dsh-pstack 0.2.0-beta.1 → 0.2.0

package/dist/skills/authored/setup-project-docs/references/decision-conventions.md

@@ -0,0 +1,13 @@
+# Decision-record conventions
+
+When decision records are enabled, draft `<dir>/AGENTS.md` as the repository's authoritative format, scope, status, and search reference. Include:
+
+- The five-field header: `Status`, `Date`, `Scope`, `Implemented-by`, `Review`.
+- The status/anchor pair rule and transitions, including immediate supersession by a new draft. A replaced `proposed` record retains `Implemented-by: -`; preserve its body rather than deleting or reverting it.
+- Before starting any repository task, read the headers of every `proposed` and `accepted` record, then select by `Scope` against the task and its affected paths and read the full text of relevant records. `accepted` records constrain current implementation; `proposed` records state the intended direction. When the task conflicts with a relevant record, report the conflict and obtain the user's direction before proceeding.
+- Related-record search and classification before writing or substantially updating a record.
+- `decision-write` as the entry rule for every record change.
+- One `Scope` matcher shared by writing and auditing, including repository-relative paths and directory globs that cover descendants.
+- `Superseded-by` with the replacing record path and one-line reason for every `superseded` record.
+
+Adapt `decision-write`'s fallback template to the repository's language and conventions. Require a real implementation anchor to intersect `Scope` and include a path outside `<dir>`. Permit a record-only commit only through `decision-write`'s explicitly confirmed Land exception, and state that audits continue to report it.

package/dist/skills/authored/setup-project-docs/references/decision-conventions.zh.md

@@ -0,0 +1,13 @@
+# 决策记录约定
+
+启用决策记录时，起草 `<dir>/AGENTS.md`，作为仓库中格式、范围、状态与检索规则的权威参考。包括：
+
+- 五字段头部：`Status`、`Date`、`Scope`、`Implemented-by`、`Review`。
+- 状态/锚点成对规则与状态流转，包括新草稿立即取代旧记录。被取代的 `proposed` 记录保留 `Implemented-by: -`；保留旧正文，不删除、不回退。
+- 开始每项仓库任务前，读取所有 `proposed` 与 `accepted` 记录的头部，再按任务及其涉及的路径与 `Scope` 筛选并读取相关记录的正文。`accepted` 记录约束当前实现；`proposed` 记录表示待落地方向。任务与相关记录冲突时，先报告冲突并取得用户指示，再继续。
+- 写入或实质更新记录前检索并分类相关记录。
+- 以 `decision-write` 作为所有记录修改的入口。
+- 写入与审计共用同一 `Scope` 匹配规则，路径相对于仓库根目录，目录 glob 覆盖所有后代。
+- 每条 `superseded` 记录都带 `Superseded-by`，包含替代记录路径和一句原因。
+
+以 `decision-write` 的回退模板为基础，适配仓库的语言与约定。真实实现锚点的路径须与 `Scope` 相交，且至少一个路径在 `<dir>` 之外；仅允许通过 `decision-write` 落地模式中经用户明确确认的例外使用仅记录提交，并写明审计仍会报告该例外。

package/dist/skills/vendored/retro/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: retro
+description: "Conduct a retrospective on a coding session."
+disable-model-invocation: true
+---
+
+The user has asked for a **retrospective**. You are suggesting improvements to the coding agent's **environment** to improve future runs.
+
+## Steps
+
+1. Call the Skill tool with `writing-for-agents` for the writing style guide.
+
+2. Read the primary sources for the session the user specifies. This may mean searching through session logs on this machine. If the user doesn't specify a session, default to the current one.
+
+3. Look for candidates for improvement in these categories.
+
+- **Navigation**: how easy was it for the agent to find the right files? Are there hidden dependencies between files? Would a **navigation pointer** make it easier? _Use when_ the session took a long time to find a piece of information.
+- **Automated checks**: are there automated checks that could catch errors the agent made? Linting, typing, tests, filesystem linters? Read the repo's own check command first (its `package.json`/build-tool `lint`/`check` scripts, its CI workflow), so a check that already exists but sits unwired or silently broken is the finding, not a reinvention. A repo with no **guardrail** (no pre-commit hook and no CI job running its lint/typecheck/test command) is itself a finding: an un-linted repo is a standing missed opportunity, not a neutral default. _Use when_ the agent made a mistake an automated check could have caught, or the repo has no guardrail at all.
