@bastani/atomic 0.9.12-alpha.1 → 0.9.13-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Added
+
+- `CreateAgentSessionOptions` and `ExtensionContext` now carry an immutable typed subagent child capability policy for in-process tool registration ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- `CreateAgentSessionOptions` now supports construction-time system-prompt and inherited-context transforms, allowing in-process child sessions to apply typed policy without extension injection ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Changed
+
+- Typed child policy now includes MCP direct-tool selection and admission-issued Intercom identity/capability, allowing in-process extensions to consume child policy without inheritable environment state ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Bundled subagent launches now use in-process `AgentSession` children with typed admission, canonical identities, and live async continuation; `async: true` work is owned by the parent process and does not survive parent exit ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Fixed
+
+- Workflow runs awaiting human input now use the blue `？` indicator in the BACKGROUND panel, `/workflow connect` picker, and `/workflow status` listing, including prompts raised by hidden nested workflow children; the indicator returns to the run's current state when the prompt resolves.
+- Fixed main-chat model fallback to classify provider failures consistently with workflows, advance rejected credentials and incompatible or unavailable models to the next candidate, and restore the user-selected model at the next turn without overriding an explicit `/model` choice. A failure that requesting the same model again cannot repair now takes that model out of the chain for the rest of the turn at every reasoning level, so a fallback entry differing only by its `:low`/`:high` suffix is skipped instead of retrying the same dead credential; transient rate-limit and transport failures keep those reasoning variants ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+- Fixed a context overflow that compaction cannot resolve to advance the configured `fallbackModels` chain instead of ending the turn, so a larger-context candidate can answer. Compaction still runs first, and a compactable overflow spends no fallback candidate ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+- Fixed a reasoning-level change during a model fallback stranding the session on the fallback model. Changing reasoning effort is not a model choice, so it no longer cancels the pending restore; the next turn returns to the user-selected primary and keeps the reasoning level that was chosen. Only an explicit `/model` selection or model cycle cancels the restore ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+- Fixed gRPC `ResourceExhausted` provider errors, seen from providers such as NVIDIA NIM, bypassing the same-model auto-retry budget. They are now retried like other transient provider failures, matching upstream pi-ai, and still advance a configured fallback chain when the retries are exhausted ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+
+## [0.9.12] - 2026-08-04
+
+Cumulative release of the `0.9.12-alpha.1` prerelease. The summary below covers the user-visible outcome of that work; the per-change detail remains in the prerelease section below.
+
+### Added
+
+- Compaction honors `<keepContext>` / `</keepContext>` tags. Wrap any part of a prompt you never want compressed, and every line of the span — tag lines included — is protected verbatim regardless of the compression ratio. The guarantee is mechanical rather than advisory: deletion ranges are split around protected lines after the planner responds. Because the tag lines are protected too, a span is re-detected on each subsequent boundary and stays protected for the life of the session. Detection is bounded on three sides, because the transcript it scans is untrusted: a tag must be the whole line after any role header, a span is scoped to one message so an unclosed tag stops at the end of its own message rather than running to the end of the region, and tags inside tool results are inert — user and assistant messages may both protect, so prompts, steering, and an agent's own pinned information all work, but file, page, or command output an agent reads cannot mark itself unreclaimable or persist through compaction ahead of real content. Protected lines count against the keep target rather than raising it, so the compression ratio stays a real bound on output size and the unprotected remainder compresses harder. Results report force-preserved ranges as `keptRanges` ([#2172](https://github.com/bastani-inc/atomic/issues/2172)).
+
+### Fixed
+
+- The compaction relevance query is no longer truncated to 1,000 characters. Truncation made prompt section order the retention policy: for a long structured prompt only the leading section reached the planner, so a constraint stated later could not influence what was kept, while the objective it qualified survived and was acted on. Long queries are safe — an oversized planner request surfaces as an explicit provider-overflow failure rather than silent truncation ([#2172](https://github.com/bastani-inc/atomic/issues/2172)).
+- Cleared three advisories in the shipped dependency tree. `undici` moves 8.5.0 → 8.9.0, which covers five advisories against 8.0.0–8.8.0 — response desynchronization via the retry interceptor, two cross-user cache-directive disclosures, CRLF injection through a blob body `type`, and cookie-attribute injection — and it is the dispatcher behind `fetch_url` and every agent HTTP request. Transitively under `@modelcontextprotocol/sdk`, `ip-address` is pinned to 10.3.1 for three SSRF and trust-boundary bypasses (octal-decoded leading-zero octets, CIDR suffixes suppressing special-use classification, and misclassified IPv4-mapped/NAT64 addresses), and `hono` to 4.12.34 for a CORS-middleware ReDoS. `npm audit` is clean.
+- Fixed bundled builtin extensions failing to load on Windows when shared modules were evaluated twice, so bundled workflows and tools initialize correctly.
+
 ## [0.9.12-alpha.1] - 2026-08-04
 
