Merge remote-tracking branch 'origin/master' into worktree/web-background-tasks-display-258f7e

# Conflicts:
#	docs/subsystems/tasks.i18n.yaml
#	docs/subsystems/tasks.md
#	docs/subsystems/tasks.zh.md
#	packages/host/apiproxy/README.i18n.yaml
#	packages/host/apiproxy/README.md
#	packages/host/apiproxy/README.zh.md
#	packages/host/apiproxy/src/api-proxy.ts
#	packages/tasks/tasks-local/src/index.ts
#	packages/tasks/tasks/README.i18n.yaml
#	packages/tasks/tasks/README.md
#	packages/tasks/tasks/README.zh.md
#	packages/tasks/tasks/src/index.ts

packages/tasks/tasks-local/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/tasks/tasks-local/README.md
-README.md: 663ce0d333c6df0f84900a2570d5487d8d7abe55
-README.zh.md: a5d1acaa50f63dc95b7607657b157272c15a4f11
+README.md: 80d7932466188955ade1c14e4968d51b739ba818
+README.zh.md: 5e4263e4685be64f91ec2a7c74edbf89e1148866

packages/tasks/tasks-local/README.md

@@ -12,6 +12,8 @@ Service disposal closes listeners, cancels all live tasks, awaits their records,
 
 Settlement is first-wins: the earliest terminal outcome — producer settlement, a rejected `done` contained as `failed`, or a teardown force-failure — records once, notifies listeners once with per-listener containment, and releases waiters. Pending waits mark the task reported before listeners run so completion surfaces do not duplicate notices.
 
+Surfaces and listeners are layered by the scope that registered them, in the tools-registry shape: a registration files into its registering context's scope, and a read unions the global layer with the owner's scope chain. One process-wide registry therefore answers per-owner questions per owner — `start()` refuses `background tasks unavailable: no control surface serves this agent (load @deepseek-ai/dsh-tool-tasks in its composition)` for an owner whose own composition attaches none, however many other compositions attach theirs, and a settlement reaches only the listeners its owner's composition registered.
+
 ## Model Experience
 
 Indirectly, through producer plugins and [`dsh-tool-tasks`](../tool-tasks/README.md), which render task ids, output, status, cancellation, and completion notices.

packages/tasks/tasks-local/README.zh.md

@@ -12,6 +12,8 @@
 
 结算遵循首次结算优先原则：最早出现的终止结果（生产方结算、作为 `failed` 隔离处理的 `done` 拒绝，或销毁时的强制失败）只记录一次，也只通知监听器一次；各监听器的故障会单独隔离，随后释放等待方。挂起的等待会在监听器运行前把任务标记为已报告，因此呈现完成情况的表层不会重复发出通知。
 
+表层与监听器按注册方所在的 scope 分层，形状与 tools 注册表一致：一次注册归档到其注册上下文的 scope，一次读取则把全局层与所有者的 scope 链求并集。因此一个进程级注册表能逐所有者地回答逐所有者的问题——对自身组合未附加任何表层的所有者，无论其他组合附加了多少，`start()` 都会拒绝并抛出 `background tasks unavailable: no control surface serves this agent (load @deepseek-ai/dsh-tool-tasks in its composition)`；一次结算也只会抵达其所有者所属组合注册的监听器。
+
 ## 模型体验
 
 通过生产方插件和 [`dsh-tool-tasks`](../tool-tasks/README.md) 间接影响；它们会呈现任务 id、输出、状态、取消和完成通知。

packages/tasks/tasks-local/package.json

@@ -1,8 +1,15 @@
 {
   "name": "@deepseek-ai/dsh-tasks-local",
   "description": "Process-local implementation of the DeepSeek Harness background task registry seam",
-  "version": "0.0.1",
-  "private": true,
+  "version": "0.0.1-rc.1",
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/tasks/tasks-local"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -25,19 +32,21 @@
   ],
   "license": "BSD-3-Clause",
   "peerDependencies": {
-    "@deepseek-ai/dsh-agent": "^0.0.1",
-    "@deepseek-ai/dsh-invariants": "^0.0.1",
-    "@deepseek-ai/dsh-tasks": "^0.0.1",
-    "@deepseek-ai/dsh-timeout": "^0.0.1",
-    "cordis": "^4.0.0-rc.7"
+    "@deepseek-ai/dsh-agent": "workspace:^",
+    "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-scope": "workspace:^",
+    "@deepseek-ai/dsh-tasks": "workspace:^",
+    "@deepseek-ai/dsh-timeout": "workspace:^",
+    "@deepseek-ai/cordis": "workspace:^"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-brand": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-scope": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
     "@deepseek-ai/dsh-tasks": "workspace:^",
     "@deepseek-ai/dsh-timeout": "workspace:^",
-    "cordis": "^4.0.0-rc.7"
+    "@deepseek-ai/cordis": "workspace:^"
   }
 }

packages/tasks/tasks-local/src/index.ts

@@ -9,8 +9,10 @@
  * @module @deepseek-ai/dsh-tasks-local
  */
 
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
+import { AnonymousEntries, ScopedLayers, scopeOf } from '@deepseek-ai/dsh-scope'
+import type { ScopeLayer } from '@deepseek-ai/dsh-scope'
 import { deadline, timeoutOf } from '@deepseek-ai/dsh-timeout'
 import { TaskService, TaskId } from '@deepseek-ai/dsh-tasks'
 import type {
@@ -52,6 +54,22 @@ function isTerminal(status: TaskStatus): boolean {
   return status === 'completed' || status === 'killed' || status === 'failed'
 }
 