+- **Coding standards**: should the **reviewer agent** be given a new rule to enforce? Should an existing rule be removed or clarified? Classify the violation first: a **mechanical** one (a fixed syntactic pattern, a banned API, an import shape, a file-location rule) gets a deterministic check, full stop: a custom rule in the repo's own linter, a new pre-commit hook, or a new CI job, whichever the repo's language and existing guardrail make cheapest. Default to building the check over writing the rule. Reserve `CODING_STANDARDS.md` for genuine **judgement calls** (cross-file consistency, "matches the surrounding style," anything no guardrail could ever substitute for). _Use when_ the reviewer agent failed to catch a mistake.
+- **Global AGENTS.md**: are there any steering instructions that should be moved to coding standards (or automated checks) instead? _Use when_ the AGENTS.md file is particularly large - in the repo OR the user's global scope.
+- **Tool economy**: did the agent make expensive tool calls that could be streamlined? Is there any custom tooling (CLI's, MCP's) that is particularly token-inefficient? _Use when_ the agent made an expensive tool call.
+- **No-ops**: look for instructions in steering files that don't modify the agent's behavior. _Use when_ the steering files are large and unwieldy.
+- **Information access**: look for opportunities to increase the agent's access to information. Teeing dev server logs, readonly access to third-party services. _Use when_ a crucial piece of information was not available to the agent.
+
+4. Present these candidates to the user, in order of severity.
+
+## Reference
+
+### Implementation vs Review
+
+Remember that all work goes through two stages: implementation and review. The implementation agent has the most **context pressure**. They are responsible for exploration, writing code, and debugging failures.
+
+The review agent has the least context pressure - it receives a diff, so no exploration needed. It often does not need to write code or debug.
+
+This means that the review agent should be responsible for imposing coding standards, not the implementation agent.
+
+### Files
+
+You have access to several files in the repo:
+
+- `CLAUDE.md`/`AGENTS.md`: these files are pushed to the context window of any agent working in this repo. They should be used incredibly sparingly, usually only for **navigation pointers** to other files.
+- `CODING_STANDARDS.md`: this file is read during review, not implementation. Add **navigation pointers** to docs folders if the standards file gets more than 1,000 lines long.
+- Docs: use docs as references files, pointed to by other files. Look for existing docs before writing new ones.
+- Skills: use skills for docs (since their description goes into the agent's context window), or for user-invoked commands. Follow the advice in the `writing-for-agents` skill.

package/dist/skills/vendored/retro/agents/openai.yaml

@@ -0,0 +1,5 @@
+interface:
+  display_name: "Retro"
+  short_description: "Conduct a retrospective on a coding session."
+policy:
+  allow_implicit_invocation: false

package/dist/skills/vendored/writing-for-agents/SKILL-MECHANICS.md

@@ -0,0 +1,22 @@
+# Skill mechanics
+
+The skill-specific branch of [`writing-for-agents`](SKILL.md): what changes when the document is a skill (frontmatter, the invocation choice, and router skills). Everything else about writing it is the universal reference in `SKILL.md`.
+
+## Invocation
+
+Two choices, trading the two loads:
+
+- A **model-invoked** skill keeps a `description`, so the agent can fire it autonomously, and other skills can reach it. You can still type its name: model-invocation always _includes_ user reach; a description only ever adds agent discovery, never removes the human's. The description is the skill's top-level context pointer, forced to stay loaded at all times: permanent context load in exchange for discoverability. A model-invoked skill whose content is all reference is also one home for shared reference: another skill can invoke it, so reference needed by several skills lives in one place. Mechanics: omit `disable-model-invocation`, and write a model-facing description carrying the trigger branches (the pointer-writing rules in `SKILL.md` apply in full).
+- A **user-invoked** skill strips the description from the agent's reach: only the human typing its name can invoke it, and no other skill can. Zero context load, but it spends cognitive load: you are the index that must remember it exists. Mechanics: set `disable-model-invocation: true`; the `description` becomes human-facing: a one-line summary, trigger lists stripped.
+
+Pick model-invocation only when the agent must reach the skill on its own, or another skill must. If it only ever fires by hand, make it user-invoked and pay no context load.
+
+Shared reference that two user-invoked skills both need can live in neither: with no descriptions, neither can fire the other. Push it to a plain file outside the skill system: external reference any skill can point at.
