dsh-model-switch 0.4.27 → 0.4.28

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## v0.4.28
+
+Two fixes for the same DSH `0.2.1-rc.2` line: re-enabling the plugin on 0.2.1 made **every tool call fail before its body ran**, and the Subagent routing adapter that 0.4.26 had to fail closed is adapted to the release's activation API.
+
+- **P0: every tool call failed under the Auto preset on DSH 0.2.1 (`src/auto-review.ts`).** With the plugin enabled and the approval policy on Auto, each tool call was rejected with `Auto review of tool "…" failed; its body was not executed: cannot get property "workingDirectory" without inject` — read, grep, pwsh, even exiting plan mode. Root cause: `model-switch-auto-review` called `official.apply(scope)` **directly inside its own fiber**, so every service the official gate reads had to be mirrored in this row's `inject`; 0.2.1's gate started reading `ctx.workingDirectory`, and the mirror list had gone stale. Fix: the official gate is now **mounted as a plugin** (`autoReviewGate` → `scope.plugin(...)`), so cordis resolves the official dependency list — including `workingDirectory` on 0.2.1 and its absence on 0.2.0 — and this row declares only the services its own code reads (`llm`, `modelSwitch`). The session-correlation listener is registered only after the gate's fiber reports that its `apply` actually ran, so it still lands ahead of the gate's own prepended listener; an already-active official row still fails loudly (single `registerAuto`), and a gate still waiting for host services is reported instead of silently mis-ordering.
+- **Subagent routing adapted to the 0.2.1 activation API (`src/subagent-runtime.ts`).** 0.2.1 replaced `start()` / `startContinuable()` with `startActivation(spec)`. The routed runtime now recognizes **either published line** (`subagentSurfaceOf`), keeps both legacy overrides unchanged, and adds a `startActivation` override that rewrites `spec.request.agentOptions` through the same `provider group → flat subagent card → session model` resolver (a caller-named route still wins; a provider whose capability is not `agentOptions` is still never reinterpreted). Only a Host publishing neither surface falls back to the untouched official runtime with `routedRuntimeUnavailableNotice`, so the 0.2.1 fallback path is now unreachable in practice.
+- **Correction to the v0.4.26 entry.** That entry claimed the official auto-review `apply` "runs unchanged under this row's scoped `llm`" on 0.2.1. The live desktop showed otherwise: it ran unchanged only until the reviewer read a service the mirrored `inject` did not carry. 0.4.26 and 0.4.27 therefore shipped that failure on 0.2.1; 0.4.28 is the first release where the gate actually runs there.
+- **Verification.**
+  - `pnpm run check` green (52 test files / 460 tests + pack gate). New coverage: the inject trap reproduced with a real cordis `Service` (an unwrapped gate fails with the exact live message, the wrapped gate passes), the official dependency list surviving the mount, gate-failure reporting, `subagentSurfaceOf` for the activation line, the start line, and neither, activation-spec routing (session group, flat fixed pair, follow-main, explicit caller route, external provider), spec passthrough, and mounting the routed runtime on an activation-only Host.
+  - **Real published packages, `0.2.1-rc.2`** (lab CLI `node_modules`, a real `Service` registration so the trap is live, the real official gate): the pre-fix shape reproduces exactly `Auto review of tool "pwsh" failed; its body was not executed: cannot get property "workingDirectory" without inject`; the shipped shape reaches `workingDirectory.ensure` (one call), registers the Auto gate once, and never fails on inject. The real 0.2.1 `SubagentRuntime` classifies as the activation line and drops `start`/`startContinuable`; the adapter delegates to that exact method with `request.agentOptions` rewritten to the configured subagent route while `provider` / `label` / `delivery` / `signal` / `parent` identity pass through.
+  - **Real published packages, `0.2.0-rc.2`**: the row registers the Auto gate **without** a `workingDirectory` service, the gate never hits an inject failure, the runtime classifies as the `start` line, and `start()` delegation still rewrites the route and preserves parent identity.
+  - **Lab plane** (`DSH_HOME=~/.dsh-lab`, npm-installed `0.2.1-rc.2` runtime, packed `dsh-model-switch-0.4.28.tgz` installed in the `labh` profile): a headless turn ran a real tool (directory listing) with no inject failure and no `{{cwd}}` error; a second turn spawned a real subagent, and the child session's own `subagent/descriptor` records `mode: continuable`, `provider: spawn`, `agentProvider: apigoto`, `agentModel: mimo-v2.6-flash` — the fixed subagent route configured for that profile, not the session default `apigoto/deepseek-flash`. That is the end-to-end proof that the activation-line override reaches the child's route on 0.2.1.
+- **Residual (honest).** The live desktop is the only place the Auto preset gate runs end to end with a real tool body: after updating, re-enable the plugin, switch the approval policy back from full-access mode to Auto, and run one tool call. The harness above exercises the real 0.2.1 packages and the real cordis `Service` trap, but not a full session snapshot — the fake session stops the reviewer right after `workingDirectory.ensure`, by design. 0.1.7 / 0.2.0 keep the same entries, the same route precedence, and the same fail-closed behavior.
+
 ## v0.4.27
 
