dsh-remote-bridge 2.8.1 → 2.9.0

package/README.en.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.8.1-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.9.0-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -402,7 +402,26 @@ inside the zero-change set, and 4 slots retained with 0 removed.
 
 ## Project
 
-- Version: `v2.8.1`
+- Version: `v2.9.0`
+- **v2.9.0 makes teammates (sub-sessions) readable**: the phone's team panel could list members and
+  sub-sessions but could not open a single one, because `sessions.list` filters out every row with
+  `origin === 'subagent'` (the bridge's own `dsh-0.2-bridge.ts:2327`, with a comment explaining that
+  exposing them "only yields rows that crash on tap"), so any sub-session id hitting `/messages` gets a
+  hard 404. Even past that visibility check the kernel's `validateAddress()` demands the
+  `{ kind:'subagent', parentSessionId, childSessionId, mode }` discriminated union instead of a plain
+  session address. This release adds a **read-only narrow port guarded by membership**:
+  `GET /api/v1/chat/sessions/{leadSessionId}/subagents/{subagentId}/messages`. Authorization takes two
+  steps — (1) the Lead session must be visible to the device (reusing `requireSession`, not a single rule
+  relaxed); (2) membership must be vouched for by a projection the kernel itself publishes
+  (`subagentCatalog[].id` or `agentTeam.members[].id`). Only then is history read directly, deliberately
+  **without** calling `requireSession(subagentId)` — removing the `origin` filter would put "crash on tap"
+  rows back into the list, while loosening `requireSession` would backdoor every session; the narrow port
+  has the cleanest boundary. Read-only (non-GET always 405), and `SUBAGENT_NOT_FOUND` deliberately does
+  not distinguish "does not exist" from "not your teammate", otherwise id existence becomes a probe
+  surface. New capability bit `subagent-history-v1` (it must be separate from `history-v1`, which always
+  404s on sub-session ids and therefore cannot advertise this). The same release re-checked DSH
+  0.2.1-rc.2 → rc.5: 18 of the 19 packages the bridge depends on are byte-identical, the only diff being
+  a single KDoc comment.
 - **v2.7.1 is a defect-fix release**: the kernel's `sessionController.resolveAgent()` returns an
   `{ agent }` / `{ error }` **envelope**, not the Agent itself (`dsh-api-session-controller/lib/index.js:365-368`
   `liveAgent()` and `:221-246` `resolve()` both have that shape). The bridge used to hand the envelope

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.8.1-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.9.0-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -433,7 +433,21 @@ DSH **0.2.1-rc.3** 隔离实例上**实跑验过**，不是静态推断：插件
 
 ## 项目信息
 
-- 当前版本：`v2.8.1`
+- 当前版本：`v2.9.0`
+- **v2.9.0 是团队成员（子会话）可读版**：手机端的团队面板此前只能看到成员与子会话的名字，点开读不到
+  任何内容 —— 因为 `sessions.list` 会把 `origin === 'subagent'` 的行整批滤掉（桥自己的
+  `dsh-0.2-bridge.ts:2327`，注释写明「暴露出来只会得到点开就崩的行」），子会话 id 打 `/messages`
+  必然 404；即使绕过可见性，内核 `validateAddress()` 也要求用
+  `{ kind:'subagent', parentSessionId, childSessionId, mode }` 判别联合寻址，而非普通会话地址。
+  这一版新增**受成员关系校验的只读窄口**
+  `GET /api/v1/chat/sessions/{leadSessionId}/subagents/{subagentId}/messages`：授权两步 ——
+  ① Lead 会话必须对设备可见（沿用 `requireSession`，规则一行不放宽）；② 成员关系必须由内核自己发布的
+  投影背书（`subagentCatalog[].id` 或 `agentTeam.members[].id`）。两步都过才直读历史，刻意不再调
+  `requireSession(subagentId)` —— 拆 `origin` 过滤会把「点开就崩」的行放回列表，放宽 `requireSession`
+  等于给所有会话开后门，窄口的边界最清晰。只读（非 GET 一律 405），错误码 `SUBAGENT_NOT_FOUND`
+  刻意不区分「不存在」与「不是成员」否则 id 是否存在就成了探测面。新增能力位 `subagent-history-v1`
+  （必须独立于 `history-v1`，后者对子会话永远 404 探测不到）。同版复核了 DSH 0.2.1-rc.2 → rc.5：
+  桥依赖的 19 个包中 18 个零差异，唯一差异是一行 KDoc 注释。
 - **v2.7.1 是缺陷修复版**：内核 `sessionController.resolveAgent()` 返回的是 `{ agent }` / `{ error }`
   **包装对象**而非 Agent 本体（`dsh-api-session-controller/lib/index.js:365-368` 的 `liveAgent()` 与
   `:221-246` 的 `resolve()` 都是这个形状），桥此前把包装对象直接当 Agent 传给 `fileUploads.upload()`，