+
+## Splitting by invocation
+
+The invocation cut of splitting (the sequence cut lives in `SKILL.md`): split off a model-invoked skill when you have a distinct leading word that should trigger it on its own (a trigger word you actually use in your prompts), or another skill must reach it. You pay context load for the new always-loaded description, so that independent reach has to be worth it.
+
+## Router skills
+
+When user-invoked skills multiply past what you can remember, that piled-up cognitive load is cured by a **router skill**: one user-invoked skill that names the others and when to reach for each, so the human has one skill to remember instead of many. It can only hint, never fire them: user-invoked skills have no description, so nothing but the human can reach them.

package/dist/skills/vendored/writing-for-agents/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: writing-for-agents
+description: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.
+---
+
+Reference for writing any document an agent consumes: a skill, an `AGENTS.md` / `CLAUDE.md`, a doc reached by a pointer. The packaging differs; the writing does not: the same levers make each one predictable, since the agent takes the same _process_ every run rather than producing the same output.
+
+When the document you're writing is a skill, read [`SKILL-MECHANICS.md`](SKILL-MECHANICS.md) for frontmatter, invocation choice, and router skills.
+
+## Context pointers
+
+A **context pointer** is a reference held in the agent's context that names some out-of-context material and encodes the condition for reaching it. A skill's description is one; a line in `AGENTS.md` naming a doc is the same object. The pointer's _wording_, not its target, decides when the agent reaches the material, and how reliably. A must-have target behind a weakly worded pointer is a variance bug: sharpen the wording first, and inline the material only if sharpening fails.
+
+A pointer does two jobs: state what the material is, and list the **branches** that should trigger reaching it (a branch is a distinct case the document handles, so different runs take different paths through it). Every word of an always-loaded pointer costs on every turn, so it earns even harder pruning than the body:
+
+- **Front-load the leading word**: the pointer is where it does its triggering work.
+- **One trigger per branch.** Synonyms that rename a single branch are one branch written twice; collapse them and keep only genuinely distinct branches.
+- **Cut identity the body already carries.**
+
+## The two loads
+
+Every document and pointer you add spends one of two budgets:
+
+- **Context load** is the cost of always-loaded material on the agent's window: an `AGENTS.md` line, a skill description, anything sitting in context every turn, spending tokens and attention whether or not it fires.
+- **Cognitive load** is the cost on the human: which documents exist and when to reach for each. The human is the index. Not a cost to minimise: it is the price of human agency; spend it where human judgement matters, remove it where it does not.
+
+Material reached only through a pointer escapes context load at the price of the pointer's own line; material with no pointer at all rides entirely on cognitive load.
+
+## Information hierarchy
+
+A document is built from two content types: **steps** (the ordered actions the agent performs) and **reference** (definitions, rules, facts consulted on demand). The two mix freely: all steps (a recipe), all reference (a review's rules, this skill), or both. The core decision is where each piece sits on the **information hierarchy**, a ladder ranked by how immediately the agent needs the material:
+
+1. **In-file step** is the primary tier: what the agent does, in order.
+2. **In-file reference** is consulted on demand. Often a legitimately flat peer-set (every rule of a review on one rung), which is a fine arrangement, not a smell.
+3. **Disclosed reference** is pushed out into a separate file, reached by a context pointer, loaded only when the pointer fires. Spans a sibling file in the same folder through fully external reference that lives anywhere and any document can point at.
+
+Push too little down and the top bloats; push too much and you hide material the agent actually needs. That tension is the whole decision.
+
+**Progressive disclosure** is the move down the ladder (out of the main file and behind a pointer) so the top stays legible. Not primarily a token optimisation: it is how the hierarchy is protected. Branching is the cleanest disclosure test: inline what every branch needs, and push behind a pointer what only some branches reach. When a document has steps, in-file reference that should be disclosed buries them and turns attending to them into a coin-flip: a variance lever, not just a legibility one.
+
+**Co-location** is the within-file companion: where the ladder decides _how far down_ a piece sits, co-location decides _what sits beside it_ once there. Keep a concept's definition, rules, and caveats under one heading rather than scattered, so reading one part brings its neighbours with it. The test: the document should read like documentation written for the agent. Grouped material reads that way; scattered material does not. (Distinct from duplication: that repeats one meaning in two places; scattering fragments one meaning across many.)
+
+**Sprawl** is the failure mode here: a document simply too long, even when every line is live and unique. Attention thins across the excess, and every extra line is one more to keep relevant. The cure is the ladder: disclose reference behind pointers, and split by branch or sequence so each path carries only what it needs.
