fix(host): preserve subagent continuation ownership

packages/host/apiproxy/tests/api-proxy-cold.spec.ts

@@ -1,21 +1,19 @@
 /**
  * Cold-session and degenerate-composition paths of the host ApiProxy:
- * sessions.list merging persisted-but-unattached summaries (mtime source,
- * createdAt fallbacks, lineage projection), the resume error split when
- * the composition has no persistence gate and no agent factory, and the
- * agent-busy mapping of a synchronous prompt rejection.
+ * metadata-only listing, Agent-free history reads, subagent ownership
+ * isolation, and prompt failure mapping.
  */
 
 import { mkdtempSync, writeFileSync, utimesSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import SessionStore from '@deepseek-ai/dsh-session'
-import AgentRegistry from '@deepseek-ai/dsh-agent'
+import AgentRegistry, { InboxItemId } from '@deepseek-ai/dsh-agent'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
-import type { SessionHeader, SessionId } from '@deepseek-ai/dsh-session'
+import type { SessionEvent, SessionHeader, SessionId } from '@deepseek-ai/dsh-session'
 import type { RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import { createApiProxy } from '@deepseek-ai/dsh-host-apiproxy'
@@ -115,8 +113,160 @@ describe('attached updatedAt excludes end-seed', () => {
   })
 })
 