+/**
+ * One scope's contributions: the control surfaces attached from it and the
+ * completion listeners registered there. Both tables are anonymous because a
+ * contribution is identified by its own disposer, never by a name a second
+ * registrant could shadow.
+ */
+class TaskLayer implements ScopeLayer {
+  readonly surfaces = new AnonymousEntries<symbol>()
+  readonly listeners = new AnonymousEntries<TaskDoneListener>()
+  readonly changed = new AnonymousEntries<TasksChangedListener>()
+
+  isEmpty(): boolean {
+    return this.surfaces.isEmpty() && this.listeners.isEmpty() && this.changed.isEmpty()
+  }
+}
+
 /**
  * The in-memory `tasks` registry. See the Service Definition contract in
  * `@deepseek-ai/dsh-tasks` for the ownership, isolation, and lifecycle
@@ -60,9 +78,19 @@ function isTerminal(status: TaskStatus): boolean {
 export class LocalTaskService extends TaskService {
   private store = new Map<TaskId, TrackedTask>()
   private counters = new Map<string, number>()
-  private surfaces = new Set<symbol>()
-  private listeners = new Set<TaskDoneListener>()
-  private changeListeners = new Set<TasksChangedListener>()
+  /**
+   * Surfaces and listeners layered by the scope that registered them, in the
+   * tools-registry shape: a contribution files into its registering context's
+   * scope, and a read unions the global layer with the reader's scope chain.
+   *
+   * The registry is one process-wide instance serving every composition, so a
+   * flat table would answer a per-owner question process-wide: one preset's
+   * task controls would hold `start()` open for an agent whose own composition
+   * loads none, and one settlement would reach every preset's notice listener.
+   * Layers make both reads owner-relative. Nothing derives a cache from a
+   * layer, so change notification is a no-op.
+   */
+  private readonly layers = new ScopedLayers<TaskLayer>(() => new TaskLayer(), () => {})
   private listenersClosed = false
   /** Owner agents with attached scope cleanup, mapped to the exact disposer. */
   private ownerCleanups = new Map<Agent, () => Promise<void> | void>()
@@ -76,8 +104,8 @@ export class LocalTaskService extends TaskService {
   }
 
   start(spec: TaskStart): TaskId {
-    if (this.surfaces.size === 0) {
-      throw new Error('background tasks unavailable: no control surface is attached (load @deepseek-ai/dsh-tool-tasks)')
+    if (!this.servesOwner(spec.owner)) {
+      throw new Error('background tasks unavailable: no control surface serves this agent (load @deepseek-ai/dsh-tool-tasks in its composition)')
     }
     if (spec.kind.length === 0) throw new Error('invalid task kind: expected a non-empty string')
     if (spec.label.length === 0) throw new Error('invalid task label: expected a non-empty string')
@@ -118,8 +146,8 @@ export class LocalTaskService extends TaskService {
     void hooks.done.then(
       (outcome) => { this.settle(task, outcome) },
       (error: unknown) => {
-        // Contain a producer contract violation so cleanup and waiters cannot hang.
-        this.selfCtx.logger.warn(`tasks: task ${task.id} 'done' rejected (producer contract violation): ${String(error)}`)
+        // Contain a producer contract violation (`done` rejected) so cleanup and waiters cannot hang.
+        this.selfCtx.logger.warn(`tasks: task ${task.id} producer done promise rejected (producer contract violation): ${String(error)}`)
         this.settle(task, { status: 'failed', detail: String(error) })
       },
     )
@@ -218,29 +246,57 @@ export class LocalTaskService extends TaskService {
   }
 
   onTaskDone(listener: TaskDoneListener): () => void {
-    const dispose = this.ctx.effect(() => {
-      this.listeners.add(listener)
-      return () => this.listeners.delete(listener)
-    }, 'tasks.onTaskDone()')
-    return () => void dispose()
+    return this.layers.effect(
+      this.ctx,
+      layer => layer.listeners.append(listener),
+      { label: 'tasks.onTaskDone()' },
+    )
   }
 
   onTasksChanged(listener: TasksChangedListener): () => void {
-    const dispose = this.ctx.effect(() => {
-      this.changeListeners.add(listener)
-      return () => this.changeListeners.delete(listener)
-    }, 'tasks.onTasksChanged()')
-    return () => void dispose()
+    return this.layers.effect(
+      this.ctx,
+      layer => layer.changed.append(listener),
+      { label: 'tasks.onTasksChanged()' },
+    )
   }
 
