dsh-model-switch 0.4.27 → 0.4.29

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+## v0.4.29
+
+The experimental "随对话更新的标题" bundle (`dsh-experimental-session-titles-bundle`) no longer fails to enable while this plugin is active: the naming row now takes over the single provider slot the bundle's row competes for, mirrors that row's cadence, and keeps the configurable naming route working.
+
+- **What broke.** Enabling the bundle produced `1 entry did not activate optional-session-title-all-prompts (@deepseek-ai/dsh-session-title-all-prompts-llm): session-title provider "session-title-first-prompt-llm" is already registered`. DSH 0.2.1's session-title service accepts exactly one registered provider, and this row already owned that slot with its mirrored first-prompt provider. The bundle's patch inserts its all-prompts row **after** this plugin's patch layer, so the static `- id: optional-session-title-all-prompts` disable this plugin ships can never reach a row that does not exist yet when that layer applies.
+- **Fix: the row now takes the slot over instead of colliding (`src/session-title.ts`).** It mirrors the official row that exists in the tree — all-prompts winning whenever the experimental row is composed, first-prompt otherwise — and it watches `loader/patch-context`, which the loader runs inside the official entry before that entry's plugin `apply`. When an official naming row is about to register, this row yields the slot first (the service lets a registration be replaced once its disposer ran), so the official `register()` **succeeds** and the loader reports no failed activation; it then disables that row through the public `Entry.update({ disabled: true })` (which disposes the row's fiber and closes its registration) and claims the slot back under the row's cadence. A bounded retry absorbs the cases where the loader has not created the row's fiber yet, and an initial sweep handles the reverse composition order (an official row that activated before this row started). Only seams the loader already publishes are used: the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer.
+- **User-visible behavior.** Enabling the bundle: titles now update with every prompt **and** the configured naming model / provider-group route keeps applying (the provider id recorded with each title is `session-title-all-prompts-llm`, matching what the official row would record). Disabling the bundle: the first-prompt cadence comes back with the same route override. A Host that changes activation timing degrades to "the official provider serves naming, one explicit log line" rather than a crash or a wrong route.
+- **Verification.** `pnpm run check` green (53 test files / 466 tests + pack gate). New coverage: the all-prompts row wins the mirror, the takeover yields before the official registration and reclaims the slot with the mirrored cadence, repeat patch-context events are idempotent, an already-active row is swept, and no official row keeps today's single first-prompt registration. Real published packages on `0.2.1-rc.2` (the real `dsh-session-title` service plus the real `dsh-session-title-all-prompts-llm` apply): the official row registers with **no** `already registered` error, the displaced row is disabled through `Entry.update`, the plugin owns the slot again, and the live provider is `session-title-all-prompts-llm` / `all-prompts`.
+- **Residual (honest).** The takeover choreographs released loader seams rather than a dedicated "supersede this provider" API; `docs/seam-gap.md` records the missing seam and the upstream proposal (a decorate/replace registration or a multi-provider slot). The reverse direction — disabling the bundle at runtime without a profile restart — re-claims through `loader/partial-dispose` where the loader emits it, and otherwise needs the restart DSH already asks for on bundle changes.
+
+## v0.4.28
+
+Two fixes for the same DSH `0.2.1-rc.2` line: re-enabling the plugin on 0.2.1 made **every tool call fail before its body ran**, and the Subagent routing adapter that 0.4.26 had to fail closed is adapted to the release's activation API.
+
+- **P0: every tool call failed under the Auto preset on DSH 0.2.1 (`src/auto-review.ts`).** With the plugin enabled and the approval policy on Auto, each tool call was rejected with `Auto review of tool "…" failed; its body was not executed: cannot get property "workingDirectory" without inject` — read, grep, pwsh, even exiting plan mode. Root cause: `model-switch-auto-review` called `official.apply(scope)` **directly inside its own fiber**, so every service the official gate reads had to be mirrored in this row's `inject`; 0.2.1's gate started reading `ctx.workingDirectory`, and the mirror list had gone stale. Fix: the official gate is now **mounted as a plugin** (`autoReviewGate` → `scope.plugin(...)`), so cordis resolves the official dependency list — including `workingDirectory` on 0.2.1 and its absence on 0.2.0 — and this row declares only the services its own code reads (`llm`, `modelSwitch`). The session-correlation listener is registered only after the gate's fiber reports that its `apply` actually ran, so it still lands ahead of the gate's own prepended listener; an already-active official row still fails loudly (single `registerAuto`), and a gate still waiting for host services is reported instead of silently mis-ordering.
+- **Subagent routing adapted to the 0.2.1 activation API (`src/subagent-runtime.ts`).** 0.2.1 replaced `start()` / `startContinuable()` with `startActivation(spec)`. The routed runtime now recognizes **either published line** (`subagentSurfaceOf`), keeps both legacy overrides unchanged, and adds a `startActivation` override that rewrites `spec.request.agentOptions` through the same `provider group → flat subagent card → session model` resolver (a caller-named route still wins; a provider whose capability is not `agentOptions` is still never reinterpreted). Only a Host publishing neither surface falls back to the untouched official runtime with `routedRuntimeUnavailableNotice`, so the 0.2.1 fallback path is now unreachable in practice.
+- **Correction to the v0.4.26 entry.** That entry claimed the official auto-review `apply` "runs unchanged under this row's scoped `llm`" on 0.2.1. The live desktop showed otherwise: it ran unchanged only until the reviewer read a service the mirrored `inject` did not carry. 0.4.26 and 0.4.27 therefore shipped that failure on 0.2.1; 0.4.28 is the first release where the gate actually runs there.
+- **Verification.**
+  - `pnpm run check` green (52 test files / 460 tests + pack gate). New coverage: the inject trap reproduced with a real cordis `Service` (an unwrapped gate fails with the exact live message, the wrapped gate passes), the official dependency list surviving the mount, gate-failure reporting, `subagentSurfaceOf` for the activation line, the start line, and neither, activation-spec routing (session group, flat fixed pair, follow-main, explicit caller route, external provider), spec passthrough, and mounting the routed runtime on an activation-only Host.
+  - **Real published packages, `0.2.1-rc.2`** (lab CLI `node_modules`, a real `Service` registration so the trap is live, the real official gate): the pre-fix shape reproduces exactly `Auto review of tool "pwsh" failed; its body was not executed: cannot get property "workingDirectory" without inject`; the shipped shape reaches `workingDirectory.ensure` (one call), registers the Auto gate once, and never fails on inject. The real 0.2.1 `SubagentRuntime` classifies as the activation line and drops `start`/`startContinuable`; the adapter delegates to that exact method with `request.agentOptions` rewritten to the configured subagent route while `provider` / `label` / `delivery` / `signal` / `parent` identity pass through.
+  - **Real published packages, `0.2.0-rc.2`**: the row registers the Auto gate **without** a `workingDirectory` service, the gate never hits an inject failure, the runtime classifies as the `start` line, and `start()` delegation still rewrites the route and preserves parent identity.
+  - **Lab plane** (`DSH_HOME=~/.dsh-lab`, npm-installed `0.2.1-rc.2` runtime, packed `dsh-model-switch-0.4.28.tgz` installed in the `labh` profile): a headless turn ran a real tool (directory listing) with no inject failure and no `{{cwd}}` error; a second turn spawned a real subagent, and the child session's own `subagent/descriptor` records `mode: continuable`, `provider: spawn`, `agentProvider: apigoto`, `agentModel: mimo-v2.6-flash` — the fixed subagent route configured for that profile, not the session default `apigoto/deepseek-flash`. That is the end-to-end proof that the activation-line override reaches the child's route on 0.2.1.
+- **Residual (honest).** The live desktop is the only place the Auto preset gate runs end to end with a real tool body: after updating, re-enable the plugin, switch the approval policy back from full-access mode to Auto, and run one tool call. The harness above exercises the real 0.2.1 packages and the real cordis `Service` trap, but not a full session snapshot — the fake session stops the reviewer right after `workingDirectory.ensure`, by design. 0.1.7 / 0.2.0 keep the same entries, the same route precedence, and the same fail-closed behavior.
+
 ## v0.4.27
 
