docs: tighten prose audit after master retarget

packages/subagent/subagent-acp/src/run.ts

@@ -1,24 +1,6 @@
 /**
- * The out-of-process ACP subagent run driver. Spawns a child agent as a
- * subprocess, speaks the Agent Client Protocol (ACP) to it over stdio as the
- * CLIENT, drives one session to completion, and shapes the result into a
- * {@link SubagentResult}. The mirror image of the server-side bridge in
- * `@deepseek-ai/dsh-acp` (which is the ACP *agent* side): here we are the ACP
- * *client*, so we CALL `initialize`/`newSession`/`prompt`/`cancel` and we
- * IMPLEMENT the `Client` callbacks (`sessionUpdate`, `requestPermission`).
- *
- * One subprocess per run (fresh-process-per-run): `start` spawns, runs exactly
- * one ACP session, and `dispose` kills the subprocess and awaits its exit.
- * Persistent-process pooling is a future optimization (see the RFC).
- *
- * TODO(acp-subagent-replay): snapshot-tier coverage of an ACP child is a
- * distinct replay shape — each child is its own PROCESS with its own
- * single-agent replay (the child boots under `DSH_SNAPSHOT=replay` with its own
- * sessions-root + fixture), unlike the in-process per-session keying in
- * `dsh-llm-replay`. Deferred to a follow-up; keyless coverage here is via a
- * scripted mock ACP server subprocess, and the with-key e2e drives the real
- * `acp-agent` example. See the ACP-subagent-backend RFC.
- *
+ * Fresh-process ACP subagent client. Drives one child session and owns process
+ * cancellation and quiescent disposal.
  * @module @deepseek-ai/dsh-subagent-acp/run
  */
 
@@ -42,16 +24,7 @@ import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { SubagentResult, SubagentRun, SubagentStartRequest, SubagentStopReason } from '@deepseek-ai/dsh-subagent'
 import { buildChildEnv, disposeChildProcess, spawnFailure } from '@deepseek-ai/dsh-subagent-subprocess'
 
-/**
- * How the client answers a child's `session/request_permission`. The first cut
- * does not surface permission prompts to a human, so every request is
- * auto-answered by this fixed policy:
- *
- * - `reject` — decline every prompt (answer `cancelled`). Safe default: a child
- *   that asks before a side effect does not get to take it.
- * - `allow` — approve every prompt by selecting its first `allow_*` option (or,
- *   if none is offered, `cancelled`). Use when the child is trusted to act.
- */
+/** Fixed response to child permission requests: reject, or first allow option. */
 export type PermissionPolicy = 'allow' | 'reject'
 
 /** Resolved spawn spec for an ACP child process (no defaults — see Config). */
@@ -95,18 +68,7 @@ export interface AcpRunSpec {
   onError?: (error: Error, stopReason: SubagentStopReason) => void
 }
 
-/**
- * Default grace for the child's EOF-driven quiesce on dispose (the
- * `disposeEofGraceMs` config) — the window for it to flush persistence and tear
- * down its OWN nested subprocesses (which may run their own `SIGTERM`→`SIGKILL`
- * escalation) before the parent escalates to a signal. Deliberately LARGER than
- * {@link DEFAULT_DISPOSE_GRACE_MS}: a cooperative child whose teardown is itself
- * waiting on a signal-trapping grandchild (e.g. a bash subprocess in its own ~3s
- * SIGTERM→SIGKILL grace) plus a final flush needs MORE than a single
- * signal-grace of headroom, or the parent's SIGTERM cuts it off exactly as it
- * reaches its own SIGKILL+flush. The child is an arbitrary ACP agent, so this is
- * a standalone generous default, NOT derived from any child's internals.
- */
+/** Default EOF grace for child flush and nested-process teardown before signaling. */
 export const DEFAULT_DISPOSE_EOF_GRACE_MS = 6_000
 
 /** Default grace between SIGTERM and SIGKILL on dispose (the `disposeGraceMs` config; mirrors the bash executor). */
@@ -174,16 +136,9 @@ function toError(value: unknown): Error {
 }
 