   attachSurface(name: string): () => void {
     // One token per call keeps duplicate labels independently disposable.
     const token = Symbol(name)
-    const dispose = this.ctx.effect(() => {
-      this.surfaces.add(token)
-      return () => this.surfaces.delete(token)
-    }, 'tasks.attachSurface()')
-    return () => void dispose()
+    return this.layers.effect(
+      this.ctx,
+      layer => layer.surfaces.append(token),
+      { label: 'tasks.attachSurface()' },
+    )
+  }
+
+  /**
+   * Whether an attached control surface can collect and stop work owned by
+   * `owner`. The global layer holds every surface attached from an unscoped
+   * context — a host composition's own controls — and therefore serves every
+   * owner; a scoped surface serves exactly the agents composed under it.
+   * @param owner - the task's owner, or undefined for unowned work.
+   * @returns whether some reachable surface serves the owner.
+   */
+  private servesOwner(owner?: Agent): boolean {
+    if (!this.layers.global.surfaces.isEmpty()) return true
+    return this.layers.chainLayers(owner === undefined ? undefined : scopeOf(owner.ctx))
+      .some(layer => !layer.surfaces.isEmpty())
+  }
+
+  /**
+   * The completion listeners that own `owner`'s notices: the global layer's
+   * first, then each scoped layer along the owner's chain. A listener outside
+   * that chain belongs to another composition and must not deliver, or the
+   * owner reads one notice per mounted preset.
+   * @param owner - the settled task's owner, or undefined for unowned work.
+   * @returns the listeners to notify, in registration order per layer.
+   */
+  private *listenersFor(owner?: Agent): IterableIterator<TaskDoneListener> {
+    yield* this.layers.global.listeners.values()
+    const scope = owner === undefined ? undefined : scopeOf(owner.ctx)
+    for (const layer of this.layers.chainLayers(scope)) yield* layer.listeners.values()
   }
 
   /** Look up a task or fail loud. */
@@ -278,12 +334,27 @@ export class LocalTaskService extends TaskService {
     }
   }
 
+  /**
+   * The change observers that own `owner`'s updates, resolved exactly like
+   * {@link listenersFor}: the global layer — a host composition's own carrier,
+   * which serves every owner — then each scoped layer along the owner's chain.
+   * An observer outside that chain belongs to another composition and would
+   * otherwise be told about agents it does not compose.
+   * @param owner - the owner whose visible set moved, or undefined for unowned work.
+   * @returns the observers to notify, in registration order per layer.
+   */
+  private *changedFor(owner?: Agent): IterableIterator<TasksChangedListener> {
+    yield* this.layers.global.changed.values()
+    const scope = owner === undefined ? undefined : scopeOf(owner.ctx)
+    for (const layer of this.layers.chainLayers(scope)) yield* layer.changed.values()
+  }
+
   /**
    * Announce that one owner's visible set changed. Each listener is contained
    * so an observer cannot break a lifecycle commit that already happened.
    */
   private notifyChanged(owner: Agent | undefined): void {
-    for (const listener of this.changeListeners) {
+    for (const listener of this.changedFor(owner)) {
       try {
         listener(owner)
       } catch (error: unknown) {
@@ -306,7 +377,7 @@ export class LocalTaskService extends TaskService {
     if (task.waiters > 0) task.reported = true
     if (!this.listenersClosed) {
       const snapshot = this.snapshot(task)
-      for (const listener of this.listeners) {
+      for (const listener of this.listenersFor(task.owner)) {
         try {
           const returned = listener(snapshot, task.owner)
           void Promise.resolve(returned).catch((error: unknown) => {
@@ -364,20 +435,20 @@ export class LocalTaskService extends TaskService {
    * effects. Throwing cancels are force-failed to avoid teardown deadlock.
    */
   private async disposeAll(): Promise<void> {
+    // The flag is the whole guard: each layer entry's undo belongs to the fiber
+    // that registered it, so this service may not drop them on its own way out.
     this.listenersClosed = true
-    this.listeners.clear()
     const all = [...this.store.values()]
     this.cancelForTeardown(all, 'tasks service disposed')
     await Promise.all(all.map(task => task.settled))
-    // Distinct owners whose records just disappeared. `onTasksChanged` binds to
-    // the CALLING fiber (the traceable proxy rebinds `this.ctx`), so a consumer
-    // mounted outside this service — the api-proxy carrier reads `ctx.get` from
-    // the mux stream — is still listening here. Without this it keeps the rows
-    // it last received after a registry reload.
+    // Distinct owners whose records just disappeared. A change observer files
+    // into the layer of the context that registered it, so a consumer mounted
+    // outside this service — the api-proxy carrier registers from the mux
+    // stream — is still reachable here. Without this it keeps the rows it last
+    // received after a registry reload.
     const emptied = new Set(all.map(task => task.owner))
     this.store.clear()
     for (const owner of emptied) this.notifyChanged(owner)
-    this.changeListeners.clear()
     // Detach cross-fiber owner effects after the shared store is quiescent.
     const ownerCleanups = [...this.ownerCleanups.values()]
     this.ownerCleanups.clear()

packages/tasks/tasks-local/src/invariant.ts

@@ -4,7 +4,7 @@
  */
 
 /* jscpd:ignore-start */
-import type { Context } from 'cordis'
+import type { Context } from '@deepseek-ai/cordis'
 import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 
 const PACKAGE_NAME = '@deepseek-ai/dsh-tasks-local'

packages/tasks/tasks-local/tests/tasks.spec.ts

@@ -1,8 +1,10 @@
 import { describe, expect, expectTypeOf, it, vi } from 'vitest'
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import { Session, SessionId } from '@deepseek-ai/dsh-session'
 import AgentRegistry, { Inbox } from '@deepseek-ai/dsh-agent'
 import type { Agent } from '@deepseek-ai/dsh-agent'
+import { bindScopeParent, createScope, scopeOf } from '@deepseek-ai/dsh-scope'
+import type { ScopeKey } from '@deepseek-ai/dsh-scope'
 import { TaskId } from '@deepseek-ai/dsh-tasks'
 import type { TaskHooks, TaskKind, TaskOutcome, TaskSnapshot, TaskStart } from '@deepseek-ai/dsh-tasks'
 import LocalTaskService from '@deepseek-ai/dsh-tasks-local'
@@ -15,9 +17,18 @@ declare module '@deepseek-ai/dsh-tasks' {
 
 const agentScopeDisposers = new WeakMap<Agent, () => Promise<void>>()
 