 ### Added

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Changed
+
+- In-process child identities and supervisor capabilities now arrive through typed admission policy and are captured on each `IntercomClient` at connect time instead of being read from environment for every message. Descendants cannot inherit a parent's supervisor grant through process environment; legacy Atomic/Pi bridge metadata remains available for older hosts ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+## [0.9.12] - 2026-08-04
+
+### Fixed
+
+- Fixed bundled Intercom resources failing to load on Windows when shared modules used mixed `.ts` and `.js` import spellings.
+
 ## [0.9.12-alpha.1] - 2026-08-04
 
 ### Fixed

package/dist/builtin/intercom/README.md

@@ -20,7 +20,7 @@ Sometimes you're running multiple Atomic/pi sessions — one researching, one ex
 
 Unlike pi-messenger (a shared chat room for multi-agent swarms), intercom is for targeted 1:1 communication where you pick the recipient.
 
-Intercom also integrates with delegated subagents: child agents get a child-only `contact_supervisor` tool when subagent bridge metadata is present. Atomic-prefixed bridge environment variables are supported, and legacy `PI_*` bridge metadata remains compatible. Atomic's subagent bridge also obtains a broker capability that binds the child session to the exact supervisor; client-authored channel flags are never trusted as cross-group authority. Use `reason: "need_decision"` for blocking clarification, `reason: "interview_request"` for multiple structured supervisor answers, and `reason: "progress_update"` for meaningful plan-changing updates. Normal sessions only see the regular `intercom` tool.
+Intercom also integrates with delegated subagents: in-process children receive a typed admission-issued identity for `contact_supervisor`, including their canonical run/agent/index metadata and any supervisor capability. The child identity is bound to its `IntercomClient` when it connects, so each message uses the same client-owned source and a descendant cannot inherit a parent's capability through process environment. Atomic-prefixed bridge environment variables and legacy `PI_*` metadata remain compatible for older integrations only. Use `reason: "need_decision"` for blocking clarification, `reason: "interview_request"` for multiple structured supervisor answers, and `reason: "progress_update"` for meaningful plan-changing updates. Normal sessions only see the regular `intercom` tool.
 
 ## In One Minute
 
@@ -227,20 +227,13 @@ The planner typically uses `send`. If you prefer manual approval for outgoing no
 
 ## Workflow: Subagent-to-Supervisor Escalation
 
-This workflow requires [`pi-subagents`](https://github.com/nicobailon/pi-subagents) to be installed and to supply child bridge metadata. When `pi-subagents` spawns a delegated child with that metadata, the child session gets a subagent-only `contact_supervisor` tool in addition to the regular `intercom` tool. Normal sessions never see `contact_supervisor`.
+This workflow uses Atomic's in-process subagent admission. When the runtime admits a delegated child with supervisor coordination, the child session gets a subagent-only `contact_supervisor` tool in addition to the regular `intercom` tool. Normal sessions never see `contact_supervisor`.
 
 ### When the Tool Appears
 
-`contact_supervisor` only registers when `pi-subagents` sets all of these environment variables:
+`contact_supervisor` is registered from the typed admission record. The record binds the supervisor target, canonical child identity, child index, session name, and broker-issued capability to the child session; these values are not inherited from environment variables. If the parent does not grant supervisor coordination, the session falls back to the regular `intercom` tool.
 