+
+## Steps and completion criteria
+
+Every step ends on a **completion criterion**, the condition that tells the agent the work is done. Two properties make it a lever:
+
+- **Clarity**: can the agent tell done from not-done? A vague bound ("understanding reached") invites **premature completion**: ending the step before it is genuinely done, attention slipping to _being done_. The visible steps still ahead (the **post-completion steps**) supply the pull; the criterion's clarity is the resistance. Defend in order: **sharpen the bound first** (local and cheap); only if it is irreducibly fuzzy _and_ you observe the rush, hide the later steps by splitting the sequence. Hiding only works across a real context boundary (a hand-off or a subagent dispatch; an inline call leaves the later steps in context and clears nothing).
+- **Demand**: how much it requires. "Every modified model accounted for" forces thorough work where "produce a change list" does not. Demand drives **legwork** (the digging the agent does within the work, latent in the wording rather than written as its own step), and it is not step-bound: "every rule applied" binds a body of flat reference just as "every step done" binds a sequence, which is how an all-reference document still carries an exhaustiveness bar.
+
+The strongest criteria are both checkable and exhaustive.
+
+## When to split
+
+Splitting one document into two spends one of the two loads, so split only when the cut earns it:
+
+- **By sequence**: split a run of steps where the post-completion steps tempt the agent to rush the one in front of it. Keeping them out of view drives more legwork on the current task. Beware the reverse: merging sequences exposes each step's later steps to what follows, inviting premature completion.
+- **By invocation**, skill-specific: see [`SKILL-MECHANICS.md`](SKILL-MECHANICS.md).
+
+## Leading words
+
+A **leading word** is a compact concept already living in the model's pretraining that the agent thinks with while running the document (_lesson_, _fog of war_, _tracer bullets_). Repeated as a token, never as a sentence, it accumulates a distributed definition and anchors a whole region of behaviour in the fewest tokens, by recruiting priors the model already holds. Coining your own works if you define it clearly, but a made-up word recruits no priors: you pay in definition tokens what a pretrained word gives free; reach for an existing word first.
+
+It anchors twice. In the body, _execution_: the agent reaches for the same behaviour every time the word appears, and inside flat reference it focuses attention on a class of thing to look for. In a pointer, _invocation_: when the same word lives in your prompts, your docs, and your codebase, the agent links that shared language to the material and reaches it more reliably.
+
+Hunt for opportunities to refactor with leading words. A triad spelled out at three sites, a pointer spending a sentence to gesture at one idea. Each is a passage begging to collapse into a single token:
+
+- "fast, deterministic, low-overhead" → _tight_ (a _tight_ loop).
+- "a loop you believe in" → _red_, turning a fuzzy gate into a binary observable state (the loop goes _red_ on the bug, or it doesn't).
+
+You win twice: fewer tokens, and a sharper hook for the agent to hang its thinking on. Assume every document is carrying restatements that leading words retire. Go find them.
+
+**Negation** is the failure mode beside this lever: steering by prohibition drags the forbidden behaviour into context and makes it _more_ available, not less. _Don't think of an elephant_, and the elephant is all there is; the negation is a weak modifier the strongly-activated concept overruns, so the ban half-reads as an instruction to do the thing. Prompt the **positive**: state the target behaviour ("write one-line comments") so the banned one is never spoken. A prohibition earns its place only as a hard guardrail you cannot phrase positively; even then, pair it with the positive target so attention lands on what to do.
+
+## Pruning
+
+- Keep each meaning in a **single source of truth**: one authoritative place, so changing the behaviour is a one-place edit. **Duplication** (the same meaning in more than one place) costs maintenance and tokens, and inflates a meaning's prominence on the ladder past its real rank. (The accidental inverse of a leading word, which repeats a token on purpose, never the meaning.)
+- The **environment** is a source of truth too (`package.json` scripts, config files, the directory layout, `--help` output), and a document that restates it is a **cache**: a copy of a lookup, earning its load only when the lookup is expensive. Cache what the agent cannot find by looking: the unwritten convention, the reason behind a choice, the gotcha no config confesses. Leave the one-file, one-command lookups to the environment, where they cannot go stale.