 /**
- * Start an out-of-process ACP child for `request` and return a {@link SubagentRun}.
- *
- * Spawns the configured command, wraps its stdio in an ACP `ClientSideConnection`,
- * and drives one session: `initialize` → `newSession` → `prompt`. The accumulated
- * `agent_message_chunk` text is the result output; the prompt's terminal
- * `StopReason` maps to the stop reason. `result` never REJECTS on a child-level
- * failure after publication resolves with `stopReason: 'error'`. A spawn,
- * initialize, new-session, or pre-publication cancellation failure instead
- * rejects only after the process has been reaped. `dispose()` requests ACP
- * cancellation, then kills and reaps the subprocess.
+ * Start and publish one ACP child after initialization and session creation.
+ * Child failures resolve through the run result; startup failures reject after
+ * process reap. Disposal cancels, kills, and reaps the child.
  * @param request - the start request; its signal is the cancellation channel.
  * @param spec - the resolved spawn spec: command/args/cwd, env, permission
  * policy, dispose graces, and the optional error sink.
@@ -194,24 +149,16 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe
 
   if (request.signal.aborted) throw new Error('subagent request was aborted before the ACP child started')
 
-  // Spawn the child ACP agent. stdin = ACP request channel, stdout = ACP
-  // response channel, stderr = INHERIT so the child's diagnostics surface on the
-  // parent's stderr (no separate capture to drain — we don't fold child stderr
-  // into the result; the seam reports only output + stop reason).
+  // Keep diagnostics on parent stderr; only ACP output contributes to the result.
   const child = spawn(spec.command, spec.args, {
     cwd: spec.cwd,
     env: buildChildEnv(spec.env),
     stdio: ['pipe', 'pipe', 'inherit'],
   })
-  // Same-tick capture (the library's contract): a spawn-level failure (e.g.
-  // ENOENT for a bad command) is an `error` EVENT that would crash the parent
-  // unheard; the result path races this promise, so a bad command settles
-  // `error` like any child failure.
+  // Capture the child-process error event immediately.
   const spawnFailed = spawnFailure(child)
 
-  // One memoized quiescence transaction is shared by startup rollback and the
-  // published run's disposer. Once start fulfills, only the holder can invoke
-  // it; before fulfillment the provider invokes it on every failure path.
+  // Startup rollback and the published handle share one process teardown.
   let processDisposal: Promise<void> | undefined
   const disposeProcess = (): Promise<void> => (processDisposal ??= disposeChildProcess(child, {
     disposeEofGraceMs: spec.disposeEofGraceMs,
@@ -220,12 +167,7 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe
 
   // Accumulate the child's streamed assistant text — the SubagentResult output.
   const output: string[] = []
-  // `cancelled` records that the required signal or disposal requested cancel, so a
-  // run torn down before the prompt resolves settles `aborted` rather than the
-  // generic error mapping. Held on a mutable object so the async closures that
-  // set it (the abort listener) and the IIFE that reads it don't fight TS's
-  // control-flow narrowing of a bare `let` (which would type the catch-time read
-  // as always-`false`).
+  // Shared mutable state keeps cancellation visible across async closures.
   const flags = { cancelled: false }
 
   const makeClient = (_agent: AcpAgent): Client => ({
@@ -261,28 +203,14 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe
   )
 
   let sessionId: string | undefined
-  // Resolves when a cancel is requested, so `result` can settle `aborted` even
-  // if the child never cooperates with `session/cancel` (it ignores the notify,
-  // or the prompt wedges). The result path races this against the ACP drive: the
-  // FIRST to settle wins, so signal/dispose cancellation always honors the contract (`result`
-  // settles `aborted`) without waiting on a non-cooperative child. `dispose`
-  // still kills the process and reaps it; this only unblocks `result`. The
-  // executor runs synchronously, so `signalCancelSettled` is assigned before the
-  // Promise constructor returns (the `!` asserts the definite assignment).
+  // Cancellation settles the result without waiting for a cooperative child.
   let signalCancelSettled!: () => void
   const cancelSettled = new Promise<void>((resolve) => { signalCancelSettled = resolve })
   const requestCancel = (): void => {
     if (flags.cancelled) return
     flags.cancelled = true
     signalCancelSettled()
-    // Best-effort: tell the child to cancel the in-flight turn. Swallows a
-    // rejection — the session may not exist yet, or the pipe may be gone; the
-    // dispose path kills the process regardless. If the session has NOT been
-    // created yet (cancel raced ahead of `newSession`), the `cancelled` flag
-    // alone carries it: the result path re-checks the flag after each await and
-    // settles `aborted` without running the prompt. The `.catch` swallow is
-    // defensive for a narrow transport race (child gone mid-send) — v8-ignored
-    // because dispose kills the process regardless, so it can't be hit in tests.
+    // Best-effort ACP cancel; process teardown remains authoritative.
     /* v8 ignore next */
     if (sessionId !== undefined) void conn.cancel({ sessionId }).catch(() => { /* child gone / no session */ })
   }
@@ -324,12 +252,7 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe
 
