2026-06-22 14:27:38 +08:00
|
|
|
{
|
|
|
|
|
"name": "@deepseek-ai/dsh-subagent-inprocess",
|
|
|
|
|
"description": "Shared in-process subagent run driver: drives a child agent on ctx.agents (used by the spawn and fork backends)",
|
|
|
|
|
"version": "0.0.1",
|
|
|
|
|
"private": true,
|
|
|
|
|
"type": "module",
|
|
|
|
|
"main": "lib/index.js",
|
2026-06-22 14:43:51 +08:00
|
|
|
"types": "lib/types/index.d.ts",
|
2026-06-22 14:27:38 +08:00
|
|
|
"exports": {
|
|
|
|
|
".": {
|
2026-06-22 14:43:51 +08:00
|
|
|
"types": "./lib/types/index.d.ts",
|
2026-06-22 14:27:38 +08:00
|
|
|
"default": "./lib/index.js"
|
|
|
|
|
},
|
2026-07-19 22:13:50 +08:00
|
|
|
"./invariant": {
|
|
|
|
|
"types": "./lib/types/invariant.d.ts",
|
|
|
|
|
"default": "./lib/invariant.js"
|
|
|
|
|
},
|
2026-06-22 14:27:38 +08:00
|
|
|
"./src/*": "./src/*",
|
|
|
|
|
"./package.json": "./package.json"
|
|
|
|
|
},
|
|
|
|
|
"files": [
|
2026-06-22 14:43:51 +08:00
|
|
|
"lib/index.js",
|
2026-07-19 22:13:50 +08:00
|
|
|
"lib/invariant.js",
|
2026-08-04 22:06:32 +08:00
|
|
|
"lib/types/**/*.d.ts"
|
2026-06-22 14:27:38 +08:00
|
|
|
],
|
|
|
|
|
"license": "BSD-3-Clause",
|
|
|
|
|
"peerDependencies": {
|
|
|
|
|
"@deepseek-ai/dsh-agent": "^0.0.1",
|
2026-07-19 22:13:50 +08:00
|
|
|
"@deepseek-ai/dsh-invariants": "^0.0.1",
|
2026-06-22 14:27:38 +08:00
|
|
|
"@deepseek-ai/dsh-llm": "^0.0.1",
|
subagent: inherit parent sandbox/approval overrides in in-process children
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
2026-07-25 04:06:19 +08:00
|
|
|
"@deepseek-ai/dsh-sandbox-policy": "^0.0.1",
|
2026-06-22 14:27:38 +08:00
|
|
|
"@deepseek-ai/dsh-session": "^0.0.1",
|
|
|
|
|
"@deepseek-ai/dsh-subagent": "^0.0.1",
|
Structured output on the subagent seam: schema subset, capture runtime, spawn/fork support
Carved out of #170 per review feedback — the foundation the workflow tool
builds on, now standing alone on master:
- dsh-tools: the structured-output JSON Schema subset (StructuredOutputSchema,
assertSupportedOutputSchema, validateStructuredValue) — rejects loud outside
the enforced subset, listing every violation
- dsh-subagent: SubagentStartRequest.outputSchema / SubagentResult.structured
become a real capability; the service rejects a schema'd request whose
provider lacks it
- dsh-subagent-inprocess: the shared structured runtime — one global
structured_output capture tool, a prepend final-assembly listener that
strips the placeholder for plain agents and swaps in the run's own schema
(plus the calling instruction as a trailing section) for structured
children, an agent/turn-continuation veto once captured, and the
capture/nudge loop in the run driver (structuredNudgeRetries, cancellation
honored mid-nudge); lifetime refcounted by backends and live runs
- subagent-spawn / subagent-fork flip outputSchema: true
One deliberate divergence from the #170 revision: the backends do NOT add
'tools' to their plugin inject. Doing so deferred their apply past the todo
plugin, and the delegation tool mirrors provider lifecycle — so the
model-visible tool order of every existing prompt changed, invalidating every
recorded snapshot fixture. The runtime now gates its capture-tool registration
on tools availability itself (sync when live, a scoped inject fiber when the
Loader starts the backend first), keeping this PR byte-invisible to existing
transcripts: all 35 snapshot scenarios pass against master's fixtures
unchanged.