 A fix for a regression v0.4.26 introduced on DSH `0.2.1-rc.2`, plus the architecture change that removes its cause: the plugin no longer ships static copies of DSH's agent presets.
@@ -16,7 +40,7 @@ Two coordinated changes: automatic session naming now survives a failing title r
 - **DSH 0.2.1 naming line (`executeSessionTitleLlm`).** `0.2.1-rc.2` removed `generateSessionTitleWithLlm` / `registerSessionTitleLlmProvider` and split the shared policy: the new `executeSessionTitleLlm(ctx, config, request, id, prepared)` returns assembled blocks plus the terminal finish reason, each provider owns its system instruction, input framing, reasoning-effort selection, and output interpretation, and `targetWords` / `targetCjkCharacters` moved into the provider's own config. The row detects the installed line at runtime and mirrors the shipped 0.2.1 provider exactly: same system instruction (including the best-effort line and, for all-prompts, the current-title stability rules anchored on a provider-sourced `currentTitle`), same JSON framing, the route's least supported reasoning effort, and the same finish-reason / whole-line-emphasis / empty-output acceptance rules. `cordis.patch.yml` also disables the `optional-session-title-all-prompts` row that 0.2.1's experimental session-titles bundle inserts (unknown-row warning on profiles without it, like the optional auto-review row).
 - **DSH 0.2.1 compatibility review (0.2.0-rc.2 → 0.2.1-rc.2, public API only).**
   - **Naming:** the service keeps `register` / `ensureFallback` / the `first-prompt` gate and only adds an optional `currentTitle` to the provider request; `onMainRequest` dropped one boundary-freshness condition. The provider request shape this row returns is unchanged.
-  - **Auto review:** the official gate now resolves the reviewing agent's directory through `ctx.workingDirectory.ensure(...)` and injects `workingDirectory`; `dsh-base` 0.2.1 mounts the `working-directory` row, so the official `apply` runs unchanged under this row's scoped `llm`.
+  - **Auto review:** the official gate now resolves the reviewing agent's directory through `ctx.workingDirectory.ensure(...)` and injects `workingDirectory`; `dsh-base` 0.2.1 mounts the `working-directory` row. **[Corrected in v0.4.28]** This entry originally claimed the official `apply` "runs unchanged under this row's scoped `llm`" on 0.2.1. It did not: the row called `apply` directly and mirrored the gate's services in its own `inject`, so the new `workingDirectory` read failed for every tool call. v0.4.28 mounts the gate as a plugin instead.
   - **Compaction and presets:** `dsh-compaction-basic` and `dsh-agent-preset` are byte-identical to 0.2.0, so the wholesale preset copies and the compaction engine need no re-sync.
   - **Unchanged surfaces this plugin calls:** `llm.stream(GenerateOptions)` (with `prepareCall` added beside it), `web.registerSearchProvider`, `tools/pre-execute` (`exec.agent` kept), session `snapshotEvents` / `requestHeader` / `requestContext` / `append`, and the composer's `conversation.input.model` seat.
   - **Subagents:** `@deepseek-ai/dsh-subagent` replaced `start()` / `startContinuable()` with `startActivation(spec)` plus a provider registry. The routed runtime therefore cannot override the new entry point; this row mounts the untouched official runtime (fail-closed) and logs one explicit notice. Recorded in `docs/seam-gap.md` for a later upstream proposal.

package/PRODUCT.md

@@ -33,4 +33,4 @@ Official `settings.section` has no icon field. The Settings nav glyph is a label
 