   const result: Promise<SubagentResult> = (async (): Promise<SubagentResult> => {
     try {
-      // Race two post-publication outcomes, first to settle wins:
-      //  - prompt: the normal remote turn;
-      //  - cancelSettled: a cancel was requested — settle `aborted` immediately
-      //    rather than waiting on a child that may ignore `session/cancel` or
-      //    wedge the prompt (`result` settles `aborted`). After `newSession`
-      // succeeds, transport/process failure rejects the in-flight prompt RPC.
+      // Race the remote turn against local cancellation.
       const prompt = async (): Promise<SubagentResult> => {
         // The startup phase cannot fulfill without assigning the session id.
         const promptResult = await conn.prompt({ sessionId: sessionId as string, prompt: toAcpPrompt(request.prompt) })
@@ -340,23 +263,14 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe
         cancelSettled.then((): SubagentResult => ({ output: collectOutput(), stopReason: 'aborted' })),
       ])
     } catch (error: unknown) {
-      // A deterministic cancellation resolves `cancelSettled` before its
-      // best-effort ACP cancel can reject the prompt. This fallback is only for
-      // a process/pipe rejection already queued when the abort event fires; its
-      // first-outcome ordering cannot be forced without a timing-dependent test.
+      // Cover a process rejection already queued when cancellation arrives.
       /* v8 ignore next */
       if (flags.cancelled) return { output: collectOutput(), stopReason: 'aborted' }
-      // The seam contract: result resolves (never rejects) on a child-level
-      // failure. Startup failures were already rejected before publication;
-      // every rejection here is a prompt transport/RPC failure.
-      // Flatten to `error` and surface the original via onError so a real fault
-      // is preserved rather than silently lost.
+      // Flatten post-publication transport failures while preserving diagnostics.
       try {
         spec.onError?.(toError(error), 'error')
       } catch {
-        // Swallows only the caller-supplied sink's OWN throw: an unguarded
-        // sink exception would reject `result` and break the contract above.
-        // The child-level failure being reported still settles as `error`.
+        // The diagnostic sink cannot reject the run result.
       }
       return { output: collectOutput(), stopReason: 'error' }
     } finally {
@@ -372,15 +286,9 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe
       if (disposal !== undefined) return disposal
       request.signal.removeEventListener('abort', onAbort)
       requestCancel()
-      // Quiescent teardown via the shared ladder (stdin EOF → SIGTERM →
-      // SIGKILL, awaiting the actual exit). For THIS child the EOF tier is the
-      // one that matters: our acp-agent has NO SIGTERM handler in a normal
-      // session — it tears down via the server bridge's connection-close path
-      // (conn.closed → per-agent dispose → final session/flush), driven by the
-      // stdin EOF, NOT by a signal — and a prompt response can resolve from a
-      // turn/end BEFORE that post-turn flush lands, so the child still has
-      // durable work owed when dispose runs (hence the wide EOF grace; see
-      // DEFAULT_DISPOSE_EOF_GRACE_MS).
+      // The shared EOF → TERM → KILL ladder awaits exit. ACP normally quiesces
+      // from stdin EOF, including the final flush, so this backend uses a wider
+      // EOF grace before signals escalate.
       disposal = disposeProcess()
       return disposal
     },