package/docs/api/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.0.0
 info:
   title: DeepSeek Harness Mobile Events
-  version: 2.8.1
+  version: 2.9.0
   description: |
     Live file and authorized DSH chat events. Reconnect clients must refresh
     REST state; unbounded replay is not provided.
@@ -154,6 +154,13 @@ channels:
       > is missing from the set will start echoing a stale `requestId` from
       > whatever request happened to be in flight when it fired.
 
+      > **子会话历史不走 WS**（2026-10-30）：团队成员 / 子会话的历史只能经
+      > REST `GET /chat/sessions/{leadSessionId}/subagents/{subagentId}/messages`
+      > 读取，本协议**没有**对应帧，也不打算加。原因是普通 `history` 帧对子会话
+      > id 必然 404（子会话被 `sessions.list` 刻意滤掉），而那条窄口的授权靠
+      > 「Lead 可见 + 内核投影背书成员关系」两步，与 WS 连接级的会话白名单不是
+      > 一回事；硬塞进 WS 只会让两套授权语义打架。详见 `docs/project/API.md`。
+
       Rules:
 
       - Absent or empty string ⇒ **no** `requestId` key in the response at all

package/docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepSeek Harness Mobile API
-  version: 2.8.1
+  version: 2.9.0
   description: Versioned file and chat BFF for mobile and third-party DSH clients. HTTP and HTTPS are both supported.
 servers:
   - url: http://127.0.0.1:3090/api/v1
@@ -24,7 +24,7 @@ paths:
                 properties:
                   ok: { type: boolean, const: true }
                   version: { type: string, const: v1 }
-                  pluginVersion: { type: string, const: 2.8.1 }
+                  pluginVersion: { type: string, const: 2.9.0 }
   /debug/host-services:
     get:
       operationId: hostServices
@@ -989,6 +989,80 @@ paths:
       responses:
         '202': { description: Prompt accepted by DSH. }
         '409': { $ref: '#/components/responses/Error' }
+  /chat/sessions/{leadSessionId}/subagents/{subagentId}/messages:
+    parameters:
+      - name: leadSessionId
+        in: path
+        required: true
+        description: |
+          The session that owns the team (the Lead). Its visibility is checked with the
+          ordinary session rules -- the narrow endpoint never relaxes them.
+        schema: { type: string }
+      - name: subagentId
+        in: path
+        required: true
+        description: |
+          A subagent / teammate session id. It is *not* required to be listed by
+          `GET /chat/sessions` (subagent sessions are filtered out of that list);
+          membership is verified against the Lead's own `subagentCatalog` /
+          `agentTeam.members` projection instead.
+        schema: { type: string }
+    get:
+      operationId: listSubagentMessages
+      description: |
+        Read the history of a subagent (teammate) session -- a read-only narrow endpoint.
+
+        Why it exists: `GET /chat/sessions/{sessionId}/messages` resolves visibility via
+        the session list, and subagent sessions are deliberately filtered out of that list
+        (the kernel refuses to activate them as ordinary sessions, so exposing them yields
+        rows that crash on open). Every subagent id therefore 404s on the ordinary path.
+
+        Authorization has two steps, both required: (1) the Lead session must be visible to
+        this device under the unchanged rules; (2) membership must be backed by the kernel's
+        own projection for that Lead (`subagentCatalog[].id` or `agentTeam.members[].id`).