-- `PI_SUBAGENT_ORCHESTRATOR_TARGET` — the supervisor session name or ID
-- `PI_SUBAGENT_RUN_ID` — the run identifier
-- `PI_SUBAGENT_CHILD_AGENT` — the agent type
-- `PI_SUBAGENT_CHILD_INDEX` — the child index within the run
-
-Atomic's bundled subagent bridge additionally supplies internal `ATOMIC_SUBAGENT_SUPERVISOR_CAPABILITY` and `ATOMIC_SUBAGENT_SUPERVISOR_SESSION_ID` values issued by the broker. They are not user-configurable authentication flags: the broker accepts the capability only for the child scope and supervisor session that requested it, and the parent restores the same secret if the broker reconnects. Legacy `PI_*` aliases remain readable where applicable.
-
-If any are missing, the session falls back to the regular `intercom` tool.
+The child identity remains stable across foreground continuation, `async: true`, interruption, and cold resume. Intercom detach uses the same in-process continuation as async work, so the jobs widget and terminal envelope retain one canonical path.
 
 ### Three Reasons
 
@@ -254,7 +247,7 @@ Do not use `contact_supervisor` for routine completion handoffs. Return the fina
 
 Cross-group delivery uses a dedicated broker protocol. Ordinary raw `send` frames always remain group-isolated and are rejected if they include a forged `channel: "supervisor"` marker. A child can cross groups only after its broker-issued capability has bound its registered socket to the exact supervisor. The broker adds the `supervisor` channel marker to validated inbound traffic so parent relays can distinguish it. Replies cross back only when `replyTo` matches a recorded supervisor message in the exact reverse direction; fabricated thread IDs do not bypass isolation.
 
-During a foreground subagent run, Atomic probes for an exact live foreground owner before delivery. The matching child reserves the request, accepts a generation-scoped detach commit, and acknowledges it before asks, sends, decisions, interviews, and progress updates enter the parent's model-visible steering queue. A busy workflow stage first reserves the message in its AgentSession generation boundary, then waits inside that admission for the same detach handshake before model-visible queue insertion. This prevents terminal stage close from overtaking the handshake while still preventing the active subagent tool from blocking the child request that would release it; unclaimed traffic and a still-current receiver whose owner disappears before commit fall back to ordinary queue insertion. One accepted commit releases foreground supervision for every active member of a parallel group while retaining each child process and eventual result. Blocking calls remain alive until the parent sends the exact threaded reply; fire-and-forget calls create no reply waiter. Background and unmatched traffic for ordinary sessions keeps queued-until-idle behavior, and generation cancellation/replacement invalidates stale handshakes.
+During a foreground subagent run, Atomic probes for an exact live foreground owner before delivery. The matching child reserves the request, accepts a generation-scoped detach commit, and acknowledges it before asks, sends, decisions, interviews, and progress updates enter the parent's model-visible steering queue. A busy workflow stage first reserves the message in its AgentSession generation boundary, then waits inside that admission for the same detach handshake before model-visible queue insertion. This prevents terminal stage close from overtaking the handshake while still preventing the active subagent tool from blocking the child request that would release it; unclaimed traffic and a still-current receiver whose owner disappears before commit fall back to ordinary queue insertion. One accepted commit releases foreground supervision for every active member of a parallel group while retaining each in-process session and eventual result. Blocking calls remain alive until the parent sends the exact threaded reply; fire-and-forget calls create no reply waiter. Background and unmatched traffic for ordinary sessions keeps queued-until-idle behavior, and generation cancellation/replacement invalidates stale handshakes.
 
