dsh-session-bridge 0.3.0 → 0.3.2-alpha.1

package/lib/index.js

@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { appendFileSync, mkdirSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-//#region node_modules/.pnpm/@deepseek-ai+dsh-home-paths@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-in_7832b76c982cc1477c0eac59a4954baf/node_modules/@deepseek-ai/dsh-home-paths/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-home-paths@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-home-paths/lib/index.js
 /**
 * Shared filesystem path helpers for DeepSeek Harness user data.
 *
@@ -2200,7 +2200,7 @@ var Service = class Service {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.1.2-rc.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
 /** The one Remote failure class shared by owners, the Gateway, and consumers. */
 /**
 * One Remote call failure: a real Error carrying its stable code and typed
@@ -2345,7 +2345,7 @@ function validateName(subject, value) {
 	if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-i_486cdbb63f2ab3a8eaad87d2b6e5a4b7/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
 /** Duplicate-install-safe JSON and immutable-value helpers. @module @deepseek-ai/dsh-util-values */
 /**
 * Mark an unreachable closed-union branch.
@@ -2557,7 +2557,7 @@ function deepFreeze(value) {
 	return value;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-i_45952c52282327ee28c4189b1e05c80c/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
 /**
 * Random v4 UUID, minted from `crypto.getRandomValues`.
 * @returns the UUID string.
@@ -2570,16 +2570,16 @@ function randomUUID$1() {
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-invaria_0a6acdb1edc9f1b3caaaafba5a0cd464/node_modules/@deepseek-ai/dsh-brand/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-brand/lib/index.js
 /**
-* Duplicate-install-safe nominal string helpers.
+* Duplicate-install-safe nominal primitive helpers.
 *
-* A brand makes structurally-identical strings non-interchangeable at the type
-* level: a `SessionId` cannot be passed where a `ToolCallId` is expected, even
-* though both are plain strings at runtime. Comparison, logging, and
-* serialization all behave as ordinary strings.
+* A brand makes structurally identical strings or numbers non-interchangeable
+* at the type level: a `SessionId` cannot be passed where a `ToolCallId` is
+* expected, and an event sequence cannot be passed as a log offset. Comparison,
+* logging, and serialization retain the underlying primitive behavior.
 *
-* This package owns no concrete id and keeps no runtime identity or mutable
+* This package owns no concrete domain value and keeps no runtime identity or mutable
 * state, so independently installed copies produce interchangeable values.
 *
 * @module @deepseek-ai/dsh-brand
@@ -3187,11 +3187,19 @@ defineMethod("transform", [
 	"preserve"
 ], ({ inner }, isInner) => inner.toString(isInner));
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.1.2-rc.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
 /** Largest delay Node schedules without clamping it to one millisecond. */
 const MAX_TIMER_DELAY_MS = 2147483647;
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-invariant_cc3ae850d309c6dee6d11afd096d0893/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+/**
+* Bound one `notice` summary to {@link CONTEXT_SUMMARY_MAX_CHARS}.
+* @param summary - the producer's one-line account, of any length.
+* @returns the account, ellipsized when it exceeds the bound.
+*/
+function boundContextSummary(summary) {
+	return summary.length <= 120 ? summary : `${summary.slice(0, 119)}…`;
+}
 /**
 * Detach and deep-freeze a message whose identity already exists.
 * @param message - complete message, including its stable identity.
@@ -3433,13 +3441,15 @@ function failureSnapshot(value) {
 		const status = candidate.status;
 		const providerRetryAfterMs = candidate.providerRetryAfterMs;
 		const requestId = candidate.requestId;
-		if (typeof message !== "string" || message.length === 0 || typeof code !== "string" || code.length === 0 || status !== void 0 && (!Number.isInteger(status) || status < 100 || status > 599) || providerRetryAfterMs !== void 0 && (!Number.isFinite(providerRetryAfterMs) || providerRetryAfterMs <= 0) || requestId !== void 0 && (typeof requestId !== "string" || requestId.length === 0)) return void 0;
+		const offloadImages = candidate.offloadImages;
+		if (typeof message !== "string" || message.length === 0 || typeof code !== "string" || code.length === 0 || status !== void 0 && (!Number.isInteger(status) || status < 100 || status > 599) || providerRetryAfterMs !== void 0 && (!Number.isFinite(providerRetryAfterMs) || providerRetryAfterMs <= 0) || requestId !== void 0 && (typeof requestId !== "string" || requestId.length === 0) || offloadImages !== void 0 && (!Number.isSafeInteger(offloadImages) || offloadImages <= 0)) return void 0;
 		return Object.freeze({
 			message,
 			code,
 			...status === void 0 ? {} : { status },
 			...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs },
-			...requestId === void 0 ? {} : { requestId }
+			...requestId === void 0 ? {} : { requestId },
+			...offloadImages === void 0 ? {} : { offloadImages }
 		});
 	} catch (_sdkFailureGetter) {
 		return;
@@ -3457,6 +3467,9 @@ function errorMessage$1(error) {
 function harnessErrorCode(error) {
 	return error instanceof HarnessError ? error.code : "UNKNOWN";
 }
+function quoted(value) {
+	return JSON.stringify(value);
+}
 /**
 * Stable text shown to a model that cannot accept one durable image reference.
 * @param ref - durable normalized attachment omitted from the request.
@@ -3476,6 +3489,76 @@ function textOnlyImageText(ref) {
 function contentHasImage(content) {
 	return content.some((block) => block.type === "image" || block.type === "tool-result" && contentHasImage(block.content));
 }
+/**
+* True when typed model content contains a file block, walking nested
+* tool-result content on the same recursion every file policy shares.
+* Reads current content on every call without retaining scan results.
+* @param content - typed model content blocks.
+* @returns whether any nested block is a file.
+*/
+function contentHasFile(content) {
+	for (const block of content) if (block.type === "file" || block.type === "tool-result" && contentHasFile(block.content)) return true;
+	return false;
+}
+/**
+* Stable model-facing handle for one durable file reference: the address of
+* the verbatim stored copy and the instruction to read it on demand. This is
+* the only representation a provider ever receives for a file.
+* @param ref - durable verbatim file reference.
+* @param readonlyPath - execution-world path of the stored copy, when resolvable.
+* @returns deterministic handle text naming the file, its size, and its address.
