dsh-plugin-subagent-director 0.1.0

package/lib/envelope.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Wire envelope parsing/validation/response helpers for the self-published
+ * "/subagent-director" settings bridge (src/remote.ts). Pure, zero-dependency
+ * (no cordis): every function here is unit-testable in a plain node
+ * environment and reused verbatim by the host route handler.
+ *
+ * The wire contract mirrors the generic Connection RPC channel that the client
+ * already speaks (dsh-client-connection/lib/client.js:10094-10113): the browser
+ * POSTs a "client-request" envelope and expects a "server-response" envelope
+ * echoing the same rpcId with an RpcResult in the result slot. We implement the
+ * host side directly on a webServer prefix route (kind:"prefix",
+ * path:"/subagent-director") instead of via connection.rpc, so a tree-external
+ * plugin needs no apiproxy changes.
+ *
+ * Referenced semantics: dsh-client-connection/lib/index.js:275-300
+ * (rpcFetchHandler) and 322-328 (fullResponse).
+ */
+import type { RpcResult } from '@deepseek-ai/dsh-host-apiproxy/api';
+/** The rpcId the host uses for envelopes that fail top-level validation. */
+export declare const INVALID_REQUEST_RPC_ID = "invalid-request";
+/** Wire "client-request" envelope a browser rpc.call sends to the channel. */
+export interface ClientRequestEnvelope {
+    type: 'client-request';
+    rpcId: string;
+    method: string;
+    payload: unknown;
+}
+/** Wire "server-response" envelope the host answers with. */
+export interface ServerResponseEnvelope<T = unknown> {
+    type: 'server-response';
+    rpcId: string;
+    result: RpcResult<T>;
+}
+/** Outcome of parsing/validating a "client-request" envelope body. */
+export type EnvelopeParseResult = {
+    ok: true;
+    envelope: ClientRequestEnvelope;
+} | {
+    ok: false;
+    issues: string[];
+};
+/**
+ * Parse and validate a decoded JSON body as a "client-request" envelope.
+ * Accepts only an object whose `type` is exactly "client-request", with string
+ * `rpcId` and `method`. Returns a structured outcome so the caller can build
+ * an "invalid client-request message" bad-request response.
+ */
+export declare function parseClientRequestEnvelope(body: unknown): EnvelopeParseResult;
+/**
+ * Build the "server-response" envelope for the requested rpcId carrying an
+ * RpcResult, mirroring dsh-client-connection/lib/index.js:322-328 (fullResponse).
+ */
+export declare function buildServerResponse<T>(rpcId: string, result: RpcResult<T>): ServerResponseEnvelope<T>;
+/**
+ * Build the bad-request "server-response" for a malformed client-request
+ * envelope. The host cannot trust the caller's rpcId on a malformed message,
+ * so it uses the fixed INVALID_REQUEST_RPC_ID (mirroring
+ * invalidEnvelopeResponse in dsh-client-connection/lib/index.js:302-309).
+ */
+export declare function buildBadRequestResponse(issues: readonly string[]): ServerResponseEnvelope;
+/**
+ * Build the bad-request "server-response" for a message whose `method` does not
+ * match the path-derived endpoint (mirroring
+ * dsh-client-connection/lib/index.js:289-293).
+ */
+export declare function buildMethodMismatchResponse(rpcId: string, method: unknown, endpoint: string): ServerResponseEnvelope;
+/**
+ * Whether a WHATWG URL hostname names the local loopback authority.
+ * Accepts "localhost", the IPv6 loopback literal "[::1]" (brackets retained, as
+ * WHATWG URL hostname does), or any IPv4 address in the 127/8 range. Rejects
+ * everything else. Mirrors the client-connection predicate
+ * (dsh-client-connection/lib/client.js:10135-10139).
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Classify a raw "Host" request header as loopback. Strips a port suffix and
+ * bracket-normalizes the authority before delegating to
+ * {@link isLoopbackHostname}. With no port present the header is treated as a
+ * bare hostname.