+- Check every line for **relevance**: does it still bear on what the document does? A line loses relevance by never bearing on the task (mere exposition, or a branch that should be disclosed) or by going stale as the behaviour or world it describes changes. Shorter documents are easier to keep relevant. Without a pruning discipline the default fate is **sediment**: stale layers that settle because adding feels safe and removing feels risky, until you must core down through them to find what is still live.
+- Hunt **no-ops** sentence by sentence: an instruction the model already obeys by default pays load to say nothing. The test (does it change behaviour versus the default?) is model-relative, not reader-relative: two people disagreeing about a no-op disagree about the default, and settle it by running the document, not by debate. When a sentence fails, delete the whole sentence rather than trim words from it. The test also grades leading words: a word too weak to beat the default (_be thorough_ when the agent is already thorough-ish) is a no-op, and the fix is a stronger word (_relentless_), not a different technique.

package/dist/skills/vendored/writing-for-agents/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Writing for Agents"
+  short_description: "Write documents agents consume"

package/dist/subagent.d.mts

@@ -1,39 +1,10 @@
-import { f as SubagentCapabilities, g as ToolDefinition, h as SubagentsHost, n as AgentOptions, o as JsonSchemaNode, r as AgentsHost, s as LlmHost, t as Agent, v as ToolsHost } from "./host-contract-o47JH_r8.mjs";
-//#region scripts/role-manifest.d.ts
-/**
- * The one pstack role manifest.
- *
- * Every consumer of the role vocabulary reads this module: `src/roles.ts` for
- * exact lookup and panel classification, `src/models.ts` for value shapes,
- * `scripts/build-assets.ts` for the generated example file, and the
- * `setup-pstack` skill text, which points at that example instead of listing the
- * roles again. A second literal role list anywhere is a bug.
- *
- * Keys are matched exactly after normalization. Commas are part of some keys
- * (`feature, refactoring`), so nothing here may be split on a comma.
- *
- * This module has no Node imports: the Host bundle imports it directly.
- */
-/** Whether a role holds one route or a comma-separated list of routes. */
-type RoleValueShape = "single" | "list";
-interface RoleSpec {
-  /** Exact key as written in the role file. Commas belong to the key. */
-  readonly key: string;
-  readonly shape: RoleValueShape;
-  /**
-   * A list role that automatically starts one child per entry. Only the three
-   * panel roles set this; every other list role selects one entry.
-   */
-  readonly autoPanel: boolean;
-  /** Skills and playbooks that read this role. */
-  readonly consumers: readonly string[];
-  readonly summary: string;
-}
-//#endregion
-//#region src/models.d.ts
+import { _ as ToolsHost, g as ToolDefinition, h as SubagentsHost, m as SubagentCapabilities, n as AgentOptions, r as AgentsHost, s as LlmHost, t as Agent, v as WorkingDirectoryHost } from "./host-contract-CUPSpeNk.mjs";
+import { t as RoleSpec } from "./role-manifest-C3fUzjLI.mjs";
 /** One resolved child route. */
-type ChildRoute = {
+type Route = {
   readonly kind: "inherit";
+  /** The spelling the file used; `undefined` for an implicit fallback. */
+  readonly alias?: "inherit-parent" | "auto";
 } | {
   readonly kind: "route";
   readonly provider: string;
@@ -45,93 +16,43 @@ type RouteSelectionMode = "single" | "panel" | "selected";
 interface RouteSelection {
   readonly role: RoleSpec;
   readonly mode: RouteSelectionMode;
-  /** Whether the role came from the file or from the inherit-parent fallback. */
+  /** Whether the role came from the file or the inherit-parent fallback. */
   readonly configured: boolean;
-  readonly routes: readonly ChildRoute[];
+  readonly routes: readonly Route[];
   /** How many entries the role holds, before selection. */
   readonly total: number;
   readonly roleIndex?: number;
-  readonly issues: readonly string[];
 }
-//#endregion
-//#region src/effort.d.ts
-/**
- * The `agentOptions` one (route, effort override) pair contributes.
- *
- * The two independent halves are easy to get wrong in opposite directions:
- *
- * - an inherit-parent route with an override must still send `reasoningEffort`,
- *   which means `{ reasoningEffort }` on its own is a real `agentOptions` value and
- *   the backend still has to support the capability;
- * - an override always wins over the role line, because the caller asked for this
- *   delegation specifically.
- */
-export declare function agentOptionsFor(route: ChildRoute, effortOverride?: string): AgentOptions | undefined;
-//#endregion
-//#region src/subagent.d.ts
 /** Cordis row name, used by Loader diagnostics. */
 export declare const name = "pstack-subagent";
 /**
- * Delegation needs the tool registry, the subagent registry, and the LLM adapters.