+        Guessing a session id does not work -- a miss is a 404.
+
+        Read-only: any non-GET method is `405 METHOD_NOT_ALLOWED`. Writing to a teammate
+        session would blur who is directing whom; the official Web UI likewise only writes
+        through the Lead's model tools.
+      parameters:
+        - name: beforeSeq
+          in: query
+          schema: { type: integer, minimum: 0 }
+        - name: maxMessages
+          in: query
+          schema: { type: integer, minimum: 1 }
+      responses:
+        '200':
+          description: |
+            Identical shape and byte budget as `listMessages`: the oldest events may be
+            dropped (with `hasMore` forced to true) and oversized strings inside one event
+            may be head/tail clamped. `truncated`/`bytes` appear only when something was
+            actually clamped. `historyFormatVersion` is always present.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [events, hasMore]
+                properties:
+                  events:
+                    type: array
+                    items: { type: object, additionalProperties: true }
+                  hasMore: { type: boolean }
+                  projections: { type: object, additionalProperties: true }
+                  bytes: { type: integer, minimum: 0 }
+                  truncated: { type: boolean }
+                  historyFormatVersion: { type: integer, minimum: 1 }
+        '404':
+          description: |
+            `SUBAGENT_NOT_FOUND` -- either the subagent is not a member of this team, or
+            the Lead's projections were unavailable (membership unprovable). The two cases
+            are deliberately indistinguishable so the existence of a session id is not
+            turned into a probing surface.
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Error' }
+        '405': { $ref: '#/components/responses/Error' }
   /chat/sessions/{sessionId}/attachments:
     parameters:
       - name: sessionId

package/kotlin-sdk/src/main/kotlin/ai/deepseek/dsh/workspace/DshWorkspaceClient.kt

@@ -541,6 +541,27 @@ class DshWorkspaceClient(
 
     fun listMessages(sessionId: String): JsonElement = executeJsonElement("chat/sessions/$sessionId/messages", "GET", null)
 
+    /**
+     * 读**子会话（团队成员）**的历史 —— 受成员关系校验的只读窄口。
+     *
+     * 不能复用 [listMessages]：那条路径靠会话列表判定可见性，而子会话被
+     * `sessions.list` 刻意滤掉（内核拒绝把它们当普通会话激活），所以任何子会话 id
+     * 打进去都是 404。这条窄口改成两步授权：Lead 会话必须可见 + 内核投影
+     * （`subagentCatalog` / `agentTeam.members`）必须背书成员关系。只读。
+     */
+    fun listSubagentMessages(
+        leadSessionId: String,
+        subagentId: String,
+        beforeSeq: Int? = null,
+        maxMessages: Int? = null,
+    ): JsonElement {
+        val query = buildString {
+            if (beforeSeq != null) append(if (isEmpty()) "?" else "&").append("beforeSeq=").append(beforeSeq)
+            if (maxMessages != null) append(if (isEmpty()) "?" else "&").append("maxMessages=").append(maxMessages)
+        }
+        return executeJsonElement("chat/sessions/$leadSessionId/subagents/$subagentId/messages$query", "GET", null)
+    }
+
     fun renameSession(sessionId: String, title: String) {
         val body = json.encodeToString(RenameRequest.serializer(), RenameRequest(title))
         executeUnit("chat/sessions/$sessionId", "PATCH", body)

