Address the review of this pull request:
- A failed image upload keeps the Host's attachment refusal reason. The
thumbnail of a refused image names the reason instead of offering a
retry that cannot succeed, and Enter while uploads hold the send names
the first failure; a transport failure still offers retry, and an
image without a file name uses the pending-image label.
- An image upload stops reading at the smaller of the per-image and
per-message byte limits.
- A carried image draft moving to a Session that sends images inline
drops its upload instead of staging it again.
- The image upload ready state no longer carries an unread image ref.
- Docs describe stored-image admission and the command image path, and
the attachment rail test builds typed props instead of casting through
unknown.
Prompt admission counted stored images only toward the image count, so
two uploads that each fit alone could exceed maxMessageImageBytes once a
prompt cited both receipts. A staged image now records the byte length
of its upload, and admission counts stored and encoded images together
against both per-message limits before storing anything.
An image upload cancelled after its last chunk, or while its image was
stored, still received a receipt. The upload now checks cancellation
after the read and again before staging, as the file stream path does;
an image whose storage began stays stored, but no receipt is issued.
An ordinary Session's composer now uploads each image draft through the
background upload queue as soon as it is added. The raw upload route stages
the body as a prompt image when the request names its media type: the Host
reads at most the per-image byte limit, then validates, normalizes, and
stores the image as prompt admission would. The prompt cites the receipt in
a file part; prompt admission resolves it to the stored image, applies the
image-input check, and counts stored images toward maxImagesPerMessage.
Send waits for every image receipt, and a failed image upload turns its
thumbnail into a retry control. Commands and subagent continuations keep
encoding images inline.
AgentAdmissionRejected now extends HarnessError with the fixed code
AGENT_ADMISSION_REJECTED. The Session Remote recognizes a refusal by that
code and imports only agent-controller types, so its mapping also holds for
an error from another copy of the module; its literals are typed by the
agent-controller constants, so a changed value fails the build.
Master's async activation makes AgentRegistry inject sessionProjections and
makes createSessionTestRemote async. Install SessionProjectionRegistry in the
agent-controller and prompt-admission harnesses and await the test Remote in
the image admission tests.
session-controller registers its resolver through `ctx.fileUploads`. Inside
that call Cordis returns a new proxy for every function-valued property read
from `this`, so the disposer's identity check never matched and the slot was
never cleared. Any restart of session-controller, such as a profile patch that
changes session-query-sqlite, then failed with "Agent resolver is already
registered" and left every sessionController dependent pending.
Store the resolver in a plain holder object, as the commands receipt resolver
already does, and test registration and disposal through a plugin fiber.
The Agent controller now finishes disposal only after every delivery it
stopped has settled, and a sender that cancels stops waiting at once, also
while its message waits behind a held one; the message keeps its place and
is dropped at its turn.
An image prompt takes the Session's image admission turn when its
preparation starts, in the Agent's delivery order, and keeps it until the
prompt settles. Image and text prompts therefore enter the inbox in arrival
order, and a model selection waits only for the image prompt being
admitted, not for one still queued.
The core page documents the delivery types, and the architecture overview
lists the controller and its admission event.
- Export `ProjectionKeySelection` (the read faces' key selection) and reuse it
from the projection cache instead of restating the union twice. The Cordis
catalog can now resolve the type its generated signatures reference.
- Make `wire.summary` a plain boolean: omitted means `true`, and a key whose
map entry carries the summary mark declares `false` so the runtime key set
and the client view type agree. The type no longer forbids a declaration.
- Describe the mark accurately: it has no runtime representation; `wire.view`
and `viewSchema` are typed with `SessionProjectionViewValue`, which strips it,
so the registration erase only widens the state type.
- Say plainly in the package README, the subsystem page, the client field
comments, and the Agent Note that a list row carries the summary projection
and never the full projection: a connected Session's store may hold more
values, but those are outside the list contract.
- Document the summary vocabulary on the subsystem page with `ts type-equiv`
blocks for the mark, its stripping, the excluded-key test, the summary value
type, and the key selection; split the prose paragraph.
