# Model Switch implementation plan

## Milestone 1 — package and pure routing core

1. Establish the publishable package, strict TypeScript declaration build, ESM bundle, and fail-closed Cordis entry.
2. Preserve the released Main/Subagent deep modules. Add two confirmed v0.2 seams: a `ModelSwitchSearchProvider` implementing the official `WebSearchProvider` interface over a provider adapter registry, and a stable `generate_image` tool over an Image adapter registry. Keep Vision outside runtime delivery.
3. Gate an actual tarball: load every export target from extraction; reject source, tests, scripts, source maps, patch/diff payloads, Core paths/fork contracts, and local dependency protocols.
4. Prove emitted artifacts reproduce from different checkout paths.

**Completion:** `pnpm run check` and `git diff --check` pass. No DSH runtime, UI, preset, or lab changes occur.

## Milestone 2 — released runtime seams

Register each feasible Settings/runtime capability only through released public Cordis/DSH interfaces, and expose every unavailable route as explicit capability data rather than simulated behavior. Contract-test against clean alpha.1 infrastructure rather than a hand-built context alone.

**Implemented foundation on alpha.1:** Model Switch owns its Settings namespace; Main reads/saves through the official Agent Default Model service; registration, committed updates, Main delegation, and disposal are covered by a real Cordis + Settings composition test.

**Implemented coordinated replacement:** the package bundle patch disables the released Loader row with id `subagent` and inserts the uniquely identified plugin-owned `dsh-model-switch/subagent-runtime`; removing the bundle restores the official profile composition. The replacement selects provider/model/effort before delegating to the official alpha.1 one-shot and continuable descriptor creation, and fails closed for partial routes, ambiguous or unexpected rows, and unsupported effort transport. Do not replace the launcher-pinned AgentPresets row: a nested AgentPresets instance loads a second dsh-scope identity and breaks session.create. Official presets consume the replacement `subagents` service after the Subagent Loader row is replaced. Search must use the released Web provider seam rather than registering a duplicate tool; Image may register only the unique `generate_image` name.

Known seam constraints from alpha.1 inspection:

- Web session creation has no atomic create-time model override; use the existing public Main Settings namespace rather than post-create selection. The Host couples `session.selectModel` to a deployment-default write, so the owned composer/Plan picker restores the captured Main default through `settings.mutate` at the immediately following revision; conflicts are left untouched so concurrent Settings edits win.
- Tool registration has disposal but no atomic replacement; stage complete generations and roll back on registration failure.
- A later child model switch cannot rewrite its durable continuable descriptor; creation snapshots remain authoritative.
- Search routing owns only provider id `model-switch`; the deployment profile pins `web.searchProvider: model-switch` while preserving its existing `fetchProvider`. The official `web_search` and `web_fetch` tools are untouched.
- `generate_image` is unique, so existing provider-specific image tools remain enabled and require no owner suppression.
- Codex and Grok register Search and Image adapters. The DeepSeek bridge reuses the official public search implementation and existing settings/credential service. Optional Cordis injection preserves standalone provider behavior and disposal; only Host-projected search metadata reaches the UI.
- Vision remains outside runtime delivery and must not register or shadow `read_image`.

## Milestone 3 — settings surface

Contribute the Model Switch settings section through declared client slots (alpha.1 has no generic standalone page registry). Use one lifecycle controller/store, three derived prop shares, plain presentation data/callbacks, optimistic revisions, independent row saves, capability filtering, and zh/en dictionaries.

## Milestone 4 — provider adapters and composition

Keep the launcher-pinned `agent-presets` row and official web tools. Add clean optional adapter releases to Codex and Grok without Vision or hard runtime dependency cycles. Explicitly configure Lab `web.searchProvider` to `model-switch` while preserving the complete existing Web config, including `fetchProvider`. The bundle does not modify the Web row; restore the prior deployment search pin before removing Model Switch. Model Switch ships no preset copies.

## Milestone 5 — pack/profile/lab acceptance

Run the full composition matrix from packed artifacts under `DSH_HOME=~/.dsh-lab` on port 3082. Validate boot, HTTP, profile composition, and artifact hashes; leave browser-only visual checks to the human because the managed browser must not open DSH itself.