+*/
+function fileHandleText(ref, readonlyPath) {
+	const digest = String(ref.attachmentId).slice(7, 15);
+	const identity = `File ${quoted(ref.name)} (${ref.bytes} bytes, sha256:${digest})`;
+	if (readonlyPath === void 0) return `[${identity} was uploaded, but the current execution environment cannot access a readable path. Report that limitation if its contents are needed; do not claim to have read it.]`;
+	return `[${identity}: verbatim read-only copy saved at ${quoted(readonlyPath)}. Read that path with your file tools when its contents are needed; copy it to a writable location before modifying it. When delegating file work, include this saved path in the delegation prompt; only subagents sharing this execution environment can read it.]`;
+}
+/** Replace every file occurrence, including nested tool results, with handle text. */
+function replaceFilesWithHandles(blocks, resolvePath) {
+	let next;
+	for (const [index, block] of blocks.entries()) {
+		if (block.type === "file") {
+			next ??= blocks.slice(0, index);
+			next.push({
+				type: "text",
+				text: fileHandleText(block.attachment, resolvePath(block.attachment))
+			});
+			continue;
+		}
+		if (block.type === "tool-result") {
+			const content = replaceFilesWithHandles(block.content, resolvePath);
+			if (content !== block.content) {
+				next ??= blocks.slice(0, index);
+				next.push({
+					...block,
+					content
+				});
+				continue;
+			}
+		}
+		next?.push(block);
+	}
+	return next ?? blocks;
+}
+/**
+* Project durable file history into deterministic handle text for every model
+* route. Unlike images, no provider receives file blocks natively, so this
+* projection is unconditional in request assembly.
+* @param messages - complete request history.
+* @param resolvePath - resolve one reference's current execution-world read path.
+* @returns the original list without files, otherwise shallow message copies with handle text.
+*/
+function projectFilesToText(messages, resolvePath) {
+	if (!messages.some((message) => contentHasFile(message.content))) return messages;
+	return messages.map((message) => {
+		const content = replaceFilesWithHandles(message.content, resolvePath);
+		return content === message.content ? message : {
+			...message,
+			content
+		};
+	});
+}
 /** Replace every image occurrence, including nested tool results, for a text-only model. */
 function replaceImagesForTextModel(blocks) {
 	let next;
@@ -3605,7 +3688,8 @@ var LlmError = class extends HarnessError {
 			code,
 			...options?.status === void 0 ? {} : { status: options.status },
 			...options?.providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs: options.providerRetryAfterMs },
-			...options?.requestId === void 0 ? {} : { requestId: options.requestId }
+			...options?.requestId === void 0 ? {} : { requestId: options.requestId },
+			...options?.offloadImages === void 0 ? {} : { offloadImages: options.offloadImages }
 		});
 	}
 };
@@ -3916,6 +4000,15 @@ var LlmError = class extends HarnessError {
 		imageRequestPricing(provider, model) {
 			return this.adapters.get(provider)?.adapter.imageRequestPricing(provider, model);
 		}
+		/**
+		* Resolve the exact text one durable file occurrence contributes to every
+		* provider request in the current execution environment.
+		* @param ref - durable verbatim file reference from model history.
+		* @returns the same deterministic handle text used at adapter dispatch.
+		*/
+		fileRequestText(ref) {
+			return fileHandleText(ref, this.fileReadPath(ref));
+		}
 		/** Detach typed adapter-owned modality metadata. */
 		detachedModalities(modalities) {
 			return modalities === void 0 ? void 0 : [...modalities];
@@ -3965,6 +4058,8 @@ var LlmError = class extends HarnessError {
 			const context = resolved.context;
 			if (context !== void 0 && (!Number.isInteger(context.contextWindow) || context.contextWindow <= 0)) throw new LlmError(`adapter returned invalid context metadata for provider "${provider}" model "${model}"`, "INVALID_MODEL_CONTEXT");
 			const inputModalities = this.detachedModalities(resolved.inputModalities);
+			const systemPromptUpdate = resolved.systemPromptUpdate;
+			if (systemPromptUpdate !== void 0 && systemPromptUpdate !== "in-history") throw new LlmError(`adapter returned invalid system prompt update mode for provider "${provider}" model "${model}"`, "INVALID_MODEL_INFO");
 			const defaultMaxTokens = resolved.defaultMaxTokens;
 			if (defaultMaxTokens !== void 0 && (!Number.isSafeInteger(defaultMaxTokens) || defaultMaxTokens <= 0)) throw new LlmError(`adapter returned invalid default maxTokens for provider "${provider}" model "${model}"`, "INVALID_MODEL_MAX_TOKENS");
 			const info = {
@@ -3974,7 +4069,8 @@ var LlmError = class extends HarnessError {
 				...resolved.description === void 0 ? {} : { description: resolved.description },
 				...inputModalities === void 0 ? {} : { inputModalities },
 				...context === void 0 ? {} : { context: { contextWindow: context.contextWindow } },
-				...defaultMaxTokens === void 0 ? {} : { defaultMaxTokens }
+				...defaultMaxTokens === void 0 ? {} : { defaultMaxTokens },
+				...resolved.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: resolved.systemPromptUpdate }
 			};
 			const reasoning = resolved.reasoning;
 			if (reasoning === void 0) return info;
@@ -4068,6 +4164,7 @@ var LlmError = class extends HarnessError {
 				adapterDefaults,
 				...context === void 0 ? {} : { context },
 				...modelInfo.inputModalities === void 0 ? {} : { inputModalities: Object.freeze([...modelInfo.inputModalities]) },
+				...modelInfo.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: modelInfo.systemPromptUpdate },
 				stream: (options) => {
 					if (dispatched) throw new LlmError("a prepared LLM call can only be dispatched once", "INVALID_PREPARED_CALL");
 					if (!callConfigEquals(options, resolvedConfig)) throw new LlmError("prepared LLM call config changed before adapter dispatch", "INVALID_PREPARED_CALL");
@@ -4109,6 +4206,20 @@ var LlmError = class extends HarnessError {
 			return Object.isFrozen(options) ? deepFreeze(filtered) : filtered;
 		}
 		/**
+		* Resolve the current execution-world read path of one durable file
+		* reference through the mounted attachment and filesystem providers.
+		*/
+		fileReadPath(ref) {
+			let hostPath;
+			try {
+				hostPath = this.ctx.get("attachments")?.fileHostPath(ref);
+			} catch {
+				return;
+			}
+			if (hostPath === void 0) return void 0;
+			return this.ctx.get("fs")?.processPathFromHostPath(hostPath);
+		}
+		/**
 		* Final adapter boundary. Adapter selection, dispatch, iterator construction,
 		* and iteration failures become one terminal failure chunk. Middleware and
 		* downstream consumer failures remain thrown plugin or consumer errors.
@@ -4139,13 +4250,16 @@ var LlmError = class extends HarnessError {
 					...options,
 					...resolvedConfig
 				};
-				const projectedOptions = modelInfo.inputModalities !== void 0 && !modelInfo.inputModalities.includes("image") && resolvedOptions.messages.some((message) => contentHasImage(message.content)) ? Object.isFrozen(resolvedOptions) ? deepFreeze({
+				let projectedMessages = resolvedOptions.messages;
+				if (projectedMessages.some((message) => contentHasFile(message.content))) projectedMessages = projectFilesToText(projectedMessages, (ref) => this.fileReadPath(ref));
+				if (modelInfo.inputModalities !== void 0 && !modelInfo.inputModalities.includes("image") && projectedMessages.some((message) => contentHasImage(message.content))) projectedMessages = projectImagesForTextModel(projectedMessages);
+				const projectedOptions = projectedMessages === resolvedOptions.messages ? resolvedOptions : Object.isFrozen(resolvedOptions) ? deepFreeze({
 					...resolvedOptions,
-					messages: projectImagesForTextModel(resolvedOptions.messages)
+					messages: projectedMessages
 				}) : {
 					...resolvedOptions,
-					messages: projectImagesForTextModel(resolvedOptions.messages)
-				} : resolvedOptions;
+					messages: projectedMessages
+				};
 				iterator = dispatch(this.forAdapter(projectedOptions, adapter))[Symbol.asyncIterator]();
 			} catch (error) {
 				yield adapterFailureChunk(error, options.signal);
@@ -8966,7 +9080,7 @@ function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-storage@0.1.2-rc.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-storage/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-storage@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-storage/lib/index.js
 /**
 * Backend-facing vocabulary of the storage hub: a backend owns one medium
 * (a file-tree root, a database file) and exposes operation groups over it.