+ */
+export declare function isLoopbackHost(rawHost: string): boolean;
+/**
+ * Derive the endpoint segment from a pathname under the channel prefix.
+ * Returns undefined when the path is not "<channel>/<single-valid-segment>",
+ * mirroring the endpointFromPath semantics in
+ * dsh-client-connection/lib/index.js:310-315 but without a global pattern
+ * import. A valid endpoint is one non-empty segment with no "/", "." or ".."
+ * traversal segments.
+ */
+export declare function endpointFromPath(channel: string, pathname: string): string | undefined;
+/**
+ * The absolute path our bridge owns on the Host web server. Kept here (rather
+ * than only in bridge-contract) so the pure helpers and route handler share one
+ * literal.
+ */
+export declare const SUBAGENT_DIRECTOR_ROUTE_PATH = "/subagent-director";
+//# sourceMappingURL=envelope.d.ts.map

package/lib/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAEV,SAAS,EACV,MAAM,oCAAoC,CAAC;AAE5C,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,OAAO;IACjD,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,qBAAqB,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpC;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,CAyB7E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAErG;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,sBAAsB,CAOzF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,MAAM,GACf,sBAAsB,CAOxB;AAID;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAcvD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtF;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAC"}

package/lib/envelope.js

@@ -0,0 +1,136 @@
+/** The rpcId the host uses for envelopes that fail top-level validation. */
+export const INVALID_REQUEST_RPC_ID = 'invalid-request';
+/**
+ * Parse and validate a decoded JSON body as a "client-request" envelope.
+ * Accepts only an object whose `type` is exactly "client-request", with string
+ * `rpcId` and `method`. Returns a structured outcome so the caller can build
+ * an "invalid client-request message" bad-request response.
+ */
+export function parseClientRequestEnvelope(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        return { ok: false, issues: ['body must be a JSON object'] };
+    }
+    const record = body;
+    const issues = [];
+    if (record.type !== 'client-request') {
+        issues.push('type must equal "client-request"');
+    }
+    if (typeof record.rpcId !== 'string') {
+        issues.push('rpcId must be a string');
+    }
+    if (typeof record.method !== 'string') {
+        issues.push('method must be a string');
+    }
+    if (issues.length > 0)
+        return { ok: false, issues };
+    return {
+        ok: true,
+        envelope: {
+            type: 'client-request',
+            rpcId: record.rpcId,
+            method: record.method,
+            payload: record.payload,
+        },
+    };
+}
+/**
+ * Build the "server-response" envelope for the requested rpcId carrying an
+ * RpcResult, mirroring dsh-client-connection/lib/index.js:322-328 (fullResponse).
+ */
+export function buildServerResponse(rpcId, result) {
+    return { type: 'server-response', rpcId, result };
+}
+/**
+ * Build the bad-request "server-response" for a malformed client-request
+ * envelope. The host cannot trust the caller's rpcId on a malformed message,
+ * so it uses the fixed INVALID_REQUEST_RPC_ID (mirroring
+ * invalidEnvelopeResponse in dsh-client-connection/lib/index.js:302-309).
+ */
+export function buildBadRequestResponse(issues) {
+    const error = {
+        code: 'bad-request',
+        message: 'invalid client-request message',
+        details: { issues: [] },
+    };
+    return buildServerResponse(INVALID_REQUEST_RPC_ID, { ok: false, error });
+}
+/**
+ * Build the bad-request "server-response" for a message whose `method` does not
+ * match the path-derived endpoint (mirroring
+ * dsh-client-connection/lib/index.js:289-293).
+ */
+export function buildMethodMismatchResponse(rpcId, method, endpoint) {
+    const error = {
+        code: 'bad-request',
+        message: 'method ' + JSON.stringify(method) + ' does not match endpoint ' + JSON.stringify(endpoint),
+        details: { issues: [] },
+    };
+    return buildServerResponse(rpcId, { ok: false, error });
+}
+const IPV4_OCTET = /^\d{1,3}$/;
+/**
+ * Whether a WHATWG URL hostname names the local loopback authority.
