external-subagent 0.6.1 → 0.6.3

package/cli/commands/plugin.mjs

@@ -1,8 +1,9 @@
 import { CliError } from '../errors.mjs';
 import { installMcp, installPlugin, uninstallPlugin } from '../install/codex.mjs';
 import { installZcodePlugin, uninstallZcodePlugin } from '../install/zcode.mjs';
-import { installDshPlugin, uninstallDshPlugin } from '../install/dsh.mjs';
+import { installDshPlugin, uninstallDshPlugin, dshHomeFor } from '../install/dsh.mjs';
 import { registerCodexHome, unregisterCodexHome } from '../install/reconcile.mjs';
+import { registerDshBinding, unregisterDshBinding } from '../install/dsh-registry.mjs';
 import { verifyPayload } from '../install/payload.mjs';
 
 // Command surface for the managed host bindings.  `install-plugin` takes an
@@ -68,7 +69,23 @@ export function pluginCommand(paths, args) {
     // error at the CLI parsing boundary with the other flag-combination
     // errors instead of deep inside the installer.
     if (!options.profile) throw new CliError('INVALID_ARGUMENT', 'the dsh host requires --profile <name>', 2);
-    return options.uninstall ? uninstallDshPlugin(paths, installerOptions) : installDshPlugin(paths, installerOptions);
+    const result = options.uninstall ? uninstallDshPlugin(paths, installerOptions) : installDshPlugin(paths, installerOptions);
+    // Registry bookkeeping survives a dsh-desktop rewrite that drops the
+    // managed block: a registered profile is RESTORED by reconcile, an
+    // unregistered one is forgotten.  Dry-runs never touch the registry.
+    if (!options.dry_run) {
+      const dshHome = dshHomeFor(installerOptions, paths);
+      if (options.uninstall) {
+        if (result.uninstalled) {
+          const claim = unregisterDshBinding(paths, dshHome, options.profile);
+          result.claim_released = claim.unregistered;
+        }
+      } else if (result.installed) {
+        const claim = registerDshBinding(paths, dshHome, options.profile, { status: 'claimed' });
+        result.claim = { registered: claim.registered, deduplicated: claim.deduplicated, bindings: claim.bindings };
+      }
+    }
+    return result;
   }
   if (options.profile) throw new CliError('INVALID_ARGUMENT', '--profile applies to the dsh host only', 2);
   if (options.dshHome) throw new CliError('INVALID_ARGUMENT', '--dsh-home applies to the dsh host only', 2);

package/cli/constants.mjs

@@ -12,7 +12,7 @@ const IS_DEBUG_VARIANT = process.env.EXTERNAL_SUBAGENT_VARIANT === 'debug';
 
 export const PRODUCT_NAME = IS_DEBUG_VARIANT ? 'external-subagent-debug' : 'external-subagent';
 export const PRODUCT_ID = IS_DEBUG_VARIANT ? 'external_subagent_debug' : 'external_subagent';
-export const VERSION = '0.6.1';
+export const VERSION = '0.6.3';
 export const LAUNCH_AGENT_LABEL = IS_DEBUG_VARIANT ? 'com.external-subagent-debug.daemon' : 'com.external-subagent.daemon';
 export const DAEMON_BIN_NAME = IS_DEBUG_VARIANT ? 'external-subagent-debugd' : 'external-subagentd';
 export const MCP_BIN_NAME = IS_DEBUG_VARIANT ? 'external-subagent-debug-mcp' : 'external-subagent-mcp';