@@ -8977,7 +9091,7 @@ function superRefine(fn, params) {
 /** Allowed format for unit and table names: safe as a file name and as a SQL identifier segment without escaping. */
 const UNIT_NAME_RE = /^[a-z][a-z0-9_]*$/;
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-storage-domain@0.1.2-rc.1_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-i_9f44d404e0b20c2f6e8599234336f27b/node_modules/@deepseek-ai/dsh-storage-domain/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-storage-domain@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2_@deepseek-ai+ds_404bb44176e435660710548cd6a4e0aa/node_modules/@deepseek-ai/dsh-storage-domain/lib/index.js
 /**
 * Domain declaration vocabulary. A spec object is the single source of a
 * domain's identity, layout, and record schemas: the owning package defines
@@ -9121,6 +9235,27 @@ function sessionEvents(session) {
 function asEventList(events) {
 	return Array.isArray(events) ? events : [];
 }
+/**
+* 读取一个持久化（离线）会话的事件日志与头部元数据。兼容两代 persistence API：
+* - 旧版：`sessionPersistence.inspect(id)` 直接返回 { events, meta }；
+* - dsh 0.1.5 之后：`inspect` 已删除，改用 `open(id, 'read')` → `handle.read()`
+*   （+ `handle.header`），读句柄不抢写所有权，读后必须 close()。
+* 会话不存在时两个 API 都抛错，调用方按原语义处理。
+*/
+async function inspectPersistedSession(ctx, id) {
+	const persistence = ctx.sessionPersistence;
+	if (typeof persistence.inspect === "function") return await persistence.inspect(id);
+	const handle = await persistence.open(id, "read");
+	try {
+		const { events } = await handle.read();
+		return {
+			events,
+			meta: handle.header
+		};
+	} finally {
+		await handle.close();
+	}
+}
 /** agent.followup / steer 接受的用户消息值。 */
 function userMessage(text) {
 	return {
@@ -9252,12 +9387,14 @@ function latestSegmentSince(events, sinceSeq = 0) {
 	return segs.length === 0 ? null : segs[segs.length - 1] ?? null;
 }
 /**
-* 对一个 live 会话的事件日志折叠出其"实时思维链"：
-* - 优先聚合流式 assistant/chunk 事件里的 reasoning-delta（turn 中途即可见、增量，
-*   这正是监控思维链并按规则提前终止所需的粒度）；
-* - 同时聚合同窗口的 text-delta 增量；
-* - 若没有进行中的 chunk（会话空闲、或该 provider 不流式推理/无推理），返回 null，
-*   调用方应回落为 foldMessages 里的已定型 message.reasoning。
+* 对一个 live 会话的事件日志折叠出其"最近推理/文本增量流"。兼容两代日志形状：
+* - dsh 0.1.5 之后：turn 内不再发布独立 chunk 事件，流式增量内嵌在已定型
+*   assistant/message（或未定型 assistant/attempt）事件的 `stream` 记录里
+*   （reasoning-chunks / text-chunks 批量段 + 原始 chunk：reasoning-delta / text-delta）；
+* - 0.1.2-rc 之前：独立的 assistant/chunk 事件（turn 中途即可见、增量，
+*   这正是旧版监控思维链并按规则提前终止所需的粒度）。
+* 两者兼读、取最新一份；无任何增量（会话空闲、或该 provider 不流式推理/无推理）
+* 返回 null，调用方应回落为 foldMessages 里已定型的 message.reasoning。
 * 纯读、无副作用；事件形状不做任何假设，缺失/异常一律安全处理。
 */
 function liveReasoningSnapshot(events) {
@@ -9271,11 +9408,41 @@ function liveReasoningSnapshot(events) {
 	let step = 0;
 	let foundDelta = false;
 	for (const event of list) {
-		if (event.type === "assistant/message") {
-			lastFinalizedSeq = event.seq;
+		const type = event.type;
+		if (type === "assistant/message" || type === "assistant/attempt") {
+			const data = event.data;
+			if (data !== null && data !== void 0 && typeof data === "object" && Array.isArray(data.stream)) {
+				let r = "";
+				let t = "";
+				for (const raw of data.stream) {
+					const record = raw;
+					if (record === null || typeof record !== "object") continue;
+					if (record.type === "reasoning-chunks" && Array.isArray(record.texts)) {
+						for (const s of record.texts) if (typeof s === "string") r += s;
+					} else if (record.type === "text-chunks" && Array.isArray(record.texts)) {
+						for (const s of record.texts) if (typeof s === "string") t += s;
+					} else if (record.type === "chunk") {
+						const c = record.chunk;
+						if (c !== null && typeof c === "object" && typeof c.type === "string" && typeof c.text === "string") {
+							if (c.type === "reasoning-delta") r += c.text;
+							else if (c.type === "text-delta") t += c.text;
+						}
+					}
+				}
+				if (r !== "" || t !== "") {
+					if (typeof data.turn === "number") turn = data.turn;
+					if (typeof data.step === "number") step = data.step;
+					reasoning = r;
+					text = t;
+					seq = event.seq;
+					time = event.time;
+					foundDelta = true;
+				}
+			}
+			if (type === "assistant/message") lastFinalizedSeq = event.seq;
 			continue;
 		}
-		if (event.type !== "assistant/chunk") continue;
+		if (type !== "assistant/chunk") continue;
 		if (event.seq <= lastFinalizedSeq) continue;
 		const data = event.data;
 		if (data === null || data === void 0 || typeof data !== "object") continue;
@@ -9511,7 +9678,7 @@ function statusSnapshot(ctx, agent) {
 		lastTurn,
 		lastActivityAt,
 		stalledMs: lastActivityAt === null ? null : Date.now() - lastActivityAt,
-		pendingWork: inbox?.hasPending ?? false,
+		pendingWork: inbox?.hasPending === true || (inbox?.nextTurn?.length ?? 0) + (inbox?.nextStep?.length ?? 0) > 0,
 		nextTurnCount: inbox?.nextTurn?.length ?? 0,
 		nextStepCount: inbox?.nextStep?.length ?? 0,
 		...lastAssistantText === void 0 ? {} : { lastAssistantText },
@@ -9874,7 +10041,7 @@ var SessionMonitor = class {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-invaria_51e6fefef6ddce4f991b3d02344a1a72/node_modules/@deepseek-ai/dsh-scope/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-invaria_eaf7046112a9b60866fe7f69bc8f6f64/node_modules/@deepseek-ai/dsh-scope/lib/index.js
 /**
 * Shared insertion-ordered storage and effect ownership for scope-aware registries.