-function stubAgent(ctx: Context, rawId: string): Agent {
+function stubAgent(ctx: Context, rawId: string, presetScope?: ScopeKey): Agent {
   const id = SessionId(rawId)
   const scopeFiber = ctx.plugin(() => {})
+  // `presetScope` reproduces what `agentPresets.compose` does: the agent gets
+  // its own key parented to the standing mount's, so the registry's chain walk
+  // reaches that preset's layer.
+  let agentCtx = scopeFiber.ctx
+  if (presetScope !== undefined) {
+    const key = {}
+    bindScopeParent(key, presetScope)
+    agentCtx = createScope(scopeFiber.ctx, key).ctx
+  }
   const session = Session.create(id)
   const agent = {
     id,
@@ -25,7 +36,7 @@ function stubAgent(ctx: Context, rawId: string): Agent {
     session,
     inbox: new Inbox(session, { inserted: () => {}, discarded: () => {}, claimed: () => {} }),
     status: 'idle' as const,
-    ctx: scopeFiber.ctx,
+    ctx: agentCtx,
     send: () => {},
     followup: () => {},
     steer: () => ({ outcome: Promise.resolve({ status: 'rejected' as const }) }),
@@ -73,6 +84,21 @@ async function harness() {
   return ctx
 }
 
+/**
+ * Attach a control surface the way `tool-tasks` does: from a plugin whose own
+ * `inject` resolves `ctx.tasks`, so the service method binds to the REGISTERING
+ * context and the surface files into that context's scope layer. Reading the
+ * service off a bare scoped context instead throws `cannot get property "tasks"
+ * without inject`, which is the same rule the shipped plugin obeys.
+ * @param ctx - the context whose scope should own the surface.
+ */
+async function attachSurfaceIn(ctx: Context): Promise<void> {
+  await ctx.plugin({
+    inject: ['tasks'],
+    apply(pluginCtx: Context) { pluginCtx.tasks.attachSurface('tool-tasks') },
+  })
+}
+
 /** Let the settlement continuation (a `done.then`) run. */
 const tick = () => new Promise<void>(r => setTimeout(r, 0))
 
@@ -89,11 +115,48 @@ describe('LocalTaskService.start', () => {
     expectTypeOf<TaskSnapshot['ownerSession']>().toEqualTypeOf<SessionId | undefined>()
   })
 
-  it('refuses to register while no control surface is attached', async () => {
+  it('refuses to register while no control surface serves the owner', async () => {
     const ctx = new Context()
     await ctx.plugin(LocalTaskService)
     expect(() => ctx.tasks.start(producer().spec))
-      .toThrow('background tasks unavailable: no control surface is attached (load @deepseek-ai/dsh-tool-tasks)')
+      .toThrow('background tasks unavailable: no control surface serves this agent (load @deepseek-ai/dsh-tool-tasks in its composition)')
+  })
+
+  it('refuses an owner whose own composition attaches no surface', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(LocalTaskService)
+    // Two standing preset mounts over one registry; only the first loads the
+    // task controls. The second must not inherit the first's open gate.
+    const withControls = createScope(ctx, {})
+    const withoutControls = createScope(ctx, {})
+    await attachSurfaceIn(withControls.ctx)
+
+    const served = stubAgent(ctx, 'served', scopeOf(withControls.ctx))
+    const unserved = stubAgent(ctx, 'unserved', scopeOf(withoutControls.ctx))
+    ctx.agents.register(served)
+    ctx.agents.register(unserved)
+
+    expect(() => ctx.tasks.start(producer({ owner: served }).spec)).not.toThrow()
+    expect(() => ctx.tasks.start(producer({ owner: unserved }).spec))
+      .toThrow('no control surface serves this agent')
+    // An unowned producer has no chain to walk, so only a global surface serves it.
+    expect(() => ctx.tasks.start(producer().spec))
+      .toThrow('no control surface serves this agent')
+  })
+
+  it('lets a surface attached without a scope serve every owner', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(LocalTaskService)
+    // The host-plane composition's own controls: no scope, so the global layer
+    // holds them and every owner's read includes it.
+    await attachSurfaceIn(ctx)
+    const scoped = stubAgent(ctx, 'scoped', scopeOf(createScope(ctx, {}).ctx))
+    ctx.agents.register(scoped)
+
+    expect(() => ctx.tasks.start(producer({ owner: scoped }).spec)).not.toThrow()
+    expect(() => ctx.tasks.start(producer().spec)).not.toThrow()
   })
 
   it('rejects an empty kind, empty label, and invalid output limit', async () => {
@@ -201,7 +264,7 @@ describe('LocalTaskService reads and settlement', () => {
     expect(warn).toHaveBeenCalledWith(expect.stringContaining('async listener boom'))
   })
 