+ * Accepts "localhost", the IPv6 loopback literal "[::1]" (brackets retained, as
+ * WHATWG URL hostname does), or any IPv4 address in the 127/8 range. Rejects
+ * everything else. Mirrors the client-connection predicate
+ * (dsh-client-connection/lib/client.js:10135-10139).
+ */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '[::1]')
+        return true;
+    const parts = hostname.split('.');
+    return (parts.length === 4 &&
+        parts[0] === '127' &&
+        parts.every((part) => IPV4_OCTET.test(part) && Number(part) <= 255));
+}
+/**
+ * Classify a raw "Host" request header as loopback. Strips a port suffix and
+ * bracket-normalizes the authority before delegating to
+ * {@link isLoopbackHostname}. With no port present the header is treated as a
+ * bare hostname.
+ */
+export function isLoopbackHost(rawHost) {
+    let host = rawHost.trim();
+    if (host.length === 0)
+        return false;
+    // IPv6 bracket literal may carry a trailing port: [::1]:3090
+    if (host.startsWith('[')) {
+        const close = host.indexOf(']');
+        if (close === -1)
+            return false;
+        host = host.slice(0, close + 1);
+    }
+    else {
+        // Split off the first colon that separates host:port (plain hostnames/IPv4).
+        const colon = host.indexOf(':');
+        if (colon !== -1)
+            host = host.slice(0, colon);
+    }
+    return isLoopbackHostname(host);
+}
+/**
+ * Derive the endpoint segment from a pathname under the channel prefix.
+ * Returns undefined when the path is not "<channel>/<single-valid-segment>",
+ * mirroring the endpointFromPath semantics in
+ * dsh-client-connection/lib/index.js:310-315 but without a global pattern
+ * import. A valid endpoint is one non-empty segment with no "/", "." or ".."
+ * traversal segments.
+ */
+export function endpointFromPath(channel, pathname) {
+    if (!pathname.startsWith(channel + '/'))
+        return undefined;
+    const endpoint = pathname.slice(channel.length + 1);
+    if (endpoint.length === 0)
+        return undefined;
+    if (endpoint.split('/').some((segment) => segment.length === 0 || segment === '.' || segment === '..')) {
+        return undefined;
+    }
+    return endpoint;
+}
+/**
+ * The absolute path our bridge owns on the Host web server. Kept here (rather
+ * than only in bridge-contract) so the pure helpers and route handler share one
+ * literal.
+ */
+export const SUBAGENT_DIRECTOR_ROUTE_PATH = '/subagent-director';
+//# sourceMappingURL=envelope.js.map

package/lib/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAsBA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAsBxD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,MAAM,CAAC,KAAe;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAgB;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAI,KAAa,EAAE,MAAoB;IACxE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAyB;IAC/D,MAAM,KAAK,GAAa;QACtB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gCAAgC;QACzC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACxB,CAAC;IACF,OAAO,mBAAmB,CAAC,sBAAsB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,MAAe,EACf,QAAgB;IAEhB,MAAM,KAAK,GAAa;QACtB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,2BAA2B,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QACpG,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACxB,CAAC;IACF,OAAO,mBAAmB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,6DAA6D;IAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAgB;IAChE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC"}

package/lib/guidance.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Main-agent role guidance section (design section 8).
+ *
+ * Registers a system-prompt section listing the configured Subagent Director
+ * role templates so the main agent knows which roles exist, what each does,
+ * and how to delegate to one. The section order (117) sits just after
+ * dsh-tool-subagent's tool paragraph (116.5) to stay locally associated.