 *
@@ -10153,7 +10320,92 @@ function scopeTarget(base, key) {
 	return carrier;
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-tools@0.1.2-alpha.2_96d3de6f0f5da790676b5bfb20e4a981/node_modules/@deepseek-ai/dsh-tools/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-sandbox@0.1.6-alpha.1_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-llm@0_1d3a97f96d2766469566ca2b01247bfa/node_modules/@deepseek-ai/dsh-sandbox/lib/index.js
+/**
+* The escalation vocabulary and choreography shared by every sandbox-enforcing
+* tool family (`@deepseek-ai/dsh-tool-bash`, `@deepseek-ai/dsh-tool-fs`): the
+* strictly-wider ladder, the argument-pairing validation, the model-facing
+* denial/hint markers, and {@link approveEscalation} — the ordered fail-closed
+* sequence that resolves a `sandbox_permissions` request through a
+* user-approval channel BEFORE anything executes. One home keeps the two
+* families' approval ordering and verbatim error texts from drifting apart.
+*
+* The channel is a minimal STRUCTURAL function shape ({@link EscalationAsk}),
+* not the approval service type: the tool layer — which owns the agent, the
+* call id, and the tool name — closes over `ctx.approval.request(...)` and
+* hands the closure down, so this package never depends on the approval or
+* agent packages.
+*
+* @module dsh-sandbox/escalation
+*/
+/**
+* The strictly-wider table: what a call whose effective mode is the key may
+* escalate TO. Checked at EXECUTION, never baked into a tool schema — the
+* schema's enum is {@link ESCALATION_TARGETS}, because schemas are
+* registry-global while the effective mode is per-call truth.
+*/
+const WIDER_MODES = {
+	"read-only": ["workspace-write", "danger-full-access"],
+	"workspace-write": ["danger-full-access"]
+};
+/**
+* The closed escalation-target vocabulary — every mode a call could ever
+* escalate TO (`read-only` is the floor; nothing escalates to it). Advertised
+* whenever the mounted capability confines: cutting the enum down to the modes
+* wider than the composition's DEFAULT would strand a session whose effective
+* mode sits below it (a `danger-full-access` default would advertise nothing
+* while a narrower-switched session stays confined with no lever).
+*/
+const ESCALATION_TARGETS = ["workspace-write", "danger-full-access"];
+/**
+* Validate the escalation argument pairing a tool schema cannot express:
+* `sandbox_permissions` and `justification` travel together — an approval
+* prompt without a reason, or a reason driving nothing, is a malformed ask —
+* and the justification must be a non-empty sentence.
+* @param sandboxPermissions - the raw `sandbox_permissions` argument, if given.
+* @param justification - the raw `justification` argument, if given.
+*/
+function validateEscalationArgs(sandboxPermissions, justification) {
+	if (sandboxPermissions !== void 0 && justification === void 0) throw new Error("invalid escalation: sandbox_permissions requires a justification");
+	if (justification !== void 0 && sandboxPermissions === void 0) throw new Error("invalid escalation: justification is only valid together with sandbox_permissions");
+	if (justification !== void 0 && justification.trim().length === 0) throw new Error("invalid justification: expected a non-empty sentence");
+}
+/**
+* Resolve a sandbox-escalation request BEFORE anything executes: check strict
+* widening against the call's effective mode, then resolve the approval
+* channel, then map every outcome — the ordered fail-closed sequence both
+* enforcing families share. Returns the granted mode to stamp onto exactly
+* this call; throws the distinct verbatim text for every other path (a
+* non-widening request, a missing approval service, an agent-less execution,
+* a rejection, a cancellation, an unanswerable ask) — the tool registry turns
+* the throw into the call's isError result, and nothing has run. A
+* non-widening request never prompts a human.
+* @param request - the escalation to judge (see {@link EscalationRequest}).
+* @param approval - the approval ingredients the tool holds (see {@link EscalationApproval}).
+* @returns the granted mode, consumed by the one call that asked.
+*/
+async function approveEscalation(request, approval) {
+	const { requestedMode: mode, effectiveMode, justification, subject } = request;
+	if (!(WIDER_MODES[effectiveMode] ?? []).includes(mode)) throw new Error(`sandbox escalation to "${mode}" is not strictly wider than this call's current "${effectiveMode}" mode`);
+	if (approval.approver === void 0) throw new Error(`sandbox escalation to "${mode}" requires approval, but no approval service is composed`);
+	if (approval.agent === void 0) throw new Error(`sandbox escalation to "${mode}" requires approval, but the call has no agent to route it through`);
+	const outcome = await approval.approver.request({
+		agent: approval.agent,
+		toolName: approval.toolName,
+		callId: approval.callId,
+		reason: `escalate sandbox to ${mode}: ${justification}`,
+		...approval.signal ? { signal: approval.signal } : {}
+	});
+	switch (outcome) {
+		case "allowed-once": return mode;
+		case "rejected": throw new Error(`the user rejected escalating this ${subject} to "${mode}"`);
+		case "cancelled": throw new Error(`approval for escalating to "${mode}" was cancelled`);
+		case "unavailable": throw new Error(`sandbox escalation to "${mode}" requires approval, but no approval channel is available`);
+		default: return assertNever(outcome, "EscalationOutcome");
+	}
+}
+//#endregion
+//#region node_modules/.pnpm/@deepseek-ai+dsh-tools@0.1.6-alpha.1_e89197212305e1b19bd6df05221bc44b/node_modules/@deepseek-ai/dsh-tools/lib/index.js
 /**
 * Enforced JSON Schema subset shared by tool outputs, generated PTC mode
 * types, subagents, and workflows. The subset accepts any JSON root, an
@@ -11024,7 +11276,7 @@ const TYPESCRIPT_FLAVOR = {
 	description: "Execute a TypeScript program against the available tools. Takes two required arguments: `code`, the BODY of an async function (erasable syntax only; top-level `await` and `return` work), and `description`, a short summary of what the program does. Call tools as `await tools.name(args)` per the declarations in the system prompt. Only what you print or return is program output — curate it. Image-bearing subtool results are attached after the run.",
 	codeDescription: "The program: the body of an async TypeScript function."
 };
-/** Per-language `run_code` schema flavors (see {@link RunCodeFlavor}); one entry per {@link CodeSdkLanguage}. */
+/** Per-language `run_code` schema flavors (see {@link RunCodeFlavor}); one entry per {@link PtcSdkLanguage}. */
 const RUN_CODE_FLAVORS = {
 	typescript: TYPESCRIPT_FLAVOR,
 	python: {
@@ -11039,17 +11291,48 @@ const RUN_CODE_FLAVORS = {
 * can never drift.
 */
 const RUN_CODE_DESCRIPTION_PARAM_DESCRIPTION = "Clear, concise description of what this program does in active voice, 5-10 words (shown in the UI). Examples: \"Count TODO markers across packages\"; \"Read failing test and its fixture\"; \"Rename config key in every cordis.yml\".";
+const RUN_CODE_CONTROLS = {
+	timeoutMs: {
+		type: "number",
+		description: "Positive elapsed-time budget in milliseconds, capped by the deployment maximum."