 ### Example: Blocked Subagent Asks for Guidance
 

package/dist/builtin/intercom/broker/client.ts

@@ -38,6 +38,8 @@ export class IntercomClient extends EventEmitter {
   private socket: net.Socket | null = null;
   private _sessionId: string | null = null;
   private _supervisorSessionId: string | null = null;
+  /** Source identity is captured once at connect, never read from env per message. */
+  private _messageSource: Message["source"] | undefined;
   private pendingSends = new PendingSendRegistry();
   private pendingLists = new Map<string, { resolve: (sessions: SessionInfo[]) => void; reject: (e: Error) => void }>();
   private pendingSupervisorAuthorizations = new Map<string, {
@@ -85,10 +87,16 @@ export class IntercomClient extends EventEmitter {
     return socket;
   }
 
-  connect(session: Omit<SessionInfo, "id">, supervisor?: SupervisorRegistration, supervisorOwnerToken?: string): Promise<void> {
+  connect(
+    session: Omit<SessionInfo, "id">,
+    supervisor?: SupervisorRegistration,
+    supervisorOwnerToken?: string,
+    messageSource?: Message["source"],
+  ): Promise<void> {
     if (this.socket) {
       return Promise.reject(new Error("Already connected"));
     }
+    this._messageSource = messageSource ?? readSubagentMessageSource();
 
     return new Promise((resolve, reject) => {
       const socket = net.connect(BROKER_SOCKET);
@@ -141,6 +149,7 @@ export class IntercomClient extends EventEmitter {
         }
         this._sessionId = null;
         this._supervisorSessionId = null;
+        this._messageSource = undefined;
         this.disconnectError = null;
         if (connectionEstablished && !wasDisconnecting) {
           this.emit("disconnected", disconnectError);
@@ -463,7 +472,7 @@ export class IntercomClient extends EventEmitter {
       replyTo: options.replyTo,
       expectsReply: options.expectsReply,
       replyError: options.replyError,
-      source: readSubagentMessageSource(),
+      source: this._messageSource,
       content: { text: options.text, attachments: options.attachments },
     };
     try {

package/dist/builtin/intercom/contact-supervisor-tool.ts

@@ -19,7 +19,7 @@ import {
 } from "./intercom-utils.js";
 
 interface ContactSupervisorDeps {
-  childOrchestratorMetadata: ChildOrchestratorMetadata | null;
+  childOrchestratorMetadata: ChildOrchestratorMetadata | null | (() => ChildOrchestratorMetadata | null);
   ensureConnected(reason: "tool"): Promise<IntercomClient>;
   syncPresenceIdentity(sessionId: string): void;
   resolveSessionTarget(activeClient: IntercomClient, nameOrId: string): Promise<string | null>;
@@ -35,7 +35,10 @@ interface ContactSupervisorDeps {
 
 export function registerContactSupervisorTool(pi: ExtensionAPI, deps: ContactSupervisorDeps): void {
   const { childOrchestratorMetadata, ensureConnected, syncPresenceIdentity, resolveSessionTarget, beginReplyWait, hasReplyWaiter } = deps;
-  if (childOrchestratorMetadata) {
+  const getMetadata = typeof childOrchestratorMetadata === "function"
+    ? childOrchestratorMetadata
+    : () => childOrchestratorMetadata;
+  if (childOrchestratorMetadata !== null) {
     pi.registerTool({
       name: "contact_supervisor",
       label: "Contact Supervisor",
@@ -116,7 +119,14 @@ export function registerContactSupervisorTool(pi: ExtensionAPI, deps: ContactSup
           };
         }
 
-        const metadata = childOrchestratorMetadata;
+        const metadata = getMetadata();
+        if (!metadata) {
+          return {
+            content: [{ type: "text", text: "Supervisor contact is unavailable for this session" }],
+            isError: true,
+            details: { error: true },
+          };
+        }
         let sendTo: string;
         if (connectedClient.supervisorSessionId || metadata.supervisor) {
           sendTo = connectedClient.supervisorSessionId ?? metadata.supervisor!.supervisorSessionId;