 A fix for a regression v0.4.26 introduced on DSH `0.2.1-rc.2`, plus the architecture change that removes its cause: the plugin no longer ships static copies of DSH's agent presets.
@@ -16,7 +30,7 @@ Two coordinated changes: automatic session naming now survives a failing title r
 - **DSH 0.2.1 naming line (`executeSessionTitleLlm`).** `0.2.1-rc.2` removed `generateSessionTitleWithLlm` / `registerSessionTitleLlmProvider` and split the shared policy: the new `executeSessionTitleLlm(ctx, config, request, id, prepared)` returns assembled blocks plus the terminal finish reason, each provider owns its system instruction, input framing, reasoning-effort selection, and output interpretation, and `targetWords` / `targetCjkCharacters` moved into the provider's own config. The row detects the installed line at runtime and mirrors the shipped 0.2.1 provider exactly: same system instruction (including the best-effort line and, for all-prompts, the current-title stability rules anchored on a provider-sourced `currentTitle`), same JSON framing, the route's least supported reasoning effort, and the same finish-reason / whole-line-emphasis / empty-output acceptance rules. `cordis.patch.yml` also disables the `optional-session-title-all-prompts` row that 0.2.1's experimental session-titles bundle inserts (unknown-row warning on profiles without it, like the optional auto-review row).
 - **DSH 0.2.1 compatibility review (0.2.0-rc.2 → 0.2.1-rc.2, public API only).**
   - **Naming:** the service keeps `register` / `ensureFallback` / the `first-prompt` gate and only adds an optional `currentTitle` to the provider request; `onMainRequest` dropped one boundary-freshness condition. The provider request shape this row returns is unchanged.
-  - **Auto review:** the official gate now resolves the reviewing agent's directory through `ctx.workingDirectory.ensure(...)` and injects `workingDirectory`; `dsh-base` 0.2.1 mounts the `working-directory` row, so the official `apply` runs unchanged under this row's scoped `llm`.
+  - **Auto review:** the official gate now resolves the reviewing agent's directory through `ctx.workingDirectory.ensure(...)` and injects `workingDirectory`; `dsh-base` 0.2.1 mounts the `working-directory` row. **[Corrected in v0.4.28]** This entry originally claimed the official `apply` "runs unchanged under this row's scoped `llm`" on 0.2.1. It did not: the row called `apply` directly and mirrored the gate's services in its own `inject`, so the new `workingDirectory` read failed for every tool call. v0.4.28 mounts the gate as a plugin instead.
   - **Compaction and presets:** `dsh-compaction-basic` and `dsh-agent-preset` are byte-identical to 0.2.0, so the wholesale preset copies and the compaction engine need no re-sync.
   - **Unchanged surfaces this plugin calls:** `llm.stream(GenerateOptions)` (with `prepareCall` added beside it), `web.registerSearchProvider`, `tools/pre-execute` (`exec.agent` kept), session `snapshotEvents` / `requestHeader` / `requestContext` / `append`, and the composer's `conversation.input.model` seat.
   - **Subagents:** `@deepseek-ai/dsh-subagent` replaced `start()` / `startContinuable()` with `startActivation(spec)` plus a provider registry. The routed runtime therefore cannot override the new entry point; this row mounts the untouched official runtime (fail-closed) and logs one explicit notice. Recorded in `docs/seam-gap.md` for a later upstream proposal.