+describe('subagent ownership fence', () => {
+  it('reads a cold child without an Agent and rejects generic resume or adoption', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(UserInteractionService)
+    const sessionId = sid('session-child')
+    const meta = header('session-child', 1000, {
+      parentSession: sid('session-parent'),
+      seedLength: 0,
+    })
+    const events = [
+      { type: 'turn/start', seq: 0, time: 1, data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } },
+      {
+        type: 'user/message',
+        seq: 1,
+        time: 2,
+        data: { content: [{ type: 'text', text: 'work' }], source: { kind: 'user' } },
+        surfaceOp: 'append',
+      },
+      {
+        type: 'subagent/descriptor',
+        seq: 2,
+        time: 3,
+        data: { version: 2, mode: 'continuable', provider: 'spawn', label: 'child' },
+      },
+      { type: 'turn/end', seq: 3, time: 4, data: { turn: 1, reason: { kind: 'completed' } } },
+    ] as SessionEvent[]
+    const inspect = vi.fn(() => Promise.resolve({ meta, events }))
+    ctx.provide('sessionPersistence', {
+      list: () => Promise.resolve([meta]),
+      inspect,
+      locate: () => undefined,
+    } as never)
+    const resume = vi.spyOn(ctx.agents, 'resume')
+    const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp', workspaceRoot: '/tmp' })
+
+    const history = await api.sessions.history(request({ sessionId }))
+    expect(history.result.ok).toBe(true)
+    if (history.result.ok) {
+      expect(history.result.value.events.map(entry => entry.event.type)).toEqual(events.map(event => event.type))
+    }
+    expect(ctx.agents.get(sessionId)).toBeUndefined()
+
+    const prompt = await api.sessions.prompt(request({
+      sessionId,
+      mode: 'queue',
+      content: [{ type: 'text', text: 'follow up' }],
+    }))
+    expect(prompt.result.ok).toBe(false)
+    if (!prompt.result.ok) {
+      expect(prompt.result.error).toMatchObject({
+        code: 'agent-busy',
+        details: { reason: 'use subagent delivery for this child session' },
+      })
+    }
+
+    const create = await api.sessions.create(request({ sessionId, cwd: '/proj' }))
+    expect(create.result.ok).toBe(false)
+    if (!create.result.ok) expect(create.result.error.code).toBe('agent-busy')
+    expect(resume).not.toHaveBeenCalled()
+    expect(ctx.agents.get(sessionId)).toBeUndefined()
+    expect(inspect).toHaveBeenCalledTimes(3)
+  })
+
+  it('rejects origin-marked and runtime-owned live children from generic controls', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(UserInteractionService)
+    const parentSession = ctx.sessions.create(sid('session-parent'), { meta: { cwd: '/proj' } })
+    const parent = { id: parentSession.id, session: parentSession, status: 'idle', ctx } as Agent
+    ctx.agents.register(parent)
+
+    const originSession = ctx.sessions.create(sid('session-origin-child'), {
+      meta: { cwd: '/proj', parentSession: parent.id, origin: 'subagent' },
+    })
+    const cancel = vi.fn()
+    const updateInbox = vi.fn(() => 'applied' as const)
+    const originChild = {
+      id: originSession.id,
+      session: originSession,
+      status: 'idle',
+      ctx,
+      cancel,
+      updateInbox,
+    } as unknown as Agent
+    ctx.agents.register(originChild)
+
+    const startingSession = ctx.sessions.create(sid('session-starting-child'), {
+      meta: { cwd: '/proj', parentSession: parent.id },
+    })
+    const startingChild = { id: startingSession.id, session: startingSession, status: 'idle', ctx } as Agent
+    ctx.agents.enter(startingChild, parent)
+    const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp', workspaceRoot: '/tmp' })
+
+    const stopped = await api.sessions.cancel(request({ sessionId: originChild.id }))
+    expect(stopped.result.ok).toBe(false)
+    if (!stopped.result.ok) expect(stopped.result.error.code).toBe('agent-busy')
+    expect(cancel).not.toHaveBeenCalled()
+
+    const queued = await api.sessions.updateQueue(request({
+      sessionId: originChild.id,
+      itemId: InboxItemId('queued-item'),
+      action: { kind: 'remove' },
+    }))
+    expect(queued.result.ok).toBe(false)
+    if (!queued.result.ok) expect(queued.result.error.code).toBe('agent-busy')
+    expect(updateInbox).not.toHaveBeenCalled()
+
+    const models = await api.sessions.models(request({ sessionId: startingChild.id }))
+    expect(models.result.ok).toBe(false)
+    if (!models.result.ok) expect(models.result.error.code).toBe('agent-busy')
+
+    const create = await api.sessions.create(request({ sessionId: originChild.id, cwd: '/proj' }))
+    expect(create.result.ok).toBe(false)
+    if (!create.result.ok) expect(create.result.error.code).toBe('agent-busy')
+
+    const history = await api.sessions.history(request({ sessionId: originChild.id }))
+    expect(history.result.ok).toBe(true)
+    expect(ctx.agents.get(originChild.id)).toBe(originChild)
+  })
+
+  it('does not classify an ordinary fork from an inherited ancestor descriptor', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(UserInteractionService)
+    const session = ctx.sessions.create(sid('session-ordinary-fork'), {
+      seed: [{
+        type: 'subagent/descriptor',
+        seq: 0,
+        time: 1,
+        data: { version: 2, mode: 'continuable', provider: 'spawn', label: 'ancestor' },
+      }],
+      meta: { cwd: '/proj', parentSession: sid('session-source'), seedLength: 1 },
+    })
+    const followup = vi.fn()
+    const agent = { id: session.id, session, status: 'idle', ctx, followup } as unknown as Agent
+    ctx.agents.register(agent)
+    const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp', workspaceRoot: '/tmp' })
+
+    const response = await api.sessions.prompt(request({
+      sessionId: agent.id,
+      mode: 'queue',
+      content: [{ type: 'text', text: 'ordinary work' }],
+    }))
+    expect(response.result.ok).toBe(true)
+    expect(followup).toHaveBeenCalledOnce()
+  })
+})
+
 describe('degenerate composition (no persistence, no factory)', () => {
-  it('list skips the cold merge and resume maps a non-not-found failure to internal', async () => {
+  it('list skips the cold merge and history reports missing persistence as internal', async () => {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
     await ctx.plugin(AgentRegistry)
@@ -127,15 +277,32 @@ describe('degenerate composition (no persistence, no factory)', () => {
     expect(listed.result.ok).toBe(true)
     if (listed.result.ok) expect(listed.result.value.items).toEqual([])
 