 ## Delivery architecture
 
-The package foundation and pure deep modules remain the policy/test surface. Runtime delivery disables the independent Subagent Loader row with its official name and inserts a uniquely identified replacement; the experimental auto-review row is disabled the same way and replaced by `dsh-model-switch/auto-review`, which runs the official gate's `apply` unchanged under a scoped `llm` shadow (one `registerAuto`, and only when the profile started with the optional auto-review bundle). Official AgentPresets stay mounted so they share the process `dsh-scope` identity. Search uses the released `ctx.web.registerSearchProvider()` seam so official tool ownership is preserved. Image uses a unique tool name and provider-owned authenticated adapters. Self-maintained Codex/Grok plugins register optional adapters through the public Model Switch service when present; standalone provider behavior is unchanged. Vision remains disabled. Replacement modules preserve the official public interfaces and fail closed when compatibility or capability validation fails.
+The package foundation and pure deep modules remain the policy/test surface. Runtime delivery disables the independent Subagent Loader row with its official name and inserts a uniquely identified replacement; the experimental auto-review row is disabled the same way and replaced by `dsh-model-switch/auto-review`, which mounts the official gate's `apply` unchanged as a plugin under a scoped `llm` shadow — the Host resolves the gate's own `inject` list (including 0.2.1's `workingDirectory`), one `registerAuto` runs, and only when the profile started with the optional auto-review bundle. Session naming replaces the official `session-title-llm` row and owns the service's single provider slot; it mirrors the official cadence the profile declares — first-prompt by default, and the all-prompts cadence whenever the experimental session-titles bundle inserts its row — so enabling that bundle keeps both the per-prompt title refresh and this plugin's configurable naming route, while disabling it restores the first-prompt cadence. The takeover only uses released loader seams (the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer) and degrades to the official provider with one explicit log line if a future Host changes activation timing. Official AgentPresets stay mounted so they share the process `dsh-scope` identity. Search uses the released `ctx.web.registerSearchProvider()` seam so official tool ownership is preserved. Image uses a unique tool name and provider-owned authenticated adapters. Self-maintained Codex/Grok plugins register optional adapters through the public Model Switch service when present; standalone provider behavior is unchanged. Vision remains disabled. Replacement modules preserve the official public interfaces and fail closed when compatibility or capability validation fails.

package/README.zh.md

@@ -119,6 +119,8 @@ DSH 会自动为新会话起名；命名的触发节奏由 profile 的官方命
 
 路由在**每次命名请求时现读**：保存后对下一次起名立即生效、无需重启，且进行中的命名请求不会被保存打断。每次请求按顺序解析路由：该会话供应商组里的命名对，其次卡片的部署级对，其次会话自身的模型。请求经由官方命名实现发出，它会把实际使用的 provider/model 记录到该会话自己的 `session/title-llm-request` 事件里，因此持久记录与真实请求永远一致。本插件替换官方的 `session-title-llm` 行而不分叉命名逻辑（该接缝每个上下文只允许注册一个命名 provider），并镜像该行声明的节奏；profile 没有官方命名行时保持 DSH 的确定性兜底标题。
 
+0.4.29 起与实验包「随对话更新的标题」（`dsh-experimental-session-titles-bundle`，插入 all-prompts 命名行）兼容：启用该实验包时，本插件接管同一个命名 provider 槽位并镜像 all-prompts 节奏，标题随对话更新，同时命名模型路由与供应商组路由继续生效（`session/title` 记录中的 provider id 为 `session-title-all-prompts-llm`，与官方行一致）；禁用实验包即回到首条提示节奏与同样的路由覆写。实现只使用 loader 已发布的缝（`loader/patch-context` 瀑布、`Entry.update`、`sessionTitle.register` 及其 disposer），让官方行先成功注册、再被停用并由本行重占槽位，因此启用时不再出现 `already registered` 激活失败弹窗。
+
 ## 供应商配置组（Provider groups）
 
 「供应商配置组」卡片为每个供应商保存一组路由——压缩、自动审查、会话命名与子代理四条路由一起存；为供应商 X 保存的组，作用于自身供应商就是 X 的会话。组是**推导出来的，而不是写进去的**：切换某个会话的供应商不写任何东西，因此不同供应商上的多个会话并行时再也不会互相覆盖、互相改写对方的辅助路由。
@@ -180,7 +182,7 @@ DeepSeek 薄适配器调用官方公开 `DeepSeekSearchProvider`，复用用户
 
 DSH Host peer 和开发依赖接受 `>=0.1.7-alpha.2`，包括 rc.1 和后续版本。开发锁文件解析到 rc.2。Cordis 接受 `>=4.0.4 <5.0.0`。
 
-已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，路由版运行时在新 Host 上不可用，本插件改为挂载未经改动的官方运行时并输出一条明确提示（记录于 `docs/seam-gap.md`）。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。0.2.1 还暴露出一处预设层面的差异（0.2.1 校验提示词变量、只有 `provider`/`model`，且把 `time-context`/`tool-schedule` 移进预设）：0.4.26 的静态预设副本因此让每一轮都报 `unknown prompt variable "{{cwd}}"`，0.4.27 删除副本改为启动期运行时桥接，并在 lab 的 0.2.1 headless 真实回合中验证通过（展开见 CHANGELOG 0.4.27）。
+已验证版本：`0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.2`、`0.2.1-rc.2`。0.2.0 的声明覆盖三处差异：Host 改名的提问撤下动词（`cancel()` → `dismiss()`）、`session.selectModel` 不 await 的部署默认值写入、以返回值报出的 `ModelDirectory.select` 拒绝；三者均已在 lab（3082/3085）与真实桌面会话中逐一验证。0.2.1 的声明覆盖两处被替换的 seam：共享命名调用改为 provider 自备提示词与解析的 `executeSessionTitleLlm`（本插件按安装行在运行时适配，并镜像官方 0.2.1 的提示词、取最低 reasoning effort 与 `currentTitle` 锚定）；Subagent 运行时以 `startActivation` 取代 `start()`/`startContinuable()`，本插件同时识别两条已发布线，并为激活入口覆写 `spec.request.agentOptions`（显式路由仍优先、非 agentOptions 能力的外部适配器不改写），路由语义与旧线一致（0.4.28，记录于 `docs/seam-gap.md`）；0.2.1 还新增了自动审查门禁对 `ctx.workingDirectory` 的读取，旧实现因在自己的 fiber 里直调 `official.apply` 而需要手工镜像门禁的 `inject`，于是每个工具调用都被拒（`cannot get property "workingDirectory" without inject`），0.4.28 改为把官方门禁以插件方式挂载、由官方 `inject` 解析依赖，本行只声明自身需要的服务。0.4.28 的真实包证据：0.2.1 上旧形态精确复现该注入错误、新形态到达 `workingDirectory.ensure` 且成功注册门禁、激活入口的路由改写与 spec 透传通过；0.2.0 上无需 `workingDirectory` 服务即可注册门禁，`start()` 路由改写与父身份保持不变。0.2.1 的 lab 证据为：npm 安装的 0.2.1 运行时 + 打包后的 0.4.26 组合 `exit 0`、命名/压缩/自动审查/子代理四行均来自本插件、Web Host 在 3082 启动并服务需要鉴权的页面；该次未经浏览器调用 3082 能力 RPC，真实桌面的 0.2.1 命名差分在应用升级后复验。0.2.1 还暴露出一处预设层面的差异（0.2.1 校验提示词变量、只有 `provider`/`model`，且把 `time-context`/`tool-schedule` 移进预设）：0.4.26 的静态预设副本因此让每一轮都报 `unknown prompt variable "{{cwd}}"`，0.4.27 删除副本改为启动期运行时桥接，并在 lab 的 0.2.1 headless 真实回合中验证通过（展开见 CHANGELOG 0.4.27）。
 