packages/subagent/subagent-inprocess/src/structured.ts

@@ -1,42 +1,6 @@
 /**
- * Structured-output support for the in-process subagent backends: the
- * mechanism behind `SubagentStartRequest.outputSchema` for children that run
- * as agents on the same context.
- *
- * Everything is a SCOPED registration on the child agent's context
- * (`child.ctx`, the dsh-scope seam): the `structured_output` capture tool
- * carries the run's REAL schema as its registered parameters (each child sees
- * exactly its own schema — two concurrent structured runs never interact), the
- * demand instruction is an ordinary order-190 scoped section, and the
- * enforcement listeners fire only for this child (scope-filtered dispatch).
- * Registration lifetime rides the child's fiber, so a backend hot-reload
- * mid-run cannot unregister the capture tool out from under a live child, and
- * a disposed child leaves no residue — no placeholder schema,
- * strip-for-everyone-else pass, or refcounted global runtime.
- *
- * The child scope's registrations enforce the contract:
- *
- * - The scoped capture tool and instruction are ordinary assembly inputs. The
- *   loop logs the assembled request header, so the demand is reconstructable
- *   log state rather than a wire-only mutation. As with every other assembly
- *   contribution, an expert `system-prompt/assemble` listener that deliberately
- *   removes or replaces either input owns the resulting composition.
- * - `agent/turn-stop` (serial, scoped): stop the child's turn once its output
- *   is captured. This terminal checkpoint runs after the ordinary continuation
- *   waterfall and steering folding, so listener order cannot resurrect a
- *   completed structured run or carry terminal steering into another turn.
- * - `tools.guard()` is the monotonic terminal gate after the extensible
- *   pre-execute waterfall: once capture commits, no later listener can turn
- *   the denial back into a dispatched side effect.
- * - `tools/result` is the capture COMMIT point. The tool body only STAGES the
- *   validated value in a WeakMap keyed by the execution object; the awaited,
- *   non-transforming notification promotes it only when the authoritative
- *   result after the whole pre/execute/post pipeline succeeds. For a Code Mode
- *   sub-dispatch, promotion waits again for the enclosing `run_code` result, so
- *   a runtime failure or outer post-policy block cannot report structured
- *   success. Execution identity makes call-id reuse and orphaned stages
- *   irrelevant.
- *
+ * Child-scoped structured-output tool, prompt instruction, terminal guard, and
+ * authoritative result capture for in-process subagents.
  * @module @deepseek-ai/dsh-subagent-inprocess/structured
  */
 
@@ -70,11 +34,8 @@ export interface StructuredAttachment {
 }
 
 /**
- * Attach the structured-output runtime to a child for `schema`: register the
- * scoped capture tool (real schema), the scoped instruction section, and the
- * scoped enforcement registrations (see the module doc). Call from the
- * agent-creation `setup` window with the child's scope context — every
- * registration rides the child's fiber and unwinds with the child.
+ * Attach the scoped capture tool, instruction, and enforcement to a child during
+ * its creation window. Child disposal removes every registration.
  * @param childCtx - the child agent's scope context (`setup`'s argument).
  * @param schema - the trusted, already-asserted schema subset to enforce (see
  *   `assertSupportedOutputSchema` in dsh-tools).

packages/subagent/subagent-inprocess/tests/structured.spec.ts

@@ -35,14 +35,7 @@ const SCHEMA: StructuredOutputSchema = {
   required: ['answer'],
 }
 