-  it('contains a rejecting done as a failed outcome (producer contract violation)', async () => {
+  it("contains rejection from the producer's done promise as a failed outcome (producer contract violation)", async () => {
     const ctx = await harness()
     const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {})
     const p = producer()
@@ -742,6 +805,30 @@ describe('LocalTaskService disposal', () => {
     expect(ownerEffects()).toHaveLength(0)
   })
 
+  it('drops a scoped layer when its registrations dispose', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(LocalTaskService)
+    const standing = createScope(ctx, {})
+    // One mount contributes both kinds into the same layer, as `tool-tasks`
+    // does; unloading it must leave nothing serving the agents that joined it.
+    const mount = await standing.ctx.plugin({
+      inject: ['tasks'],
+      apply(pluginCtx: Context) {
+        pluginCtx.tasks.attachSurface('tool-tasks')
+        pluginCtx.tasks.onTaskDone(() => {})
+      },
+    })
+    const owner = stubAgent(ctx, 'joined', scopeOf(standing.ctx))
+    ctx.agents.register(owner)
+    expect(() => ctx.tasks.start(producer({ owner }).spec)).not.toThrow()
+
+    await mount.dispose()
+
+    expect(() => ctx.tasks.start(producer({ owner }).spec))
+      .toThrow('no control surface serves this agent')
+  })
+
   it('detaching the last surface re-arms the register fence', async () => {
     const ctx = new Context()
     await ctx.plugin(LocalTaskService)
@@ -757,7 +844,7 @@ describe('LocalTaskService disposal', () => {
     detachA2()
     expect(() => ctx.tasks.start(producer().spec)).not.toThrow() // b remains
     await fiber.dispose() // detaches b with its fiber (HMR safety)
-    expect(() => ctx.tasks.start(producer().spec)).toThrow('no control surface is attached')
+    expect(() => ctx.tasks.start(producer().spec)).toThrow('no control surface serves this agent')
   })
 })
 

packages/tasks/tasks-local/tsconfig.json

@@ -17,6 +17,9 @@
     {
       "path": "../../core/agent"
     },
+    {
+      "path": "../../core/scope"
+    },
     {
       "path": "../../util/timeout"
     },

packages/tasks/tasks/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/tasks/tasks/README.md
-README.md: 71da4cbd189c3cd2aac51bfb004d2dd774e081c2
-README.zh.md: 283e3dd3aee1c86c856f056156ebe12caff276ae
+README.md: 053e407d2e28cb175ebe9de15c7e16ef04e95cb8
+README.zh.md: dd39b1098cd01d7db9db6e49210c2b1149b37ecb

packages/tasks/tasks/README.md

@@ -13,7 +13,9 @@ The background task registry contract (`ctx.tasks`). The abstract `TaskService`
 - `wait(id, timeoutMs, caller?, signal?)` returns a terminal snapshot or the live snapshot at timeout. Aborting stops only the wait; settlement wins once it has committed terminal delivery to that waiter.
 - `onTaskDone(listener)` observes each terminal record with the exact owner. Listener throws and rejections are contained; listener work is not awaited.
 - `onTasksChanged(listener)` observes visible-set changes — registration, every stopping transition (teardown's included, before it awaits a slow producer), settlement, owner-disposal removal, and the emptying service disposal commits — carrying only the owner whose set moved, or `undefined` when an unowned task changed and every caller's set moved with it. It is owner-granular because removal is a change no per-task record can express, and it is not a superset of `onTaskDone`: it carries no delivery meaning and marks nothing reported. The registration binds to the calling fiber, so an observer mounted outside the registry still sees the disposal emptying.
-- `attachSurface(name)` declares a control surface for its effect lifetime. `start()` fails before producer execution when none is attached.
+- `attachSurface(name)` declares a control surface for its effect lifetime. `start()` fails before producer execution when no attached surface serves the spec's owner.
+
+All three registrations are owner-relative, because one registry serves every composition in the process. A surface or listener registered from an unscoped context serves every owner; one registered under an agent composition's scope serves exactly the agents composed under it. So a composition that loads no control surface cannot start background work on the strength of another composition's controls, and one settlement notifies only the listeners its owner's composition registered.
 
 Owned access compares the task's `SessionId` with the caller's. Ids such as `bash-1` are predictable, so this fence is the boundary. Unowned tasks are open to callers and last until service disposal.
 