 `package.json#dsh.compatibility.dshReleases` 中的已验证版本是证据，不是允许列表。新增验证声明前要审查公开 API 变化并测试新 Host 版本。
 

package/lib/auto-review.js

@@ -32,15 +32,18 @@ import { AsyncLocalStorage } from "node:async_hooks";
 */
 /** Cordis plugin name used by loader diagnostics. */
 const name = "model-switch-auto-review";
-/** The official gate's host services plus Model Switch's settings owner. */
-const inject = [
-	"modelSwitch",
-	"approval",
-	"llm",
-	"permissionPresets",
-	"sessions",
-	"tools"
-];
+/**
+* Only the services this row's own code touches.
+*
+* The official gate used to run inside this row's fiber, so this list had to
+* mirror every service the official `apply` reads. DSH 0.2.1 added
+* `workingDirectory` to the official gate and the mirror went stale, which made
+* every tool call fail with `cannot get property "workingDirectory" without
+* inject`. The gate is now mounted as its own plugin (see {@link autoReviewGate}),
+* so cordis resolves the official dependency list — including future additions —
+* and this row declares only what it reads itself.
+*/
+const inject = ["llm", "modelSwitch"];
 /** Optional bundle whose composition opts a profile into Auto review. */
 const AUTO_REVIEW_BUNDLE = "@deepseek-ai/dsh-experimental-auto-review";
 /**
@@ -138,6 +141,35 @@ function autoReviewBundleActive(ctx) {
 	return Array.isArray(bundles) && bundles.includes(AUTO_REVIEW_BUNDLE);
 }
 /**
+* Wrap the official gate as a plugin that declares its own dependencies.
+*
+* Directly calling `official.apply(scope)` ran the gate's code on this row's
+* fiber, so every service the gate reads had to be mirrored in this row's
+* `inject`. Mounting it instead lets cordis resolve the official list, which is
+* what keeps a released Host's new dependency (0.2.1's `workingDirectory`) from
+* breaking every tool call. The hooks let the caller observe whether the gate
+* actually ran before it binds the session-correlation listener.
+*
+* @param gate - the official module (or an equivalent structural gate).
+* @param hooks - applied/failure observers; the failure is rethrown.
+* @returns A cordis plugin mounting the official gate unchanged.
+*/
+function autoReviewGate(gate, hooks = {}) {
+	return {
+		name: gate.name ?? "experimental-auto-review",
+		...gate.inject === void 0 ? {} : { inject: [...gate.inject] },
+		apply(gateCtx) {
+			try {
+				gate.apply(gateCtx);
+			} catch (error) {
+				hooks.onFailure?.(error);
+				throw error;
+			}
+			hooks.onApplied?.();
+		}
+	};
+}
+/**
 * Mount the official gate under the reviewer-route scope.
 *
 * A profile that never enabled the optional bundle keeps no Auto preset and no
@@ -159,13 +191,31 @@ async function apply(ctx) {
 	}
 	const activeSession = new AsyncLocalStorage();
 	const scope = reviewScope(ctx, activeSession);
+	let failure;
+	let applied = false;
+	const fiber = scope.plugin(autoReviewGate(official, {
+		onApplied: () => {
+			applied = true;
+		},
+		onFailure: (error) => {
+			failure = error;
+		}
+	}));
 	try {
-		official.apply(scope);
-		bindAutoReviewSessionCorrelation(scope, activeSession);
+		await fiber;
 	} catch (cause) {
+		failure ??= cause;
+	}
+	if (failure !== void 0) {
 		ctx.logger.error("model-switch: the official auto-review row is already active; the reviewer route override is unavailable");
-		ctx.logger.error(cause);
+		ctx.logger.error(failure);
+		return;
+	}
+	if (!applied) {
+		ctx.logger.info("model-switch: the official auto-review gate is waiting for its host services; the reviewer route override is not bound yet");
+		return;
 	}
+	bindAutoReviewSessionCorrelation(scope, activeSession);
 }
 //#endregion
-export { apply, autoReviewRouteOf, bindAutoReviewSessionCorrelation, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };
+export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/session-title.js