package/cli/install/dsh-registry.mjs

@@ -0,0 +1,143 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { CliError } from '../errors.mjs';
+import { atomicWrite, jsonBytes, readOptional } from '../fs-atomic.mjs';
+
+// D28: the persistent registry of bound DSH profiles.  The dsh binding is
+// derivable from the patch sentinel in daily operation, but the sentinel
+// itself lives inside a file the dsh desktop rewrites wholesale on upgrade
+// (OBSERVED 2026-10-28, dsh 0.2.1-rc.3: both bound profiles lost the
+// managed block AND the staged skill, while the product's sentinel-only
+// reconcile reported bound:false and silently forgot the machines ever
+// bound).  This registry remembers what the user explicitly bound so
+// reconcile can RESTORE a dropped binding instead of merely refreshing
+// surviving ones.  It follows the codex-homes D08 model: atomic writes,
+// per-entry status bookkeeping, and corruption recovery that preserves the
+// bad bytes as evidence and continues with an empty table rather than
+// aborting the caller.
+
+const REGISTRY_SCHEMA_VERSION = 1;
+
+export function dshBindingsRegistryPath(paths) {
+  return path.join(paths.data, 'dsh-bindings.json');
+}
+
+function emptyRegistry() {
+  return { schema_version: REGISTRY_SCHEMA_VERSION, product: 'external-subagent', bindings: [] };
+}
+
+// Resolve a home to its canonical registry key.  A plain realpath fails on
+// a not-yet-created directory (a dsh home registered before its first
+// boot), and on macOS the /var -> /private/var symlink then yields the
+// UNRESOLVED prefix — so the same home would register and reconcile under
+// two different strings depending on whether it existed at the time.
+// Resolve the deepest EXISTING ancestor and append the remainder instead:
+// the key is stable across creation, removal, and symlinked tmpdirs.
+export function canonicalHome(home) {
+  if (typeof home !== 'string' || home.length === 0) throw new CliError('INVALID_ARGUMENT', 'dsh home must be a non-empty string', 2);
+  const absolute = path.resolve(home);
+  try { return fs.realpathSync(absolute); } catch { /* fall through to ancestor resolution */ }
+  const parent = path.dirname(absolute);
+  if (parent === absolute) return absolute;
+  return path.join(canonicalHome(parent), path.basename(absolute));
+}
+
+function resolveHome(home) {
+  return canonicalHome(home);
+}
+
+function normalizeEntry(entry) {
+  if (!entry || typeof entry.home !== 'string' || typeof entry.profile !== 'string') {
+    throw new CliError('DSH_BINDINGS_REGISTRY_INVALID', 'registry entry is missing its home or profile path');
+  }
+  if (/[\\/]/u.test(entry.profile)) {
+    throw new CliError('DSH_BINDINGS_REGISTRY_INVALID', 'registry entry profile must not contain path separators');
+  }
+  return {
+    home: entry.home,
+    profile: entry.profile,
+    claimed_at_ms: Number.isInteger(entry.claimed_at_ms) ? entry.claimed_at_ms : null,
+    last_sync_ms: Number.isInteger(entry.last_sync_ms) ? entry.last_sync_ms : null,
+    last_status: typeof entry.last_status === 'string' ? entry.last_status : null,
+  };
+}
+
+function parseRegistry(bytes, file) {
+  const doc = JSON.parse(bytes.toString('utf8'));
+  if (doc?.schema_version !== REGISTRY_SCHEMA_VERSION || doc?.product !== 'external-subagent' || !Array.isArray(doc.bindings)) {
+    throw new CliError('DSH_BINDINGS_REGISTRY_INVALID', 'registry identity or bindings table is invalid');
+  }
+  const registry = emptyRegistry();
+  registry.bindings = doc.bindings.map(normalizeEntry);
+  return registry;
+}
+
+// Corrupted registry: preserve the bytes for inspection, atomically stage a
+// fresh registry, and report a recoverable error — never abort the caller.
+export function loadDshBindings(paths) {
+  const file = dshBindingsRegistryPath(paths);
+  const bytes = readOptional(file);
+  if (bytes === null) return { registry: emptyRegistry(), recovery: null };
+  try {
+    return { registry: parseRegistry(bytes, file), recovery: null };
+  } catch (error) {
+    const backup = `${file}.corrupt-${Date.now()}`;
+    try { fs.renameSync(file, backup); } catch (renameError) {
+      throw new CliError('DSH_BINDINGS_REGISTRY_CORRUPT', `registry is corrupted and could not be preserved: ${renameError.message}`);
+    }
+    atomicWrite(file, jsonBytes(emptyRegistry()));
+    return {
+      registry: emptyRegistry(),
+      recovery: { status: 'recovered', code: 'DSH_BINDINGS_REGISTRY_CORRUPT', backup, error: error.message },
+    };
+  }
+}
+
+export function persistRegistry(paths, registry) {
+  atomicWrite(dshBindingsRegistryPath(paths), jsonBytes(registry));
+}
+
+export function registerDshBinding(paths, dshHome, profile, meta = {}) {
+  const { registry, recovery } = loadDshBindings(paths);
+  const home = resolveHome(dshHome);
+  const existing = registry.bindings.find((entry) => entry.home === home && entry.profile === profile);
+  let entry;
+  if (existing) {
+    entry = existing;
+    if (typeof meta.status === 'string') entry.last_status = meta.status;
+  } else {
+    entry = {
+      home,
+      profile,
+      claimed_at_ms: Date.now(),
+      last_sync_ms: null,
+      last_status: typeof meta.status === 'string' ? meta.status : 'claimed',
+    };
+    registry.bindings.push(entry);
+  }
+  persistRegistry(paths, registry);
+  return { registered: true, home, profile, deduplicated: Boolean(existing), bindings: registry.bindings.length, recovery };
+}
+
+export function unregisterDshBinding(paths, dshHome, profile) {
+  const { registry } = loadDshBindings(paths);
+  const home = resolveHome(dshHome);
+  const remaining = registry.bindings.filter((entry) => !(entry.home === home && entry.profile === profile));
+  const unregistered = remaining.length !== registry.bindings.length;
+  registry.bindings = remaining;
+  if (unregistered) persistRegistry(paths, registry);
+  return { unregistered, home, profile, bindings: registry.bindings.length };
+}
+
+// Product uninstall: no profile remains claimed.  The registry file itself
+// stays inside retained product data, matching the codex-homes posture.
+export function unregisterAllDshBindings(paths) {
+  const { registry } = loadDshBindings(paths);
+  const released = registry.bindings.map((entry) => ({ home: entry.home, profile: entry.profile }));
+  const file = dshBindingsRegistryPath(paths);
+  if (released.length > 0 || fs.existsSync(file)) {
+    registry.bindings = [];
+    persistRegistry(paths, registry);
+  }
+  return { unregistered: released.length, bindings: released };
+}

package/cli/install/dsh.mjs

@@ -7,6 +7,7 @@ import { atomicWrite, readOptional, restoreOptional } from '../fs-atomic.mjs';
 import { MCP_BIN_NAME } from '../constants.mjs';
 import { nativeBinary, pluginSourceRoot, PLUGIN_NAME } from './layout.mjs';
 import { guardedRestores } from './plugin-stage.mjs';
+import { loadDshBindings, persistRegistry as persistDshRegistry, dshBindingsRegistryPath, canonicalHome } from './dsh-registry.mjs';
 
 // Managed DSH host binding.  DSH boots profiles as an ordered stack of
 // plugin-bundle patch layers under the user's own overrides; the user layer
@@ -17,9 +18,11 @@ import { guardedRestores } from './plugin-stage.mjs';
 // into the user skill root (<dshHome>/skills), which dsh-skill-filesystem
 // scans by default (rank 400; OBSERVED against dsh 0.2.0-rc.2).  It never
 // touches the profile's package.json, bundles, node_modules, or any dsh
-// market/plugin-install state.  There is no registry file: the binding is
-// fully derivable from the patch sentinel plus the staged skill, so
-// reconcile and uninstall detect rather than remember it (the zcode model).
+// market/plugin-install state.  Claims also live in the persistent
+// dsh-bindings.json registry (dsh-registry.mjs): the dsh desktop rewrites
+// cordis.patch.yml wholesale on upgrade and DROPS the managed block
+// (OBSERVED 2026-10-28), so reconcile pairs the sentinel scan with the
+// registry to RESTORE a dropped binding instead of forgetting it.
 