package/lib/index.d.ts

@@ -785,6 +785,23 @@ interface AttachmentStoreLike {
     data: Uint8Array;
   }>;
 }
+/**
+ * 内核的 `SessionAddress` 判别联合（`dsh-api-session-controller` 的
+ * types.d.ts:406-414）。普通会话用 `kind:'session'`，**子会话必须**用
+ * `kind:'subagent'` 并带上父会话 id —— 内核在 `validateAddress()` 里对
+ * `{kind:'session'}` 且 header.origin==='subagent' 直接抛
+ * `session/agent-busy: "subagent Sessions require their durable parent address"`。
+ * 也就是说：子会话历史一直是可读的，只是必须按内核要的地址形状去问。
+ */
+type SessionAddressLike = {
+  kind: 'session';
+  sessionId: string;
+} | {
+  kind: 'subagent';
+  parentSessionId: string;
+  childSessionId: string;
+  mode: 'one-shot' | 'continuable' | 'unknown';
+};
 interface SessionControllerLike {
   list(request: {
     cursor?: string;
@@ -808,10 +825,7 @@ interface SessionControllerLike {
    * a well-formed but *empty* page — a silent failure, not an error.
    */
   follow(request: {
-    address: {
-      kind: 'session';
-      sessionId: string;
-    };
+    address: SessionAddressLike;
     maxMessages?: number;
     /**
      * Assistant presentation frames are opt-in: without `assistantStream: true`
@@ -860,10 +874,7 @@ interface SessionControllerLike {
    * `beforeSeq` is optional and acts as an earlier boundary.
    */
   page(request: {
-    address: {
-      kind: 'session';
-      sessionId: string;
-    };
+    address: SessionAddressLike;
     throughSeq: number;
     beforeSeq?: number;
     maxMessages?: number;
@@ -1286,12 +1297,20 @@ interface DshApiProxy {
       sessionId: string;
       agentPreset?: string;
     }>>;
+    /**
+     * 读历史。`parentSessionId` + `subagentMode` 是本桥的**扩展字段**（内核契约里
+     * 没有）：带上它们表示「这是 parentSessionId 名下的子会话」，底层据此把地址
+     * 拼成 `kind:'subagent'`（内核只认这个形状，拿 childSessionId 冒充普通
+     * sessionId 会被 validateAddress() 拒掉）。不带就是普通会话，行为一字不变。
+     */
     history(request: {
       rpcId: string;
       payload: {
         sessionId: string;
         beforeSeq?: number;
         maxMessages?: number;
+        parentSessionId?: string;
+        subagentMode?: 'one-shot' | 'continuable' | 'unknown';
       };
     }): Promise<RpcResponse<{
       events: unknown[];
@@ -1928,6 +1947,51 @@ declare class DshChatAdapter {
     truncated?: boolean;
     historyFormatVersion?: number;
   }>;
+  /**
+   * 读**子会话**（subagent / 团队成员）的历史 —— 受成员关系校验的只读窄口。
+   *
+   * ## 为什么需要一条单独的路径
+   *
+   * 内核 0.2.x 把子会话也列在 `sessions.list` 里、并标 `origin: 'subagent'`，
+   * 而桥在 `dsh-0.2-bridge.ts` 的 `sessions.list` 把它们**整批滤掉**（内核拒绝
+   * 把子会话当普通会话激活，暴露出来只会得到「点开就崩」的行）。`requireSession()`
+   * 的可见性判定正是建立在 `listSessions()` 上的，于是任何 `{subagentId}` 打进来
+   * 都是 404 —— 手机端「团队面板里点成员/子会话看内容」因此根本走不通。
+   *
+   * 三条路可选：拆掉 `origin` 过滤（把「点开就崩」的行放回列表，回归风险最大）、
+   * 放宽 `requireSession`（等于给所有会话开一条后门，最危险）、或者**单开一条
+   * 自带授权规则的窄口**。本实现选第三条：授权判定不依赖会话列表，改用**内核自己
+   * 发布的投影**来证明成员关系。
+   *
+   * ## 授权是怎么成立的（两步，缺一不可）
+   *
+   * ① **Lead 必须可见**：`requireSession(leadSessionId)` 走的是完全没变的既有规则
+   *    （设备 scope + 授权根 + 归档状态）。子会话能读，前提是它的 Lead 本来就能读。
+   * ② **成员关系必须由内核背书**：读 Lead 的会话投影，要求 `subagentId` 出现在
+   *    `subagentCatalog[].id`（或 `agentTeam.members[].id`，两者在内核里指向同一批
+   *    Session）里。这份目录是内核为这个 Lead 亲手发布的，不是我们维护的白名单，
+   *    所以「猜一个 sessionId 来读别人会话」在这里不成立 —— 猜不中就是 404。
+   *
+   * 通过这两步之后才直读历史。注意 ③ **刻意不再调 `requireSession`**：那正是会
+   * 必然 404 的那一步，授权已在 ①② 完成，③ 纯粹是取数据。
+   *
+   * ## 为什么只读
+   *
+   * 写子会话（给成员发消息、改它的模型/权限）会让「谁在指挥谁」变得含混：官方 Web 端
+   * 同样不允许人类直接写成员会话，一切经由 Lead 的模型工具。这条窄口只开放 `events`
+   * 读取，`POST` 一律 405。
+   */
+  subagentHistory(principal: Principal, leadSessionId: string, subagentId: string, options: {
+    beforeSeq?: number;
+    maxMessages?: number;
+  }): Promise<{
+    events: unknown[];
+    hasMore: boolean;
+    projections?: unknown;
+    bytes?: number;
+    truncated?: boolean;
+    historyFormatVersion?: number;
+  }>;
   prompt(principal: Principal, sessionId: string, parts: PromptContentPart[], mode: 'queue' | 'steer', clientTimeZone?: string, locale?: HandoffLocale): Promise<{
     accepted: true;
     command?: unknown;