@@ -148,19 +148,32 @@ function selectTitleMessages(messages, firstPromptOnly) {
 	if (first === void 0) throw new Error("first-prompt title provider requires one human message");
 	return [first];
 }
+/** The id the experimental session-titles bundle inserts for all-prompts naming. */
+const ALL_PROMPTS_ROW = "optional-session-title-all-prompts";
 /**
 * Locate the official session-title provider row in the loader tree.
+*
 * Disabled entries stay in the tree, so a name-matched disable still matches.
+* The all-prompts row wins when it is present: that row only exists while the
+* experimental session-titles bundle is composed, and its presence is exactly
+* the user's choice to update titles with every prompt. The default
+* first-prompt row is the fallback when that bundle is off.
 * @param loader - the host loader, when one is reachable.
-* @returns The official entry, or undefined when this profile has no such row.
+* @returns The official entry to mirror, or undefined when this profile has no such row.
 */
 function officialTitleEntry(loader) {
 	if (!loader) return void 0;
+	const allPrompts = TITLE_CADENCES[1];
+	const firstPrompt = TITLE_CADENCES[0];
+	let fallback;
 	for (const entry of loader.entries()) {
-		if (entry.id === OFFICIAL_TITLE_ROW) return entry;
+		if (entry.id === ALL_PROMPTS_ROW) return entry;
 		const pkg = entry.options?.name;
-		if (typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg)) return entry;
+		if (typeof pkg === "string" && allPrompts !== void 0 && pkg === allPrompts.pkg) return entry;
+		if (fallback === void 0 && entry.id === OFFICIAL_TITLE_ROW) fallback = entry;
+		else if (fallback === void 0 && firstPrompt !== void 0 && pkg === firstPrompt.pkg) fallback = entry;
 	}
+	return fallback;
 }
 /**
 * Copy the official row's stored config, ignoring non-object payloads.
@@ -517,6 +530,214 @@ function currentSettings(ctx) {
 		return;
 	}
 }
+/** Resolve the naming plan for one official row, or the shipped defaults when no row exists. */
+function planFor(ctx, module, entry) {
+	const cadence = titleCadence(entry === void 0 ? void 0 : officialTitlePackage(entry)) ?? TITLE_CADENCES[0];
+	if (cadence === void 0) return void 0;
+	const forwarded = entry === void 0 ? {} : forwardedConfig(entry);
+	let policy;
+	try {
+		policy = resolveNamingPolicy(module, forwarded);
+	} catch (cause) {
+		ctx.logger.error("model-switch: the official session-title row has no valid naming policy; naming keeps the deterministic fallback");
+		ctx.logger.error(cause);
+		return;
+	}
+	return {
+		cadence,
+		config: policy.config,
+		targets: policy.targets
+	};
+}
+/** One naming plan bound to a live route resolver. */
+function providerOf(ctx, module, plan) {
+	return {
+		id: plan.cadence.id,
+		automatic: plan.cadence.automatic,
+		generate: (request) => generateTitle(ctx, module, plan, request)
+	};
+}
+/** Timing knobs for the takeover choreography (exported for tests). */
+const TAKEOVER_RETRY_DELAY_MS = 10;
+/** How many times the takeover re-checks after disabling the official row. */
+const TAKEOVER_MAX_ATTEMPTS = 20;
+/**
+* The single naming-provider slot this row serves.
+*
+* DSH's session-title service accepts exactly one registered provider, and the
+* official rows (`session-title-llm`, and the experimental row the
+* `dsh-experimental-session-titles-bundle` inserts) compete for the same slot.
+* This row therefore mirrors one official row and owns the slot; when another
+* official row activates anyway (the experimental bundle inserts its row after
+* this plugin's patch layer, so a static `disabled` cannot reach it), it yields
+* the slot so that row's own registration succeeds — no activation warning —
+* and then disables that row and takes the slot back with its cadence mirrored.
+* Every step uses released seams: the `loader/patch-context` waterfall, the
+* public `Entry.update`, and `sessionTitle.register` plus its disposer.
+*/
+var NamingSeam = class {
+	ctx;
+	module;
+	disposer;
+	plan;
+	constructor(ctx, module, plan) {
+		this.ctx = ctx;
+		this.module = module;
+		this.plan = plan;
+	}
+	/** The cadence currently registered. */
+	get cadence() {
+		return this.plan.cadence;
+	}
+	/** Whether this row currently owns the slot. */
+	get claimed() {
+		return this.disposer !== void 0;
+	}
+	/**
+	* Register this row's provider with the given plan.
+	* @param plan - the naming plan to serve (defaults to the current one).
+	* @returns true when the slot is ours, false when another provider holds it.
+	*/
+	claim(plan = this.plan) {
+		this.plan = plan;
+		if (this.disposer !== void 0) return true;
+		try {
+			this.disposer = this.ctx.sessionTitle.register(providerOf(this.ctx, this.module, plan));
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/** Release the slot (the service lets the next registration replace a closing one). */
+	yieldSlot() {
+		const disposer = this.disposer;
+		this.disposer = void 0;
+		if (disposer === void 0) return;
+		try {
+			disposer();
+		} catch (cause) {
+			this.ctx.logger.error("model-switch: releasing the session-title provider failed");
+			this.ctx.logger.error(cause);
+		}
+	}
+	/** Swap the served plan, re-registering only when the slot is already ours. */
+	retarget(plan) {
+		if (!this.claimed) {
+			this.plan = plan;
+			return;
+		}
+		this.yieldSlot();
+		this.claim(plan);
+	}
+};
+/** Whether one loader entry declares an official naming provider this row supersedes. */
+function isOfficialTitleRow(entry) {
+	if (entry === void 0) return false;
+	if (entry.id === OFFICIAL_TITLE_ROW || entry.id === ALL_PROMPTS_ROW) return true;
+	const pkg = entry.options?.name;
+	return typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg);
+}
+/** The id one entry is known by (the loader's leaf id, not a nested path). */
+function leafId(entry) {
+	const raw = entry.options?.id;
+	return typeof raw === "string" ? raw : void 0;
+}
+/**
+* Install the takeover choreography for naming rows that activate after this one.
+*
+* `loader/patch-context` runs inside the official entry's own `_init`, before its
+* plugin's `apply`, and it receives that entry. At that point the entry's
+* `options` are final, so this row can yield the slot first — the official
+* `register()` then succeeds instead of throwing the "already registered"
+* activation warning — and afterwards disable that row through the public
+* `Entry.update` and take the slot back with its cadence mirrored.
+* @param ctx - this row's context.
+* @param module - the auxiliary-LLM package.