packages/tasks/tasks/README.zh.md

@@ -13,7 +13,9 @@
 - `wait(id, timeoutMs, caller?, signal?)` 返回终止快照，或在超时时返回存活快照。中止只会停止等待；一旦终止交付已向该等待方提交，终止结果优先。
 - `onTaskDone(listener)` 观察每条终止记录及其精确 owner。监听器抛出的异常和产生的拒绝都会被隔离；系统不会等待监听器工作。
 - `onTasksChanged(listener)` 观察可见集合的变化——注册、每一次转入 stopping（包括 teardown 在等待缓慢生产者之前的那一次）、结算、owner 销毁时的移除，以及服务销毁提交的清空——只携带集合发生变化的那个 owner，或在无主任务变化、因而每个调用方的集合都随之变化时携带 `undefined`。它按 owner 分粒度，因为移除是任何逐任务记录都无法表达的变化；它也不是 `onTaskDone` 的超集：它不含任何投递含义，也不把任何东西标为已上报。注册绑定的是调用方 fiber，因此挂在注册表之外的观察者仍能收到销毁时的清空。
-- `attachSurface(name)` 在其 effect 生命周期内声明控制表层。如果没有附加任何表层，`start()` 会在生产方执行前失败。
+- `attachSurface(name)` 在其 effect 生命周期内声明控制表层。当没有任何已附加的表层服务于 spec 的所有者时，`start()` 会在生产方执行前失败。
+
+这三类注册都是相对于所有者的，因为一个注册表要服务进程内的每一套组合。从不带 scope 的上下文注册的表层或监听器服务于每个所有者；在某套 agent 组合的 scope 下注册的，则恰好服务于在该组合下组合出的 agent。因此，未加载任何控制表层的组合无法借另一套组合的控制工具启动后台工作，而一次结算也只会通知其所有者所属组合注册的监听器。
 
 有 owner 的访问会比较任务的 `SessionId` 与调用方。`bash-1` 等 id 可预测，因此这道隔离是安全边界。无 owner 的任务向调用方开放，并持续到服务释放。
 

packages/tasks/tasks/package.json

@@ -1,8 +1,15 @@
 {
   "name": "@deepseek-ai/dsh-tasks",
   "description": "Background task registry (ctx.tasks) for the DeepSeek Harness — shared ids, owner isolation, polling, cancellation, and completion listeners for long-running tool work",
-  "version": "0.0.1",
-  "private": true,
+  "version": "0.0.1-rc.1",
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/tasks/tasks"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -30,17 +37,17 @@
   ],
   "license": "BSD-3-Clause",
   "peerDependencies": {
-    "@deepseek-ai/dsh-agent": "^0.0.1",
-    "@deepseek-ai/dsh-brand": "^0.0.1",
-    "@deepseek-ai/dsh-invariants": "^0.0.1",
-    "@deepseek-ai/dsh-session": "^0.0.1",
-    "cordis": "^4.0.0-rc.6"
+    "@deepseek-ai/dsh-agent": "workspace:^",
+    "@deepseek-ai/dsh-brand": "workspace:^",
+    "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
+    "@deepseek-ai/cordis": "workspace:^"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent": "workspace:^",
     "@deepseek-ai/dsh-brand": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
-    "cordis": "^4.0.0-rc.6"
+    "@deepseek-ai/cordis": "workspace:^"
   }
 }

packages/tasks/tasks/src/index.ts

@@ -6,7 +6,7 @@
  * @module @deepseek-ai/dsh-tasks
  */
 
-import { Context, Service } from 'cordis'
+import { Context, Service } from '@deepseek-ai/cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import type {
   TaskDoneListener, TaskId, TaskRead, TaskSnapshot, TaskStart, TasksChangedListener,
@@ -26,7 +26,7 @@ export type {
   TasksChangedListener,
 } from './types.ts'
 
-declare module 'cordis' {
+declare module '@deepseek-ai/cordis' {
   interface Context {
     tasks: TaskService
   }
@@ -47,8 +47,13 @@ declare module 'cordis' {
  * - Settlement is first-wins: one terminal record, one round of contained
  *   listener notification, and released waiters, even against a late
  *   producer outcome.
- * - {@link start} refuses work while no control surface is attached, so a
- *   producer cannot start work that callers cannot collect or stop.
+ * - {@link start} refuses work while no attached control surface serves the
+ *   spec's owner, so a producer cannot start work that owner cannot collect
+ *   or stop. One registry serves every composition in the process, so this
+ *   question — and completion-listener delivery — is owner-relative rather
+ *   than process-wide: registrations made from an unscoped context serve
+ *   every owner, and registrations made under an agent composition's scope
+ *   serve exactly the agents composed under it.
  */
 export abstract class TaskService extends Service {
   constructor(ctx: Context) {
@@ -123,14 +128,16 @@ export abstract class TaskService extends Service {
   abstract wait(id: TaskId, timeoutMs: number, caller?: Agent, signal?: AbortSignal): Promise<TaskSnapshot>
 
   /**
-   * Register an effect-scoped completion listener. Each listener is contained;
-   * returned promises are observed but not awaited. No listener runs after
-   * service disposal.
+   * Register an effect-scoped completion listener. It receives the settlements
+   * of the owners its registering context's scope covers; each listener is
+   * contained; returned promises are observed but not awaited. No listener runs
+   * after service disposal.
    * @param listener - receives each terminal snapshot and its exact owner.
    * @returns disposer that unregisters the listener.
    */
   abstract onTaskDone(listener: TaskDoneListener): () => void
 
+  /**
   /**
    * Register an effect-scoped observer of visible-set changes. It fires after
    * every commit that changes what {@link list} returns for that owner —
@@ -139,9 +146,10 @@ export abstract class TaskService extends Service {
    * removal, and the emptying that service disposal commits — so an observer
    * re-reads rather than accumulating deltas.
    *
-   * The registration binds to the CALLING fiber, so an observer mounted outside
-   * this service still receives the disposal emptying; that is what stops a
-   * consumer from retaining rows after the registry unloads.
+   * Delivery is owner-relative on the same terms as {@link onTaskDone}: an
+   * observer registered from an unscoped context — a host composition's own
+   * carrier — sees every owner, while one registered under an agent
+   * composition's scope sees exactly the agents composed under it.
    *
    * This is not a superset of {@link onTaskDone}: that one delivers the terminal
    * record under first-wins semantics a control surface couples to notice
@@ -154,8 +162,9 @@ export abstract class TaskService extends Service {
   abstract onTasksChanged(listener: TasksChangedListener): () => void
 