package/PRODUCT.md

@@ -33,4 +33,4 @@ Official `settings.section` has no icon field. The Settings nav glyph is a label
 
 ## Delivery architecture
 
-The package foundation and pure deep modules remain the policy/test surface. Runtime delivery disables the independent Subagent Loader row with its official name and inserts a uniquely identified replacement; the experimental auto-review row is disabled the same way and replaced by `dsh-model-switch/auto-review`, which runs the official gate's `apply` unchanged under a scoped `llm` shadow (one `registerAuto`, and only when the profile started with the optional auto-review bundle). Official AgentPresets stay mounted so they share the process `dsh-scope` identity. Search uses the released `ctx.web.registerSearchProvider()` seam so official tool ownership is preserved. Image uses a unique tool name and provider-owned authenticated adapters. Self-maintained Codex/Grok plugins register optional adapters through the public Model Switch service when present; standalone provider behavior is unchanged. Vision remains disabled. Replacement modules preserve the official public interfaces and fail closed when compatibility or capability validation fails.
+The package foundation and pure deep modules remain the policy/test surface. Runtime delivery disables the independent Subagent Loader row with its official name and inserts a uniquely identified replacement; the experimental auto-review row is disabled the same way and replaced by `dsh-model-switch/auto-review`, which mounts the official gate's `apply` unchanged as a plugin under a scoped `llm` shadow — the Host resolves the gate's own `inject` list (including 0.2.1's `workingDirectory`), one `registerAuto` runs, and only when the profile started with the optional auto-review bundle. Official AgentPresets stay mounted so they share the process `dsh-scope` identity. Search uses the released `ctx.web.registerSearchProvider()` seam so official tool ownership is preserved. Image uses a unique tool name and provider-owned authenticated adapters. Self-maintained Codex/Grok plugins register optional adapters through the public Model Switch service when present; standalone provider behavior is unchanged. Vision remains disabled. Replacement modules preserve the official public interfaces and fail closed when compatibility or capability validation fails.

package/README.zh.md

@@ -180,7 +180,7 @@ DeepSeek 薄适配器调用官方公开 `DeepSeekSearchProvider`，复用用户
 
 DSH Host peer 和开发依赖接受 `>=0.1.7-alpha.2`，包括 rc.1 和后续版本。开发锁文件解析到 rc.2。Cordis 接受 `>=4.0.4 <5.0.0`。
 
-已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，路由版运行时在新 Host 上不可用，本插件改为挂载未经改动的官方运行时并输出一条明确提示（记录于 `docs/seam-gap.md`）。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。0.2.1 还暴露出一处预设层面的差异（0.2.1 校验提示词变量、只有 `provider`/`model`，且把 `time-context`/`tool-schedule` 移进预设）：0.4.26 的静态预设副本因此让每一轮都报 `unknown prompt variable "{{cwd}}"`，0.4.27 删除副本改为启动期运行时桥接，并在 lab 的 0.2.1 headless 真实回合中验证通过（展开见 CHANGELOG 0.4.27）。
+已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，本插件同时识别两条已发布线，并为激活入口覆写 `spec.request.agentOptions`（显式路由仍优先、非 agentOptions 能力的外部适配器不改写），路由语义与旧线一致（0.4.28，记录于 `docs/seam-gap.md`）；0.2.1 还新增了自动审查门禁对 `ctx.workingDirectory` 的读取，旧实现因在自己的 fiber 里直调 `official.apply` 而需要手工镜像门禁的 `inject`，于是每个工具调用都被拒（`cannot get property "workingDirectory" without inject`），0.4.28 改为把官方门禁以插件方式挂载、由官方 `inject` 解析依赖，本行只声明自身需要的服务。0.4.28 的真实包证据：0.2.1 上旧形态精确复现该注入错误、新形态到达 `workingDirectory.ensure` 且成功注册门禁、激活入口的路由改写与 spec 透传通过；0.2.0 上无需 `workingDirectory` 服务即可注册门禁，`start()` 路由改写与父身份保持不变。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。0.2.1 还暴露出一处预设层面的差异（0.2.1 校验提示词变量、只有 `provider`/`model`，且把 `time-context`/`tool-schedule` 移进预设）：0.4.26 的静态预设副本因此让每一轮都报 `unknown prompt variable "{{cwd}}"`，0.4.27 删除副本改为启动期运行时桥接，并在 lab 的 0.2.1 headless 真实回合中验证通过（展开见 CHANGELOG 0.4.27）。
 