+* @param seam - the slot owner.
+* @returns Nothing; the listeners are effects of this row's fiber.
+*/
+function installTakeover(ctx, module, seam) {
+	/** Entries already handled, so a repeated patch-context does not loop. */
+	const handled = /* @__PURE__ */ new Set();
+	/** Entries with a reclaim cycle in flight, so two triggers cannot race. */
+	const reclaiming = /* @__PURE__ */ new Set();
+	/** After the yield, disable the official row and take the slot back. */
+	const reclaim = async (entry, plan) => {
+		if (reclaiming.has(entry)) return;
+		reclaiming.add(entry);
+		try {
+			for (let attempt = 0; attempt < 20; attempt += 1) {
+				await new Promise((resolve) => setTimeout(resolve, attempt === 0 ? 0 : 10));
+				try {
+					await entry.update({ disabled: true });
+				} catch (cause) {
+					ctx.logger.info("model-switch: the displaced naming row could not be persisted as disabled; the takeover repeats next startup");
+					ctx.logger.info(String(cause));
+				}
+				if (seam.claim(plan)) {
+					ctx.logger.info(`model-switch: displaced the official naming row ${String(leafId(entry) ?? "unknown")}; its ${plan.cadence.automatic} cadence and policy are mirrored by the configurable naming route`);
+					return;
+				}
+			}
+			ctx.logger.error(`model-switch: the official naming row ${String(leafId(entry) ?? "unknown")} kept the session-title provider slot; the configurable naming route is unavailable this session`);
+		} finally {
+			reclaiming.delete(entry);
+		}
+	};
+	/**
+	* The row an event names.
+	*
+	* The loader hands the emitting entry as the event's `this`, but cordis does
+	* not rebind `this` for listeners added through `ctx.on`, so a listener can
+	* also receive the payload as its first argument. Both shapes are accepted;
+	* the real Host always provides one of them.
+	*/
+	const entryOfEvent = (self, first) => {
+		const candidate = self ?? first;
+		return candidate !== null && typeof candidate === "object" && "options" in candidate ? candidate : void 0;
+	};
+	const listeners = [];
+	const listen = (event, listener) => {
+		const dispose = ctx.on?.(event, listener);
+		if (dispose !== void 0) listeners.push(dispose);
+	};
+	listen("loader/patch-context", function(first, second) {
+		const nextFn = typeof first === "function" ? first : second;
+		const entry = entryOfEvent(this, typeof first === "function" ? void 0 : first);
+		if (entry === void 0 || typeof nextFn !== "function" || !isOfficialTitleRow(entry) || handled.has(entry)) return nextFn === void 0 ? void 0 : nextFn();
+		handled.add(entry);
+		const plan = planFor(ctx, module, entry);
+		if (plan !== void 0) {
+			seam.yieldSlot();
+			reclaim(entry, plan);
+		}
+		return nextFn();
+	});
+	listen("loader/partial-dispose", function(first) {
+		const entry = entryOfEvent(this, first);
+		if (entry === void 0 || !isOfficialTitleRow(entry)) return;
+		handled.delete(entry);
+		if (seam.claimed) return;
+		const plan = planFor(ctx, module, officialTitleEntry(ctx.get("loader", false)));
+		if (plan !== void 0) seam.claim(plan);
+	});
+	const loader = ctx.get("loader", false);
+	if (typeof loader?.entries === "function") for (const candidate of loader.entries()) {
+		if (!isOfficialTitleRow(candidate)) continue;
+		if (candidate.disabled === true) continue;
+		const plan = planFor(ctx, module, candidate);
+		if (plan !== void 0) reclaim(candidate, plan);
+	}
+	const disposable = () => {
+		for (const dispose of listeners.splice(0)) dispose();
+	};
+	const effect = ctx.effect;
+	if (effect === void 0) return;
+	const registration = effect(function* () {
+		yield disposable;
+	}, "model-switch: session-title takeover");
+	if (typeof registration === "function") listeners.push(registration);
+}
 /**
 * Mount the Model Switch session-naming row for this profile.
 *
@@ -529,11 +750,7 @@ function currentSettings(ctx) {
 */
 async function apply(ctx) {
 	const entry = officialTitleEntry(ctx.get("loader", false));
-	const cadence = titleCadence(entry === void 0 ? void 0 : officialTitlePackage(entry)) ?? TITLE_CADENCES[0];
-	if (cadence === void 0) return;
 	if (entry === void 0) ctx.logger.info("model-switch: no instantiated official session-title row to mirror; naming uses the first-prompt cadence");
-	/** The displaced row's naming policy, or the shipped defaults when it is absent. */
-	const forwarded = entry === void 0 ? {} : forwardedConfig(entry);
 	let module;
 	try {
 		module = await import(__rewriteRelativeImportExtension(TITLE_LLM_PACKAGE));
@@ -542,29 +759,11 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
-	let policy;
-	try {
-		policy = resolveNamingPolicy(module, forwarded);
-	} catch (cause) {
-		ctx.logger.error("model-switch: the official session-title row has no valid naming policy; naming keeps the deterministic fallback");
-		ctx.logger.error(cause);
-		return;
-	}
-	const plan = {
-		cadence,
-		config: policy.config,
-		targets: policy.targets
-	};
-	try {
-		ctx.sessionTitle.register({
-			id: cadence.id,
-			automatic: cadence.automatic,
-			generate: (request) => generateTitle(ctx, module, plan, request)
-		});
-	} catch (cause) {
-		ctx.logger.error("model-switch: another session-title provider is already registered; the configurable naming route is unavailable");
-		ctx.logger.error(cause);
-	}
+	const plan = planFor(ctx, module, entry);
+	if (plan === void 0) return;
+	const seam = new NamingSeam(ctx, module, plan);
+	if (!seam.claim()) ctx.logger.info("model-switch: another session-title provider already owns the seam; naming follows it while it is active");
+	installTakeover(ctx, module, seam);
 }
 //#endregion
-export { TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, frameTitleInput, inject, isMaxTokensFailure, isModernTitleModule, name, normalizeTitleText, officialTitleEntry, officialTitlePackage, resolveNamingPolicy, selectTitleMessages, selectTitleReasoningEffort, shouldTryNextCandidate, splitTitlePolicy, titleCadence, titleFromOutput, titleFromResponse, titleRouteCandidates, titleSystemPrompt, widerTitleBudget };
+export { TAKEOVER_MAX_ATTEMPTS, TAKEOVER_RETRY_DELAY_MS, TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, frameTitleInput, inject, isMaxTokensFailure, isModernTitleModule, isOfficialTitleRow, name, normalizeTitleText, officialTitleEntry, officialTitlePackage, resolveNamingPolicy, selectTitleMessages, selectTitleReasoningEffort, shouldTryNextCandidate, splitTitlePolicy, titleCadence, titleFromOutput, titleFromResponse, titleRouteCandidates, titleSystemPrompt, widerTitleBudget };