package/lib/index.js

@@ -2998,22 +2998,30 @@ function createDsh02ApiProxy(host, options = {}) {
 			create: (request) => call("sessions.create", (signal) => host.sessionController.create(request.payload)),
 			history: (request) => call("sessions.history", async (signal) => {
 				const { sessionId, maxMessages, beforeSeq } = request.payload;
+				const parentSessionId = request.payload.parentSessionId;
+				const subagentMode = request.payload.subagentMode;
+				const address = typeof parentSessionId === "string" && parentSessionId !== "" ? {
+					kind: "subagent",
+					parentSessionId,
+					childSessionId: sessionId,
+					mode: subagentMode === "one-shot" || subagentMode === "continuable" ? subagentMode : "unknown"
+				} : {
+					kind: "session",
+					sessionId
+				};
 				const controller = new AbortController();
 				if (signal.aborted) controller.abort();
 				else signal.addEventListener("abort", () => controller.abort(), { once: true });
 				try {
 					const snapshot = (await host.sessionController.follow({
-						address: {
-							kind: "session",
-							sessionId
-						},
+						address,
 						...maxMessages === void 0 ? {} : { maxMessages }
 					}, controller.signal)[Symbol.asyncIterator]().next()).value;
 					if (snapshot === void 0 || snapshot.type !== "snapshot") return {
 						events: [],
 						hasMore: false
 					};
-					const projections = projectionsOf(snapshot) ?? await readSessionProjections(host, sessionId, controller.signal);
+					const projections = projectionsOf(snapshot) ?? (address.kind === "session" ? await readSessionProjections(host, sessionId, controller.signal) : void 0);
 					const withProjections = (payload) => projections === void 0 ? payload : {
 						...payload,
 						projections
@@ -3023,10 +3031,7 @@ function createDsh02ApiProxy(host, options = {}) {
 						hasMore: snapshot.hasMore === true
 					});
 					const page = await host.sessionController.page({
-						address: {
-							kind: "session",
-							sessionId
-						},
+						address,
 						throughSeq: snapshot.cursor,
 						beforeSeq,
 						...maxMessages === void 0 ? {} : { maxMessages }
@@ -3294,7 +3299,7 @@ function createDsh02ApiProxy(host, options = {}) {
 }
 //#endregion
 //#region src/shared/version.ts
-const PLUGIN_VERSION = "2.8.1";
+const PLUGIN_VERSION = "2.9.0";
 //#endregion
 //#region src/host/capabilities.ts
 /**
@@ -3358,6 +3363,7 @@ const BRIDGE_CAPABILITIES = [
 	"session-archive-v1",
 	"session-archive-list-v1",
 	"history-v1",
+	"subagent-history-v1",
 	"turn-cancel-v1",
 	"session-config-v1",
 	"commands-v1",
@@ -3911,6 +3917,85 @@ var DshChatAdapter = class {
 			historyFormatVersion: 1