 `package.json#dsh.compatibility.dshReleases` 中的已验证版本是证据，不是允许列表。新增验证声明前要审查公开 API 变化并测试新 Host 版本。
 

package/lib/auto-review.js

@@ -32,15 +32,18 @@ import { AsyncLocalStorage } from "node:async_hooks";
 */
 /** Cordis plugin name used by loader diagnostics. */
 const name = "model-switch-auto-review";
-/** The official gate's host services plus Model Switch's settings owner. */
-const inject = [
-	"modelSwitch",
-	"approval",
-	"llm",
-	"permissionPresets",
-	"sessions",
-	"tools"
-];
+/**
+* Only the services this row's own code touches.
+*
+* The official gate used to run inside this row's fiber, so this list had to
+* mirror every service the official `apply` reads. DSH 0.2.1 added
+* `workingDirectory` to the official gate and the mirror went stale, which made
+* every tool call fail with `cannot get property "workingDirectory" without
+* inject`. The gate is now mounted as its own plugin (see {@link autoReviewGate}),
+* so cordis resolves the official dependency list — including future additions —
+* and this row declares only what it reads itself.
+*/
+const inject = ["llm", "modelSwitch"];
 /** Optional bundle whose composition opts a profile into Auto review. */
 const AUTO_REVIEW_BUNDLE = "@deepseek-ai/dsh-experimental-auto-review";
 /**
@@ -138,6 +141,35 @@ function autoReviewBundleActive(ctx) {
 	return Array.isArray(bundles) && bundles.includes(AUTO_REVIEW_BUNDLE);
 }
 /**
+* Wrap the official gate as a plugin that declares its own dependencies.
+*
+* Directly calling `official.apply(scope)` ran the gate's code on this row's
+* fiber, so every service the gate reads had to be mirrored in this row's
+* `inject`. Mounting it instead lets cordis resolve the official list, which is
+* what keeps a released Host's new dependency (0.2.1's `workingDirectory`) from
+* breaking every tool call. The hooks let the caller observe whether the gate
+* actually ran before it binds the session-correlation listener.
+*
+* @param gate - the official module (or an equivalent structural gate).
+* @param hooks - applied/failure observers; the failure is rethrown.
+* @returns A cordis plugin mounting the official gate unchanged.
+*/
+function autoReviewGate(gate, hooks = {}) {
+	return {
+		name: gate.name ?? "experimental-auto-review",
+		...gate.inject === void 0 ? {} : { inject: [...gate.inject] },
+		apply(gateCtx) {
+			try {
+				gate.apply(gateCtx);
+			} catch (error) {
+				hooks.onFailure?.(error);
+				throw error;
+			}
+			hooks.onApplied?.();
+		}
+	};
+}
+/**
 * Mount the official gate under the reviewer-route scope.
 *
 * A profile that never enabled the optional bundle keeps no Auto preset and no
@@ -159,13 +191,31 @@ async function apply(ctx) {
 	}
 	const activeSession = new AsyncLocalStorage();
 	const scope = reviewScope(ctx, activeSession);
+	let failure;
+	let applied = false;
+	const fiber = scope.plugin(autoReviewGate(official, {
+		onApplied: () => {
+			applied = true;
+		},
+		onFailure: (error) => {
+			failure = error;
+		}
+	}));
 	try {
-		official.apply(scope);
-		bindAutoReviewSessionCorrelation(scope, activeSession);
+		await fiber;
 	} catch (cause) {
+		failure ??= cause;
+	}
+	if (failure !== void 0) {
 		ctx.logger.error("model-switch: the official auto-review row is already active; the reviewer route override is unavailable");
-		ctx.logger.error(cause);
+		ctx.logger.error(failure);
+		return;
+	}
+	if (!applied) {
+		ctx.logger.info("model-switch: the official auto-review gate is waiting for its host services; the reviewer route override is not bound yet");
+		return;
 	}
+	bindAutoReviewSessionCorrelation(scope, activeSession);
 }
 //#endregion
-export { apply, autoReviewRouteOf, bindAutoReviewSessionCorrelation, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };
+export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/subagent-runtime.js