- *
- * `agents` is deliberately **not** here. It is used only to reach a child this tool
- * has just started, and a composition without it still delegates: the children keep
- * the effort their request carried and cannot change it afterwards. Declaring it as
- * a hard dependency would make the whole row inert in such a profile, so the tool
- * would not exist at all — the failure `pstack-history` already paid for once with
- * `sessionQuery`. It is read per call through `ctx.get("agents")` instead, which is
- * why a controller mounted after this row is still seen.
+ * Delegation needs the tool registry, the subagent registry, the LLM adapters, and the
+ * session directory. `agents` is not here: it is optional and read per call, so a
+ * profile without it still delegates and the child simply keeps its starting effort.
  */
 export declare const inject: string[];
 /** Model-facing tool name. */
 export declare const TOOL_NAME = "pstack_subagent";
 /** Backend used when the row does not name one. */
 export declare const DEFAULT_SUBAGENT_PROVIDER = "spawn";
-/** Agent type used when the call does not name one. */
-export declare const DEFAULT_AGENT_KIND = "poteto-agent";
 /** The child kinds this tool knows how to brief. */
 export declare const AGENT_KINDS: readonly ["poteto-agent", "comment-sicko", "general"];
 export type AgentKind = (typeof AGENT_KINDS)[number];
-/** One exact route a row may authorize for explicit child selection. */
-export interface AllowedModelRoute {
-  readonly provider: string;
-  readonly model: string;
-}
 /** Row configuration. */
 export interface PstackSubagentConfig {
-  /** `ctx.subagents` provider to start children on. */
   readonly provider: string;
-  /**
-   * This row's delegation-depth cap. A call may lower it and may never exceed it.
-   * Omitted means the Host setting decides.
-   */
   readonly maxDepth?: number;
-  /**
-   * Exact routes this row authorizes. Empty means no explicit route limit. This is
-   * pstack's own check and is unrelated to the native session `allowedModels`
-   * policy, which this plugin does not read.
-   */
-  readonly allowedModels: readonly AllowedModelRoute[];
-  /** Non-empty allowlist; also what makes `agentPreset` appear in the schema. */
-  readonly allowedAgentPresets: readonly string[];
 }
-/** What a call asked for, after argument validation. */
+/** What a call asked for, after every required argument has been validated. */
 export interface DelegationArgs {
   readonly description: string;
   readonly prompt: string;
   readonly agent: AgentKind;
-  readonly role?: string;
-  readonly cwd?: string;
-  readonly agentPreset?: string;
-  readonly maxDepth?: number;
-  readonly roleIndex?: number;
-  /**
-   * Effort for every child this call starts, overriding each role line's value.
-   *
-   * Validated per entry against the model that entry will actually request, so a
-   * panel with one incompatible entry starts nothing rather than half its children.
-   */
-  readonly reasoningEffort?: string;
+  readonly role: string | null;
+  readonly cwd: string | null;
+  readonly maxDepth: number;
+  readonly roleIndex: number | null;
+  readonly reasoningEffort: string | null;
 }
 /** One child this call started. */
 export interface ChildRecord {
@@ -140,7 +61,6 @@ export interface ChildRecord {
   readonly agent: string;
   readonly role: string;
   readonly route: string;
-  /** The effort this child runs at, when any applies. */
   readonly effort?: string;
   readonly maxDepth?: number;
 }
@@ -158,73 +78,37 @@ export declare class PartialDelegationError extends DelegationError {
   readonly startedChildren: readonly ChildRecord[];
   constructor(message: string, startedChildren: readonly ChildRecord[]);
 }
-/** Raised when a required agent preamble is missing or unusable. */
-export declare class PreambleError extends DelegationError {
-  constructor(message: string);
-}
 /** The live services and locations one delegation reads. */
 export interface SubagentRuntime {
   readonly subagents: SubagentsHost;
   readonly llm: LlmHost;
-  /**
-   * The Agent registry, used to reach a child this tool just started.
-   *
-   * Optional because a row can be composed without the `agents` service and a
-   * delegation still works there: the children then keep the effort their request
-   * carried and simply cannot change it afterwards. Making it required would turn a
-   * missing service into a row that registers no tool at all.