2026-07-06 23:29:08 +08:00
|
|
|
"@deepseek-ai/dsh-system-prompt": "^0.0.1",
|
|
|
|
|
"@deepseek-ai/dsh-tools": "^0.0.1",
|
subagent: inherit parent sandbox/approval overrides in in-process children
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
2026-07-25 04:06:19 +08:00
|
|
|
"@deepseek-ai/dsh-user-approval": "^0.0.1",
|
2026-07-15 11:28:45 +08:00
|
|
|
"cordis": "^4.0.0-rc.7"
|
2026-06-22 14:27:38 +08:00
|
|
|
},
|
2026-07-26 22:02:02 +08:00
|
|
|
"peerDependenciesMeta": {
|
|
|
|
|
"@deepseek-ai/dsh-sandbox-policy": {
|
|
|
|
|
"optional": true
|
|
|
|
|
},
|
|
|
|
|
"@deepseek-ai/dsh-user-approval": {
|
|
|
|
|
"optional": true
|
|
|
|
|
}
|
|
|
|
|
},
|
2026-06-22 14:27:38 +08:00
|
|
|
"devDependencies": {
|
|
|
|
|
"@deepseek-ai/dsh-agent": "workspace:^",
|
|
|
|
|
"@deepseek-ai/dsh-agent-loop": "workspace:^",
|
2026-07-16 17:39:53 +08:00
|
|
|
"@deepseek-ai/dsh-agent-loop-testkit": "workspace:^",
|
subagent: inherit parent sandbox/approval overrides in in-process children
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
2026-07-25 04:06:19 +08:00
|
|
|
"@deepseek-ai/dsh-fs-sandbox": "workspace:^",
|
2026-06-22 14:27:38 +08:00
|
|
|
"@deepseek-ai/dsh-invariants": "workspace:^",
|
|
|
|
|
"@deepseek-ai/dsh-llm": "workspace:^",
|
subagent: inherit parent sandbox/approval overrides in in-process children
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
2026-07-25 04:06:19 +08:00
|
|
|
"@deepseek-ai/dsh-sandbox-policy": "workspace:^",
|
2026-06-22 14:27:38 +08:00
|
|
|
"@deepseek-ai/dsh-session": "workspace:^",
|
|
|
|
|
"@deepseek-ai/dsh-subagent": "workspace:^",
|
|
|
|
|
"@deepseek-ai/dsh-system-prompt": "workspace:^",
|
subagent: inherit parent sandbox/approval overrides in in-process children
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
2026-07-25 04:06:19 +08:00
|
|
|
"@deepseek-ai/dsh-tool-fs": "workspace:^",
|
2026-06-22 14:27:38 +08:00
|
|
|
"@deepseek-ai/dsh-tools": "workspace:^",
|
subagent: inherit parent sandbox/approval overrides in in-process children
Per-session policy overrides (sandbox/mode, approval/policy) never crossed
the delegation boundary: a spawn child of a read-only-switched parent ran
under the wider deployment default, and a fork child missed any switch made
after its seed boundary — delegation was a bypass channel for a user's
tightening.
The in-process driver now snapshots the delegating parent's override chain
and stamps it onto the child through the canonical write paths
(SandboxPolicyService.inheritOverride / ApprovalService.inheritOverride),
anchored inside the child's first turn via a one-shot agent/prompt-submit
listener: turn-enclosed (durable), ahead of the first request (an inherited
'never' reaches the child's first system prompt), and positioned after any
stale fork-seed switch so the ordinary last-event-wins fold resolves it.
Only overrides are copied — an unswitched parent stamps nothing and the
child follows the live deployment default; both services are consumed
opportunistically, so compositions without them delegate unchanged. Nesting
composes by construction (each stamp folds the already-stamped parent log).
Evidence: inheritance.spec.ts drives scripted-model children into the real
dsh-fs-sandbox fence through the real write tool (disk-state + denial-marker
assertions; spawn, stale-seed fork, grandchild, escalation fail-closed, and
no-stamp guards), inheritOverride contract tests in both service suites, and
the recorded subagent-sandbox-inheritance ACP snapshot (read-only preset →
delegate → child denied, replayed keylessly).
See .agents/notes/implemented/feature/2026-07-25-subagent-policy-inheritance.md.
2026-07-25 04:06:19 +08:00
|
|
|
"@deepseek-ai/dsh-user-approval": "workspace:^",
|
2026-07-15 11:28:45 +08:00
|
|
|
"cordis": "^4.0.0-rc.7"
|
2026-06-22 14:27:38 +08:00
|
|
|
}
|
|
|
|
|
}
|