+	},
+	sandbox_permissions: {
+		type: "string",
+		enum: [...ESCALATION_TARGETS],
+		description: "Wider sandbox mode for this complete program execution; requires justification and approval."
+	},
+	justification: {
+		type: "string",
+		description: "Reason this complete program needs wider access, shown to the user for approval."
+	}
+};
+function controlParameters(runtime) {
+	if (runtime === void 0) return RUN_CODE_CONTROLS;
+	return {
+		...runtime.timeout === void 0 ? {} : { timeoutMs: {
+			...RUN_CODE_CONTROLS.timeoutMs,
+			description: `Positive elapsed-time budget in milliseconds, including nested tool and approval waits. Default ${runtime.timeout.defaultMs}; capped at ${runtime.timeout.maxMs}. Zero does not disable the deadline.`
+		} },
+		...runtime.sandboxMode === void 0 ? {} : {
+			sandbox_permissions: RUN_CODE_CONTROLS.sandbox_permissions,
+			justification: RUN_CODE_CONTROLS.justification
+		}
+	};
+}
+function escalationGuidance(runtime) {
+	return runtime?.sandboxMode === void 0 ? "" : " A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.";
+}
 /**
 * Resolve the {@link RunCodeFlavor} for the loaded runtime's language, read at
 * schema-emission time so the model-visible `run_code` schema always matches
 * the SDK section's language. `peekRuntime` returns `undefined` only when no
 * runtime is mounted, which reaches this function through definition readers
 * and `schemas()` — the doc-catalog harvest is the only shipped one, and none
-* of them feeds a model, because `wireSchemas` calls `requireCodeRuntime`
+* of them feeds a model, because `wireSchemas` calls `requirePtcRuntime`
 * before projecting — so that path degrades to {@link TYPESCRIPT_FLAVOR}. A
 * mounted runtime whose language has no flavor entry fails loud, exactly as
-* `requireCodeRuntime` rejects it at assembly. Keeping this table in step with
-* `SDK_RENDERERS` is the compiler's job ({@link CodeSdkLanguage}); what this
+* `requirePtcRuntime` rejects it at assembly. Keeping this table in step with
+* `SDK_RENDERERS` is the compiler's job ({@link PtcSdkLanguage}); what this
 * guard owns is the runtime-supplied language neither table knows, which never
 * yields a wrong-language schema for a real runtime.
 */
@@ -11218,7 +11501,8 @@ function createRunCodeTool(registry, options) {
 				type: "string",
 				required: true,
 				description: RUN_CODE_DESCRIPTION_PARAM_DESCRIPTION
-			}
+			},
+			...RUN_CODE_CONTROLS
 		},
 		output: {
 			schema: {
@@ -11230,12 +11514,37 @@ function createRunCodeTool(registry, options) {
 						required: true,
 						items: { type: "string" }
 					},
-					result: { type: "json" }
+					result: { type: "json" },
+					sandbox: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							mode: {
+								type: "string",
+								required: true,
+								enum: [
+									"read-only",
+									"workspace-write",
+									"danger-full-access"
+								]
+							},
+							denied: {
+								type: "boolean",
+								required: true
+							},
+							enforcement: {
+								type: "string",
+								enum: ["full", "partial"]
+							}
+						}
+					}
 				}
 			},
 			render: (_args, value) => {
 				const rendered = value.result === void 0 ? "" : renderValue(value.result);
 				const parts = [value.logs.join("\n"), rendered].filter((part) => part.length > 0);
+				if (value.sandbox?.enforcement === "partial") parts.push("File sandbox enforcement is partial on this host.");
+				if (value.sandbox?.denied) parts.push(`The ${value.sandbox.mode} file sandbox denied an operation.${escalationGuidance(peekRuntime())}`);
 				return [{
 					type: "text",
 					text: parts.length > 0 ? parts.join("\n") : "(run_code completed with no output)"
@@ -11245,6 +11554,31 @@ function createRunCodeTool(registry, options) {
 		async execute(args, exec) {
 			if (args.description.trim().length === 0) throw new Error("invalid description: expected a non-empty string");
 			const runtime = requireRuntime();
+			validateEscalationArgs(args.sandbox_permissions, args.justification);
+			if (args.timeoutMs !== void 0 && runtime.timeout === void 0) throw new Error("timeoutMs is not available for this PTC runtime");
+			if (args.timeoutMs !== void 0 && (!Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) throw new Error("invalid timeoutMs: expected a positive finite number");
+			const standingPolicy = runtime.sandboxMode === void 0 ? void 0 : options.resolveSandboxPolicy(exec);
+			let policy = standingPolicy;
+			if (args.sandbox_permissions !== void 0 && args.justification !== void 0) {
+				if (standingPolicy === void 0) throw new Error("sandbox_permissions is not available for this PTC runtime");
+				const approvedMode = await approveEscalation({
+					requestedMode: args.sandbox_permissions,
+					justification: args.justification,
+					effectiveMode: standingPolicy.mode,
+					subject: "program"
+				}, {
+					approver: options.peekApprover(),
+					agent: exec.agent,
+					callId: exec.callId,
+					toolName: RUN_CODE_NAME,
+					signal: exec.signal
+				});
+				policy = {
+					...standingPolicy,
+					mode: approvedMode
+				};
+			}
+			exec.signal.throwIfAborted();
 			const runController = new AbortController();
 			const onOuterAbort = () => {
 				runController.abort(exec.signal.reason);
@@ -11326,15 +11660,17 @@ function createRunCodeTool(registry, options) {
 				while (logWork.size > 0) await Promise.allSettled([...logWork]);
 			};
 			const runOver = () => runController.signal.aborted;
-			const binding = (name) => async (rawArgs) => {
+			const binding = (schema) => async (rawArgs) => {
+				const { name } = schema;
 				if (runOver()) throw new Error(`run_code run is over (${String(runController.signal.reason)}); ${name} not dispatched`);
 				const normalized = jsonNormalizeArgs(rawArgs);
 				const n = ++dispatches;
-				const subCallId = brandString(`${String(exec.callId)}:code:${n}`);
+				const subCallId = brandString(`${String(exec.callId)}:ptc:${n}`);
 				const input = {
 					callId: subCallId,
 					rootCallId: exec.rootCallId,
 					name,
+					schema,
 					arguments: normalized.dispatched,
 					...exec.agent ? { agent: exec.agent } : {},
 					parent: exec.token,
@@ -11362,13 +11698,14 @@ function createRunCodeTool(registry, options) {
 								isError: result.isError,
 								content: result.content
 							});
-							agent.session.append("tool/code-dispatch", {
+							agent.session.append("tool/ptc-dispatch", {
 								rootCallId: exec.rootCallId,
 								parentCallId: exec.callId,
 								subCallId,
 								name,
 								arguments: normalized.logged,
 								isError: result.isError,