-    // No persistence → the servable gate passes silently; the factory-less
-    // registry then rejects resume, which is NOT a SessionNotFound.
+    // No persistence means cold history cannot inspect a transcript.
     const response = await api.sessions.history(request({ sessionId: sid('session-ghost') }))
     expect(response.result.ok).toBe(false)
     if (!response.result.ok) {
       expect(response.result.error.code).toBe('internal')
-      expect(response.result.error.message).toMatch(/resume failed for session "session-ghost"/)
+      expect(response.result.error.message).toMatch(/history unavailable for session "session-ghost"/)
     }
   })
+
+  it('maps a persistence catalog miss to session-not-found without inspection', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(UserInteractionService)
+    const inspect = vi.fn()
+    ctx.provide('sessionPersistence', {
+      list: () => Promise.resolve([]),
+      inspect,
+    } as never)
+    const api = createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp', workspaceRoot: '/tmp' })
+
+    const response = await api.sessions.history(request({ sessionId: sid('session-missing') }))
+    expect(response.result.ok).toBe(false)
+    if (!response.result.ok) expect(response.result.error.code).toBe('session-not-found')
+    expect(inspect).not.toHaveBeenCalled()
+  })
 })
 
 describe('sessions.prompt synchronous rejection', () => {

packages/host/apiproxy/tests/api-proxy-commands.spec.ts

@@ -99,6 +99,17 @@ describe('command.list', () => {
     expect(error.code).toBe('internal')
     expect(error.message).toContain('command registry')
   })
+
+  it('does not route a live subagent through the generic command domain', async () => {
+    const ctx = await harness()
+    const session = ctx.sessions.create(undefined, { meta: { cwd: '/proj', origin: 'subagent' } })
+    const agent = { id: session.id, session, status: 'idle', ctx } as Agent
+    ctx.agents.register(agent)
+    const api = createApiProxy(ctx, DEFAULTS)
+
+    const error = expectErr(await api.commands.list(request({ sessionId: agent.id })))
+    expect(error).toMatchObject({ code: 'agent-busy' })
+  })
 })
 
 describe('command.execute', () => {
@@ -142,7 +153,7 @@ describe('command.execute', () => {
     const api = createApiProxy(ctx, DEFAULTS)
     const missing = expectErr(await api.commands.execute(
       request({ sessionId: 'session-nope' as SessionId, line: '/x' }), new AbortController().signal))
-    expect(missing.code).toBe('internal') // no persistence configured: resume fails loud past the gate
+    expect(missing.code).toBe('internal') // Cold Agent-bound access fails loud when persistence is absent.
 
     const bare = await harness({ commands: false })
     const bareApi = createApiProxy(bare, DEFAULTS)

packages/host/apiproxy/tests/api-proxy-fork.spec.ts

@@ -1,13 +1,13 @@
 /** Session-fork boundaries, lineage, and inherited model routing. */
 
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import AgentRegistry, { agentEvents } from '@deepseek-ai/dsh-agent'
 import type { Agent, AgentHandle, CreateAgentOptions } from '@deepseek-ai/dsh-agent'
 import { createUserMessage, ReasoningEffortId } from '@deepseek-ai/dsh-llm'
 import type { LlmCallConfig } from '@deepseek-ai/dsh-llm'
 import SessionStore from '@deepseek-ai/dsh-session'
-import type { Session, SessionId } from '@deepseek-ai/dsh-session'
+import type { Session, SessionEvent, SessionHeader, SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
 import type { RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
@@ -94,6 +94,49 @@ describe('sessions.fork', () => {
     await ctx.fiber.dispose()
   })
 
+  it('forks a persisted subagent without resuming its Agent', async () => {
+    const ctx = await composed()
+    const sourceId = sid('session-cold-subagent')
+    const parentId = sid('session-cold-parent')
+    const header: SessionHeader = {
+      version: 0,
+      id: sourceId,
+      createdAt: 1,
+      cwd: '/proj',
+      parentSession: parentId,
+      origin: 'subagent',
+    }
+    const events = [
+      { type: 'turn/start', seq: 0, time: 1, data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } },
+      {
+        type: 'user/message',
+        seq: 1,
+        time: 2,
+        data: createUserMessage({ content: [{ type: 'text', text: 'work' }], source: { kind: 'user' } }),
+        surfaceOp: 'append',
+      },
+      { type: 'turn/end', seq: 2, time: 3, data: { turn: 1, reason: { kind: 'completed' } } },
+    ] as SessionEvent[]
+    ctx.provide('sessionPersistence', {
+      list: () => Promise.resolve([header]),
+      inspect: () => Promise.resolve({ meta: header, events }),
+    } as never)
+    const resume = vi.spyOn(ctx.agents, 'resume')
+
+    const response = await api(ctx).sessions.fork(request({ sessionId: sourceId }))
+
+    expect(response.result.ok).toBe(true)
+    if (!response.result.ok) return
+    expect(resume).not.toHaveBeenCalled()
+    expect(ctx.agents.get(sourceId)).toBeUndefined()
+    expect(ctx.sessions.get(response.result.value.sessionId)?.header).toMatchObject({
+      parentSession: sourceId,
+      cwd: '/proj',
+    })
+    expect(ctx.sessions.get(response.result.value.sessionId)?.header.origin).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
   it('uses the last completed turn only for omitted and past-end anchors', async () => {
     const ctx = await composed()
     const source = liveAgent(ctx, 'session-tail', 2, 'open')