 		};
 	}
+	/**
+	* 读**子会话**（subagent / 团队成员）的历史 —— 受成员关系校验的只读窄口。
+	*
+	* ## 为什么需要一条单独的路径
+	*
+	* 内核 0.2.x 把子会话也列在 `sessions.list` 里、并标 `origin: 'subagent'`，
+	* 而桥在 `dsh-0.2-bridge.ts` 的 `sessions.list` 把它们**整批滤掉**（内核拒绝
+	* 把子会话当普通会话激活，暴露出来只会得到「点开就崩」的行）。`requireSession()`
+	* 的可见性判定正是建立在 `listSessions()` 上的，于是任何 `{subagentId}` 打进来
+	* 都是 404 —— 手机端「团队面板里点成员/子会话看内容」因此根本走不通。
+	*
+	* 三条路可选：拆掉 `origin` 过滤（把「点开就崩」的行放回列表，回归风险最大）、
+	* 放宽 `requireSession`（等于给所有会话开一条后门，最危险）、或者**单开一条
+	* 自带授权规则的窄口**。本实现选第三条：授权判定不依赖会话列表，改用**内核自己
+	* 发布的投影**来证明成员关系。
+	*
+	* ## 授权是怎么成立的（两步，缺一不可）
+	*
+	* ① **Lead 必须可见**：`requireSession(leadSessionId)` 走的是完全没变的既有规则
+	*    （设备 scope + 授权根 + 归档状态）。子会话能读，前提是它的 Lead 本来就能读。
+	* ② **成员关系必须由内核背书**：读 Lead 的会话投影，要求 `subagentId` 出现在
+	*    `subagentCatalog[].id`（或 `agentTeam.members[].id`，两者在内核里指向同一批
+	*    Session）里。这份目录是内核为这个 Lead 亲手发布的，不是我们维护的白名单，
+	*    所以「猜一个 sessionId 来读别人会话」在这里不成立 —— 猜不中就是 404。
+	*
+	* 通过这两步之后才直读历史。注意 ③ **刻意不再调 `requireSession`**：那正是会
+	* 必然 404 的那一步，授权已在 ①② 完成，③ 纯粹是取数据。
+	*
+	* ## 为什么只读
+	*
+	* 写子会话（给成员发消息、改它的模型/权限）会让「谁在指挥谁」变得含混：官方 Web 端
+	* 同样不允许人类直接写成员会话，一切经由 Lead 的模型工具。这条窄口只开放 `events`
+	* 读取，`POST` 一律 405。
+	*/
+	async subagentHistory(principal, leadSessionId, subagentId, options) {
+		await this.requireSession(principal, leadSessionId);
+		const baseline = unwrapDsh(await this.api.sessions.projections({
+			rpcId: randomUUID(),
+			payload: { sessionId: leadSessionId }
+		}));
+		if (baseline === null || baseline === void 0) throw new ApiError(404, "SUBAGENT_NOT_FOUND", "Session projections are unavailable, cannot verify membership.");
+		const values = baseline.values ?? {};
+		const members = /* @__PURE__ */ new Set();
+		const modes = /* @__PURE__ */ new Map();
+		const catalog = values["subagentCatalog"];
+		if (Array.isArray(catalog)) for (const entry of catalog) {
+			if (typeof entry !== "object" || entry === null) continue;
+			const record = entry;
+			const id = typeof record["id"] === "string" ? record["id"] : record["sessionId"];
+			if (typeof id !== "string" || id === "") continue;
+			members.add(id);
+			const mode = record["mode"];
+			if (mode === "one-shot" || mode === "continuable" || mode === "unknown") modes.set(id, mode);
+		}
+		const team = values["agentTeam"];
+		if (typeof team === "object" && team !== null) {
+			const teamMembers = team["members"];
+			if (Array.isArray(teamMembers)) for (const entry of teamMembers) {
+				if (typeof entry !== "object" || entry === null) continue;
+				const id = entry["id"];
+				if (typeof id === "string" && id !== "") members.add(id);
+			}
+		}
+		if (!members.has(subagentId)) throw new ApiError(404, "SUBAGENT_NOT_FOUND", "The session is not a member of this team.");