+ *
+ * Dependency handling: ctx.systemPrompt is optional. When the service is not
+ * mounted we skip registration entirely (zero intrusion). When it is mounted
+ * but there are no roles, the section text provider renders empty and
+ * renderPrompt drops it — the observable AC-6.1 behaviour (no roles, no
+ * section) while staying robust to roles appearing at runtime.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SubagentDirectorSettings } from './settings.js';
+/** Prompt order: just after dsh-tool-subagent's 116.5 tool section. */
+export declare const GUIDANCE_SECTION_ORDER = 117;
+/** Stable, unique section name (configuration changes only affect new assemblies). */
+export declare const GUIDANCE_SECTION_NAME = "subagent-director:roles";
+/**
+ * Pure projection of the role settings onto the guidance prose the main agent
+ * reads. Returns '' when there are no roles so the assembled section is dropped.
+ * @param settings - current resolved settings snapshot.
+ * @param toolName - the configured model-facing delegation tool name.
+ */
+export declare function renderRolesGuidance(settings: SubagentDirectorSettings, toolName: string): string;
+/**
+ * Register the role guidance section, or no-op when the systemPrompt service
+ * is absent. Evalutes roles from the live settings snapshot at each assembly.
+ * @param ctx - plugin context.
+ * @param getSettings - returns the current settings snapshot.
+ * @param toolName - the configured model-facing tool name.
+ * @returns the exact section disposer, or undefined when skipped.
+ */
+export declare function applyGuidance(ctx: Context, getSettings: () => SubagentDirectorSettings, toolName: string): (() => void) | undefined;
+//# sourceMappingURL=guidance.d.ts.map

package/lib/guidance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../src/guidance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBhG;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,MAAM,wBAAwB,EAC3C,QAAQ,EAAE,MAAM,GACf,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAQ1B"}

package/lib/guidance.js

@@ -0,0 +1,46 @@
+/** Prompt order: just after dsh-tool-subagent's 116.5 tool section. */
+export const GUIDANCE_SECTION_ORDER = 117;
+/** Stable, unique section name (configuration changes only affect new assemblies). */
+export const GUIDANCE_SECTION_NAME = 'subagent-director:roles';
+/**
+ * Pure projection of the role settings onto the guidance prose the main agent
+ * reads. Returns '' when there are no roles so the assembled section is dropped.
+ * @param settings - current resolved settings snapshot.
+ * @param toolName - the configured model-facing delegation tool name.
+ */
+export function renderRolesGuidance(settings, toolName) {
+    const roles = settings.roles ?? {};
+    const entries = Object.entries(roles).filter(([, role]) => role !== undefined);
+    if (entries.length === 0)
+        return '';
+    const lines = [
+        'Subagent Director roles — delegate one of these role-bound subagents when the task matches its description. Each role may bind a model; when it does, the subagent runs on that model route.',
+    ];
+    for (const [id, role] of entries) {
+        const bound = role.provider !== undefined && role.provider !== '' ?
+            role.model !== undefined && role.model !== '' ? ` (model: ${role.provider}/${role.model})` : ` (provider: ${role.provider})` :
+            '';
+        lines.push(`- ${role.displayName || id}${bound}: ${role.description}`);
+        lines.push(`    Delegate with: ${toolName}({ role: "${id}", prompt: "..." })`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Register the role guidance section, or no-op when the systemPrompt service
+ * is absent. Evalutes roles from the live settings snapshot at each assembly.
+ * @param ctx - plugin context.
+ * @param getSettings - returns the current settings snapshot.
+ * @param toolName - the configured model-facing tool name.
+ * @returns the exact section disposer, or undefined when skipped.
+ */
+export function applyGuidance(ctx, getSettings, toolName) {
+    const systemPrompt = ctx.get('systemPrompt');
+    if (systemPrompt === undefined)
+        return undefined;
+    return systemPrompt.section({
+        name: GUIDANCE_SECTION_NAME,
+        order: GUIDANCE_SECTION_ORDER,
+        text: () => renderRolesGuidance(getSettings(), toolName),
+    });
+}
+//# sourceMappingURL=guidance.js.map

package/lib/guidance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guidance.js","sourceRoot":"","sources":["../src/guidance.ts"],"names":[],"mappings":"AAiBA,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkC,EAAE,QAAgB;IACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAa;QACtB,8LAA8L;KAC/L,CAAC;IACF,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GACT,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAC9H,EAAE,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,WAA2C,EAC3C,QAAgB;IAEhB,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,YAAY,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC;KACzD,CAAC,CAAC;AACL,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Subagent Director — host plugin composition entry (design section 3).
