[Bug] Agent Teams bundle 在 Web/Desktop 未禁用 subagent：子代理不在 Team roster，list_agents/send_message 找不到也联系不上

[LLKernel]

中文摘要：在 Web/Desktop（preset 平面）上开启 Agent Teams bundle 后，subagent / subagent_fork 并没有被禁用（bundle 的 disabled patch 只落在 host 平面），而 Team 的 send_message / list_agents / interrupt_agent 又以同名工具遮蔽了 preset 的 continuable-child 控件。结果：模型用 subagent 派出的子代理既不在 Team roster 里，也没有任何工具能按 agent_id 联系它们 —— 也就是"我明明派了人，却找不到也联系不上"。

English summary: With the Agent Teams bundle enabled on Web/Desktop, the bundle's disabled patches only hit host-plane rows, so the preset plane still exposes subagent/subagent_fork. The Team tools shadow the preset's same-named child controls, so children spawned through subagent are not Team members: list_agents never shows them and send_message reports active teammate "…" not found.

---

环境

• dsh 0.1.7-rc.1（源码 checkout，HEAD 46a7f68b09），Web GUI
• profile：web，dsh.profile.bundles = ["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app", "@deepseek-ai/dsh-experimental-agent-team-profile"]（在 Plugins 页开启 Agent Teams）
• 平台：Windows

现象

开启 bundle 后，Lead 会话的工具表同时包含两套语义冲突的委派工具：

• Team：spawn_teammate、send_message、list_agents、interrupt_agent、wait_agent、team_task_*
• 旧的直接委派：subagent、subagent_fork

其中 send_message / list_agents / interrupt_agent 的描述是 Team 版（target 为 teammate 名、role: lead/teammate），不是 agent_id / scope 版；即 bundle 想要禁用的旧控件只是被同名遮蔽，而 subagent / subagent_fork 原样可用。

实测（同一会话）

1. 调用 subagent 派一个后台子代理，子代理正常返回。
2. list_agents() → [{"target":"lead","role":"lead","status":"running","diagnostics":[]}]，只有 lead。
3. send_message({target:"<子代理 id 或 label>"}) → Error: active teammate "190afdd6-…" not found。

也就是说：模型按 subagent 正常委派之后，既无法列出、也无法联系它自己创建的子代理。错误信息只说明"找不到这个 teammate"，不提示任何可行的替代路径。

最小复现

1. 在 web（或 Desktop）profile 启用 @deepseek-ai/dsh-experimental-agent-team-profile。
2. 新开一个会话，不要提及 Agent Teams，让模型用 subagent 委派一个后台子任务。
3. 子代理返回后，调用 list_agents → 只有 lead。
4. 调用 send_message({ target: "<子代理 id/label>" }) → active teammate "…" not found。

根因

1. bundle 的禁用意图是 host 平面的 id patch
   agent-team-profile/cordis.patch.yml 禁用 tool-subagent-control / tool-subagent-list-agents / tool-subagent / tool-subagent-fork；README 也承诺 "Ordinary subagent delegation … disabled"（README L12、L49）。

2. Web profile 里这些 id 属于 host 平面，且早已被 web-app 禁用
   web-app/cordis.patch.yml L497-L514。bundle 的 patch 命中了正确的 id，但那一行本来就是关的 —— 静默无效。

3. 真正给模型的 delegation 工具由 agent preset 声明
   presets/standard.patch.yml L80-L118 的 delegation 组（tool-subagent-control、tool-subagent-list-agents、tool-subagent、tool-subagent-fork）；ptc、cordis 两个 preset 同样声明（minimal 没有）。GUI 每个 agent 都会挂默认 preset：api/session-controller/src/agent.ts L381-L397。

4. 顶层 patch 跨不进 preset 内部，且这是被强制的两平面架构
   applyEntryPatches 只索引顶层条目与同层 group 行（vendor/include/src/index.ts L65-L74），未命中的 id 只 warn 并跳过（L109-L113）；同时 scripts/verify-cordis-config.ts L139-L166 要求"一行只属于一个平面"。因此 preset 行无法被任何其他 bundle 的 patch 层禁用。

5. Team 工具靠"同名遮蔽"替换旧控件，但只遮蔽了三个
   preset scope 通过 bindScopeParent 成为 agent scope 的父层（agent-preset-registry L248-L257、core/scope L72）；Team 工具注册进 agent 自身的层（tool-agent-team L164-L175），工具解析里 own 层最后写入并遮蔽 inherited（core/tools L1177-L1208）。于是 send_message/list_agents/interrupt_agent 被替换，subagent/subagent_fork 存活。