- Revert the behavior-neutral cache-double refactors in three specs, and record
in the Agent Note why no upgrade guide accompanies the wire change and how a
consumer migrates.
`imageLimits` is a boot constant every Session shares: the unit stores no
per-Session state (`stateSchema: z.null()`, `apply: state => state`) and its
view returns `ctx.attachments.imageLimits`. A list row therefore repeated one
host-wide capability fact on every row. It now carries the summary mark like
the three log-derived units, so a summary read skips it while an opened Session
still receives it through `session/follow`, the control baseline, and
`session.projections`.
No other logic changes: the registration, its schema, its constant view, and
the host-side prompt validation keep reading `ctx.attachments` directly.
A Session-list row no longer carries every registered client view: the three
units whose values a list row never renders (`turnOutline`, `sessionStats`,
and `todos`) are excluded, which removes the whole-log turn outline and the
figure and todo payloads from every row. An opened Session is unchanged —
`session/follow`, the `session/control` baseline, and `session.projections`
still serve every projected key.
The exclusion is one type-level mark plus one registration interlock:
`SessionProjectionSummaryExcluded<T>` marks a map entry, and
`ProjectionDefinition.wire` requires `summary: false` exactly on a marked key
and rejects it everywhere else, so the mark and the declaration cannot drift.
A nullable entry keeps `null` outside the wrapper, so `todos` stays
`TodoItem[] | null`. `summaryKeys()` returns the derived set, stable until a
registration or its disposal changes the key table, and the existing
key-taking read faces (`cachedSnapshot`, `viewCheckpoint`) accept that set
directly, so summaries need no separate read face and no per-read key copy.
`packages/api/session-controller/src/list.ts` passes the set to the live and
cold cached faces; `cachedPredecessorTitle` is untouched.
Client types only: `SessionSummary.projectionValues` narrows to
`SessionProjectionSummaryValues`, `SessionProjectionSnapshot.values` keeps
every view value with the mark stripped, and no wire field or client name
changed. The cache, subsystem page, and package README document the summary
rule and the two read faces.
Add @deepseek-ai/dsh-agent-controller, composed in the base bundle, as the
entry through which a sender delivers a message from outside an Agent into
its inbox. deliver() runs the sender's content preparation in the Agent's
delivery order, asks the agent-controller/admission waterfall for a
decision, rechecks cancellation and registration, and appends the message
with followup() or steer(). dsh-agent and agent-loop are unchanged.
The Web session/prompt Remote delivers through it: the image model check,
upload receipt resolution, and attachment storage run as prepare, the
receipt binding runs as beforeInsert, and refusals map to
session/prompt-rejected. The Web client keeps its existing echo.
This replaces the Host half of deepseek-harness/deepseek-harness#6178,
whose admission stage lived in dsh-agent.
Add @deepseek-ai/dsh-agent-model. It provides ctx.agentModel
(resolveForNextStep, select, applyConfiguredRoute) and owns the
modelSelection projection, which the Agent registry no longer registers.
dsh-agent-loop now injects agentModel; the base and SDK-minimal bundles
and the Python SDK runtime include it.
The provider keeps the projection registered until consumers that are
still unloading finish their cleanup. The model-switch notice becomes an
opt-in per-Agent plugin at @deepseek-ai/dsh-agent-model/notice, and
agent/request now also rejects reasoning-effort changes after step
preparation.
Mount the provider in every composition that loads dsh-agent-loop, and
update consumers, the switch-notice snapshot driver, docs, and the
upgrade guide.
Folding on the next message reserved the whole closing height as bottom
room and kept scrollTop whenever the input had no transcript echo on this
page: a message from another tab, a queued message delivered after the
previous Turn, or a send from a subagent child in the right Sidebar. A
reader below the fold was left on an empty viewport.
Every batch of closing rows now runs on the viewport's frame-clock driver.
It lands at the tail for this client's own input or a following reader and
otherwise keeps the reader's content still, installing only the room the
landing lacks. Subagent child sends register a local echo and pass its
request id to subagents.prompt, so the child's recorded message retires it.
Turtle