package/lib/subagent-runtime.js

@@ -49,6 +49,30 @@ function routeSubagentRequest(request, route) {
 function assertPublicMethod(value, surface, method) {
 	if (value === null || typeof value !== "object" && typeof value !== "function" || typeof Reflect.get(value, method) !== "function") throw new StartupIncompatibilityError(surface, surface + " must expose public " + method + "()");
 }
+/**
+* Classify the runtime surface this Host publishes.
+*
+* DSH 0.2.1 replaced `start()` / `startContinuable()` with the activation API
+* (`startActivation`), so a version-agnostic adapter has to recognize both
+* lines instead of hard-coding one.
+*
+* @param value - a runtime class's prototype or a mounted runtime instance.
+* @returns `activation` (0.2.1+), `start` (0.1.7/0.2.0), or undefined when neither is published.
+*/
+function subagentSurfaceOf(value) {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return void 0;
+	if (typeof Reflect.get(value, "startActivation") === "function") return "activation";
+	const hasStart = typeof Reflect.get(value, "start") === "function";
+	const hasContinuable = typeof Reflect.get(value, "startContinuable") === "function";
+	return hasStart && hasContinuable ? "start" : void 0;
+}
+/** Read one public method, failing with the typed startup error when it is absent. */
+function publicMethod(prototype, surface, method) {
+	if (prototype === null || typeof prototype !== "object" && typeof prototype !== "function") throw new StartupIncompatibilityError(surface, surface + " must expose public " + method + "()");
+	const value = Reflect.get(prototype, method);
+	if (typeof value !== "function") throw new StartupIncompatibilityError(surface, surface + " must expose public " + method + "()");
+	return value;
+}
 function constructible(value) {
 	if (typeof value !== "function") return false;
 	try {
@@ -62,9 +86,9 @@ function constructible(value) {
 function assertOfficialRuntimeSurface() {
 	const runtime = OfficialSubagentRuntime;
 	if (!constructible(runtime)) throw new StartupIncompatibilityError("OfficialSubagentRuntime", "OfficialSubagentRuntime must be constructible");
-	const prototype = Reflect.get(runtime, "prototype");
-	assertPublicMethod(prototype, "OfficialSubagentRuntime", "start");
-	assertPublicMethod(prototype, "OfficialSubagentRuntime", "startContinuable");
+	const line = subagentSurfaceOf(Reflect.get(runtime, "prototype"));
+	if (line === void 0) throw new StartupIncompatibilityError("OfficialSubagentRuntime", "OfficialSubagentRuntime must expose public startActivation() (0.2.1+) or start()/startContinuable()");
+	return line;
 }
 function assertRoutingSurface(ctx) {
 	const modelSwitch = ctx.modelSwitch;
@@ -74,9 +98,9 @@ function routingSurface(ctx) {
 	return ctx.modelSwitch;
 }
 function assertMountedSurface(ctx) {
-	assertPublicMethod(ctx.subagents, "mounted Subagent runtime", "start");
-	assertPublicMethod(ctx.subagents, "mounted Subagent runtime", "startContinuable");
-	assertPublicMethod(ctx.subagents, "mounted Subagent runtime", "resolveMaxDepth");
+	const service = ctx.subagents;
+	assertPublicMethod(service, "mounted Subagent runtime", "resolveMaxDepth");
+	if (subagentSurfaceOf(service) === void 0) throw new StartupIncompatibilityError("mounted Subagent runtime", "mounted Subagent runtime must expose public startActivation() (0.2.1+) or start()/startContinuable()");
 }
 function once(dispose) {
 	let pending;
@@ -199,14 +223,29 @@ var ModelSwitchSubagentRuntime = class extends OfficialSubagentRuntime {
 		return routeSubagentRequest(request, sessionSubagentRouteOf(this.ctx, request.parent.session, modelSwitch.currentSettings()));
 	}
 	start(name, request) {
-		return super.start(name, this.routed(name, request));
+		return publicMethod(OfficialSubagentRuntime.prototype, "OfficialSubagentRuntime", "start").call(this, name, this.routed(name, request));
 	}
 	startContinuable(spec) {
-		return super.startContinuable({
+		return publicMethod(OfficialSubagentRuntime.prototype, "OfficialSubagentRuntime", "startContinuable").call(this, {
+			...spec,
+			request: this.routed(spec.provider, spec.request)
+		});
+	}
+	/**
+	* 0.2.1+ activation entry: delegation tools call this instead of
+	* `start()`/`startContinuable()`, and its spec carries the same
+	* `request.agentOptions` this adapter already rewrites. Every other spec
+	* field (label, childId, signal, delivery) passes through untouched.
+	*
+	* @param spec - the activation spec published by the installed Host.
+	* @returns The official activation result.
+	*/
+	startActivation(spec) {
+		return publicMethod(OfficialSubagentRuntime.prototype, "OfficialSubagentRuntime", "startActivation").call(this, {
 			...spec,
 			request: this.routed(spec.provider, spec.request)
 		});
 	}
 };
 //#endregion
-export { ModelSwitchSubagentRuntime, StartupIncompatibilityError, profileSubagentRuntime as default, profileSubagentRuntime, mountWithStartupFallback, routeSubagentRequest, routedRuntimeUnavailableNotice };
+export { ModelSwitchSubagentRuntime, StartupIncompatibilityError, profileSubagentRuntime as default, profileSubagentRuntime, mountWithStartupFallback, routeSubagentRequest, routedRuntimeUnavailableNotice, subagentSurfaceOf };