6. 普通子代理不是 Team 成员，因此不可见也不可达
   tryMembership 对带 subagent descriptor 的子代理返回 undefined（roster.ts L92-L122），list 只返回 Lead + roster（L129-L160），send_message 按 member 名解析并抛 TEAM_MEMBER_NOT_FOUND（L43-L55）。

这不是"模型乱用 Agent Teams 语义"

模型的路径其实被工具文档教成这样，且完全不需要用户提及 Agent Teams：

• tool:policy 只约束"创建 teammate"（create teammates only when the user explicitly asks…），不约束是否委派，也不禁止 subagent；九件套对 Lead 是无条件安装的（tool-agent-team L402-L421）。
• subagent 的系统提示段写着 "Use subagent in the background by default…"（tool-subagent L599-L605），工具描述本身也写着 "send_message steers the child's nearest step…"（L387）。
• 但模型拿到的 send_message 是 Team 版：传 agent_id → invalid arguments: missing required property "target"；传子代理名字/id → active teammate "…" not found。policy 中没有任何一句说明"本会话的 send_message/list_agents 只认 Team 成员"。

因此在开启 bundle 的 Web/Desktop 上，每一次普通委派都会踩到这条死路；用户不提 teams 时反而更容易踩，因为此时没有 teammate，而可用的控制工具全是 Team 语义。

为什么 CI 没有发现

• 录制的 Team 产品快照跑 headless，headless 不 mount preset，期望工具表里确实没有 subagent（snapshots/session/team-targets/tool-schemas.expected.json）—— 测试钉住的是正确组合，与 Web/Desktop 无关。
• Web 侧 agent-team-panel.e2e.ts L36-L54 只断言 overlay == bundle patch + 面板 UI，其 scaffold 没有开启 agentPresets（scaffold.ts L665-L667），因此看不到该泄漏。
• 另外 README 的 Known Limitations 其实写了 "Preset-scoped child controls — Web presets can still mount continuable Subagent controls in their own scope; this top-level bundle does not replace those registrations."（L108），与 Summary / What you get 的"已禁用"表述自相矛盾，且没有说明由此产生的"Team 工具遮蔽 + subagent 存活"混用后果。

影响面

• 受影响：Web、Desktop（走 preset 挂载的 GUI 会话）；standard / ptc / cordis 三个 shipped preset 都声明这些行。
• 不受影响：headless / ACP / SDK 等不 mount preset 的组合。
• 严重性：委派与协作能力不可用 + 误导模型（会浪费轮次反复尝试联系不存在的成员），无数据损坏。

建议修复

A（推荐，符合两平面架构的最小改动）：让 preset 平面对 Team 服务感知 —— 在 presets/standard|ptc|cordis.patch.yml 的这 4 个 legacy child-control 行上各加 disabled: !!js "ctx.get('agentTeams') !== undefined"（同文件已有 !!js 先例，host 平面也有 !ctx.get('profileContext') 先例）。注意必须逐行加、不能禁用整个 delegation 组，否则 workflow 也会一起消失（headless Team 快照中 workflow 是保留的）。配套：增加一条"Web preset × Team bundle"组合下断言模型可见工具表的产品级测试，并同步 README。

B：由 Team bundle 自带一个 Team preset 并 patch 顶层 agent-preset-registry 的 default。不动 web-app，但要复制整份 preset 声明，与 preset 编辑器/用户自定义 preset 冲突，实验包还需承担 release preset 的维护成本 —— 不推荐。

C：让 tool-subagent 检测到 agentTeams 就不注册。隐式耦合，且会让 host 平面行也静默消失 —— 不建议。

D（止血，不足以修复）：在 Team policy/工具错误信息中说明"本会话仍可能出现 subagent，其子代理不属于 Team，send_message/list_agents 无法到达它们"，并修正 README 的矛盾表述。

备注

以上结论均在开启 bundle 的真实 Web 会话中实测（工具表比对 + list_agents / send_message 的实际返回），代码位置对应 HEAD 46a7f68b09。

[argszero]

Thanks for the report — I re-verified the whole chain against 46a7f68b09 and it holds as written, including the two parts that are easiest to miss: the profile patch re-sets rows bundle/web-app/cordis.patch.yml:504-514 had already disabled (and nothing warns, precisely because the ids do match a row), and the controls that survive are the ones with no Team twin (subagent, subagent_fork) rather than the three Team shadows.