   /**
-   * Attach an effect-scoped surface that can read and stop tasks. {@link start}
-   * refuses work while none is attached.
+   * Attach an effect-scoped surface that can read and stop tasks. It serves the
+   * owners its registering context's scope covers, and {@link start} refuses an
+   * owner no attached surface serves.
    * @param name - diagnostic label; duplicate names remain independent.
    * @returns disposer that detaches this surface.
    */

packages/tasks/tasks/src/invariant.ts

@@ -1,6 +1,6 @@
 /** Package-owned background-task snapshot invariants. @module @deepseek-ai/dsh-tasks/invariant */
 
-import type { Context } from 'cordis'
+import type { Context } from '@deepseek-ai/cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { InvariantFailure, InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 import type { TaskSnapshot } from './types.ts'

packages/tasks/tasks/tests/invariant.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import TaskService, { TaskId } from '@deepseek-ai/dsh-tasks'

packages/tasks/tasks/tests/service.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { TaskId, TaskService } from '@deepseek-ai/dsh-tasks'
 import type {

packages/tasks/tool-tasks/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/tasks/tool-tasks/README.md
-README.md: 6e8e889c2330d6991cb384674b011e4d2e988268
-README.zh.md: 355b6736b476fb2434f17ea3857544f32c40adb3
+README.md: 4e8872b087bac6576a3b48acbf079d3f06f3a131
+README.zh.md: 3beeb1b70c3a757f5935b0621c9648e0a02c7aa5

packages/tasks/tool-tasks/README.md

@@ -20,6 +20,8 @@ When a producer supplies `outputLimitBytes`, `task_output`, terminal `task_kill`
 
 An unreported completion injects `background task <id> (<kind>: <label>) finished [status: ...]. Read its output with task_output.` into the exact owner's next-step inbox. When bounded, the stable id prefix and collection command outrank variable label/detail so the notice remains actionable at PTY's supported 64-byte minimum. Injection is durable pending context for a later pre-step claim, not a wake-up; cancellation or owner disposal may discard it before claim. A kill or terminal read/wait marks delivery reported and suppresses the redundant notice.
 
+One host registry may carry several mounts of this plugin — one per agent preset. The registry routes each settlement to the listeners the owner's scope chain reaches, so a mount under one preset never sees another preset's agents and an agent reads exactly one notice per completion however many presets are mounted. The same routing decides which agents this mount's control surface serves: an agent whose composition loads no `tool-tasks` cannot start background work at all.
+
 ## Config
 
 | key | default | meaning |

packages/tasks/tool-tasks/README.zh.md

@@ -20,6 +20,8 @@
 
 一项尚未报告的完成会把 `background task <id> (<kind>: <label>) finished [status: ...]. Read its output with task_output.` 注入到确切所有者的 next-step inbox。应用上限时，即使采用 PTY 支持的 64 字节下限，稳定 id 前缀和收集命令的优先级也高于可变 label/detail，因此通知仍可操作。注入是等待后续 pre-step 领取的持久上下文，并非唤醒；取消或 owner 释放可能在领取前丢弃它。kill 或针对已终止任务的 read/wait 会把交付标为已报告，并抑制重复通知。
 
+一个宿主注册表可能承载本插件的多份挂载——每个 agent preset 一份。注册表会把每次结算路由给所有者 scope 链所能抵达的监听器，因此某个 preset 下的挂载永远看不到另一个 preset 的 agent，无论挂载了多少 preset，一个 agent 每次完成都只读到一条通知。同一套路由也决定本挂载的控制表层服务哪些 agent：组合中未加载 `tool-tasks` 的 agent 根本无法启动后台工作。
+
 ## 配置
 
 | key | 默认值 | 含义 |

packages/tasks/tool-tasks/package.json

@@ -1,8 +1,15 @@
 {
   "name": "@deepseek-ai/dsh-tool-tasks",
   "description": "Model-facing background task control tools (task_output, task_list, task_kill) over the ctx.tasks registry",
-  "version": "0.0.1",
-  "private": true,
+  "version": "0.0.1-rc.1",
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/tasks/tool-tasks"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -25,17 +32,17 @@
   ],
   "license": "BSD-3-Clause",
   "dependencies": {
-    "schemastery": "^3.18.0"
+    "@deepseek-ai/schemastery": "workspace:^"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-agent": "^0.0.1",
-    "@deepseek-ai/dsh-invariants": "^0.0.1",
-    "@deepseek-ai/dsh-llm": "^0.0.1",
-    "@deepseek-ai/dsh-retention": "^0.0.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.0.1",
-    "@deepseek-ai/dsh-tasks": "^0.0.1",
-    "@deepseek-ai/dsh-tools": "^0.0.1",
-    "cordis": "^4.0.0-rc.6"
+    "@deepseek-ai/dsh-agent": "workspace:^",
+    "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-llm": "workspace:^",
+    "@deepseek-ai/dsh-retention": "workspace:^",
+    "@deepseek-ai/dsh-system-prompt": "workspace:^",
+    "@deepseek-ai/dsh-tasks": "workspace:^",
+    "@deepseek-ai/dsh-tools": "workspace:^",
+    "@deepseek-ai/cordis": "workspace:^"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent": "workspace:^",
@@ -47,6 +54,6 @@
     "@deepseek-ai/dsh-tasks": "workspace:^",
     "@deepseek-ai/dsh-tasks-local": "workspace:^",
     "@deepseek-ai/dsh-tools": "workspace:^",
-    "cordis": "^4.0.0-rc.6"
+    "@deepseek-ai/cordis": "workspace:^"
   }
 }