 // The MCP client plugin is resolved by the dsh loader from the CLI's own
 // install tree when the bare package name is used (OBSERVED: a fresh
@@ -546,61 +549,135 @@ export function uninstallDshPlugin(paths, options = {}) {
   };
 }
 
-// Stateless reconcile for update flows (the zcode model): every profile
-// directory whose patch file carries the sentinel is rebound; the skill is
-// refreshed alongside.  Unknown/corrupt states are reported, never fatal to
-// the caller's broader reconcile.
+// Reconcile for update flows: the persistent registry (dsh-bindings.json)
+// UNION the sentinel scan.  The scan alone follows the zcode model — detect
+// rather than remember — but the dsh desktop rewrites cordis.patch.yml
+// wholesale on upgrade and DROPS the managed block (OBSERVED 2026-10-28),
+// after which a sentinel-only reconcile silently forgets the profile was
+// ever bound.  Registry entries therefore drive a RESTORE: a registered
+// profile whose patch lost the sentinel is re-bound (status `rebound`),
+// and one whose profile directory itself vanished is reported
+// (`missing_profile_dir`) without failing the reconcile.  Profiles bearing
+// the sentinel but absent from the registry (bound by an older build, or
+// by hand) are adopted into the registry so future drops restore too.
 export function reconcileDshBindings(paths, options = {}) {
   const dshHome = dshHomeFor(options, paths);
+  // Registry entries store realpath-resolved homes (registerDshBinding
+  // resolves); compare and dedupe against the SAME resolved form, or a
+  // symlinked dshHome (/var -> /private/var on macOS tmpdirs) would never
+  // match its own registry claims.
+  const resolvedHome = canonicalHome(dshHome);
   const profilesRoot = path.join(dshHome, 'profiles');
-  let entries;
+  const { registry, recovery } = loadDshBindings(paths);
+  const results = [];
+  const visited = new Set();
+  let directories = [];
+  let profilesRootAbsent = false;
   try {
-    entries = fs.readdirSync(profilesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
+    directories = fs.readdirSync(profilesRoot, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name);
   } catch (error) {
-    if (error?.code === 'ENOENT') return { bound: false, profiles: [], note: 'no dsh profiles directory' };
-    return { bound: false, profiles: [], error: { code: 'DSH_PROFILES_UNREADABLE', message: error.message } };
+    if (error?.code === 'ENOENT') profilesRootAbsent = true;
+    else {
+      return { bound: false, profiles: [], error: { code: 'DSH_PROFILES_UNREADABLE', message: error.message }, ...(recovery ? { recovery } : {}) };
+    }
   }
-  const results = [];
-  for (const entry of entries) {
-    if (DSH_FORBIDDEN_PROFILES.includes(entry.name)) continue;
-    const patchFile = path.join(profilesRoot, entry.name, 'cordis.patch.yml');
+  const directorySet = new Set(directories);
+  // Sentinel scan: refresh every surviving binding and adopt unregistered ones.
+  for (const name of directories) {
+    if (DSH_FORBIDDEN_PROFILES.includes(name)) continue;
+    const patchFile = path.join(profilesRoot, name, 'cordis.patch.yml');
     const bytes = readOptional(patchFile);
     if (bytes === null || !bytes.toString('utf8').includes(SENTINEL)) continue;
+    visited.add(`${resolvedHome}\u0000${name}`);
+    try {
+      installDshPlugin(paths, { ...options, profile: name });
+      upsertRegistryEntry(registry, resolvedHome, name, 'updated');
+      results.push({ profile: name, status: 'updated', idempotent: true });
+    } catch (error) {
+      results.push({ profile: name, status: 'failed', error: { code: error.code || 'DSH_BINDING_FAILED', message: error.message } });
+    }
+  }
+  // Registry pass: restore registered profiles whose sentinel was dropped.
+  for (const entry of registry.bindings) {
+    if (entry.home !== resolvedHome) continue;
+    if (visited.has(`${entry.home}\u0000${entry.profile}`)) continue;
+    if (DSH_FORBIDDEN_PROFILES.includes(entry.profile)) continue;
+    if (!directorySet.has(entry.profile)) {
+      entry.last_status = 'missing_profile_dir';
+      results.push({ profile: entry.profile, status: 'missing_profile_dir' });
+      continue;
+    }
     try {
-      const install = installDshPlugin(paths, { ...options, profile: entry.name });
-      results.push({ profile: entry.name, status: 'updated', idempotent: Boolean(install.idempotent) });
+      installDshPlugin(paths, { ...options, dshHome: entry.home, profile: entry.profile });
+      entry.last_status = 'rebound';
+      entry.last_sync_ms = Date.now();
+      results.push({ profile: entry.profile, status: 'rebound' });
     } catch (error) {
-      results.push({ profile: entry.name, status: 'failed', error: { code: error.code || 'DSH_BINDING_FAILED', message: error.message } });
+      entry.last_status = 'failed';
+      results.push({ profile: entry.profile, status: 'failed', error: { code: error.code || 'DSH_BINDING_FAILED', message: error.message } });
     }
   }
-  return { bound: results.length > 0, profiles: results };
+  if (results.length > 0 || fs.existsSync(dshBindingsRegistryPath(paths))) {
+    persistDshRegistry(paths, registry);
+  }
+  return {
+    bound: results.length > 0,
+    profiles: results,
+    ...(profilesRootAbsent ? { note: 'no dsh profiles directory' } : {}),
+    ...(recovery ? { recovery } : {}),
+  };
+}
+
+// Insert or refresh a registry entry in place (the loaded registry object is
+// the caller's working copy; persisting happens once at the end).
+function upsertRegistryEntry(registry, dshHome, profile, status) {
+  const home = canonicalHome(dshHome);
+  const existing = registry.bindings.find((entry) => entry.home === home && entry.profile === profile);
+  if (existing) {
+    existing.last_status = status;
+    existing.last_sync_ms = Date.now();
+  } else {
+    registry.bindings.push({
+      home,
+      profile,
+      claimed_at_ms: Date.now(),
+      last_sync_ms: Date.now(),
+      last_status: status,
+    });
+  }
 }
 
