fix(web): address a session's own services from the host

A preset publishes its services behind `isolate` realms, which is what
makes them per session — and what makes them invisible to every host
context. The api-proxy kept reading the root realm, so requests that are
ABOUT a session but arrive from outside it answered for a singleton that
no longer exists: `goal.pause`/`clear` and `skill.list` returned "this
deployment does not mount @deepseek-ai/dsh-goal / dsh-skill" for sessions
whose composition mounts exactly that. Verified against a running host
before and after.

`agentPresets.serviceFor(agent, name)` addresses the instance instead,
reading the same subtree-ownership relation `leakedServices` already
uses, inverted. It is read addressing for a caller holding the agent: a
host row that `inject`s a service cannot use it, because injection
resolves before any session exists — which is why `tools` and
`subagents` stay host-plane and this is not a way around that.

Tool presenters had the same shape and the same cure: `viewFor` looked
definitions up without a scope while the global layer is empty by
design, so every card degraded to the generic renderer. It now takes the
owning agent.

Cold resume through `agentFor()` mounted no preset at all, so every
generic entry point — prompt, models, commands — rebuilt a restarted
session on host tools and the deployment persona. It composes the
recorded preset now, as the other resume path already did.

packages/host/apiproxy/tests/api-proxy-agent-preset.spec.ts

@@ -15,6 +15,7 @@ import SessionStore, { SessionId, type Session } from '@deepseek-ai/dsh-session'
 import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
 import { RpcId, type RpcRequest } from '../src/api/rpc.ts'
 import { UnknownPresetError } from '@deepseek-ai/dsh-agent-presets'
+import { GoalId } from '@deepseek-ai/dsh-goal'
 import { createApiProxy } from '../src/api-proxy.ts'
 import { describe, expect, it } from 'vitest'
 
@@ -44,9 +45,19 @@ function roster(ids: readonly string[]): unknown {
     },
     mount: (_ctx: Context, id?: string) =>
       Promise.resolve({ id: id ?? ids[0], trust: 'system', path: '/presets/x.yml' }),
+    // What a real mount leaves behind: a service instance only the agent that
+    // mounted it can be used to address. The doubles are per agent so a test
+    // can tell "this session's" from "some session's".
+    serviceFor: (agent: { id: unknown }, name: string) => {
+      const perAgent = services.get(String(agent.id))
+      return perAgent?.[name]
+    },
   }
 }
 
+/** Per-agent service instances a mounted preset would own, keyed by session id. */
+const services = new Map<string, Record<string, unknown>>()
+
 async function harness(presets?: readonly string[]) {
   const cwd = realpathSync(mkdtempSync(join(tmpdir(), 'dsh-apiproxy-preset-')))
   const ctx = new Context()
@@ -143,3 +154,62 @@ describe('session.create with an agent preset', () => {
     expect(ctx.sessions.get(SessionId('s6'))?.header.agentPreset).toBeUndefined()
   })
 })
+
+/**
+ * A capability a preset mounts is reachable from nowhere the host normally
+ * looks: an `isolate` realm is what makes it per session. The gateway serves
+ * requests that are ABOUT a session from OUTSIDE it, so it addresses the
+ * instance through the agent instead of reading a root-realm singleton.
+ */
+describe('a capability the session\'s preset mounts', () => {
+  it('serves the goal RPC from the session\'s own goal service', async () => {
+    const { api } = await harness(['standard'])
+    await api.sessions.create(request({ sessionId: SessionId('g1'), agentPreset: 'standard' }))
+    const ref = { id: GoalId('goal-1'), revision: 1 }
+    const paused: unknown[] = []
+    services.set('g1', {
+      goals: { pause: (agent: { id: unknown }, r: unknown) => { paused.push([String(agent.id), r]); return ref } },
+    })
+
+    const response = await api.goals.pause(request({ sessionId: SessionId('g1'), ref }))
+
+    expect(response.result).toMatchObject({ ok: true, value: { ref } })
+    // Reached the instance this session mounted, and was handed its own agent.
+    expect(paused).toEqual([['g1', ref]])
+    services.delete('g1')
+  })
+
+  it('serves the skill catalog from the session\'s own registry', async () => {
+    const { api } = await harness(['standard'])
+    await api.sessions.create(request({ sessionId: SessionId('k1'), agentPreset: 'standard' }))
+    services.set('k1', {
+      skills: {
+        list: () => Promise.resolve([{
+          name: 'preset-owned',
+          description: 'ships inside the preset directory',
+          invocation: { modelInvocable: true, userInvocable: true },
+        }]),
+      },
+    })
+
+    const response = await api.skills.list(request({ sessionId: SessionId('k1') }))
+
+    // A preset ships its own skill directory, so the catalog IS the
+    // session's; reading a host singleton would answer for the wrong one.
+    expect(response.result).toMatchObject({ ok: true, value: { skills: [{ name: 'preset-owned' }] } })
+    services.delete('k1')
+  })
+
+  it('says so when no composition mounts the capability at all', async () => {
+    const { api } = await harness(['standard'])
+    await api.sessions.create(request({ sessionId: SessionId('n1'), agentPreset: 'standard' }))
+
+    const response = await api.skills.list(request({ sessionId: SessionId('n1') }))
+
+    // Absent means absent — not "this session has none", which is what a
+    // root-realm read used to report for every presetd session.
+    expect(response.result.ok).toBe(false)
+    const failure = response.result as { ok: false; error: { message: string } }
+    expect(failure.error.message).toContain('neither this session')
+  })
+})

packages/host/apiproxy/tests/api-proxy-subagents.spec.ts

@@ -112,7 +112,12 @@ describe('subagent gateway', () => {
       .toMatchObject({ ok: true, value: { entries: [{ activity: 'running' }] } })
   })
 
-  it('reads a healthy direct child without looking up or activating any Agent', async () => {
+  it('reads a healthy direct child without acquiring an Agent owner', async () => {
+    // `bench()` leaves the child with no live Agent at all, so the response
+    // below is produced cold — which is the invariant: the read never creates
+    // or resumes one. It may still CONSULT the live registry, because tool
+    // presenters live with the per-agent definitions and rendering this
+    // child's own cards needs its layer.
     const { api, getAgent, readSession } = bench()
     const response = await api.subagents.history(request({
       parentSessionId: PARENT, childSessionId: CHILD, mode: 'continuable', maxMessages: 10,
@@ -122,7 +127,7 @@ describe('subagent gateway', () => {
       value: { hasMore: false, events: [{ event: { type: 'user/message', seq: 0 } }] },
     })
     expect(readSession).toHaveBeenCalledWith(CHILD)
-    expect(getAgent).not.toHaveBeenCalled()
+    expect(getAgent).not.toHaveBeenCalledWith(PARENT)
   })
 
   it('reads one-shot history and rejects an address with the wrong mode', async () => {