package/dist/builtin/intercom/index-heavy.ts

@@ -15,6 +15,7 @@ import { registerSubagentRelay } from "./subagent-relay.js";
 import { ForegroundDetachHandoff, handleForegroundInboundDelivery } from "./foreground-detach-handoff.js";
 import { routeIncomingReply } from "./reply-routing.js";
 import { INBOUND_FLUSH_DELAY_MS, INBOUND_IDLE_RETRY_MS, buildPresenceIdentity, formatAttachments, readChildOrchestratorMetadata, toError } from "./intercom-utils.js";
+import { readSubagentMessageSource } from "./source-ownership.js";
 import { buildIncomingCustomMessage, createIncomingMessageSender } from "./incoming-message-delivery.js";
 import { InboundIdleQueue } from "./inbound-idle-queue.js";
 import { registerTerminalOrderingBarrier } from "./terminal-ordering-barrier.js";
@@ -46,8 +47,13 @@ export default function piIntercomExtension(pi: ExtensionAPI, testOverrides: Int
   };
   let client: IntercomClient | null = null;
   const config: IntercomConfig = loadConfig();
-  const childOrchestratorMetadata = readChildOrchestratorMetadata();
+  const legacyChildOrchestratorMetadata = readChildOrchestratorMetadata();
   let runtimeContext: ExtensionContext | null = null;
+  function currentChildOrchestratorMetadata() {
+    return runtimeContext?.subagentPolicy !== undefined
+      ? readChildOrchestratorMetadata(runtimeContext.subagentPolicy)
+      : legacyChildOrchestratorMetadata;
+  }
   let currentSessionId: string | null = null;
   let currentModel = "unknown";
   let sessionStartedAt: number | null = null;
@@ -389,8 +395,12 @@ export default function piIntercomExtension(pi: ExtensionAPI, testOverrides: Int
       attachClientHandlers(nextClient);
       try {
         await spawnBrokerIfNeeded(config.brokerCommand, config.brokerArgs);
+        const childMetadata = currentChildOrchestratorMetadata();
         await nextClient.connect(
-          buildRegistration(), childOrchestratorMetadata?.supervisor, supervisorAuthorizations.ownerToken,
+          buildRegistration(),
+          childMetadata?.supervisor,
+          supervisorAuthorizations.ownerToken,
+          readSubagentMessageSource(runtimeContext?.subagentPolicy),
         );
         await supervisorAuthorizations.restore(nextClient);
         if (!getLiveContext(contextAtStart, generationAtStart)) {
@@ -470,7 +480,7 @@ export default function piIntercomExtension(pi: ExtensionAPI, testOverrides: Int
   });
 
   registerContactSupervisorTool(pi, {
-    childOrchestratorMetadata,
+    childOrchestratorMetadata: currentChildOrchestratorMetadata,
     ensureConnected,
     syncPresenceIdentity,
     resolveSessionTarget: resolveSessionTargetId,

