for one naming request.
  */
-export declare function composeTitleRoute(config: ResolvedSessionTitleLlmConfig, route: CapabilityRoute | undefined): ResolvedSessionTitleLlmConfig;
+export declare function composeTitleRoute(config: TitleLlmPolicy, route: CapabilityRoute | undefined): TitleLlmPolicy;
 /**
  * Frame the exact human messages one naming revision represents.
  * @param messages - every eligible human message of the revision.
@@ -84,13 +150,126 @@ export declare function officialTitleEntry(loader: Loader | undefined): Entry |
  * result is untrusted: the profile may be hand-edited, so the official policy
  * validator runs over it before any naming request is served.
  */
-export declare function forwardedConfig(entry: Entry): Partial<SessionTitleLlmConfig>;
+export declare function forwardedConfig(entry: Entry): Record<string, unknown>;
 /**
  * The official package name this row mounts (either cadence).
  * @param entry - the official session-title provider entry.
  * @returns The package name, or undefined when the row declares none.
  */
 export declare function officialTitlePackage(entry: Entry): string | undefined;
+/**
+ * Split one untrusted stored policy into the halves both official lines accept.
+ *
+ * Execution controls pass through untouched (an invalid value still fails the
+ * official validator). Absent execution fields fall back to the shipped
+ * official defaults, because a profile that mounts no official row has no
+ * policy to forward and this row must still run. Title-length targets are read
+ * here for the system instruction: the pre-0.2.1 line wants them in its shared
+ * config, while 0.2.1 moved them into each provider.
+ * @param forwarded - the disabled official row's stored config.
+ * @returns The execution subset and the title-length targets.
+ */
+export declare function splitTitlePolicy(forwarded: Record<string, unknown>): SplitTitlePolicy;
+/**
+ * Detect the 0.2.1+ auxiliary-LLM line.
+ * @param module - the loaded auxiliary-LLM package.
+ * @returns Whether the module exposes the provider-prepared call.
+ */
+export declare function isModernTitleModule(module: TitleLlmModule): boolean;
+/** One validated naming policy: the execution config plus the targets the system instruction needs. */
+export interface ResolvedNamingPolicy {
+    readonly config: TitleLlmPolicy;
+    readonly targets: TitleLengthTargets;
+}
+/**
+ * Validate the stored policy through the official validator of the installed line.
+ * @param module - the loaded auxiliary-LLM package.
+ * @param forwarded - the disabled official row's stored config.
+ * @returns The validated execution config and title-length targets.
+ * @throws when the official validator rejects the stored policy.
+ */
+export declare function resolveNamingPolicy(module: TitleLlmModule, forwarded: Record<string, unknown>): ResolvedNamingPolicy;
+/**
+ * Candidate routes for one naming request, most specific first and deduplicated.
+ *
+ * The stored session group's pair wins, then the deployment-wide pair, then the
+ * row's own configured pair, then the session's logged route. The list is also
+ * the fallback order: a failing candidate falls through to the next one.
+ * @param settings - live Model Switch settings; undefined skips the stored pairs.
+ * @param provider - the delegating session's provider, when one is observable.
+ * @param policy - the validated row policy (its own pair is the third candidate).
+ * @param requestRoute - the session's logged main-request route, when one exists.
+ * @returns The ordered, deduplicated candidates; empty when only the row policy applies.
+ */
+export declare function titleRouteCandidates(settings: RouteBearingSettings | undefined, provider: string | undefined, policy: TitleLlmPolicy, requestRoute: CapabilityRoute | undefined): readonly CapabilityRoute[];
+/**
+ * Whether a failure may be retried on another candidate.
+ * A superseded or disposed request keeps no budget, and a deadline that fired is
+ * the caller's bound, not the route's fault: both end the attempt loop.
+ * @param error - the failure thrown by the auxiliary call.
+ * @param request - the service-owned request whose signal bounds the work.
+ * @returns Whether another candidate may be tried.
+ */
+export declare function shouldTryNextCandidate(error: unknown, request: SessionTitleProviderRequest): boolean;
+/**
+ * Whether the failure is the model filling its output budget before finishing.
+ * Official lines report this as `title output reached maxOutputTokens`; a widened
+ * budget is the only retry that can succeed for it.
+ * @param error - the failure thrown by the auxiliary call.
+ * @returns Whether one widened-budget retry is worth trying.