+ *
+ * Wires the settings section, the role-guidance section, and the subagent_role
+ * delegation tool. Reads user settings live; a deployment without a settings
+ * provider degrades to an empty resolved section (zero intrusion).
+ *
+ * Dependency posture: tools/subagents/llm/settings are required through inject
+ * (both web and headless bundles mount the settings service); systemPrompt
+ * remains optional and is acquired lazily so its absence does not block the
+ * rest. The webServer-dependent HTTP bridge lives in the separate
+ * \`subagent-director-bridge\` entry (src/bridge-entry.ts).
+ *
+ * Background modes: 'one-shot' defaults calls to foreground and runs background
+ * calls as a plain Task; 'continuable' defaults them to background via
+ * ctx.subagents.startContinuable() and requires the transport provider's
+ * prepareContinuable capability, which is validated at mount time (mirrors
+ * dsh-tool-subagent).
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export { Config } from './config.js';
+export type { DirectorConfig } from './config.js';
+export { assertDelegationCapabilities, buildSubagentRequest, createDelegationParameters, createDelegationOutputSchema, createDelegationTool, DELEGATION_TOOL_PREFIX, resolveDelegationMode, renderDelegationResult, type DelegationToolArgs, type DelegationResult, type DelegationRoute, type DelegationModeDecision, type SubagentRequestParts, } from './delegation-tool.js';
+export { applyGuidance, renderRolesGuidance, GUIDANCE_SECTION_ORDER, GUIDANCE_SECTION_NAME } from './guidance.js';
+export { SUBAGENT_DIRECTOR_SETTINGS_NAMESPACE, SettingsSchema, validateDirectorSettings, installDirectorSettings, type RoleTemplate, type SubagentDirectorSettings, } from './settings.js';
+export declare const name = "subagent-director";
+export declare const inject: string[];
+export declare function apply(ctx: Context, config: import('./config.js').DirectorConfig): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAQnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,wBAAwB,GAC9B,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,IAAI,sBAAsB,CAAC;AAExC,eAAO,MAAM,MAAM,UAA4C,CAAC;AAEhE,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,aAAa,EAAE,cAAc,QAuD/E"}

package/lib/index.js

@@ -0,0 +1,63 @@
+import { assertSubagentMaxDepth } from '@deepseek-ai/dsh-subagent';
+import { createDelegationTool } from './delegation-tool.js';
+import { applyGuidance } from './guidance.js';
+import { installDirectorSettings } from './settings.js';
+export { Config } from './config.js';
+export { assertDelegationCapabilities, buildSubagentRequest, createDelegationParameters, createDelegationOutputSchema, createDelegationTool, DELEGATION_TOOL_PREFIX, resolveDelegationMode, renderDelegationResult, } from './delegation-tool.js';
+export { applyGuidance, renderRolesGuidance, GUIDANCE_SECTION_ORDER, GUIDANCE_SECTION_NAME } from './guidance.js';
+export { SUBAGENT_DIRECTOR_SETTINGS_NAMESPACE, SettingsSchema, validateDirectorSettings, installDirectorSettings, } from './settings.js';
+export const name = 'subagent-director';
+export const inject = ['tools', 'subagents', 'llm', 'settings'];
+export function apply(ctx, config) {
+    const backgroundMode = config.backgroundMode ?? 'one-shot';
+    const toolName = config.toolName ?? 'subagent_role';
+    const providerName = config.subagentProvider ?? 'spawn';
+    // NOTE: the /subagent-director settings bridge route is installed by the
+    // separate `subagent-director-bridge` plugin entry (src/bridge-entry.ts),
+    // which injects webServer — tree-external plugins cannot see that service
+    // through ctx.get(). The main entry must not touch webServer, or headless
+    // profiles would lose the delegation tool.