package/dist/builtin/intercom/index.ts

@@ -92,10 +92,10 @@ function renderHeavyToolResult(loadedHeavy: CapturedHeavy | null, name: string,
 	return renderIntercomToolResult(name, args);
 }
 export default function intercom(pi: ExtensionAPI, options: LightweightIntercomOptions = {}) {
-	const delegatedSessionName = readSubagentEnv("INTERCOM_SESSION_NAME");
-	let heavyAttempt: HeavyAttempt | null = null;
-	let loadedHeavy: IntercomHeavyHandle | null = null;
-	let sessionSnapshot: SessionSnapshot | null = null;
+  const inheritedDelegatedSessionName = readSubagentEnv("INTERCOM_SESSION_NAME");
+  let heavyAttempt: HeavyAttempt | null = null;
+  let loadedHeavy: IntercomHeavyHandle | null = null;
+  let sessionSnapshot: SessionSnapshot | null = null;
 	let lifecycleGeneration = 0;
 	let nextLeaseId = 1;
 	let activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++);
@@ -229,21 +229,45 @@ export default function intercom(pi: ExtensionAPI, options: LightweightIntercomO
 		);
 		return promise;
 	}
-	pi.on("session_start", async (event, ctx) => {
-		if (delegatedSessionName && typeof pi.setSessionName === "function") pi.setSessionName(delegatedSessionName);
-		if (activeLease.retired) activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++, activeLease.cleanupBarrier);
-		const lease = activeLease;
-		await waitForPriorCleanup(lease);
-		if (sessionSnapshot) {
-			activeLifecycle.turnStart = null;
-			activeLifecycle.agentStart = null;
-			activeLifecycle.activeTools.clear();
-			activeLifecycle.modelSelect = null;
-		}
-		const generation = ++lifecycleGeneration;
-		sessionSnapshot = { event, ctx, generation, lease };
-		if (loadedHeavy) await ensureSessionStartReplayed(loadedHeavy.heavy, lease);
-	});
+  let typedContactSupervisorRegistered = hasSubagentIntercomEnv();
+  const registerTypedContactSupervisor = (): void => {
+    if (typedContactSupervisorRegistered) return;
+    typedContactSupervisorRegistered = true;
+    pi.registerTool({
+      name: "contact_supervisor",
+      label: "Contact Supervisor",
+      description: "Subagent-only tool for contacting the supervisor agent that delegated this task.",
+      promptSnippet: "Subagent-only: contact the supervisor for decisions, interviews, or meaningful updates.",
+      parameters: Type.Object({
+        reason: Type.String({ enum: ["need_decision", "progress_update", "interview_request"] }),
+        message: Type.Optional(Type.String()),
+        interview: Type.Optional(Type.Unknown()),
+      }),
+      execute: (...args) => executeHeavyTool(loadHeavy, "contact_supervisor", args),
+      renderResult: (...args) => renderHeavyToolResult(loadedHeavy?.heavy ?? null, "contact_supervisor", args),
+    });
+  };
+  pi.on("session_start", async (event, ctx) => {
+    const typedIdentity = ctx.subagentPolicy?.intercom;
+    if (typedIdentity) {
+      if (typedIdentity.sessionName && typeof pi.setSessionName === "function") pi.setSessionName(typedIdentity.sessionName);
+      registerTypedContactSupervisor();
+    } else if (inheritedDelegatedSessionName && typeof pi.setSessionName === "function") {
+      pi.setSessionName(inheritedDelegatedSessionName);
+    }
+    if (activeLease.retired) activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++, activeLease.cleanupBarrier);
+    const lease = activeLease;
+    await waitForPriorCleanup(lease);
+    if (sessionSnapshot) {
+      activeLifecycle.turnStart = null;
+      activeLifecycle.agentStart = null;
+      activeLifecycle.activeTools.clear();
+      activeLifecycle.modelSelect = null;
+    }
+    const generation = ++lifecycleGeneration;
+    sessionSnapshot = { event, ctx, generation, lease };
+    if (loadedHeavy) await ensureSessionStartReplayed(loadedHeavy.heavy, lease);
+  });
 	pi.on("session_shutdown", async (event, ctx) => {
 		const lease = activeLease;
 		const generation = ++lifecycleGeneration;

package/dist/builtin/intercom/intercom-utils.ts

@@ -1,5 +1,4 @@
-import type { ExtensionAPI } from "@bastani/atomic";
-import { APP_NAME, getEnvValue } from "@bastani/atomic";
+import { type ExtensionAPI, type SubagentChildPolicy } from "@bastani/atomic";
 import type { Attachment, Message, SessionInfo, SupervisorRegistration } from "./types.js";
 import { DEFAULT_GROUP, normalizeGroup } from "./group.js";
 
@@ -12,14 +11,6 @@ export const SUBAGENT_SUPERVISOR_AUTHORIZATION_EVENT = "subagent:supervisor-auth
 export const INBOUND_FLUSH_DELAY_MS = 200;
 export const INBOUND_IDLE_RETRY_MS = 500;
 export const DEFAULT_UNNAMED_SESSION_ALIAS_PREFIX = "subagent-chat";
-const ENV_PREFIX = APP_NAME.toUpperCase();
-const SUBAGENT_ORCHESTRATOR_TARGET_ENV = `${ENV_PREFIX}_SUBAGENT_ORCHESTRATOR_TARGET`;
-const SUBAGENT_RUN_ID_ENV = `${ENV_PREFIX}_SUBAGENT_RUN_ID`;
-const SUBAGENT_CHILD_AGENT_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_AGENT`;
-const SUBAGENT_CHILD_INDEX_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_INDEX`;
-const SUBAGENT_INTERCOM_SESSION_NAME_ENV = `${ENV_PREFIX}_SUBAGENT_INTERCOM_SESSION_NAME`;
-const SUBAGENT_SUPERVISOR_CAPABILITY_ENV = `${ENV_PREFIX}_SUBAGENT_SUPERVISOR_CAPABILITY`;
-const SUBAGENT_SUPERVISOR_SESSION_ID_ENV = `${ENV_PREFIX}_SUBAGENT_SUPERVISOR_SESSION_ID`;
 