packages/tasks/tool-tasks/src/index.ts

@@ -6,8 +6,8 @@
  * @module @deepseek-ai/dsh-tool-tasks
  */
 
-import type { Context } from 'cordis'
-import z from 'schemastery'
+import type { Context } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
 import { boundContextSummary, createUserMessage, type ContentBlock } from '@deepseek-ai/dsh-llm'
 import { TextRetainer } from '@deepseek-ai/dsh-retention'
 import { defineTool } from '@deepseek-ai/dsh-tools'
@@ -230,6 +230,10 @@ export function apply(ctx: Context, config: Config): void {
   // Delivery targets the exact lifecycle owner. The notice waits in its
   // next-step inbox until another step claims it; disposal before that
   // boundary discards it with the owner.
+  //
+  // The registry routes each settlement to the listeners its owner's scope
+  // chain reaches, so a mount under one preset never sees another preset's
+  // agents; this listener owns delivery, not the choice of whom to deliver to.
   ctx.tasks.onTaskDone((snapshot, owner) => {
     if (snapshot.reported || owner === undefined) return
     owner.inject(createUserMessage({

packages/tasks/tool-tasks/src/invariant.ts

@@ -4,7 +4,7 @@
  */
 
 /* jscpd:ignore-start */
-import type { Context } from 'cordis'
+import type { Context } from '@deepseek-ai/cordis'
 import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
 
 const PACKAGE_NAME = '@deepseek-ai/dsh-tool-tasks'

packages/tasks/tool-tasks/tests/tool-tasks.spec.ts

@@ -1,11 +1,12 @@
 import { describe, expect, it, vi } from 'vitest'
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { SessionId } from '@deepseek-ai/dsh-session'
+import { bindScopeParent, createScope, scopeOf } from '@deepseek-ai/dsh-scope'
 import { TaskId } from '@deepseek-ai/dsh-tasks'
 import LocalTaskService from '@deepseek-ai/dsh-tasks-local'
 import type { TaskHooks, TaskOutcome, TaskSnapshot, TaskStart } from '@deepseek-ai/dsh-tasks'
@@ -85,7 +86,7 @@ describe('tool-tasks setup', () => {
     const { ctx, toolsFiber } = await setup()
     expect(() => ctx.tasks.start(producer().spec)).not.toThrow()
     await toolsFiber.dispose()
-    expect(() => ctx.tasks.start(producer().spec)).toThrow('no control surface is attached')
+    expect(() => ctx.tasks.start(producer().spec)).toThrow('no control surface serves this agent')
   })
 
   it('rejects a config whose default wait exceeds the cap', async () => {
@@ -445,6 +446,54 @@ describe('tool-owned UI presentation (presentCall)', () => {
   })
 })
 
+describe('completion notices across scoped mounts', () => {
+  /**
+   * Two agent presets mounting `tool-tasks` over ONE host registry: each mount
+   * registers its own `onTaskDone` listener on the shared service, and
+   * `settle()` broadcasts one snapshot to every listener with no scope filter.
+   * Only the mount whose scope the owner belongs to may deliver the notice.
+   */
+  it('delivers one notice from the owning scope when two mounts share the registry', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SystemPrompt)
+    await ctx.plugin(ToolRegistry)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(LocalTaskService)
+
+    const standingA = createScope(ctx, {})
+    const standingB = createScope(ctx, {})
+    await standingA.ctx.plugin(ToolTasks)
+    await standingB.ctx.plugin(ToolTasks)
+
+    // The agent joins preset A exactly as `agentPresets.compose` binds it.
+    const agentKey = {}
+    const agentScope = createScope(ctx, agentKey)
+    bindScopeParent(agentKey, scopeOf(standingA.ctx) as object)
+
+    const inject = vi.fn()
+    const owner = {
+      id: SessionId('sess-scoped'),
+      ctx: agentScope.ctx,
+      inject,
+      session: { id: SessionId('sess-scoped'), header: { version: 0, id: SessionId('sess-scoped'), createdAt: 0 } },
+    } as unknown as Agent
+    const dispose = ctx.agents.register(owner)
+
+    try {
+      // No waiter: `settle()` leaves `reported` false, which is the only path
+      // that reaches the notice listeners at all.
+      const p = producer({ owner, label: 'pnpm test' })
+      ctx.tasks.start(p.spec)
+      p.settle({ status: 'completed', detail: 'exit code: 0' })
+      await tick()
+
+      expect(inject).toHaveBeenCalledTimes(1)
+    } finally {
+      dispose()
+    }
+  })
+})
+
 describe('completion notices', () => {
   it('injects a notice into the owning agent when an unreported task settles', async () => {
     const { ctx } = await setup()