+    // ---- settings snapshot -------------------------------------------------
+    let settings = {};
+    installDirectorSettings(ctx, {}, {
+        setSource: (current) => {
+            settings = current();
+        },
+        onChange: () => {
+            // snapshot already updated by setSource; nothing further to do in M1.
+        },
+    });
+    const getSettings = () => settings;
+    // ---- role guidance ----------------------------------------------------
+    applyGuidance(ctx, getSettings, toolName);
+    // ---- delegation tool registration ------------------------------------
+    if (typeof config.maxDepth === 'number')
+        assertSubagentMaxDepth(config.maxDepth);
+    let disposeTool;
+    const mount = (provider) => {
+        if (typeof config.maxDepth === 'number' && !provider.capabilities.depthLimit) {
+            throw new Error('subagent-director: provider "' + provider.name + '" cannot enforce maxDepth (no depthLimit capability) — set maxDepth: \'provider-managed\'');
+        }
+        if (backgroundMode === 'continuable' && provider.prepareContinuable === undefined) {
+            throw new Error('subagent-director: provider "' + provider.name + '" does not support backgroundMode: continuable — switch the subagent provider or use backgroundMode: "one-shot"');
+        }
+        ctx.logger.info('[' + name + '] registering ' + toolName + ' on subagent transport ' + '"' + providerName + '"' + ' with backgroundMode ' + '"' + backgroundMode + '"');
+        disposeTool = ctx.tools.register(createDelegationTool({ ctx, config, provider, getSettings }));
+    };
+    ctx.on('subagent/provider-added', (provider) => {
+        if (provider.name === providerName && disposeTool === undefined)
+            mount(provider);
+    });
+    ctx.on('subagent/provider-removed', (name2) => {
+        if (name2 !== providerName || disposeTool === undefined)
+            return;
+        disposeTool();
+        disposeTool = undefined;
+    });
+    const present = ctx.subagents.getProvider(providerName);
+    if (present !== undefined)
+        mount(present);
+    else
+        ctx.logger.info('[' + name + '] subagent provider ' + '"' + providerName + '" not registered yet; the "' + toolName + '" tool will register when it appears');
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GAMvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,EACL,oCAAoC,EACpC,cAAc,EACd,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAEhE,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA4C;IAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,UAAU,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC;IACpD,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC;IAExD,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,2CAA2C;IAE3C,2EAA2E;IAC3E,IAAI,QAAQ,GAAqD,EAAE,CAAC;IACpE,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE;QAC/B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YACrB,QAAQ,GAAG,OAAO,EAAE,CAAC;QACvB,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE;YACb,sEAAsE;QACxE,CAAC;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,GAAqD,EAAE,CAAC,QAAQ,CAAC;IAErF,0EAA0E;IAC1E,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE1C,yEAAyE;IACzE,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,WAAqC,CAAC;IAE1C,MAAM,KAAK,GAAG,CAAC,QAA0B,EAAE,EAAE;QAC3C,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,QAAQ,CAAC,IAAI,GAAG,2FAA2F,CAAC,CAAC;QACjK,CAAC;QACD,IAAI,cAAc,KAAK,aAAa,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,QAAQ,CAAC,IAAI,GAAG,iHAAiH,CAAC,CAAC;QACvL,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,GAAG,GAAG,IAAI,GAAG,gBAAgB,GAAG,QAAQ,GAAG,yBAAyB,GAAG,GAAG,GAAG,YAAY,GAAG,GAAG,GAAG,uBAAuB,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,CACvJ,CAAC;QACF,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,yBAAyB,EAAE,CAAC,QAA0B,EAAE,EAAE;QAC/D,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,2BAA2B,EAAE,CAAC,KAAa,EAAE,EAAE;QACpD,IAAI,KAAK,KAAK,YAAY,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO;QAChE,WAAW,EAAE,CAAC;QACd,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,CAAC,CAAC;;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,sBAAsB,GAAG,GAAG,GAAG,YAAY,GAAG,6BAA6B,GAAG,QAAQ,GAAG,sCAAsC,CAAC,CAAC;AACrK,CAAC"}

package/lib/remote.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Subagent Director — self-published setting bridge on the Host web server
+ * (design fix: "namespace not exposed").
