DSH Product Subagent Console

English | 简体中文

An independent community plugin for DeepSeek Harness (DSH) that adds a third Subagents tab beside Chat and Trajectory. It renders the current conversation's real delegation branches as a pannable, zoomable, draggable, top-down task canvas.

Alpha software. The first supported baseline is DSH 0.1.1-rc.2. Install the prebuilt release tarball when possible and pin every DSH package to the same release family.

Real 0.1.1-rc.2 browser smoke run: two Codex delegations performing read-only README tasks, published as sibling branches. This is a runtime screenshot, not a knowledge-graph mockup.

What this is — and is not

The canvas deliberately looks like a compact graph workbench because that makes parent/child task ownership easier to understand. It is not a knowledge graph:

• every connector comes from an authoritative DSH parent/child catalog or subagent lifecycle;
• dragging a card changes browser presentation coordinates only;
• clicking a card opens read-only task and lifecycle details;
• users cannot create semantic entities, draw arbitrary edges, reparent work, or edit a running Agent;
• the plugin does not invent a plan, hidden child Agents, progress percentages, retries, success, or product-internal thread trees.

Features

• A conversation-level Subagents tab, not a settings-only dashboard.
• One tree for native DSH child Sessions and observed external Provider runs such as Codex or Claude Code.
• Pan, zoom, minimap, fit-to-view, deterministic auto-layout, keyboard selection, and local card dragging.
• Concise task/responsibility labels, exact tool and Provider identity when observed, factual state, duration, and a read-only details drawer.
• Honest distinctions between native Ended and Resumable, published Running / Completed / Aborted / Failed / Token limit / Refused / Unknown, plugin-owned Queued / Starting / Not published, and Disconnected (state unconfirmed).
• Stable correlation through the official tool-execution and subagent lifecycle call chain—never timestamp guessing.
• A bounded, session-filtered loopback RPC instead of exposing the Host ledger as a general remote API.
• Simplified Chinese and English UI copy.

Architecture

flowchart LR
  Catalog[Native DSH child catalog] --> Client[Conversation Subagents canvas]
  Tool[Official tool execution] --> Host[Plugin Host observer]
  Lifecycle[Official subagent start/end] --> Host
  Owned[Optional plugin-owned tool] --> Admission[Bounded admission queue]
  Admission --> Lifecycle
  Host --> RPC[Loopback, session-filtered snapshot]
  RPC --> Client

The root Bundle mounts the Host observer and advertises the lazy browser client. It does not install Codex, Claude Code, or any other coding-agent runtime. Provider Bundles remain separate operator choices.

Compatibility

Component	Supported in 0.1.0-alpha.1
DeepSeek Harness family	Exact 0.1.1-rc.2 peers
Node.js	^22.19.0 or >=24.0.0
DSH surface	Web profile; a headless profile has no conversation tab
Browser module	DSH lazy-CJS client loader from 0.1.1-rc.2
Codex Provider Bundle	@deepseek-ai/dsh-subagent-codex@0.1.1-rc.2
Claude Code Provider Bundle	@deepseek-ai/dsh-subagent-claude-code@0.1.1-rc.2
Package manager for development	pnpm 11.7.0

@next is a moving prerelease tag. It is acceptable only when it currently resolves to the same tested DSH family. Check before installing:

npm view @deepseek-ai/dsh-subagent-codex dist-tags --json
npm view @deepseek-ai/dsh-subagent-claude-code dist-tags --json

Do not mix this plugin's exact 0.1.1-rc.2 peers with a later @next family. Upgrade the plugin and the entire DSH profile together after a newer compatibility row is published.

Installation

1. Install the prebuilt release tarball (recommended)

Download the .tgz and SHA256SUMS.txt assets from the matching GitHub prerelease. Verify the checksum, then install the local archive into the Web profile:

dsh plugin --profile web add ./dsh-product-subagent-console-0.1.0-alpha.1.tgz
dsh --profile web --dump-config

The dump should contain a product-subagent-console row. Restart the Web profile after installation. A tarball contains prebuilt Host, type declaration, and browser artifacts, so it needs no install-time build permission.

2. Install from a pinned Git tag or commit

Git installs fetch source and run this package's prepare build. Pin the source rather than following a moving branch:

dsh plugin --profile web add "github:Jokasa7/dsh-product-subagent-console#v0.1.0-alpha.1"

pnpm 10 and later deny dependency build scripts by default. The first command may therefore stop and print the exact profile workspace file that needs an allowance. Add the package key to that profile's pnpm-workspace.yaml:

allowBuilds:
  dsh-product-subagent-console: true

Then rerun the same pinned dsh plugin ... add command. This allowance permits repository code to execute on the machine during installation, outside the Agent sandbox. Review the source and pin a trusted tag or commit before granting it. Prefer the release tarball if install-time execution is undesirable.