+		const payload = {
+			sessionId: subagentId,
+			parentSessionId: leadSessionId,
+			subagentMode: modes.get(subagentId) ?? "unknown",
+			...options.beforeSeq === void 0 ? {} : { beforeSeq: options.beforeSeq },
+			...options.maxMessages === void 0 ? {} : { maxMessages: options.maxMessages }
+		};
+		return {
+			...applyHistoryBudget(unwrapDsh(await this.api.sessions.history({
+				rpcId: randomUUID(),
+				payload
+			}))),
+			historyFormatVersion: 1
+		};
+	}
 	async prompt(principal, sessionId, parts, mode, clientTimeZone, locale) {
 		await this.requireSession(principal, sessionId);
 		const hasText = parts.some((part) => part.type === "text" && part.text.trim() !== "");
@@ -4267,7 +4352,7 @@ var DshChatAdapter = class {
 			const key = approvalKey(payload.sessionId, payload.approvalId);
 			const previous = this.pendingApprovals.get(key);
 			this.pendingApprovals.set(key, {
-				rpcId: frame.rpcId,
+				rpcId: typeof payload.rpcId === "string" && payload.rpcId.length > 0 ? payload.rpcId : frame.rpcId,
 				sessionId: payload.sessionId,
 				approvalId: payload.approvalId,
 				toolName: redactApprovalText(payload.toolName, 120),
@@ -9991,6 +10076,22 @@ var ApiRouter = class {
 				return;
 			}
 		}
+		const subagentHistoryRoute = pathname.match(/^\/api\/v1\/chat\/sessions\/([^/]+)\/subagents\/([^/]+)\/messages$/);
+		if (subagentHistoryRoute !== null) {
+			const leadSessionId = decodePathSegment(subagentHistoryRoute[1]);
+			const subagentId = decodePathSegment(subagentHistoryRoute[2]);
+			if (method === "GET") {
+				this.options.auth.requireScope(principal, "chat.read");
+				const beforeSeq = optionalInteger(url.searchParams.get("beforeSeq"));
+				const maxMessages = optionalInteger(url.searchParams.get("maxMessages"));
+				sendJson(res, 200, await this.options.chat.subagentHistory(principal, leadSessionId, subagentId, {
+					...beforeSeq === void 0 ? {} : { beforeSeq },
+					...maxMessages === void 0 ? {} : { maxMessages }
+				}));
+				return;
+			}
+			throw new ApiError(405, "METHOD_NOT_ALLOWED", "Subagent history is read-only.");
+		}
 		const attachmentRoute = pathname.match(/^\/api\/v1\/attachments\/([^/]+)$/);
 		if (attachmentRoute !== null && method === "GET") {
 			this.options.auth.requireScope(principal, "files.read");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-bridge",
-  "version": "2.8.1",
+  "version": "2.9.0",
   "description": "Versioned REST bridge for DeepSeek Harness: remote access for trusted clients (chat, files, devices) plus a Phone-settings panel inside the DSH WebUI.",
   "type": "module",
   "packageManager": "pnpm@11.19.0",