 export interface ChildOrchestratorMetadata {
   orchestratorTarget: string;
@@ -76,28 +67,23 @@ export function formatAttachments(attachments: Attachment[]): string {
   }
   return text;
 }
-export function readChildOrchestratorMetadata(): ChildOrchestratorMetadata | null {
-  const orchestratorTarget = getEnvValue(SUBAGENT_ORCHESTRATOR_TARGET_ENV)?.trim();
-  const runId = getEnvValue(SUBAGENT_RUN_ID_ENV)?.trim();
-  const agent = getEnvValue(SUBAGENT_CHILD_AGENT_ENV)?.trim();
-  const index = getEnvValue(SUBAGENT_CHILD_INDEX_ENV)?.trim();
-  if (!orchestratorTarget || !runId || !agent || !index) {
-    return null;
-  }
-  const sessionName = getEnvValue(SUBAGENT_INTERCOM_SESSION_NAME_ENV)?.trim();
-  const capability = getEnvValue(SUBAGENT_SUPERVISOR_CAPABILITY_ENV)?.trim();
-  const supervisorSessionId = getEnvValue(SUBAGENT_SUPERVISOR_SESSION_ID_ENV)?.trim();
+export function childOrchestratorMetadataFromPolicy(policy?: SubagentChildPolicy): ChildOrchestratorMetadata | null {
+  const identity = policy?.intercom;
+  if (!identity) return null;
   return {
-    orchestratorTarget,
-    runId,
-    agent,
-    index,
-    ...(sessionName ? { sessionName } : {}),
-    ...(capability && supervisorSessionId
-      ? { supervisor: { capability, supervisorSessionId } }
-      : {}),
+    orchestratorTarget: identity.orchestratorTarget,
+    runId: identity.runId,
+    agent: identity.agent,
+    index: String(identity.index),
+    ...(identity.sessionName ? { sessionName: identity.sessionName } : {}),
+    ...(identity.supervisor ? { supervisor: identity.supervisor } : {}),
   };
 }
+
+/** Resolve metadata only from the admission-issued typed child identity. */
+export function readChildOrchestratorMetadata(policy?: SubagentChildPolicy): ChildOrchestratorMetadata | null {
+	return childOrchestratorMetadataFromPolicy(policy);
+}
 export function formatChildOrchestratorMessage(kind: "ask" | "update" | "interview", metadata: ChildOrchestratorMetadata, message: string): string {
   const heading = kind === "ask"
     ? "Subagent needs a supervisor decision."

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.12-alpha.1",
+  "version": "0.9.13-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/intercom/source-ownership.ts

@@ -1,11 +1,6 @@
-import { APP_NAME, getEnvValue } from "@bastani/atomic";
+import { type SubagentChildPolicy } from "@bastani/atomic";
 import type { Message } from "./types.js";
 
-const ENV_PREFIX = APP_NAME.toUpperCase();
-const SUBAGENT_RUN_ID_ENV = `${ENV_PREFIX}_SUBAGENT_RUN_ID`;
-const SUBAGENT_CHILD_AGENT_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_AGENT`;
-const SUBAGENT_CHILD_INDEX_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_INDEX`;
-
 export function buildSubagentMessageSource(
   runIdValue: string | undefined,
   agentValue: string | undefined,
@@ -25,10 +20,12 @@ export function buildSubagentMessageSource(
   };
 }
 