+ *
+ * The Web settings client read/writes the plugin's `subagent-director`
+ * namespace via a dedicated "/subagent-director" webServer prefix route instead
+ * of the Host apiproxy's settings.describe/mutate, which the API proxy gates
+ * behind its hard-coded exposedNamespaces() allowlist
+ * (dsh-host-apiproxy). A tree-external plugin cannot add its own namespace to
+ * that list, so those calls answer `settings-not-exposed`. To bypass the
+ * allowlist without touching apiproxy, this module self-publishes a prefix
+ * route (kind:"prefix", path:"/subagent-director") via `ctx.webServer.register`
+ * (dsh-host-webserver/lib/index.js:53-60) and reads/writes `ctx.settings`
+ * itself.
+ *
+ * The wire contract mirrors the settings domain slice apiproxy exposes for
+ * one namespace: `settingsView` returns `{ writable, view }` where `view` is a
+ * `SettingsNamespaceView` (redacted), and `settingsMutate` applies path ops
+ * with an optimistic `expectedRevision` and returns the new redacted view, or
+ * an error with the same `settings-conflict` / `settings-rejected` semantics so
+ * the existing client conflict-reload logic works unchanged. The client already
+ * speaks this contract unchanged (dsh-client-connection/lib/client.js:10094-10113
+ * and src/client/store.ts), so no client change is required.
+ *
+ * Pure mapping / wire-envelope helpers live at the top (no cordis) so they are
+ * unit-testable in a plain node environment. The route handler is a node:http
+ * (req, res) handler, mirroring the Connection channel semantics in
+ * dsh-client-connection/lib/index.js:275-300 and 322-328, plus a lightweight
+ * loopback Host fence.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Context } from '@deepseek-ai/cordis';
+import { SettingsConflictError, type SettingsDescriptor, type SettingsProvider } from '@deepseek-ai/dsh-settings';
+import type { RpcResult, RpcError, SettingsNamespaceView, SettingsPathOpView } from '@deepseek-ai/dsh-host-apiproxy/api';
+import { SettingsSchema } from './settings.js';
+import { SUBAGENT_DIRECTOR_RPC_VIEW, SUBAGENT_DIRECTOR_RPC_MUTATE, type DirectorMutateRequest, type DirectorViewSuccess } from './bridge-contract.js';
+import { SUBAGENT_DIRECTOR_ROUTE_PATH } from './envelope.js';
+/** Wire route path the bridge owns on the Host web server. */
+export { SUBAGENT_DIRECTOR_ROUTE_PATH as SUBAGENT_DIRECTOR_RPC_CHANNEL };
+/** Endpoint that returns the namespace's redacted wire view. */
+export { SUBAGENT_DIRECTOR_RPC_VIEW };
+/** Endpoint that applies one path-op mutation. */
+export { SUBAGENT_DIRECTOR_RPC_MUTATE };
+/** Request payload for the settingsMutate bridge endpoint. */
+export type { DirectorMutateRequest, DirectorViewSuccess };
+/**
+ * Map one redacted settings descriptor to its wire view — mirrors apiproxy's
+ * `namespaceView` (dsh-host-apiproxy/lib/index.js:2385-2399) exactly, so the
+ * client store sees the same `SettingsNamespaceView` shape it already renders.
+ */
+export declare function toDirectorNamespaceView(descriptor: SettingsDescriptor): SettingsNamespaceView;
+/**
+ * Find the Subagent Director namespace in a redacted describe result and map
+ * it to its wire view; `undefined` when the namespace is not registered.
+ */
+export declare function pickDirectorNamespaceView(descriptors: readonly SettingsDescriptor[]): SettingsNamespaceView | undefined;
+/**
+ * Read the current redacted namespace view straight from the settings seam.