-/**
- * Real loop + scripted mock model + an INLINE fresh-conversation provider over the
- * shared driver. The concrete backend plugins are deliberately NOT loaded —
- * they would devDep-cycle this package (spawn/fork already depend on the
- * driver), and the runtime under test is the driver's; plugin-level structured
- * coverage lives in the spawn/fork specs. The mock model script drives the
- * child's structured_output calls.
- */
+/** Real loop and inline provider without a backend package dependency cycle. */
 async function setup(script: Script, options: SetupOptions = {}) {
   const ctx = new Context()
   const adapter = new MockAdapter(script)
@@ -216,11 +209,7 @@ describe('in-process structured output', () => {
     ])
     ctx.on('agent/turn-continuation', () => Promise.resolve<ContinuationDecision>({ action: 'stop' }))
     let wrapperInstalled = false
-    // Register before the ready-only start. The child session-start boundary is
-    // after unpublished setup attached structured output but before the loop
-    // can run. The wrapper awaits the
-    // explicit downstream stop above, then overwrites that result with continue.
-    // The later terminal checkpoint still wins.
+    // Install a wrapper before the child loop can run.
     ctx.on('agent/session-start', (child) => {
       if (child === parent) return
       wrapperInstalled = true
@@ -244,10 +233,7 @@ describe('in-process structured output', () => {
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 9 }),
       textResponse('MUST NOT BE CONSUMED'),
     ])
-    // The downstream ordinary policy says stop. A wrapper registered after
-    // start() delegates to that stop, then queues steering; ordinary folding
-    // would turn the stop back into continue. The terminal checkpoint runs
-    // afterwards and discards that steering.
+    // The terminal checkpoint must discard steering queued by a wrapper.
     ctx.on('agent/turn-continuation', () => Promise.resolve<ContinuationDecision>({ action: 'stop' }))
     const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     ctx.on('agent/session-start', (child) => {

packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts

@@ -152,11 +152,7 @@ describe('dsh-subagent-spawn', () => {
   })
 
   it('rejects without publishing when the request signal is already aborted', async () => {
-    // Regression: a signal aborted BEFORE the run starts never fires an `abort`
-    // event, so the listener can't catch it. The driver must check the
-    // already-aborted case up front and settle `aborted` without running the
-    // child — otherwise an already-cancelled request runs to `completed`. The
-    // empty script proves the child's model is never called.
+    // An already-aborted signal will not emit another abort event.
     const controller = new AbortController()
     controller.abort()
     const { ctx, parent } = await setup([])
@@ -165,10 +161,7 @@ describe('dsh-subagent-spawn', () => {
   })
 
   it('same-tick cancellation rejects start and prevents child publication', async () => {
-    // Regression: cancellation before publication used to set a flag but let the
-    // async factory publish a child anyway, so `started` fulfilled and lifecycle
-    // observers saw an agent for an attempt the caller had already cancelled.
-    // The empty script also proves no model turn can run.
+    // Same-tick cancellation must win before publication.
     const { ctx, parent } = await setup([])
     const beforeAgents = ctx.agents.list().length
     const beforeSessions = ctx.sessions.list().length

packages/subagent/subagent/src/types.ts

@@ -54,14 +54,8 @@ export interface SubagentStartRequest {
   /** Per-child agent options (model and plugin-defined extension fields). */
   readonly agentOptions?: AgentOptions
   /**
-   * Optional structured-output schema — an object-rooted JSON Schema within the
-   * enforced subset (see `assertSupportedOutputSchema` in dsh-tools; a schema
-   * outside the subset is rejected loud at start). When set AND the provider's
-   * {@link SubagentCapabilities.outputSchema} is `true`, the child is driven to
-   * report a value matching this schema, surfaced as
-   * {@link SubagentResult.structured}. The schema must be plain host-realm JSON
-   * data — a caller holding foreign-realm data materializes it first.
-   * Requesting it against a provider that lacks the capability is rejected at start.
+   * Supported object-rooted JSON Schema for {@link SubagentResult.structured}.
+   * Requires the provider capability and plain host-realm JSON data.
    */
   readonly outputSchema?: StructuredOutputSchema
   /**
@@ -130,14 +124,8 @@ export interface SubagentResult {
 }
 