@@ -49,6 +49,30 @@ function routeSubagentRequest(request, route) {
 function assertPublicMethod(value, surface, method) {
 	if (value === null || typeof value !== "object" && typeof value !== "function" || typeof Reflect.get(value, method) !== "function") throw new StartupIncompatibilityError(surface, surface + " must expose public " + method + "()");
 }
+/**
+* Classify the runtime surface this Host publishes.
+*
+* DSH 0.2.1 replaced `start()` / `startContinuable()` with the activation API
+* (`startActivation`), so a version-agnostic adapter has to recognize both
+* lines instead of hard-coding one.
+*
+* @param value - a runtime class's prototype or a mounted runtime instance.
+* @returns `activation` (0.2.1+), `start` (0.1.7/0.2.0), or undefined when neither is published.
+*/
+function subagentSurfaceOf(value) {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return void 0;
+	if (typeof Reflect.get(value, "startActivation") === "function") return "activation";
+	const hasStart = typeof Reflect.get(value, "start") === "function";
+	const hasContinuable = typeof Reflect.get(value, "startContinuable") === "function";
+	return hasStart && hasContinuable ? "start" : void 0;
+}
+/** Read one public method, failing with the typed startup error when it is absent. */
+function publicMethod(prototype, surface, method) {
+	if (prototype === null || typeof prototype !== "object" && typeof prototype !== "function") throw new StartupIncompatibilityError(surface, surface + " must expose public " + method + "()");
+	const value = Reflect.get(prototype, method);
+	if (typeof value !== "function") throw new StartupIncompatibilityError(surface, surface + " must expose public " + method + "()");
+	return value;
+}
 function constructible(value) {
 	if (typeof value !== "function") return false;
 	try {
@@ -62,9 +86,9 @@ function constructible(value) {
 function assertOfficialRuntimeSurface() {
 	const runtime = OfficialSubagentRuntime;
 	if (!constructible(runtime)) throw new StartupIncompatibilityError("OfficialSubagentRuntime", "OfficialSubagentRuntime must be constructible");
-	const prototype = Reflect.get(runtime, "prototype");
-	assertPublicMethod(prototype, "OfficialSubagentRuntime", "start");
-	assertPublicMethod(prototype, "OfficialSubagentRuntime", "startContinuable");
+	const line = subagentSurfaceOf(Reflect.get(runtime, "prototype"));
+	if (line === void 0) throw new StartupIncompatibilityError("OfficialSubagentRuntime", "OfficialSubagentRuntime must expose public startActivation() (0.2.1+) or start()/startContinuable()");
+	return line;
 }
 function assertRoutingSurface(ctx) {
 	const modelSwitch = ctx.modelSwitch;
@@ -74,9 +98,9 @@ function routingSurface(ctx) {
 	return ctx.modelSwitch;
 }
 function assertMountedSurface(ctx) {
-	assertPublicMethod(ctx.subagents, "mounted Subagent runtime", "start");
-	assertPublicMethod(ctx.subagents, "mounted Subagent runtime", "startContinuable");
-	assertPublicMethod(ctx.subagents, "mounted Subagent runtime", "resolveMaxDepth");
+	const service = ctx.subagents;
+	assertPublicMethod(service, "mounted Subagent runtime", "resolveMaxDepth");
+	if (subagentSurfaceOf(service) === void 0) throw new StartupIncompatibilityError("mounted Subagent runtime", "mounted Subagent runtime must expose public startActivation() (0.2.1+) or start()/startContinuable()");
 }
 function once(dispose) {
 	let pending;
@@ -199,14 +223,29 @@ var ModelSwitchSubagentRuntime = class extends OfficialSubagentRuntime {
 		return routeSubagentRequest(request, sessionSubagentRouteOf(this.ctx, request.parent.session, modelSwitch.currentSettings()));
 	}
 	start(name, request) {
-		return super.start(name, this.routed(name, request));
+		return publicMethod(OfficialSubagentRuntime.prototype, "OfficialSubagentRuntime", "start").call(this, name, this.routed(name, request));
 	}
 	startContinuable(spec) {
-		return super.startContinuable({
+		return publicMethod(OfficialSubagentRuntime.prototype, "OfficialSubagentRuntime", "startContinuable").call(this, {
+			...spec,
+			request: this.routed(spec.provider, spec.request)
+		});
+	}
+	/**
+	* 0.2.1+ activation entry: delegation tools call this instead of
+	* `start()`/`startContinuable()`, and its spec carries the same
+	* `request.agentOptions` this adapter already rewrites. Every other spec
+	* field (label, childId, signal, delivery) passes through untouched.
+	*
+	* @param spec - the activation spec published by the installed Host.
+	* @returns The official activation result.
+	*/
+	startActivation(spec) {
+		return publicMethod(OfficialSubagentRuntime.prototype, "OfficialSubagentRuntime", "startActivation").call(this, {
 			...spec,
 			request: this.routed(spec.provider, spec.request)
 		});
 	}
 };
 //#endregion
-export { ModelSwitchSubagentRuntime, StartupIncompatibilityError, profileSubagentRuntime as default, profileSubagentRuntime, mountWithStartupFallback, routeSubagentRequest, routedRuntimeUnavailableNotice };
+export { ModelSwitchSubagentRuntime, StartupIncompatibilityError, profileSubagentRuntime as default, profileSubagentRuntime, mountWithStartupFallback, routeSubagentRequest, routedRuntimeUnavailableNotice, subagentSurfaceOf };