 // Product uninstall: release every detected binding at once.  Detection is
-// the same sentinel scan as reconcile; each profile is uninstalled
-// independently (a failure on one never skips the rest, matching the
-// per-home codex release posture), and the shared staged skill is removed
-// when no bound profile remains.
+// the same sentinel scan plus the registry, so a desktop-rewritten patch
+// (sentinel dropped) is still unregistered even though its block is gone.
+// Each profile is uninstalled independently (a failure on one never skips
+// the rest, matching the per-home codex release posture), and the shared
+// staged skill is removed when no bound profile remains.
 export function uninstallAllDshBindings(paths, options = {}) {
   const dshHome = dshHomeFor(options, paths);
   const profilesRoot = path.join(dshHome, 'profiles');
-  let entries;
+  let entries = [];
   try {
-    entries = fs.readdirSync(profilesRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory());
-  } catch {
-    return { released: 0, profiles: [] };
+    entries = fs.readdirSync(profilesRoot, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name);
+  } catch { /* registry pass below still releases claims */ }
+  const names = new Set(entries);
+  const resolvedHome = canonicalHome(dshHome);
+  const { registry } = loadDshBindings(paths);
+  for (const entry of registry.bindings) {
+    if (entry.home === resolvedHome) names.add(entry.profile);
   }
   const results = [];
-  for (const entry of entries) {
-    if (DSH_FORBIDDEN_PROFILES.includes(entry.name)) continue;
-    const patchFile = path.join(profilesRoot, entry.name, 'cordis.patch.yml');
-    const bytes = readOptional(patchFile);
-    if (bytes === null || !bytes.toString('utf8').includes(SENTINEL)) continue;
+  for (const name of names) {
+    if (DSH_FORBIDDEN_PROFILES.includes(name)) continue;
     try {
-      const removed = uninstallDshPlugin(paths, { ...options, profile: entry.name });
-      results.push({ profile: entry.name, status: removed.uninstalled ? 'released' : 'absent' });
+      const removed = uninstallDshPlugin(paths, { ...options, profile: name });
+      results.push({ profile: name, status: removed.uninstalled ? 'released' : 'absent' });
     } catch (error) {
-      results.push({ profile: entry.name, status: 'failed', error: { code: error.code || 'DSH_BINDING_RELEASE_FAILED', message: error.message } });
+      results.push({ profile: name, status: 'failed', error: { code: error.code || 'DSH_BINDING_RELEASE_FAILED', message: error.message } });
     }
   }
   // The skill is shared across profiles; remove it once no binding remains.
@@ -609,5 +686,10 @@ export function uninstallAllDshBindings(paths, options = {}) {
       unstageSkill(dshHome, options.source || pluginSourceRoot());
     } catch { /* reported per-profile above; a stuck skill never fails the release */ }
   }
-  return { released: results.filter((result) => result.status === 'released').length, profiles: results };
+  // Release every registry claim for THIS dsh home (other homes keep theirs).
+  const before = registry.bindings.length;
+  registry.bindings = registry.bindings.filter((entry) => entry.home !== resolvedHome);
+  const registry_cleared = before !== registry.bindings.length || fs.existsSync(dshBindingsRegistryPath(paths));
+  if (registry_cleared) persistDshRegistry(paths, registry);
+  return { released: results.filter((result) => result.status === 'released').length, profiles: results, registry_cleared };
 }

package/npm/native/darwin-arm64/payload.json

@@ -1,20 +1,20 @@
 {
   "schema_version": 1,
   "product": "external-subagent",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "platform": "darwin-arm64",
   "files": [
     {
       "name": "external-subagentd",
-      "bytes": 10436368,
+      "bytes": 10454160,
       "mode": "755",
-      "sha256": "4aebf0b109a33e9b2b1a7897287d1249f7e3792ae7848560f0d08d9365495d06"
+      "sha256": "8365dfc712e5cca2f3332dcab5db0e7b5eb905eb2e0e7dc231016b45c7275094"
     },
     {
       "name": "external-subagent-mcp",
       "bytes": 935776,
       "mode": "755",
-      "sha256": "1960fd2fb95e5e7125eec8ea21456cddc60e266b65ae67f247f611bd855a233c"
+      "sha256": "98e60f3a0ff2840318842232a6f7689326a1e7d75f487cbcb0878ddce7b64719"
     }
   ]
 }

package/npm/native/linux-x64/payload.json

@@ -1,20 +1,20 @@
 {
   "schema_version": 1,
   "product": "external-subagent",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "platform": "linux-x64",
   "files": [
     {
       "name": "external-subagentd",
-      "bytes": 12031656,
+      "bytes": 12033072,
       "mode": "755",
-      "sha256": "3e114f16cc88e5ce287013694f5c239616195769178af3b8f0c81d7ee8373c95"
+      "sha256": "5d8f39b76e22c24c8f848f9c753b7ba4336e9ecb57b82ef25d511ed21039dce7"
     },
     {
       "name": "external-subagent-mcp",
-      "bytes": 1025536,
+      "bytes": 1025520,
       "mode": "755",
-      "sha256": "d859ad4eed3e7e44faf377982fe0d641fb78157bd4da7a05256eeadc8eb545cb"
+      "sha256": "11999c141398a0009f33d740123d381ad4aae58c0a56fb2131629b378da96e89"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "external-subagent",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Manage bounded ZCode, DeepSeek Harness (DSH), Codex, and Google Antigravity (agy) subagent tasks through a local MCP service for any local host (Codex, ZCode, or a custom MCP client)",
   "type": "module",
   "license": "MIT",