+								...result.error?.info === void 0 ? {} : { error: result.error.info },
 								content: logged
 							});
 						})().finally(() => {
@@ -11384,7 +11721,7 @@ function createRunCodeTool(registry, options) {
 							reject(/* @__PURE__ */ new Error(`run_code run is over (${String(runController.signal.reason)}); ${name} tool call abandoned`));
 						},
 						async start() {
-							exec.agent?.session.append("tool/code-dispatch-start", {
+							exec.agent?.session.append("tool/ptc-dispatch-start", {
 								rootCallId: exec.rootCallId,
 								parentCallId: exec.callId,
 								subCallId,
@@ -11418,7 +11755,7 @@ function createRunCodeTool(registry, options) {
 								content: result.content,
 								source: {
 									kind: "plugin",
-									plugin: "tools-code-mode"
+									plugin: "tools-ptc"
 								}
 							}));
 							for (const context of result.additionalContexts ?? []) exec.deferContext(context);
@@ -11439,13 +11776,13 @@ function createRunCodeTool(registry, options) {
 				if (schema.name === "run_code") continue;
 				Object.defineProperty(functions, schema.name, {
 					enumerable: true,
-					value: binding(schema.name)
+					value: binding(deepFreeze(schema))
 				});
 			}
 			try {
 				let result;
 				try {
-					result = await runtime.run({
+					result = await runtime.run(runtime.resolve({
 						program: args.code,
 						bindings: [{
 							global: "tools",
@@ -11455,18 +11792,23 @@ function createRunCodeTool(registry, options) {
 								memberNameProperty: "toolName"
 							}
 						}],
-						signal: runController.signal
-					});
+						signal: runController.signal,
+						...exec.agent?.session.header.cwd !== void 0 ? { cwd: exec.agent.session.header.cwd } : {},
+						...policy !== void 0 ? { sandboxPolicy: policy } : {},
+						...args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {}
+					}));
 				} finally {
 					runController.abort("run_code settled");
 					await drainDispatches();
 				}
 				if (result.error) {
 					const logsText = result.logs.length > 0 ? `\nCaptured output:\n${result.logs.join("\n")}` : "";
-					throw new CodeRunFailedError(`code run failed (${result.error.kind}): ${result.error.message}${logsText}`);
+					const sandboxText = result.sandbox === void 0 ? "" : `\nFile sandbox: ${result.sandbox.mode}${result.sandbox.enforcement === void 0 ? "" : `; enforcement: ${result.sandbox.enforcement}`}${result.sandbox.denied ? "; operation denied" : ""}.`;
+					throw new CodeRunFailedError(`code run failed (${result.error.kind}): ${result.error.message}${logsText}${sandboxText}${result.sandbox?.denied ? escalationGuidance(runtime) : ""}`);
 				}
 				return {
 					logs: result.logs,
+					...result.sandbox === void 0 ? {} : { sandbox: result.sandbox },
 					...result.value !== void 0 ? { result: result.value } : {}
 				};
 			} finally {
@@ -11482,7 +11824,11 @@ function createRunCodeTool(registry, options) {
 	});
 	Object.defineProperty(definition, "description", {
 		enumerable: true,
-		get: () => resolveFlavor(peekRuntime).description
+		get: () => {
+			const runtime = peekRuntime();
+			const instructions = runtime?.executionInstructions;
+			return resolveFlavor(peekRuntime).description + (instructions ? ` ${instructions}` : "") + (runtime === void 0 ? "" : " The working directory is the Session's current directory.") + escalationGuidance(runtime);
+		}
 	});
 	Object.defineProperty(definition, "parameters", {
 		enumerable: true,
@@ -11496,7 +11842,8 @@ function createRunCodeTool(registry, options) {
 				type: "string",
 				required: true,
 				description: RUN_CODE_DESCRIPTION_PARAM_DESCRIPTION
-			}
+			},
+			...controlParameters(peekRuntime())
 		})
 	});
 	return definition;
@@ -11781,7 +12128,7 @@ function renderToolsSdk(schemas) {
 * PTC mode codegen — Python flavor. The pure projection from registered tool schemas to the
 * Python SDK text the model programs against under `runtime.language === 'python'`. Sibling of
 * {@link ./ts-types.ts | ts-types.ts}; the two files are two projections of the same registry
-* store, keyed by the loaded {@link @deepseek-ai/dsh-code-runtime#CodeRuntime.language | code
+* store, keyed by the loaded {@link @deepseek-ai/dsh-ptc-runtime#PtcRuntime.language | PTC
 * runtime's language}.
 *
 * Under `mode: 'ptc'` the native tool schemas are omitted from the request, so this generated
@@ -12468,17 +12815,17 @@ function renderToolsSdkPy(schemas) {
 */
 /**
 * Language → SDK-section renderer. The registry looks up the loaded
-* `ctx.codeRuntime.language` in this table when assembling the `tools:sdk`
+* `ctx.ptcRuntime.language` in this table when assembling the `tools:sdk`
 * section under a non-native mode; a runtime whose language is not a key
 * fails the assembly loudly (same idiom as `toolOrder` violations). Adding a
-* new backend language is three parallel edits — a {@link CodeSdkLanguage}
+* new backend language is three parallel edits — a {@link PtcSdkLanguage}
 * member, an entry here, and a `RUN_CODE_FLAVORS` entry in `ptc.ts` for
 * its `run_code` schema strings — plus the renderer function this table points
 * at. The `satisfies` clause pins this table's key set to that union, which
 * the flavor table is checked against too, so any of the three left out is a
 * typecheck failure. What no check reaches is the prose that names the values
-* instead of deriving them: the seam's `dsh-code-runtime` README pair, its
-* `CodeRuntime.language` JSDoc, and `docs/subsystems/code-runtime.md`
+* instead of deriving them: the seam's `dsh-ptc-runtime` README pair, its
+* `PtcRuntime.language` JSDoc, and `docs/subsystems/ptc-runtime.md`
 * with its zh pair, plus this package's own README pair and the
 * {@link Config.mode} JSDoc.
 */
@@ -12717,12 +13064,13 @@ var ToolRuntime = class extends Service {
 		return {
 			name: "tools:sdk",
 			order: this.ctx.systemPrompt.getSectionOrder("TOOLS_SDK"),
+			interpolate: false,
 			text: (context) => {
 				const mode = this.modeFor(context.scope);
 				if (mode === "native") return "";
-				const runtime = this.requireCodeRuntime(mode);
+				const runtime = this.requirePtcRuntime(mode);
 				const render = SDK_RENDERERS[runtime.language];
-				/* v8 ignore next -- requireCodeRuntime rejects an unknown language before this runs. */
+				/* v8 ignore next -- requirePtcRuntime rejects an unknown language before this runs. */
 				if (render === void 0) throw new Error(`dsh-tools: no SDK renderer for ${runtime.language}`);
 				return render(this.sdkSchemas(context.scope));
 			}
@@ -12751,10 +13099,16 @@ var ToolRuntime = class extends Service {
 	* and only for scopes whose mode actually presents it.
 	* @returns the shared transport definition.