package/lib/types/auto-review.d.ts

@@ -33,7 +33,17 @@ import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { Session } from '@deepseek-ai/dsh-session';
 /** Cordis plugin name used by loader diagnostics. */
 export declare const name = "model-switch-auto-review";
-/** The official gate's host services plus Model Switch's settings owner. */
+/**
+ * Only the services this row's own code touches.
+ *
+ * The official gate used to run inside this row's fiber, so this list had to
+ * mirror every service the official `apply` reads. DSH 0.2.1 added
+ * `workingDirectory` to the official gate and the mirror went stale, which made
+ * every tool call fail with `cannot get property "workingDirectory" without
+ * inject`. The gate is now mounted as its own plugin (see {@link autoReviewGate}),
+ * so cordis resolves the official dependency list — including future additions —
+ * and this row declares only what it reads itself.
+ */
 export declare const inject: string[];
 /** Pinned reviewer route; both identifiers are non-empty. */
 export interface AutoReviewRoute {
@@ -93,6 +103,42 @@ export declare function bindAutoReviewSessionCorrelation(scope: Context, activeS
  * @returns A child context shadowing only the llm service.
  */
 export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>): Context;
+/**
+ * Structural view of the official gate's plugin face.
+ *
+ * `name` and `inject` are part of the module's released plugin contract; the
+ * gate is mounted through cordis rather than called directly so its own
+ * dependency list is what the fiber resolves.
+ */
+export interface OfficialAutoReviewGate {
+    readonly apply: (ctx: Context) => void;
+    readonly inject?: readonly string[];
+    readonly name?: string;
+}
+/** The plugin face handed to cordis, with the official dependency list kept. */
+export interface MountedAutoReviewGate {
+    readonly name: string;
+    readonly inject?: string[];
+    readonly apply: (gateCtx: Context) => void;
+}
+/**
+ * Wrap the official gate as a plugin that declares its own dependencies.
+ *
+ * Directly calling `official.apply(scope)` ran the gate's code on this row's
+ * fiber, so every service the gate reads had to be mirrored in this row's
+ * `inject`. Mounting it instead lets cordis resolve the official list, which is
+ * what keeps a released Host's new dependency (0.2.1's `workingDirectory`) from
+ * breaking every tool call. The hooks let the caller observe whether the gate
+ * actually ran before it binds the session-correlation listener.
+ *
+ * @param gate - the official module (or an equivalent structural gate).
+ * @param hooks - applied/failure observers; the failure is rethrown.
+ * @returns A cordis plugin mounting the official gate unchanged.
+ */
+export declare function autoReviewGate(gate: OfficialAutoReviewGate, hooks?: {
+    readonly onApplied?: () => void;
+    readonly onFailure?: (error: unknown) => void;
+}): MountedAutoReviewGate;
 /**
  * Mount the official gate under the reviewer-route scope.
  *