packages/host/apiproxy/tests/api-proxy-projections.spec.ts

@@ -1,20 +1,16 @@
 /**
- * Projection carrier paths of the host ApiProxy: the history tail page's
- * projections block reads the registry's watermark snapshot (asOfSeq = last
- * event seq, one consistent cut); loadOlder pages never carry the block; a
- * composition without the registry serves histories without it; a disposed
- * registration's key leaves subsequent responses; and every unit change is
- * pushed to mux consumers as a session/projection frame minted here.
+ * Projection carrier paths of the host ApiProxy: history tail pages snapshot
+ * attached state or fold one cold inspected prefix, loadOlder omits the block,
+ * and live unit changes push session/projection frames.
  */
 
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import { z } from 'zod'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
-import type { Agent } from '@deepseek-ai/dsh-agent'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
-import type { Session } from '@deepseek-ai/dsh-session'
+import type { Session, SessionEvent, SessionHeader } from '@deepseek-ai/dsh-session'
 import SessionProjectionRegistry from '@deepseek-ai/dsh-session-projection'
 import type { ProjectionDefinition } from '@deepseek-ai/dsh-session-projection'
 import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
@@ -53,9 +49,6 @@ async function harness(withRegistry: boolean): Promise<{ ctx: Context; session:
   await ctx.plugin(AgentRegistry)
   if (withRegistry) await ctx.plugin(SessionProjectionRegistry)
   const session = ctx.sessions.create()
-  // history resolves the agent first; a live structural stub is enough (only
-  // .session is read on this path).
-  ctx.agents.register({ id: session.id, session, status: 'idle', ctx } as Agent)
   return { ctx, session }
 }
 
@@ -87,6 +80,40 @@ describe('session.history projections block', () => {
     expect(events.at(-1)?.event.seq).toBe(projections?.asOfSeq)
   })
 
+  it('folds a cold inspected prefix without publishing an Agent', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(UserInteractionService)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(SessionProjectionRegistry)
+    ctx.sessionProjections.register(lastUserUnit())
+    const sessionId = SessionId('session-cold-history')
+    const meta: SessionHeader = { version: 0, id: sessionId, createdAt: 1, cwd: '/tmp' }
+    const events = [{
+      type: 'user/message',
+      seq: 0,
+      time: 2,
+      data: createUserMessage({
+        content: [{ type: 'text', text: 'persisted' }],
+        source: { kind: 'user' },
+      }),
+      surfaceOp: 'append',
+    }] as SessionEvent[]
+    ctx.provide('sessionPersistence', {
+      list: () => Promise.resolve([meta]),
+      inspect: () => Promise.resolve({ meta, events }),
+    } as never)
+
+    const response = await api(ctx).sessions.history(request({ sessionId }))
+    expect(response.result.ok).toBe(true)
+    if (!response.result.ok) throw new Error('unreachable')
+    expect(response.result.value.projections).toEqual({
+      asOfSeq: 0,
+      values: { 'test/last-user': { text: 'persisted' } },
+    })
+    expect(ctx.agents.get(sessionId)).toBeUndefined()
+  })
+
   it('never carries the block on loadOlder pages (beforeSeq present)', async () => {
     const { ctx, session } = await harness(true)
     ctx.sessionProjections.register(lastUserUnit())