package/schema/external-subagent-public-api.json

@@ -4,181 +4,544 @@
   "title": "external-subagent MCP public API",
   "description": "The intentionally small external_subagent_* wire catalog.",
   "type": "object",
-  "required": ["tools"],
+  "required": [
+    "tools"
+  ],
   "properties": {
     "tools": {
       "type": "array",
-      "const": ["external_subagent_cancel", "external_subagent_close", "external_subagent_list", "external_subagent_observe", "external_subagent_wait", "external_subagent_respond", "external_subagent_result", "external_subagent_send", "external_subagent_spawn", "external_subagent_status"]
+      "const": [
+        "external_subagent_cancel",
+        "external_subagent_close",
+        "external_subagent_list",
+        "external_subagent_observe",
+        "external_subagent_wait",
+        "external_subagent_respond",
+        "external_subagent_result",
+        "external_subagent_send",
+        "external_subagent_spawn",
+        "external_subagent_status"
+      ]
+    },
+    "permission_mode": {
+      "enum": [
+        "build",
+        "edit",
+        "plan",
+        "yolo"
+      ],
+      "default": "build"
     },
-    "permission_mode": { "enum": ["build", "edit", "plan", "yolo"], "default": "build" },
     "subagent_status": {
       "type": "object",
-      "required": ["subagent", "configured", "enabled", "spawn_supported", "permission_modes", "model_selection", "effort_selection", "local", "auth", "hi"],
+      "required": [
+        "subagent",
+        "configured",
+        "enabled",
+        "spawn_supported",
+        "permission_modes",
+        "model_selection",
+        "effort_selection",
+        "local",
+        "auth",
+        "hi"
+      ],
       "properties": {
-        "subagent": { "enum": ["zcode", "dsh", "codex", "agy"] },
-        "configured": { "type": "boolean" },
-        "enabled": { "type": "boolean" },
-        "spawn_supported": { "type": "boolean" },
+        "subagent": {
+          "enum": [
+            "zcode",
+            "dsh",
+            "codex",
+            "agy"
+          ]
+        },
+        "configured": {
+          "type": "boolean"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "spawn_supported": {
+          "type": "boolean"
+        },
         "permission_modes": {
           "type": "array",
-          "items": { "enum": ["build", "edit", "plan", "yolo"] },
+          "items": {
+            "enum": [
+              "build",
+              "edit",
+              "plan",
+              "yolo"
+            ]
+          },
           "uniqueItems": true
         },
         "model_selection": {
           "type": "object",
-          "required": ["supported", "mode"],
+          "required": [
+            "supported",
+            "mode"
+          ],
           "properties": {
-            "supported": { "type": "boolean" },
-            "mode": { "enum": ["native_only", "catalog_token"] }
+            "supported": {
+              "type": "boolean"
+            },
+            "mode": {
+              "enum": [
+                "native_only",
+                "catalog_token"
+              ]
+            }
           },
           "additionalProperties": false
         },
         "effort_selection": {
           "type": "object",
           "description": "Reasoning-effort steering capability. codex admits only its closed set; zcode and dsh pass a bounded [a-z0-9_] token through to the runtime.",
-          "required": ["supported", "mode"],
+          "required": [
+            "supported",
+            "mode"
+          ],
           "properties": {
-            "supported": { "type": "boolean" },
-            "mode": { "enum": ["closed_set", "passthrough_token"] }
+            "supported": {
+              "type": "boolean"
+            },
+            "mode": {
+              "enum": [
+                "closed_set",
+                "passthrough_token"
+              ]
+            }
           },
           "additionalProperties": false
         },
-        "local": { "$ref": "#/properties/subagent_scope_status" },
-        "auth": { "$ref": "#/properties/subagent_scope_status" },
-        "hi": { "$ref": "#/properties/subagent_scope_status" }
+        "local": {
+          "$ref": "#/properties/subagent_scope_status"
+        },
+        "auth": {
+          "$ref": "#/properties/subagent_scope_status"
+        },
+        "hi": {
+          "$ref": "#/properties/subagent_scope_status"
+        }
       },
       "additionalProperties": false
     },
     "subagent_scope_status": {
       "type": "object",
       "description": "Readiness conclusion only. Probe evidence (scope paths, version, checked_at_ms, reason) stays on the daemon RPC view for the CLI diagnose owner.",
-      "required": ["state"],
+      "required": [
+        "state"
+      ],
       "properties": {
-        "state": { "enum": ["READY", "DEGRADED", "UNAVAILABLE", "UNKNOWN"] }
+        "state": {
+          "enum": [
+            "READY",
+            "DEGRADED",
+            "UNAVAILABLE",
+            "UNKNOWN"
+          ]
+        }
       },
       "additionalProperties": false
     },
     "spawn": {
       "type": "object",
       "description": "Start one durable subagent in an absolute repository workspace, returning after establishing the new session.",
-      "required": ["repository", "prompt"],
+      "required": [
+        "repository",
+        "prompt"
+      ],
       "properties": {
-        "profile": { "type": "string", "minLength": 1, "description": "Profile name referencing a JSON preset in profiles/*.json. Mutually exclusive with subagent, permission_mode, model, and effort." },
-        "subagent": { "type": "string", "minLength": 1, "description": "Subagent route key; omission uses configured default_subagent or returns subagent_required. Null is invalid; dsh production spawn requires its enabled + spawn_supported + pinned-runtime configuration." },
-        "repository": { "type": "string", "minLength": 1 },
-        "permission_mode": { "$ref": "#/properties/permission_mode", "description": "codex supports build/edit (workspace-write), plan (read-only), and yolo (danger-full-access), always with approvalPolicy=never; agy supports only build (--mode accept-edits) and yolo (--dangerously-skip-permissions)." },
-        "prompt": { "type": "string", "minLength": 1 },
-        "model": { "type": "string", "minLength": 1, "description": "Task model. dsh requires provider:model, split at the first colon (the model side may contain further colons; a missing colon or an empty side is rejected before any task). codex uses its own model id; zcode requires an explicit provider/model token from the spawn request or a named profile, and rejects a bare token, an omitted model, and agents.zcode.default_model at admission. agy uses a bare model slug with no ':' or '/' separator or whitespace; admission validates only that shape and the daemon does not verify catalog membership, so an unknown slug fails loudly at session start when the agy CLI rejects it. Omission falls back to the configured default_model for dsh and agy, then to the provider-native model; codex requires an explicit model or agents.codex.default_model; zcode and codex never fall back to a provider default." },
-        "effort": { "type": "string", "minLength": 1, "maxLength": 24, "pattern": "^[a-z0-9_]+$", "description": "Reasoning-effort token: 1..24 bytes of [a-z0-9_]. codex admits only low, medium, high or xhigh; agy admits only low, medium, high or max; zcode and dsh pass the bounded token through. Omission keeps the runtime default." },
-        "write_manifest": { "type": "array", "items": { "type": "string", "minLength": 1 }, "description": "codex requires an empty or omitted write_manifest; non-empty input returns codex_write_manifest_unsupported before task creation. agy likewise requires an empty or omitted write_manifest; non-empty input returns agy_write_manifest_unsupported before task creation. dsh admits a non-empty manifest in build through the guarded manifest-build composition (workspace-write sandbox, only tool-fs writable, out-of-manifest paths rejected as FS_WRITE_MANIFEST_DENIED), at most 256 entries; an explicit [\".\"] keeps the existing build composition. plan requires an empty manifest for every subagent." }