package/lib/types/auto-review.d.ts

@@ -33,7 +33,17 @@ import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { Session } from '@deepseek-ai/dsh-session';
 /** Cordis plugin name used by loader diagnostics. */
 export declare const name = "model-switch-auto-review";
-/** The official gate's host services plus Model Switch's settings owner. */
+/**
+ * Only the services this row's own code touches.
+ *
+ * The official gate used to run inside this row's fiber, so this list had to
+ * mirror every service the official `apply` reads. DSH 0.2.1 added
+ * `workingDirectory` to the official gate and the mirror went stale, which made
+ * every tool call fail with `cannot get property "workingDirectory" without
+ * inject`. The gate is now mounted as its own plugin (see {@link autoReviewGate}),
+ * so cordis resolves the official dependency list — including future additions —
+ * and this row declares only what it reads itself.
+ */
 export declare const inject: string[];
 /** Pinned reviewer route; both identifiers are non-empty. */
 export interface AutoReviewRoute {
@@ -93,6 +103,42 @@ export declare function bindAutoReviewSessionCorrelation(scope: Context, activeS
  * @returns A child context shadowing only the llm service.
  */
 export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>): Context;
+/**
+ * Structural view of the official gate's plugin face.
+ *
+ * `name` and `inject` are part of the module's released plugin contract; the
+ * gate is mounted through cordis rather than called directly so its own
+ * dependency list is what the fiber resolves.
+ */
+export interface OfficialAutoReviewGate {
+    readonly apply: (ctx: Context) => void;
+    readonly inject?: readonly string[];
+    readonly name?: string;
+}
+/** The plugin face handed to cordis, with the official dependency list kept. */
+export interface MountedAutoReviewGate {
+    readonly name: string;
+    readonly inject?: string[];
+    readonly apply: (gateCtx: Context) => void;
+}
+/**
+ * Wrap the official gate as a plugin that declares its own dependencies.
+ *
+ * Directly calling `official.apply(scope)` ran the gate's code on this row's
+ * fiber, so every service the gate reads had to be mirrored in this row's
+ * `inject`. Mounting it instead lets cordis resolve the official list, which is
+ * what keeps a released Host's new dependency (0.2.1's `workingDirectory`) from
+ * breaking every tool call. The hooks let the caller observe whether the gate
+ * actually ran before it binds the session-correlation listener.
+ *
+ * @param gate - the official module (or an equivalent structural gate).
+ * @param hooks - applied/failure observers; the failure is rethrown.
+ * @returns A cordis plugin mounting the official gate unchanged.
+ */
+export declare function autoReviewGate(gate: OfficialAutoReviewGate, hooks?: {
+    readonly onApplied?: () => void;
+    readonly onFailure?: (error: unknown) => void;
+}): MountedAutoReviewGate;
 /**
  * Mount the official gate under the reviewer-route scope.
  *

package/lib/types/session-title.d.ts

@@ -138,9 +138,14 @@ export declare function composeTitleRoute(config: TitleLlmPolicy, route: Capabil
 export declare function selectTitleMessages(messages: readonly SessionTitleUserMessage[], firstPromptOnly: boolean): readonly SessionTitleUserMessage[];
 /**
  * Locate the official session-title provider row in the loader tree.
+ *
  * Disabled entries stay in the tree, so a name-matched disable still matches.
+ * The all-prompts row wins when it is present: that row only exists while the
+ * experimental session-titles bundle is composed, and its presence is exactly
+ * the user's choice to update titles with every prompt. The default
+ * first-prompt row is the fallback when that bundle is off.
  * @param loader - the host loader, when one is reachable.
- * @returns The official entry, or undefined when this profile has no such row.
+ * @returns The official entry to mirror, or undefined when this profile has no such row.
  */
 export declare function officialTitleEntry(loader: Loader | undefined): Entry | undefined;
 /**
@@ -270,6 +275,12 @@ export declare function titleSystemPrompt(targets: TitleLengthTargets, hasCurren
  * @returns The framed user input.
  */
 export declare function frameTitleInput(messages: readonly SessionTitleUserMessage[], currentTitle: string | undefined): string;
+/** Timing knobs for the takeover choreography (exported for tests). */
+export declare const TAKEOVER_RETRY_DELAY_MS = 10;
+/** How many times the takeover re-checks after disabling the official row. */
+export declare const TAKEOVER_MAX_ATTEMPTS = 20;
+/** Whether one loader entry declares an official naming provider this row supersedes. */
+export declare function isOfficialTitleRow(entry: Entry | undefined): boolean;
 /**
  * Mount the Model Switch session-naming row for this profile.
  *

package/lib/types/subagent-runtime.d.ts

@@ -21,6 +21,19 @@ export interface MountedStartup<T> {
     readonly dispose: () => Promise<void>;
 }
 type RoutableSubagentRequest = Pick<SubagentStartRequest, 'parent' | 'agentOptions'>;
+/**
+ * The 0.2.1+ activation spec, declared structurally.
+ *
+ * The pinned dependency typings predate the activation API, so the modern entry
+ * is described here and delegated through the base prototype. `request` carries
+ * the same `parent`/`agentOptions` pair the legacy start request does, which is
+ * why one route adapter serves both lines.
+ */
+export interface SubagentActivationSpecLike {
+    readonly provider: string;
+    readonly request: Pick<SubagentStartRequest, 'parent' | 'agentOptions'> & Record<string, unknown>;
+    readonly [field: string]: unknown;
+}
 /**
  * Inject one resolved route into a spawn that names none.
  *
@@ -34,6 +47,19 @@ type RoutableSubagentRequest = Pick<SubagentStartRequest, 'parent' | 'agentOptio
  * @returns The request to hand the official runtime.
  */
 export declare function routeSubagentRequest<T extends RoutableSubagentRequest>(request: T, route: SubagentRoute | undefined): T;
+/** The public start surface one installed Subagent runtime publishes. */
+export type SubagentSurfaceLine = 'activation' | 'start';
+/**
+ * Classify the runtime surface this Host publishes.
+ *
+ * DSH 0.2.1 replaced `start()` / `startContinuable()` with the activation API
+ * (`startActivation`), so a version-agnostic adapter has to recognize both
+ * lines instead of hard-coding one.
+ *
+ * @param value - a runtime class's prototype or a mounted runtime instance.
+ * @returns `activation` (0.2.1+), `start` (0.1.7/0.2.0), or undefined when neither is published.
+ */
+export declare function subagentSurfaceOf(value: unknown): SubagentSurfaceLine | undefined;
 /**
  * Mount a candidate and use the fallback only for typed startup incompatibility.
  *
@@ -68,5 +94,15 @@ export declare class ModelSwitchSubagentRuntime extends OfficialSubagentRuntime
     private routed;
     start(name: string, request: SubagentStartRequest): Promise<SubagentRun>;
     startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+    /**
+     * 0.2.1+ activation entry: delegation tools call this instead of
+     * `start()`/`startContinuable()`, and its spec carries the same
+     * `request.agentOptions` this adapter already rewrites. Every other spec
+     * field (label, childId, signal, delivery) passes through untouched.
+     *
+     * @param spec - the activation spec published by the installed Host.
+     * @returns The official activation result.
+     */
+    startActivation(spec: SubagentActivationSpecLike): Promise<unknown>;
 }
 export default profileSubagentRuntime;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",