3. Install an external Provider only if needed

The console already displays native DSH child Sessions. To delegate to an external coding Agent, install its official Provider Bundle separately and restart the same profile:

dsh plugin --profile web add @deepseek-ai/dsh-subagent-codex@0.1.1-rc.2
dsh plugin --profile web add @deepseek-ai/dsh-subagent-claude-code@0.1.1-rc.2

Install only the Provider(s) you use. During an aligned prerelease window the equivalent commands may use @next, but verify the resolved versions first:

dsh plugin --profile web add @deepseek-ai/dsh-subagent-codex@next
dsh plugin --profile web add @deepseek-ai/dsh-subagent-claude-code@next

Installing a Provider registers dormant Host capability. It does not grant every Session a model-visible delegation tool, start a product process, change permissions, or configure credentials. Complete product authentication through the Provider's normal DSH/product setup.

Enable a delegation tool in an Agent Preset

The canvas observes native children and compatible official tool calls without replacing DSH's tool. For a standard official delegation, copy a shipped Agent Preset in Settings → Agent Presets, edit only the copy, and enable its @deepseek-ai/dsh-tool-subagent row for the chosen Provider. Create a new Session with that preset; existing Sessions retain the generation with which they were created.

Optional plugin-owned tool

Use dsh-product-subagent-console/tool only when the Agent needs truthful pre-publication states and exact configured display metadata. Add a row like this to a copied Agent Preset:

- id: board-subagent-codex
  name: dsh-product-subagent-console/tool
  config:
    provider: codex
    toolName: board_subagent_codex
    product: codex
    displayName: Codex
    instance: default
    enableRunInBackground: false
    maxDepth: provider-managed

The owned tool accepts a short description for the card and a prompt for the Provider. It creates Queued and Starting attempts before the official run is published, then promotes the same stable card when the official start event arrives. Generic DSH tools appear only after publication because the plugin does not own their earlier state.

Keep enableRunInBackground: false for the smallest setup. When it is true, a request with run_in_background: true also requires the DSH Jobs runtime; otherwise the tool fails explicitly. Multiple Provider instances require unique Provider names and unique model-visible toolName values.

This is an execution adapter, not an automatic multi-Agent planner. It does not pre-create speculative branches before DSH has a real attempt or child relationship.

Host configuration

Defaults are conservative and apply globally to calls made through the plugin-owned tool:

Setting	Default	Meaning
maxConcurrent	4	Maximum active owned delegations
maxQueued	16	Maximum owned attempts waiting for admission
historyLimit	50	Combined terminal attempt/run records kept in this Host generation
maxObservedActive	128	Maximum simultaneously retained observe-only runs
runTimeoutMs	0	Owned-run abort timer; 0 disables it

Override the Bundle row in the profile's later cordis.patch.yml layer. A DSH row override replaces the whole config, so restate every non-default value you intend to keep:

- id: product-subagent-console
  config:
    maxConcurrent: 4
    maxQueued: 16
    historyLimit: 50
    maxObservedActive: 128
    runTimeoutMs: 0

Admission limits do not throttle generic official subagent tools, because the console only observes calls it does not own. runTimeoutMs likewise applies only to the plugin-owned path.

Truth, permissions, and privacy

The browser wire can contain bounded display metadata: parent/child/run/call/attempt ids, Provider and tool names, a short label, operator-configured product/instance labels, timestamps, state, and stop reason. It does not carry the subagent prompt, output, credentials, environment variables, filesystem paths, native stderr, or raw Provider diagnostics.

Treat the short description as visible UI data and do not put secrets in it. The dedicated RPC is registered with loopback authority and filters every request to at most 64 parent Session ids.

The console does not interpret a Provider permission mode as a filesystem guarantee. In particular, a non-interactive or never approval mode does not mean read-only. Permission and sandbox policy remain owned by the DSH Session and the installed Provider; configure them outside this canvas.

Performance and lifecycle limits

• Live attempts/runs poll every 1 second; idle views poll every 3 seconds. Requests are serialized and abort when the view unmounts.
• The browser artifact privately bundles React Flow, Dagre, and their supporting libraries. The alpha build is approximately 700 kB raw / 155 kB gzip and is loaded only when this Bundle is installed.
• Terminal history is bounded and volatile. Restarting the Host clears the plugin ledger and prevents old process state from being presented as a current run.
• While the plugin RPC is connected, an observed run remains Running until DSH publishes its official end event. The UI never changes it to success merely because time passed.
• If the plugin RPC fails after a successful snapshot, the last snapshot stays visible, but only its live product run/attempt nodes change to Disconnected (state unconfirmed) and their clocks freeze at that snapshot's capturedAt. Native DSH catalog nodes continue to follow the main DSH connection and are not relabelled by this plugin-RPC error.
• Provider-internal retries, transport fallback, token consumption, permission waits, and nested private Agent threads are not available through the stock 0.1.1-rc.2 lifecycle. This plugin does not scrape logs or fabricate them.
• External run ids are not assumed to be navigable DSH child Sessions. Native child nodes can be opened; external nodes remain read-only leaves unless DSH supplies an authoritative Session relationship.
• Card positions are local to the current browser view and are not persisted or used to mutate task ownership.
• Browser cancellation, retry, reparenting, task editing, and durable replay are intentionally outside the first release.