+        "profile": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Profile name referencing a JSON preset in profiles/*.json. Mutually exclusive with subagent, permission_mode, model, and effort."
+        },
+        "subagent": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Subagent route key; omission uses configured default_subagent or returns subagent_required. Null is invalid; dsh production spawn requires its enabled + spawn_supported + pinned-runtime configuration."
+        },
+        "repository": {
+          "type": "string",
+          "minLength": 1
+        },
+        "permission_mode": {
+          "$ref": "#/properties/permission_mode",
+          "description": "codex supports build/edit (workspace-write), plan (read-only), and yolo (danger-full-access), always with approvalPolicy=never; agy supports only build (--mode accept-edits) and yolo (--dangerously-skip-permissions)."
+        },
+        "prompt": {
+          "type": "string",
+          "minLength": 1
+        },
+        "model": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Task model. dsh requires provider:model, split at the first colon (the model side may contain further colons; a missing colon or an empty side is rejected before any task). codex uses its own model id; zcode requires an explicit provider/model token from the spawn request or a named profile, and rejects a bare token, an omitted model, and agents.zcode.default_model at admission. agy uses a bare model slug with no ':' or '/' separator or whitespace; admission validates only that shape and the daemon does not verify catalog membership, so an unknown slug fails loudly at session start when the agy CLI rejects it. Omission falls back to the configured default_model for dsh and agy, then to the provider-native model; codex requires an explicit model or agents.codex.default_model; zcode and codex never fall back to a provider default."
+        },
+        "effort": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 24,
+          "pattern": "^[a-z0-9_]+$",
+          "description": "Reasoning-effort token: 1..24 bytes of [a-z0-9_]. codex admits only low, medium, high or xhigh; agy admits only low, medium, high or max; zcode and dsh pass the bounded token through. Omission keeps the runtime default."
+        },
+        "write_manifest": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "codex requires an empty or omitted write_manifest; non-empty input returns codex_write_manifest_unsupported before task creation. agy likewise requires an empty or omitted write_manifest; non-empty input returns agy_write_manifest_unsupported before task creation. dsh admits a non-empty manifest in build through the guarded manifest-build composition (workspace-write sandbox, only tool-fs writable, out-of-manifest paths rejected as FS_WRITE_MANIFEST_DENIED), at most 256 entries; an explicit [\".\"] keeps the existing build composition. plan requires an empty manifest for every subagent."
+        }
       },
       "allOf": [
-        { "if": { "required": ["subagent"], "properties": { "subagent": { "const": "codex" } } },
-          "then": { "properties": { "write_manifest": { "maxItems": 0 } } } },
-        { "if": { "required": ["subagent"], "properties": { "subagent": { "const": "dsh" } } },
-          "then": { "properties": { "write_manifest": { "maxItems": 256 } } } },
-        { "if": { "required": ["subagent"], "properties": { "subagent": { "const": "agy" } } },
-          "then": { "properties": {
-            "permission_mode": { "enum": ["build", "yolo"] },
-            "model": { "type": "string", "minLength": 1, "maxLength": 512, "pattern": "^[^:/\\s]+$" },
-            "effort": { "enum": ["low", "medium", "high", "max"] },
-            "write_manifest": { "maxItems": 0 }
-          } } },
-        { "if": { "required": ["permission_mode"], "properties": { "permission_mode": { "const": "plan" } } },
-          "then": { "properties": { "write_manifest": { "maxItems": 0 } } } }
+        {
+          "if": {
+            "required": [
+              "subagent"
+            ],
+            "properties": {
+              "subagent": {
+                "const": "codex"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "write_manifest": {
+                "maxItems": 0
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "subagent"
+            ],
+            "properties": {
+              "subagent": {
+                "const": "dsh"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "write_manifest": {
+                "maxItems": 256
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "subagent"
+            ],
+            "properties": {
+              "subagent": {
+                "const": "agy"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "permission_mode": {
+                "enum": [
+                  "build",
+                  "yolo"
+                ]
+              },
+              "model": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 512,
+                "pattern": "^[^:/\\s]+$"
+              },
+              "effort": {
+                "enum": [
+                  "low",
+                  "medium",
+                  "high",
+                  "max"
+                ]
+              },
+              "write_manifest": {
+                "maxItems": 0
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "permission_mode"
+            ],
+            "properties": {
+              "permission_mode": {
+                "const": "plan"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "write_manifest": {
+                "maxItems": 0
+              }
+            }
+          }
+        }
       ],
       "additionalProperties": false
     },
     "list": {
       "type": "object",
-      "required": ["repository"],
+      "required": [
+        "repository"
+      ],
       "properties": {
-        "subagent": { "type": "string", "minLength": 1 },
-        "repository": { "type": "string", "minLength": 1 },
-        "phase": { "type": ["string", "null"], "default": null },
-        "outcome": { "type": ["string", "null"], "default": null },
-        "cursor": { "type": ["string", "null"], "default": null },
-        "limit": { "type": "integer", "minimum": 1, "maximum": 100, "default": 100 }
+        "subagent": {
+          "type": "string",
+          "minLength": 1
+        },
+        "repository": {
+          "type": "string",
+          "minLength": 1
+        },
+        "phase": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
+        },
+        "outcome": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
+        },
+        "cursor": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "default": null
+        },
+        "limit": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 100,
+          "default": 100
+        }
       },
       "additionalProperties": false
     },
     "wait": {
       "type": "object",
       "description": "agent_id accepts one agent id (number) or a list of 1..