 	*/
-	requireCodeTransport() {
+	requirePtcTransport() {
 		this.ptcTransport ??= createRunCodeTool(this, {
-			requireRuntime: () => this.requireCodeRuntime(this.defaultMode),
-			peekRuntime: () => this.ctx.get("codeRuntime"),
+			requireRuntime: () => this.requirePtcRuntime(this.defaultMode),
+			peekApprover: () => this.ctx.get("approval"),
+			resolveSandboxPolicy: (exec) => {
+				const policy = this.ctx.get("sandboxPolicy");
+				if (policy === void 0) throw new Error("dsh-tools: confined PTC runtime requires sandboxPolicy");
+				return policy.resolve(exec.agent === void 0 ? {} : { session: exec.agent.session });
+			},
+			peekRuntime: () => this.ctx.get("ptcRuntime"),
 			maxParallel: this.maxParallelSubCalls,
 			shapeDispatchLog: (dispatch) => this.shapeDispatchLog(dispatch)
 		});
@@ -12799,7 +13153,7 @@ var ToolRuntime = class extends Service {
 			schemas: [...view.visible.values()].map((definition) => this.schemaOf(definition, false)),
 			knownNames: [...view.knownNames]
 		};
-		this.requireCodeRuntime(mode);
+		this.requirePtcRuntime(mode);
 		const schemas = [...view.visible.values()].map((definition) => this.schemaOf(definition, false));
 		if (mode === "ptc") return {
 			schemas: schemas.filter((schema) => schema.name === RUN_CODE_NAME),
@@ -12811,10 +13165,10 @@ var ToolRuntime = class extends Service {
 		};
 	}
 	/**
-	* Resolve the code runtime or throw the actionable misconfiguration error.
+	* Resolve the PTC runtime or throw the actionable misconfiguration error.
 	* Read at use time (assembly / run_code execution), NOT via static
 	* `inject`: an inject entry would hold `ctx.tools` — and every tool plugin
-	* behind it — hostage to a code runtime existing even under `mode:
+	* behind it — hostage to a PTC runtime existing even under `mode:
 	* 'native'`.
 	*
 	* Assembly and `run_code` execution read separately, so the language is not
@@ -12822,12 +13176,11 @@ var ToolRuntime = class extends Service {
 	* reads return the same flavor — but a reload that swapped in a second
 	* language between them would hand a program written against one SDK to the
 	* other. Binding it is deferred until a second backend ships (the first
-	* point it is testable); rationale in the
-	* [language-dispatch note](../../../../.agents/notes/implemented/feature/2026-07-31-ptc-language-dispatch.md).
+	* point it is testable).
 	*/
-	requireCodeRuntime(mode) {
-		const runtime = this.ctx.get("codeRuntime");
-		if (!runtime) throw new Error(`dsh-tools: mode "${mode}" requires a code runtime — load a ctx.codeRuntime implementation (e.g. @deepseek-ai/dsh-code-runtime-worker-thread) or set tools mode to "native"`);
+	requirePtcRuntime(mode) {
+		const runtime = this.ctx.get("ptcRuntime");
+		if (!runtime) throw new Error(`dsh-tools: mode "${mode}" requires a PTC runtime — load a ctx.ptcRuntime implementation (e.g. @deepseek-ai/dsh-ptc-runtime-node) or set tools mode to "native"`);
 		if (!Object.hasOwn(SDK_RENDERERS, runtime.language)) {
 			const known = Object.keys(SDK_RENDERERS).map((name) => JSON.stringify(name)).join(", ");
 			throw new Error(`dsh-tools: no SDK renderer registered for runtime language ${JSON.stringify(runtime.language)} (known: ${known})`);
@@ -12909,9 +13262,9 @@ var ToolRuntime = class extends Service {
 	* A restriction filters what a scope inherits — the global layer and every
 	* ancestor layer on its chain — and never what its OWN layer registers.
 	* That exemption is what a per-child capability filter has to keep intact:
-	* the delegation runtime registers a child's reporting and structured-output
-	* tools into the child's own layer, and a filter naming the capabilities the
-	* child may use must not strip the machinery it answers through.
+	* the delegation runtime registers a child's structured-output tool into the
+	* child's own layer, and a filter naming the capabilities the child may use
+	* must not strip the machinery it answers through.
 	*
 	* Reading the exempt set as "the global layer" instead of "not mine" held
 	* only while every model-facing tool sat in the host composition. Once
@@ -12941,7 +13294,7 @@ var ToolRuntime = class extends Service {
 			knownNames.add(name);
 			visible.set(name, definition);
 		}
-		if (this.modeFor(scope) !== "native") visible.set(RUN_CODE_NAME, this.requireCodeTransport());
+		if (this.modeFor(scope) !== "native") visible.set(RUN_CODE_NAME, this.requirePtcTransport());
 		return {
 			visible,
 			knownNames,
@@ -13029,7 +13382,7 @@ var ToolRuntime = class extends Service {
 	}
 	/**
 	* Run the `tools/ptc-dispatch-log` waterfall over one settled sub-dispatch
-	* and return the content the bridge should log on `tool/code-dispatch`.
+	* and return the content the bridge should log on `tool/ptc-dispatch`.
 	* Contained: when a listener throws, the method logs the original settled
 	* content; that failure must not fail the dispatch or omit the settle event. Private:
 	* the ONE consumer is the `run_code` bridge this registry constructs, which
@@ -13112,6 +13465,7 @@ var ToolRuntime = class extends Service {
 			signal,
 			...agent !== void 0 ? { agent } : {},
 			...parent !== void 0 ? { parent } : {},
+			...exec.schema !== void 0 ? { schema: exec.schema } : {},
 			deferContext(context) {
 				deferredContexts.push(context);
 			},
@@ -13194,7 +13548,13 @@ var ToolRuntime = class extends Service {
 				exec,
 				result: toolAbortedBeforeDispatchResult()
 			});
+			if (decision.kind === "cancel") return await next({
+				kind: "post-result",
+				exec,
+				result: toolAbortedBeforeDispatchResult()
+			});
 			const denialReason = decision.kind === "allow" ? this.guardReason(exec) : decision.reason;
+			const denialInfo = decision.kind === "deny" ? decision.info : void 0;
 			if (denialReason !== void 0) return await next({
 				kind: "post-result",
 				exec,
@@ -13204,7 +13564,10 @@ var ToolRuntime = class extends Service {
 						text: `Error: ${denialReason}`
 					}],
 					isError: true,
-					error: { message: denialReason }
+					error: {
+						message: denialReason,
+						...denialInfo === void 0 ? {} : { info: denialInfo }
+					}
 				})
 			});
 			if (this.callerCancelled(exec)) return await next({
@@ -13655,11 +14018,33 @@ function toolAbortedBeforeDispatchResult(prior) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+dsh-agent@0.1.2-alpha.2_82401c175458b799db42b9e8f7dd7700/node_modules/@deepseek-ai/dsh-agent/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+dsh-agent@0.1.6-alpha.1_ce40d13c69e7e1ce48818baba37665e1/node_modules/@deepseek-ai/dsh-agent/lib/index.js
 /**
 * Agent-scoped model selection shared by runtime entry points.