Real-dialogue smoke test

After enabling a tool in a copied preset, create a new Session and start with a zero-file-side-effect request:

Call board_subagent_codex exactly once. Ask the child not to read files or use tools and to reply with exactly CODEX_SMOKE_OK. Return that result unchanged.

Then use a small read-only workspace task:

Call board_subagent_codex exactly once with description "Check README facts". Ask it to read only README.md, return the first heading and three stated facts, and create, modify, or delete nothing.

Verify the result across the product surfaces:

1. Trajectory contains the exact tool call and arguments.
2. Chat shows the tool's submitted/running/terminal result.
3. Subagents shows the correct parent branch, attempt publication transition, final state, and frozen duration.
4. A file inventory and the hash of README.md are unchanged.

A parent model that never invokes an available tool is a model-compliance issue. A tool call followed by authentication, process, network, or sandbox failure belongs to the Provider/runtime layer. A published run missing from the canvas, attached to the wrong parent, or still live after an official end event belongs to the console/lifecycle layer.

Troubleshooting

Symptom	Check
No Subagents tab	Confirm this Bundle is installed in the Web profile, --dump-config contains product-subagent-console, all DSH peers are 0.1.1-rc.2, and the Host was restarted.
Tab is present but empty	An installed Provider is dormant. Enable a delegation tool in a copied Agent Preset, create a new Session, and make a real call. Native children appear only after DSH publishes them.
Owned tool is missing	Confirm the preset row uses dsh-product-subagent-console/tool, its provider exactly matches a registered Provider name, and the Session was created after the preset change.
background jobs unavailable	Set enableRunInBackground: false, omit run_in_background, or install/mount the compatible DSH Jobs runtime.
queue-full	Wait for owned runs to dispose or deliberately raise maxQueued; do not confuse this plugin admission limit with Provider capacity.
A run appears to run forever	Check Trajectory and Provider logs for a real official end event. Codex may retry timed-out Responses streams and then fall back to HTTP; while the Provider is genuinely retrying, the truthful state is still Running. Refresh cannot invent an end. runTimeoutMs affects only new owned calls; restarting the Host clears the volatile console ledger.
Active runs were omitted	maxObservedActive was reached. The canvas shows a truncation warning; raise the bound only after considering browser and Host load.
Product nodes say Disconnected (state unconfirmed)	The last valid plugin snapshot is being preserved while its RPC is unavailable. The frozen duration is intentional. Restore the Host/RPC and retry; native DSH nodes continue through the main connection.
Git install refuses prepare	Add the exact allowBuilds key printed by pnpm to the target profile workspace, or install the prebuilt .tgz.
ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION	A local or organization supply-chain policy considers the newly published DSH packages too young. Wait for the policy window or use a reviewed, narrowly scoped exception; do not silently disable the policy machine-wide.
Client module or peer error	Do not mix DSH release families. Reinstall this alpha with exact 0.1.1-rc.2 peers.
Provider mismatch warning	The owned tool expected one Provider but the official lifecycle reported another. Verify preset/provider wiring before trusting attribution.

Uninstall

Remove plugin-owned tool rows from copied Agent Presets, then remove the Bundle and restart the profile:

dsh plugin --profile web remove dsh-product-subagent-console

Removing the console does not remove separately installed Codex or Claude Code Provider Bundles. Remove those explicitly only if they are no longer used. The console stores no durable history, so there is no plugin database to migrate or erase.

Discussion-driven decisions

Three DSH Discussions by Jokasa7 directly shaped the release posture:

• #3667 exposed prerelease dist-tag drift. This README therefore recommends a built tarball, pins the tested DSH version, treats @next as moving, and makes the release workflow validate tag/package parity.
• #3669 showed that Provider retries and transport fallback can be hidden behind a generic running state. Stock 0.1.1-rc.2 does not publish those safe events, so this plugin states the limitation and refuses to derive them from raw stderr.
• #3670 identified ambiguity around Codex permissionMode=never. The canvas reports Provider identity without calling it read-only and leaves permission policy outside model-facing tool arguments.

Broader multi-Agent feedback also informed bounded owned concurrency (4 active, 16 queued), explicit queue/start/publish/failure boundaries, Provider mismatch warnings, and max-tokens/unknown terminal states.

Development and release

corepack enable
pnpm install --frozen-lockfile
pnpm run typecheck
pnpm test
pnpm run build
pnpm run pack:check

CI runs the supported Node lines and validates the build and package inventory. Its job environment keeps pnpm's release-age gate for every dependency except the official @deepseek-ai/* namespace, whose exact tested prerelease versions are already pinned by the frozen lockfile. Pushing a tag exactly matching a prerelease package version, for example v0.1.0-alpha.1, runs the prerelease workflow, rebuilds and checks the package, creates the .tgz plus SHA256SUMS.txt, and publishes a GitHub prerelease. It does not publish to npm.

License

MIT. Adaptation and bundled dependency notices are recorded in NOTICE and THIRD_PARTY_NOTICES.md.

This is an independent community project and is not an official DeepSeek release.