=16 ids. A single id returns the single wait object described below. A list blocks until every listed agent is terminal OR any one of them raises an actionable pending request, then returns a FLAT object: one key per distinct agent id carrying that agent's ordinary wait object (a repeated id is awaited once like any other), plus one \"error\" key mapping problematic ids to markers - duplicated for ids repeated in the input and unknown_agent for ids that do not exist; the remaining ids are still awaited normally. Recommended parallel pattern: spawn every subagent first, then call wait once with all ids. In list mode message_id is not supported (pass it only with a scalar id), every element carries message_receipt=null, and each element's timed_out flag follows the same shared deadline. Wait up to 290 seconds by default. Returns early only when an actionable pending request exists (permission requests need allow/deny; user-input requests carry the full embedded question and need answer with non-empty content) or the terminal result is available; ordinary progress, message receipts, already-responded and unsupported requests never wake it, and its timeout still returns timed_out=true. When the embedded result page carries next_offset=null it is the whole final result and no further result call is needed; otherwise continue reading with external_subagent_result from next_offset. A failed terminal result also carries failure_message: usually the daemon's bounded single-line JSON failure detail, but an early fail_claim row may be plain text, so treat it as an opaque bounded string and attempt JSON parsing defensively (null when the task has no persisted detail or the outcome is not a failure). Read failure_message before falling back to daemon logs or sqlite. The pending_requests projection stays capped at 100 records while the wake decision scans the full pending set, and the request that woke the wait is always part of the returned projection so its request_id can be answered directly. activity carries the text tail incrementally: each wait returns only the text appended since the previous wait (an empty tail means nothing new), every byte is delivered by wait at most once, and latest_text_truncated flags the case where undelivered bytes rolled out of the bounded window so this response degraded to the whole window (on the terminal response, bytes repeating the embedded result page verbatim are stripped so they are not shipped twice), tool calls started in the last 60 seconds, and telemetry status; activity also exposes last_activity_age_ms (null before any activity) and model_request_active; additionally in_flight_tool_count counts tracked in-flight tool calls (scheduled or started without a matching result, error or permission resolution; 0 when there is no snapshot or the adapter has no per-call lifecycle tracking, such as codex) and oldest_in_flight_tool_age_ms is the age since the oldest tracked in-flight call first appeared (null when none is tracked); use external_subagent_observe only when these liveness signals suggest a meaningless loop or a stuck command, to inspect recent tool-call detail.Wait up to 290 seconds by default. Returns early only when an actionable pending request exists (permission requests need allow/deny; user-input requests carry the full embedded question and need answer with non-empty content) or the terminal result is available; ordinary progress, message receipts, already-responded and unsupported requests never wake it, and its timeout still returns timed_out=true. When the embedded result page carries next_offset=null it is the whole final result and no further result call is needed; otherwise continue reading with external_subagent_result from next_offset. A failed terminal result also carries failure_message: usually the daemon's bounded single-line JSON failure detail, but an early fail_claim row may be plain text, so treat it as an opaque bounded string and attempt JSON parsing defensively (null when the task has no persisted detail or the outcome is not a failure). Read failure_message before falling back to daemon logs or sqlite. The pending_requests projection stays capped at 100 records while the wake decision scans the full pending set, and the request that woke the wait is always part of the returned projection so its request_id can be answered directly. activity carries the text tail incrementally: each wait returns only the text appended since the previous wait (an empty tail means nothing new), every byte is delivered by wait at most once, and latest_text_truncated flags the case where undelivered bytes rolled out of the bounded window so this response degraded to the whole window (on the terminal response, bytes repeating the embedded result page verbatim are stripped so they are not shipped twice), tool calls started in the last 60 seconds, and telemetry status; activity also exposes last_activity_age_ms (null before any activity) and model_request_active; additionally in_flight_tool_count counts tracked in-flight tool calls (scheduled or started without a matching result, error or permission resolution; 0 when there is no snapshot or the adapter has no per-call lifecycle tracking, such as codex) and oldest_in_flight_tool_age_ms is the age since the oldest tracked in-flight call first appeared (null when none is tracked); use external_subagent_observe only when these liveness signals suggest a meaningless loop or a stuck command, to inspect recent tool-call detail.",
-      "required": ["agent_id"],
+      "required": [
+        "agent_id"
+      ],
       "properties": {
         "agent_id": {
           "anyOf": [
-            { "type": "integer", "minimum": 10000000, "maximum": 99999999 },
-            { "type": "array", "minItems": 1, "maxItems": 16, "items": { "type": "integer", "minimum": 10000000, "maximum": 99999999 } }
+            {
+              "type": "integer",
+              "minimum": 10000000,
+              "maximum": 99999999
+            },
+            {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 16,
+              "items": {
+                "type": "integer",
+                "minimum": 10000000,
+                "maximum": 99999999
+              }
+            }
           ],
           "description": "One agent id (scalar response) or a list of 1..=16 ids awaited together (response is an object keyed by agent id, each value the ordinary wait output or {\"error\":\"duplicated\"}/{\"error\":\"unknown_agent\"})."
         },
-        "wait_time": { "type": "integer", "minimum": 0, "maximum": 299, "default": 290 }
-        ,"message_id": { "type": ["string", "null"], "description": "Only supported with a scalar agent_id." }
+        "wait_time": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 299,
+          "default": 290
+        },
+        "message_id": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Only supported with a scalar agent_id."
+        }
       },
       "additionalProperties": false
     },
     "observe": {
       "description": "Read captured task observations for zcode, dsh, codex or agy. zcode and dsh expose at most 200 Unicode characters of public reasoning; codex and agy reasoning is null. Coverage reports capture gaps and unsupported history truthfully.",
       "type": "object",
-      "required": ["agent_id"],
+      "required": [
+        "agent_id"
+      ],
       "properties": {
-        "agent_id": { "type": "integer", "minimum": 10000000, "maximum": 99999999 }
+        "agent_id": {
+          "type": "integer",
+          "minimum": 10000000,
+          "maximum": 99999999
+        }
       },
       "additionalProperties": false
     },
     "result": {
       "type": "object",
       "description": "Pages bounded terminal task-owned text with the offset and limit continuation contract. Questions from user-input requests are embedded in full in wait projections, not paged here.",
-      "required": ["agent_id"],
+      "required": [
+        "agent_id"
+      ],
       "properties": {
-        "agent_id": { "type": "integer", "minimum": 10000000, "maximum": 99999999 },
-        "offset": { "type": "integer", "minimum": 0, "default": 0 },
-        "limit": { "type": "integer", "minimum": 1, "maximum": 262144, "default": 262144 }
+        "agent_id": {
+          "type": "integer",
+          "minimum": 10000000,
+          "maximum": 99999999
+        },
+        "offset": {
+          "type": "integer",
+          "minimum": 0,
+          "default": 0
+        },
+        "limit": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 262144,
+          "default": 262144
+        }
       },
       "additionalProperties": false
     },
     "result_projection": {
       "type": "object",
-      "required": ["outcome", "final_text", "partial", "offset", "total_bytes", "next_offset", "reason_code", "failure_message"],
+      "required": [
+        "outcome",
+        "final_text",
+        "partial",
+        "offset",
+        "total_bytes",
+        "next_offset",
+        "reason_code",
+        "failure_message"
+      ],
       "properties": {
-        "outcome": { "enum": ["COMPLETED", "FAILED", "CANCELLED", "TIMED_OUT", "RUNTIME_LOST", "RESULT_INVALID"] },
-        "final_text": { "type": "string" },
-        "partial": { "type": "boolean" },
-        "offset": { "type": "integer", "minimum": 0 },
-        "total_bytes": { "type": "integer", "minimum": 0 },
-        "next_offset": { "type": ["integer", "null"], "minimum": 0 },