+ */
+export declare function isMaxTokensFailure(error: unknown): boolean;
+/**
+ * A widened output budget for the same route.
+ * @param maxOutputTokens - the policy's configured budget.
+ * @returns Four times the budget, capped at 4096 tokens.
+ */
+export declare function widerTitleBudget(maxOutputTokens: number): number;
+/**
+ * Normalize one accepted title exactly like the official service.
+ * @param input - untrusted title text.
+ * @returns A terminal-safe, whitespace-normalized one-line title, possibly empty.
+ */
+export declare function normalizeTitleText(input: string): string;
+/**
+ * Take the title from model output: the first non-empty line, without asterisk
+ * emphasis wrapping that whole line. Models that disregard the one-line
+ * instruction put the title first and commentary after it.
+ * @param text - joined text blocks of the auxiliary response.
+ * @returns The candidate title line.
+ */
+export declare function titleFromOutput(text: string): string;
+/**
+ * Interpret one assembled 0.2.1+ response as a title.
+ * Rejects terminal tool-call and max-token outcomes exactly like the official
+ * provider, so the row keeps the official acceptance rules.
+ * @param response - the assembled auxiliary response.
+ * @returns A non-empty normalized title.
+ * @throws when the finish reason, a tool-call block, or empty text makes the response unusable.
+ */
+export declare function titleFromResponse(response: TitleLlmResponse): string;
+/**
+ * Select the route's least supported reasoning effort for a title call, as the
+ * official 0.2.1 provider does: naming is a short auxiliary task, and a full
+ * reasoning budget can consume the whole output allowance.
+ * @param model - the prepared model metadata.
+ * @returns The first declared effort id, or undefined when the model has none.
+ */
+export declare function selectTitleReasoningEffort(model: TitleModelMetadata): string | undefined;
+/**
+ * The official 0.2.1+ system instruction, including the optional current-title anchor.
+ * @param targets - title-length targets.
+ * @param hasCurrentTitle - whether the request is anchored to an existing provider title.
+ * @returns The system prompt text.
+ */
+export declare function titleSystemPrompt(targets: TitleLengthTargets, hasCurrentTitle: boolean): string;
+/**
+ * Frame the exact messages as JSON so user text cannot break structural delimiters.
+ * @param messages - the selected human messages.
+ * @param currentTitle - the accepted provider title to anchor on, when there is one.
+ * @returns The framed user input.
+ */
+export declare function frameTitleInput(messages: readonly SessionTitleUserMessage[], currentTitle: string | undefined): string;
 /**
  * Mount the Model Switch session-naming row for this profile.
  *
@@ -102,3 +281,4 @@ export declare function officialTitlePackage(entry: Entry): string | undefined;
  * @param ctx - this row's context.
  */
 export declare function apply(ctx: Context): Promise<void>;
+export {};

package/lib/types/subagent-runtime.d.ts

@@ -48,6 +48,16 @@ export declare function routeSubagentRequest<T extends RoutableSubagentRequest>(
  * @throws the fallback startup error when fallback startup fails.
  */
 export declare function mountWithStartupFallback<T>(candidate: (track: StartupCleanupTracker) => Promise<T>, fallback: (track: StartupCleanupTracker) => Promise<T>): Promise<MountedStartup<T>>;
+/**
+ * Operator-facing notice for a Host whose Subagent runtime cannot be routed.
+ *
+ * DSH 0.2.1 replaced `start()`/`startContinuable()` with the activation API, so
+ * this adapter's override point is gone; the row then mounts the untouched
+ * official runtime instead of guessing a new seam.
+ * @param error - the typed startup incompatibility that rejected the candidate.
+ * @returns The notice logged once at startup.
+ */
+export declare function routedRuntimeUnavailableNotice(error: StartupIncompatibilityError): string;
 /** Profile replacement that selects the routed runtime or the untouched official runtime. */
 export declare const profileSubagentRuntime: ((ctx: Context) => Promise<() => Promise<void>>) & {
     inject: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.25",
+  "version": "0.4.26",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",
@@ -106,7 +106,8 @@
         "0.1.7-alpha.2": "compatible",
         "0.1.7-rc.1": "compatible",
         "0.1.7-rc.2": "compatible",
-        "0.2.0-rc.2": "compatible"
+        "0.2.0-rc.2": "compatible",
+        "0.2.1-rc.2": "compatible"
       }
     }
   },