 * @module @deepseek-ai/dsh-agent/model-selection
 */
+function sameRoute(left, right) {
+	return left.provider === right.provider && left.model === right.model;
+}
+function routeLabel(route, other) {
+	return route.provider === other.provider ? route.model : `${route.provider}/${route.model}`;
+}
+function modelSwitchNotice(previous, selected) {
+	const from = routeLabel(previous, selected);
+	const to = routeLabel(selected, previous);
+	return createUserMessage({
+		content: [{
+			type: "text",
+			text: `[model changed: assistant turns above this point were generated by ${from}; the session continues with ${to}]`
+		}],
+		source: {
+			kind: "plugin",
+			plugin: "model-selection",
+			form: "notice",
+			summary: boundContextSummary(`${from} → ${to}`)
+		}
+	});
+}
 /**
 * Couple one mutable selection to Agent-scoped prompt assembly and request routing.
 * Prompt assembly snapshots the selected model before delegating, then applies
@@ -13668,9 +14053,15 @@ function toolAbortedBeforeDispatchResult(prior) {
 * surfaces. An absent selected effort clears any inherited effort, restoring
 * the selected model's provider/default behavior.
 *
+* A provider/model change appends a durable user-role notice to the next
+* admitted request. It compares the assembled selection with the latest
+* request header; effort-only changes and empty no-request decisions add no
+* notice. Failure before header persistence repeats the notice on the next
+* request.
+*
 * @param agentCtx - The selected Agent's scoped context.
 * @param selection - Mutable selection owned by the calling entry point.
-* @returns Disposer for both scoped waterfall listeners.
+* @returns Disposer for all scoped waterfall listeners.
 */
 function installModelSelection(agentCtx, selection) {
 	const disposeAssembly = agentCtx.on("system-prompt/assemble", async (_assembly, _context, next) => {
@@ -13699,9 +14090,22 @@ function installModelSelection(agentCtx, selection) {
 			...selected.reasoningEffort === void 0 ? {} : { reasoningEffort: selected.reasoningEffort }
 		};
 	});
+	const disposeNotice = agentCtx.on("agent/pre-step", async ({ agent, messages, signal, step }, next) => {
+		const decision = await next();
+		if (decision.kind === "reject" || signal.aborted) return decision;
+		if (decision.messages.length === 0 && (step === 1 || messages.length > 0)) return decision;
+		const selected = selection.assembled;
+		const previous = agent.session.requestHeader()?.config;
+		if (selected === void 0 || previous === void 0 || sameRoute(selected, previous)) return decision;
+		return {
+			...decision,
+			messages: [...decision.messages, modelSwitchNotice(previous, selected)]
+		};
+	}, { prepend: true });
 	return () => {
 		disposeAssembly();
 		disposeRequest();
+		disposeNotice();
 	};
 }
 //#endregion
@@ -13853,8 +14257,10 @@ function registerCreate(env) {
 					...model !== "" ? { model } : {},
 					...reasoningEffort === void 0 ? {} : { reasoningEffort }
 				},
-				setup: (agentCtx) => {
-					if (caller !== void 0) env.ctx.agentPresets.composeFrom(agentCtx, caller.ctx);
+				setup: async (agentCtx) => {
+					const requestedPreset = typeof args.agentPreset === "string" && args.agentPreset.trim() !== "" ? args.agentPreset.trim() : void 0;
+					if (requestedPreset !== void 0) await env.ctx.agentPresets.mount(agentCtx, requestedPreset);
+					else if (caller !== void 0) env.ctx.agentPresets.composeFrom(agentCtx, caller.ctx);
 					if (installModelSelection$1 !== void 0) {
 						installModelSelection$1(agentCtx, selection);
 						return;
@@ -14022,7 +14428,11 @@ function registerResume(env) {
 			}
 			let headers = [];
 			try {
-				headers = await env.ctx.sessionPersistence.list();
+				headers = (await env.ctx.sessionPersistence.list()).map((rec) => ({
+					id: rec.header.id,
+					...rec.header.cwd === void 0 ? {} : { cwd: rec.header.cwd },
+					createdAt: rec.header.createdAt
+				}));
 			} catch (error) {
 				throw new Error("session persistence unavailable: " + (error instanceof Error ? error.message : String(error)));
 			}
@@ -14185,7 +14595,7 @@ function registerSegments(env) {
 				events = sessionEvents(agent.session);
 				live = true;
 			} else try {
-				events = (await env.ctx.sessionPersistence.inspect(args.sessionId)).events;
+				events = (await inspectPersistedSession(env.ctx, args.sessionId)).events;
 				live = false;
 			} catch (error) {
 				throw new Error(String(error));
@@ -14279,7 +14689,7 @@ function registerRead(env) {
 			} else {
 				let inspection;
 				try {
-					inspection = await env.ctx.sessionPersistence.inspect(args.sessionId);
+					inspection = await inspectPersistedSession(env.ctx, args.sessionId);
 				} catch (error) {
 					throw new Error("cannot read session " + JSON.stringify(args.sessionId) + ": " + (error instanceof Error ? error.message : String(error)));
 				}
@@ -14403,7 +14813,8 @@ function registerFind(env) {
 			}
 			if (args.liveOnly !== true) try {
 				const persistence = env.ctx.sessionPersistence;
-				for (const header of await persistence.list()) {
+				for (const rec of await persistence.list()) {
+					const header = rec.header;
 					if (items.some((item) => item.sessionId === header.id)) continue;
 					items.push({
 						sessionId: header.id,
@@ -14439,13 +14850,12 @@ function registerFind(env) {
 			const wsFilter = typeof args.workspaceId === "string" ? args.workspaceId.trim() : "";
 			const cwdFilter = typeof args.cwd === "string" ? args.cwd.trim().toLowerCase() : "";
 			if (titleFilter !== "" || query !== "" && items.some((item) => !item.live)) {
-				const persistence = env.ctx.sessionPersistence;
 				let inspected = 0;
 				for (const item of items) {
 					if (inspected >= 30) break;
 					if (item.live || item.title !== void 0) continue;
 					try {
-						item.title = titleOf((await persistence.inspect(item.sessionId)).events);
+						item.title = titleOf((await inspectPersistedSession(env.ctx, item.sessionId)).events);
 						inspected += 1;
 					} catch {
 						inspected += 1;
@@ -14950,7 +15360,6 @@ function registerArchive(env) {
 		async execute(args) {
 			const items = env.ctx.workspaceRegistry.archivedSessionIds.map(String).map((id) => ({ sessionId: id }));
 			if (args.resolveTitles === true && items.length > 0) {
-				const persistence = env.ctx.sessionPersistence;
 				const registryTitles = /* @__PURE__ */ new Map();
 				try {
 					const records = await env.registry.all();
@@ -14962,7 +15371,7 @@ function registerArchive(env) {
 						continue;
 					}
 					try {
-						item.title = titleOf((await persistence.inspect(item.sessionId)).events);
+						item.title = titleOf((await inspectPersistedSession(env.ctx, item.sessionId)).events);
 					} catch {}
 				}
 			}