-        "reason_code": { "type": ["string", "null"] },
-        "failure_message": { "type": ["string", "null"] }
+        "outcome": {
+          "enum": [
+            "COMPLETED",
+            "FAILED",
+            "CANCELLED",
+            "TIMED_OUT",
+            "RUNTIME_LOST",
+            "RESULT_INVALID"
+          ]
+        },
+        "final_text": {
+          "type": "string"
+        },
+        "partial": {
+          "type": "boolean"
+        },
+        "offset": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "total_bytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "next_offset": {
+          "type": [
+            "integer",
+            "null"
+          ],
+          "minimum": 0
+        },
+        "reason_code": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "failure_message": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
       },
       "additionalProperties": false
     },
     "question_projection": {
       "type": "object",
       "description": "Embedded question of an answerable user-input request in the wait projection's pending_requests entries; wait is the only retrieval surface, so a question beyond the embed cap is marked truncated instead of paged.",
-      "required": ["text", "truncated"],
+      "required": [
+        "text",
+        "truncated"
+      ],
       "properties": {
-        "text": { "type": "string" },
-        "truncated": { "type": "boolean" }
+        "text": {
+          "type": "string"
+        },
+        "truncated": {
+          "type": "boolean"
+        }
       },
       "additionalProperties": false
     },
     "error_projection": {
       "type": "object",
-      "required": ["error"],
+      "required": [
+        "error"
+      ],
       "properties": {
         "error": {
           "type": "object",
-          "required": ["code", "message"],
+          "required": [
+            "code",
+            "message"
+          ],
           "properties": {
-            "code": { "type": "string", "minLength": 1 },
-            "message": { "type": "string", "minLength": 1 },
-            "component": { "type": "string", "minLength": 1 },
-            "operation": { "type": "string", "minLength": 1 },
-            "request_id": { "type": "string", "minLength": 1 },
-            "agent_id": { "type": "integer", "minimum": 10000000, "maximum": 99999999 },
-            "prompt_count": { "type": "integer", "minimum": 0 }
+            "code": {
+              "type": "string",
+              "minLength": 1
+            },
+            "message": {
+              "type": "string",
+              "minLength": 1
+            },
+            "component": {
+              "type": "string",
+              "minLength": 1
+            },
+            "operation": {
+              "type": "string",
+              "minLength": 1
+            },
+            "request_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "agent_id": {
+              "type": "integer",
+              "minimum": 10000000,
+              "maximum": 99999999
+            },
+            "prompt_count": {
+              "type": "integer",
+              "minimum": 0
+            }
           },
           "additionalProperties": false
         }
@@ -189,16 +552,140 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "external_subagent_status": { "input": [], "output": ["mcp_version", "components", "capabilities", "subagents"] },
-        "external_subagent_spawn": { "input": ["profile", "subagent", "repository", "permission_mode", "prompt", "model", "effort", "write_manifest"], "output": ["agent_id", "status", "session_id", "instruction"], "idempotent": false },
-        "external_subagent_wait": { "input": ["agent_id", "wait_time", "message_id"], "output": ["task", "pending_requests", "activity", "result", "timed_out", "message_receipt"], "output_many": ["<agent_id> keys", "error"], "agent_id_forms": "scalar or array of 1..=16", "parallel_note": "spawn all subagents first, then wait once with the full id list" },
-        "external_subagent_observe": { "input": ["agent_id"], "output": ["tools", "reasoning", "coverage"], "idempotent": true },
-        "external_subagent_list": { "input": ["subagent", "repository", "phase", "outcome", "cursor", "limit"], "output": ["tasks", "next_cursor"] },
-        "external_subagent_send": { "input": ["agent_id", "message_id", "mode", "content"], "required": ["agent_id", "mode", "content"], "mode": ["queue", "steer"], "output": ["message_id", "disposition"] },
-        "external_subagent_respond": { "input": ["agent_id", "request_id", "decision", "content"], "output": ["disposition", "requested_decision", "effective_decision", "policy_overrode", "policy_reason_code"] },
-        "external_subagent_cancel": { "input": ["agent_id"], "output": ["task"] },
-        "external_subagent_result": { "input": ["agent_id", "offset", "limit"], "output": ["task", "result"] },
-        "external_subagent_close": { "input": ["agent_id"], "output": ["task"] }
+        "external_subagent_status": {
+          "input": [],
+          "output": [
+            "mcp_version",
+            "components",
+            "capabilities",
+            "subagents"
+          ]
+        },
+        "external_subagent_spawn": {
+          "input": [
+            "profile",
+            "subagent",
+            "repository",
+            "permission_mode",
+            "prompt",
+            "model",
+            "effort",
+            "write_manifest"
+          ],
+          "output": [
+            "agent_id",
+            "status",
+            "session_id",
+            "instruction"
+          ],
+          "idempotent": false
+        },
+        "external_subagent_wait": {
+          "input": [
+            "agent_id",
+            "wait_time",
+            "message_id"
+          ],
+          "output": [
+            "task",
+            "pending_requests",
+            "activity",
+            "result",
+            "timed_out",
+            "message_receipt"
+          ],
+          "output_many": "<agent_id> keys, \"error\" only when an id was duplicated or unknown",
+          "agent_id_forms": "scalar or array of 1..=16",
+          "parallel_note": "spawn all subagents first, then wait once with the full id list"
+        },
+        "external_subagent_observe": {
+          "input": [
+            "agent_id"
+          ],
+          "output": [
+            "tools",
+            "reasoning",
+            "coverage"
+          ],
+          "idempotent": true
+        },
+        "external_subagent_list": {
+          "input": [
+            "subagent",
+            "repository",
+            "phase",
+            "outcome",
+            "cursor",
+            "limit"
+          ],
+          "output": [
+            "tasks",
+            "next_cursor"
+          ]
+        },
+        "external_subagent_send": {
+          "input": [
+            "agent_id",
+            "message_id",
+            "mode",
+            "content"
+          ],
+          "required": [
+            "agent_id",
+            "mode",
+            "content"
+          ],
+          "mode": [
+            "queue",
+            "steer"
+          ],
+          "output": [
+            "message_id",
+            "disposition"
+          ]
+        },
+        "external_subagent_respond": {
+          "input": [
+            "agent_id",
+            "request_id",
+            "decision",
+            "content"
+          ],
+          "output": [
+            "disposition",
+            "requested_decision",
+            "effective_decision",
+            "policy_overrode",
+            "policy_reason_code"
+          ]
+        },
+        "external_subagent_cancel": {
+          "input": [
+            "agent_id"
+          ],
+          "output": [
+            "task"
+          ]
+        },
+        "external_subagent_result": {
+          "input": [
+            "agent_id",
+            "offset",
+            "limit"
+          ],
+          "output": [
+            "task",
+            "result"
+          ]
+        },
+        "external_subagent_close": {
+          "input": [
+            "agent_id"
+          ],
+          "output": [
+            "task"
+          ]
+        }
       }
     }
   },