A plugin cannot reach the preset plane either, so I took the one seam that can act on this at runtime — agent.ctx.tools.restrict() — and shipped it:

@argszero/cordis-plugin-team-delegation-guard@0.1.0
npm: https://www.npmjs.com/package/@argszero/cordis-plugin-team-delegation-guard
repo: https://github.com/argszero/cordis-plugin-team-delegation-guard

- insert:
    - id: team-delegation-guard
      name: '@argszero/cordis-plugin-team-delegation-guard'

What it does

For every agent whose scope carries the Team tool set, it withdraws the legacy delegation names that agent can still see:

agent.ctx.tools.restrict({ deny: ['subagent', 'subagent_fork', /* … */] })

Three properties of the seam are what make that precise instead of approximate, and they are why the plugin is shaped this way:

1. restrict() filters the inherited surface only. core/tools/src/index.ts view() applies restrictions to the global layer and every non-own ancestor layer, then merges the scope's own registrations after the filter, outside it. Preset rows are an ancestor contribution, so they are maskable; Team's own tools are own-layer, so they never are. That asymmetry is exactly the split the fix needs.
2. restrict() throws on a name it cannot resolve (core/tools/src/index.ts:1096-1122) rather than ignoring it. So the deny list is built from the live view — never from a constant — and a name that turns out to be own-layer is dropped and reported on its own instead of taking the whole batch down with it.
3. The restriction is owned by agent.ctx, so it lifts with the agent and leaves no residue on the ancestor plane.

The discriminator is a marker tool, not a flag and not the Team service. spawn_teammate is registered by tool-agent-team into agent.ctx for every agent the Team runtime owns (tool-agent-team/src/index.ts:164-176), and nothing else in the tree registers that name — so its visibility answers "does Team own this agent". ctx.agentTeams.tryMembership() does not answer that: it resolves a membership for every root agent (role: 'lead'), mounted Team bundle or not (agent-team/src/roster.ts:92-122). Ordering is handled rather than assumed: the guard leaves an agent undecided until its marker appears and reconsiders on tools/change, so it does not matter whether this plugin or tool-agent-team mounts first.

It also goes inert by itself once fix A lands: subagent stops being visible, there is nothing to deny, and no configuration or version pin changes. It cannot fight the fix.

What it deliberately does not do

send_message, interrupt_agent and list_agents are among the four rows you identify, but withdrawing them through this seam is a no-op — Team registers all three in the agent's own layer, which restrict() exempts, so the Team versions stay visible either way. They are absent from the default deny list for that reason: listing them would look like coverage without being coverage, which is the shape of the bug being fixed. And it does not touch a session where Team is absent, nor can it make a subagent child into a Team member — that is the roster, in agent-team.

Verification

• 25 arms, including one that mounts the real @deepseek-ai/dsh-experimental-tool-agent-team with the guard mounted first: the shipped install path is what puts spawn_teammate in the scope, and all nine real Team tools survive while subagent / subagent_fork disappear.
• Six defect injections, each breaking specific arms: marker check disabled (5 failures), deny list unfiltered (1), no per-name fallback (2), tools/change catch-up removed (2), once-only decision removed (1), restriction applied to the plugin context instead of the agent scope (11).
• The packaging guard (npm pack --dry-run --json plus "the entry's relative import closure is inside the tarball") caught a real release defect before publishing: a path declared in files that does not exist is omitted from the tarball with no warning at all.

On the core-side fix

A is right, and the per-row form matters for exactly the reason you give — the delegation group also carries workflow (presets/standard.patch.yml:80-118), and headless Team snapshots retain it.

Worth including in the same change: the bundle README contradicts itself today. Summary and What you get say ordinary subagent delegation is disabled (experimental/agent-team-profile/README.md:12, :49) while Known Limitations says the profile does not replace preset-scoped child controls (:108). The second statement is the accurate one, and the pair should not ship in one document regardless of what happens to the planes.

On CI: the blind spots you name — a recorded Team snapshot that runs headless, and a Web overlay test whose scaffold does not enable agentPresets — are consistent with what I see in the tree, though I did not re-run either suite here. An arm asserting the model-visible tool table for one Web-preset × Team-bundle session would cover this case, and is also the natural place to pin the inverse (Team absent ⇒ subagent stays).

The plugin is a runtime-plane enforcement of the bundle's own declared intent, offered as an immediate stop-gap; fix A remains the fix.