-   */
+  /** Optional: absent means the child keeps the effort it was started with. */
   readonly agents?: AgentsHost;
-  /** `$DSH_HOME`, home of the role file. */
+  readonly workingDirectory: WorkingDirectoryHost;
   readonly dshHome: string;
-  /** Absolute package assets root, home of the agent preambles. */
-  readonly assetsRoot: string;
-}
-interface StandardSchemaIssue {
-  readonly message: string;
-  readonly path?: readonly (string | number)[];
-}
-type StandardSchemaResult = {
-  readonly value: PstackSubagentConfig;
-  readonly issues?: undefined;
-} | {
-  readonly issues: readonly StandardSchemaIssue[];
-};
-/**
- * Minimal Standard Schema for this row, so an omitted `config` is valid and a
- * typo fails at load instead of at the first delegation.
- */
-export declare const Config: {
-  "~standard": {
-    version: number;
-    vendor: string;
-    validate(value: unknown): StandardSchemaResult;
-  };
-};
-/**
- * Read one agent preamble from the package assets by absolute path.
- *
- * A missing or empty preamble blocks that agent type. It never degrades into a
- * plain child, because a `comment-sicko` or `poteto-agent` child without its
- * instructions is a different agent wearing the name.
- */
-export declare function loadAgentPreamble(agent: AgentKind, assetsRoot: string): string | undefined;
-/** One absolute path the Host injects into a child brief. */
-export interface InjectedPath {
-  readonly label: string;
-  readonly path: string;
 }
 /**
- * Compose the self-contained prompt one child receives.
+ * Validate the row configuration without a Schemastery dependency.
  *
- * The preambles used to locate things themselves; the Host injects the absolute
- * paths instead, so a child never scans a plugin directory or guesses a version.
+ * A typo must fail at activation rather than at the first delegation, and an omitted
+ * `config` must be valid. Cordis passes the raw mapping because this row exports no
+ * `Config` object; callers that object as `config` are still checked here.
  */
+export declare function normalizeConfig(value: unknown): PstackSubagentConfig;
+/** The preset id behind each pstack agent kind. `general` joins the parent preset. */
+export declare const AGENT_PRESETS: Readonly<Record<Exclude<AgentKind, "general">, string>>;
+/** The preset a child of this kind must mount, or undefined to join the parent preset. */
+export declare function agentPresetFor(agent: AgentKind): string | undefined;
+/** Compose the self-contained prompt one child receives. */
 export declare function composeChildPrompt(input: {
-  readonly preamble?: string;
-  readonly injectedPaths?: readonly InjectedPath[];
+  readonly injectedPaths?: readonly {
+    readonly label: string;
+    readonly path: string;
+  }[];
   readonly task: string;
 }): string;
+/** Validate every required model-facing argument. Null declines an optional setting. */
+export declare function parseDelegationArgs(raw: unknown): DelegationArgs;
 /** One planned child, before any Host call. */
 export interface ChildPlan {
   readonly index: number;
@@ -232,16 +116,15 @@ export interface ChildPlan {
   readonly label: string;
   readonly agent: AgentKind;
   readonly role: string;
-  readonly route: ChildRoute;
+  readonly route: Route;
   readonly routeLabel: string;
-  /** The effort this child will actually run at: the override when present, else the role line's. */
   readonly effort?: string;
   readonly agentOptions?: AgentOptions;
+  /** Preset id that supplies this child's persona and tool composition. */
   readonly agentPreset?: string;
   readonly cwd?: string;
   readonly maxDepth?: number;
 }
-/** The decided plan for one call. */
 export interface DelegationPlan {
   readonly agent: AgentKind;
   readonly prompt: string;
@@ -250,41 +133,15 @@ export interface DelegationPlan {
   readonly mode: RouteSelection["mode"];
   readonly roleIndex?: number;
   readonly roleTotal: number;
-  /** The call-wide effort override, when it supplied one. */
   readonly reasoningEffort?: string;
   readonly children: readonly ChildPlan[];
   readonly diagnostics: readonly string[];
 }
-/** The text form of one route, as reported back to the model. */
-export declare function routeLabel(route: ChildRoute): string;
-/**
- * The route text a caller sees when an effort override wins.
- *
- * `routeLabel` describes the role file, which stops being the whole truth once the
- * caller overrode the effort. Reporting the file's value there would tell the model
- * its override had been ignored.
- */
-export declare function plannedRouteLabel(route: ChildRoute, effortOverride?: string): string;
-/**
- * Take the smallest of the requested depth, this row's cap, and the Host setting.