 /**
- * A live subagent run: a handle the consumer holds while a child executes.
- * Returned by {@link SubagentProvider.start} (via the service) only after the
- * child is ready. The consumer awaits {@link result} and MUST {@link dispose}
- * on every path to cancel any remaining work and reach child quiescence.
- *
- * {@link sendMessage} and {@link resume} are OPTIONAL: a provider that supports
- * the runtime capability defines the method; one that doesn't omits it. The
- * presence of the method IS the capability — narrow before calling.
+ * Ready child handle. Consumers await {@link result} and always {@link dispose}
+ * for quiescence. Optional methods indicate their runtime capabilities.
  */
 export interface SubagentRun {
   /** The child agent's id (local in-process runs are already published in `ctx.agents`; remote transports need not publish locally). */
@@ -182,15 +170,9 @@ export interface SubagentProvider {
   /** The start-time features this provider supports (see {@link SubagentCapabilities}). */
   readonly capabilities: SubagentCapabilities
   /**
-   * The provider's conversation-history descriptor: `true` when a child SEES the parent
-   * conversation (fork — the child is seeded with the parent's completed-turn
-   * prefix), `false` when it starts fresh (spawn, ACP). A DESCRIPTIVE fact,
-   * not a start-time capability: the service validates nothing against it —
-   * the model-facing consumer (`dsh-tool-subagent`) derives truthful tool
-   * wording from it, so a tool bound to a fork provider stops telling the
-   * model the child "does not see this conversation". This descriptor concerns
-   * conversation history only; it says nothing about tool registrations,
-   * injected services, or authority inheritance.
+   * Whether a child receives the parent's completed conversation history. This
+   * descriptive fact drives tool wording; it says nothing about services, tools,
+   * or authority.
    */
   readonly inheritsParentContext: boolean
   /**

packages/subagent/tool-subagent/src/index.ts

@@ -1,34 +1,6 @@
 /**
- * The model-facing `subagent` tool: delegate a task to a child agent and return
- * its final output. Pure schema + lifecycle shaping — every transport concern
- * lives behind the `ctx.subagents` provider registry
- * (`@deepseek-ai/dsh-subagent`), so an in-process, ACP, or future A2A backend
- * swaps in without touching what the model sees.
- *
- * Provider selection is config, not model-facing: this plugin is bound to
- * EXACTLY ONE provider name (`Config.provider`). To expose more than one
- * transport, load the plugin more than once, each bound to a different provider
- * — there is no provider/type parameter in the model-facing schema. The model
- * sees only `{ description, prompt }`.
- *
- * The tool DESCRIPTION is derived from the bound provider's conversation-history
- * descriptor ({@link providerWording}): a fresh-conversation provider (spawn,
- * ACP) gets the standalone-prompt wording, while a seeded-conversation provider
- * (fork) tells the model the child already sees the conversation's completed
- * turns. This descriptor says nothing about Cordis scope, services, tools, or
- * authority. The tool MIRRORS the
- * provider's lifecycle via `subagent/provider-added`/`-removed` — it registers
- * when the provider is (or becomes) available and unregisters when the
- * provider goes away — so no load-order requirement exists and an HMR reload
- * of the backend re-derives the wording from the fresh provider.
- *
- * Collection is SYNCHRONOUS this cut: `execute` starts a run and awaits
- * `run.result` inside a `try/finally` that always disposes the run, so the
- * owned child agent/session is torn down on every path (success, error, abort)
- * and never leaks as a live idle child. A non-`completed` stop reason maps to an
- * `isError` tool result (by throwing) rather than returning partial output as
- * success.
- *
+ * Provider-bound model tool that delegates to one child agent, awaits its
+ * result, and always disposes the run. Provider lifecycle controls registration.
  * @module @deepseek-ai/dsh-tool-subagent
  */
 
@@ -105,16 +77,7 @@ export const Config: z<Config> = z.object({
     model: z.string(),
   }).default(undefined as unknown as { model: string }),
   persona: z.string(),
-  // A schemastery object materializes {} (with [] for nested arrays) when the
-  // key is omitted — for toolFilter that would mean an EMPTY ALLOW-LIST, i.e.
-  // deny-everything, silently. Force the omitted key to stay absent (the same
-  // shape discipline as SystemPrompt's toolOrder); the cast is needed because
-  // .default() expects the object type.
-  // The NESTED arrays get the same treatment as the object itself: a partial
-  // filter ({deny: […]}) must not materialize allow: [] beside it — an empty
-  // allow-list means deny-EVERYTHING, so the materialized default would turn
-  // a deny-one config into deny-all. An EXPLICIT allow: [] (grant-only
-  // children) survives, since only the omitted key defaults to undefined.
+  // Preserve omitted filters and nested lists; an empty allow-list means deny all.
   toolFilter: z.object({
     allow: z.array(z.string()).default(undefined as unknown as string[]),
     deny: z.array(z.string()).default(undefined as unknown as string[]),