package/lib/types/subagent-runtime.d.ts

@@ -21,6 +21,19 @@ export interface MountedStartup<T> {
     readonly dispose: () => Promise<void>;
 }
 type RoutableSubagentRequest = Pick<SubagentStartRequest, 'parent' | 'agentOptions'>;
+/**
+ * The 0.2.1+ activation spec, declared structurally.
+ *
+ * The pinned dependency typings predate the activation API, so the modern entry
+ * is described here and delegated through the base prototype. `request` carries
+ * the same `parent`/`agentOptions` pair the legacy start request does, which is
+ * why one route adapter serves both lines.
+ */
+export interface SubagentActivationSpecLike {
+    readonly provider: string;
+    readonly request: Pick<SubagentStartRequest, 'parent' | 'agentOptions'> & Record<string, unknown>;
+    readonly [field: string]: unknown;
+}
 /**
  * Inject one resolved route into a spawn that names none.
  *
@@ -34,6 +47,19 @@ type RoutableSubagentRequest = Pick<SubagentStartRequest, 'parent' | 'agentOptio
  * @returns The request to hand the official runtime.
  */
 export declare function routeSubagentRequest<T extends RoutableSubagentRequest>(request: T, route: SubagentRoute | undefined): T;
+/** The public start surface one installed Subagent runtime publishes. */
+export type SubagentSurfaceLine = 'activation' | 'start';
+/**
+ * Classify the runtime surface this Host publishes.
+ *
+ * DSH 0.2.1 replaced `start()` / `startContinuable()` with the activation API
+ * (`startActivation`), so a version-agnostic adapter has to recognize both
+ * lines instead of hard-coding one.
+ *
+ * @param value - a runtime class's prototype or a mounted runtime instance.
+ * @returns `activation` (0.2.1+), `start` (0.1.7/0.2.0), or undefined when neither is published.
+ */
+export declare function subagentSurfaceOf(value: unknown): SubagentSurfaceLine | undefined;
 /**
  * Mount a candidate and use the fallback only for typed startup incompatibility.
  *
@@ -68,5 +94,15 @@ export declare class ModelSwitchSubagentRuntime extends OfficialSubagentRuntime
     private routed;
     start(name: string, request: SubagentStartRequest): Promise<SubagentRun>;
     startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+    /**
+     * 0.2.1+ activation entry: delegation tools call this instead of
+     * `start()`/`startContinuable()`, and its spec carries the same
+     * `request.agentOptions` this adapter already rewrites. Every other spec
+     * field (label, childId, signal, delivery) passes through untouched.
+     *
+     * @param spec - the activation spec published by the installed Host.
+     * @returns The official activation result.
+     */
+    startActivation(spec: SubagentActivationSpecLike): Promise<unknown>;
 }
 export default profileSubagentRuntime;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.27",
+  "version": "0.4.28",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",