- *
- * A request above the row cap is an error rather than a silent clamp, so a caller
- * cannot believe it asked for two levels when the row allows one.
- */
+/** Route text as reported to the model. */
+export declare function routeLabel(route: Route, effortOverride?: string): string;
+/** Take the smallest of the requested depth, this row's cap, and the Host setting. */
 export declare function resolveDelegationDepth(configured: number | undefined, requested: number | undefined, hostLimit: number | undefined): number | undefined;
-/**
- * Validate the model-facing arguments.
- *
- * The tool schema is advisory at the model boundary, so every constraint is
- * re-checked here and reported with the reason.
- */
-export declare function parseDelegationArgs(raw: unknown, config?: PstackSubagentConfig): DelegationArgs;
-/**
- * Resolve the role file, the routes, the prompt, and the depth into one plan.
- *
- * Pure with respect to the Host: it reads the role file and the packaged preamble,
- * and it makes no service call.
- */
+/** Resolve the role file, routes, prompt, and depth into one plan. Pure of service calls. */
 export declare function planDelegation(args: DelegationArgs, runtime: SubagentRuntime, config?: PstackSubagentConfig): DelegationPlan;
 /** Check the backend can enforce what this call asks for. */
 export declare function assertProviderCapabilities(capabilities: SubagentCapabilities, providerName: string, asks: {
@@ -293,44 +150,35 @@ export declare function assertProviderCapabilities(capabilities: SubagentCapabil
   readonly maxDepth: boolean;
 }): void;
 /**
- * Start the planned children.
+ * Resolve and validate one child's `cwd`.
  *
- * Everything that can be rejected has already been rejected. A failure at entry N
- * keeps children 1..N-1 running and reports their ids, because the runtime owns
- * those activations and this tool cannot roll them back.
+ * A child may run inside the session directory or inside an explicitly separate Git
+ * worktree. Anything else is refused: this tool does not create isolation, so it will
+ * not promise one.
+ */
+export declare function resolveChildCwd(requested: string | undefined, sessionRoot: string): string | undefined;
+/**
+ * Start the planned children. Everything rejectable has already been rejected; a
+ * failure at entry N keeps children 1..N-1 running and reports their ids.
  */
 export declare function startPlannedChildren(parent: Agent, plan: DelegationPlan, runtime: SubagentRuntime, config: PstackSubagentConfig, signal: AbortSignal): Promise<DelegationResult>;
 /** Full delegation: plan, validate, start. */
 export declare function delegate(parent: Agent, args: DelegationArgs, runtime: SubagentRuntime, config?: PstackSubagentConfig, signal?: AbortSignal): Promise<DelegationResult>;
-export declare const OUTPUT_SCHEMA: JsonSchemaNode;
 /** Render one delegation result for the model. */
 export declare function renderDelegationResult(result: DelegationResult): string;
 /** Build the model-facing tool for one row. */
 export declare function createPstackSubagentTool(runtime: SubagentRuntime, config?: PstackSubagentConfig): ToolDefinition;
-/**
- * The slices of the Cordis context this row uses.
- *
- * `agents` is optional in both directions: it is absent from `inject` and read per
- * call below, so a profile that mounts no agent registry still registers this tool.
- * See the `inject` comment for why a hard dependency is the wrong shape here.
- */
+/** The slices of the Cordis context this row uses. */
 export interface PstackSubagentHost {
   readonly tools: ToolsHost;
   readonly subagents: SubagentsHost;
   readonly llm: LlmHost;
+  readonly workingDirectory: WorkingDirectoryHost;
 }
 /** Build the runtime a real Host call reads. */
 export declare function hostRuntime(ctx: PstackSubagentHost, getAgentRegistry?: () => AgentsHost | undefined): SubagentRuntime;
-/**
- * Register `pstack_subagent` for this row.
- *
- * @param ctx - context providing the tool registry, the subagent registry, the LLM
- *   adapters, and optionally `ctx.get` for the agent registry.
- * @param config - validated row config.
- */
+/** Register `pstack_subagent` for this row. */
 export declare function apply(ctx: PstackSubagentHost & {
   get?: (name: string) => AgentsHost | undefined;
-}, config?: PstackSubagentConfig): void;
-//#endregion
-export {};
-//# sourceMappingURL=subagent.d.mts.map
+}, config?: unknown): void;
+export {};