+ * Exported for reuse by tests and by the bridge handler.
+ */
+export declare function readDirectorNamespaceView(settings: SettingsProvider): DirectorViewSuccess;
+/** Build the `settings-rejected` RPC error for one seam failure. */
+export declare function directorRejected(ns: string, error: unknown): RpcError;
+/** Build the `settings-conflict` RPC error, mirroring apiproxy's mapping. */
+export declare function directorConflict(conflict: SettingsConflictError): RpcError;
+/**
+ * Build the ok payload for the settingsView endpoint.
+ * Mirrors the apiproxy `settings.describe` value minus `hasDocument` (the
+ * bridge does not own the document affordance; the client ignores it).
+ */
+export declare function directorViewOk(settings: SettingsProvider): RpcResult<DirectorViewSuccess>;
+/**
+ * Execute one path-op mutation against the settings seam and map the outcome
+ * to an RpcResult carrying the new redacted view (or a `settings-conflict` /
+ * `settings-rejected` error). Pure over the injected primitives for testing.
+ */
+export declare function directorMutate(mutate: SettingsProvider['mutate'], describe: SettingsProvider['describe'], ns: string, ops: readonly SettingsPathOpView[], expectedRevision: number | undefined): Promise<RpcResult<SettingsNamespaceView>>;
+/** Re-export the wire-envelope helpers so tests import them from one place. */
+export { parseClientRequestEnvelope, isLoopbackHost, isLoopbackHostname, endpointFromPath, buildServerResponse, buildMethodMismatchResponse, buildBadRequestResponse, INVALID_REQUEST_RPC_ID, } from './envelope.js';
+/**
+ * The node:http handler for the "/subagent-director" prefix route. Owns the
+ * full response lifecycle. Wire contract mirrors the generic Connection RPC
+ * channel (dsh-client-connection/lib/index.js:275-328):
+ *   - non-POST        → 404 "not found"
+ *   - wrong content-type → 415
+ *   - unparseable JSON body → 400 "body is not JSON"
+ *   - malformed client-request envelope → 200 bad-request (fixed rpcId)
+ *   - method vs endpoint mismatch → 200 bad-request
+ *   - non-loopback Host header → 403 "forbidden" (lightweight trust fence)
+ *   - dispatch error → 500 "handler failure: ..."
+ */
+export declare function handleDirectorBridgeRequest(settings: SettingsProvider, req: IncomingMessage, res: ServerResponse): Promise<void>;
+/**
+ * Install the Subagent Director setting bridge on the Host web server via a
+ * self-published prefix route. Lazy-acquires `ctx.webServer`; a deployment
+ * without that service (e.g. headless) logs a debug line naming the missing
+ * service and installs nothing. Returns a disposer.
+ */
+export declare function installDirectorRemoteBridge(ctx: Context): () => void;
+/** Convenience re-export for the namespaced schema used to document the view. */
+export { SettingsSchema };
+//# sourceMappingURL=remote.d.ts.map

package/lib/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../src/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,qBAAqB,EAErB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,SAAS,EACT,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,cAAc,EAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAQ7B,MAAM,eAAe,CAAC;AAEvB,8DAA8D;AAC9D,OAAO,EAAE,4BAA4B,IAAI,6BAA6B,EAAE,CAAC;AACzE,gEAAgE;AAChE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,kDAAkD;AAClD,OAAO,EAAE,4BAA4B,EAAE,CAAC;AACxC,8DAA8D;AAC9D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,kBAAkB,GAAG,qBAAqB,CAc7F;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACzC,qBAAqB,GAAG,SAAS,CAOnC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,mBAAmB,CAMzF;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,QAAQ,CAMrE;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,QAAQ,CAa1E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,CAAC,mBAAmB,CAAC,CAEzF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAClC,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,EACtC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,SAAS,kBAAkB,EAAE,EAClC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAwB3C;AAED,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAqFD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CA2BpE;AAiCD,iFAAiF;AACjF,OAAO,EAAE,cAAc,EAAE,CAAC"}