-export function readSubagentMessageSource(): Message["source"] | undefined {
-  return buildSubagentMessageSource(
-    getEnvValue(SUBAGENT_RUN_ID_ENV),
-    getEnvValue(SUBAGENT_CHILD_AGENT_ENV),
-    getEnvValue(SUBAGENT_CHILD_INDEX_ENV),
-  );
+export function readSubagentMessageSource(policy?: SubagentChildPolicy): Message["source"] | undefined {
+	const identity = policy?.intercom;
+	if (!identity) return undefined;
+	return {
+		subagentRunId: identity.runId,
+		subagentAgent: identity.agent,
+		subagentIndex: identity.index,
+	};
 }

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Changed
+
+- In-process subagents now receive MCP direct-tool selection through typed admission policy. Omitted selection preserves MCP configuration defaults, a list selects exact server/tool entries, and an empty list disables direct tools; the process-era environment bridge has been removed ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+## [0.9.12] - 2026-08-04
+
+### Fixed
+
+- Fixed bundled MCP resources failing to load on Windows when shared modules used mixed `.ts` and `.js` import spellings.
+
 ## [0.9.12-alpha.1] - 2026-08-04
 
 ### Fixed

package/dist/builtin/mcp/README.md

@@ -240,7 +240,9 @@ To exclude specific tools while still using `directTools: true`, add `excludeToo
 
 Each direct tool costs ~150-300 tokens in the system prompt (name + description + schema). Good for targeted sets of 5-20 tools. For servers with 75+ tools, stick with the proxy or pick specific tools with a `string[]`.
 
-Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup when the cache is warm. On the first session after adding `directTools` to a new server, or when a child/subagent selects tools through `MCP_DIRECT_TOOLS`, the cache may not exist yet — tools fall back to proxy-only while the selected/configured direct-tool servers populate in the background, then the extension refreshes tool registration so the warmed direct tools become available in the current session. To force it immediately: `/mcp reconnect <server>`.
+Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup when the cache is warm. On the first session after adding `directTools` to a new server, or when a child/subagent selects tools, the cache may not exist yet — tools fall back to proxy-only while the selected/configured direct-tool servers populate in the background, then the extension refreshes tool registration so the warmed direct tools become available in the current session. To force it immediately: `/mcp reconnect <server>`.
+
+In-process subagents receive direct-tool selection through the typed admission policy rather than an environment bridge. An omitted `mcpDirectTools` field preserves the session's MCP configuration defaults, a list selects exactly those server/tool names, and an empty list explicitly disables direct tools. The legacy environment override is removed; parent sessions should use MCP configuration instead.
 
 When you change direct-tool toggles in `/mcp` or write new config through `/mcp setup`, the extension triggers Pi's normal reload flow automatically. That refreshes extensions, prompts, skills, and MCP tool registration in one shot, so newly configured direct tools can appear without a manual restart.
 

package/dist/builtin/mcp/index.ts

@@ -1,4 +1,4 @@
-import type { AgentToolUpdateCallback, ExtensionAPI, ExtensionContext, ToolInfo } from "@bastani/atomic";
+import type { AgentToolUpdateCallback, ExtensionAPI, ExtensionContext, SubagentChildPolicy, ToolInfo } from "@bastani/atomic";
 import type { McpExtensionState } from "./state.js";
 import type { McpConfig } from "./types.ts";
 import type { MetadataCache } from "./metadata-cache.js";
@@ -55,22 +55,15 @@ export default function mcpAdapter(pi: ExtensionAPI) {
   async function registerDirectToolsFromConfig(
     config: McpConfig,
     cache: MetadataCache | null,
+    subagentPolicy?: SubagentChildPolicy,
   ): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
     const [{ resolveDirectTools, createDirectToolExecutor, getMissingConfiguredDirectToolServers }, { truncateAtWord }] = await Promise.all([
       import("./direct-tools.ts"),
       import("./utils.js"),
     ]);
     const prefix = config.settings?.toolPrefix ?? "server";
-    const envRaw = process.env.MCP_DIRECT_TOOLS;
-    const envDirectTools = envRaw?.split(",").map(s => s.trim()).filter(Boolean);
-    const directSpecs = envRaw === "__none__"
-      ? []
-      : resolveDirectTools(
-          config,
-          cache,
-          prefix,
-          envDirectTools,
-        );
+    const directTools = subagentPolicy?.mcpDirectTools;
+    const directSpecs = resolveDirectTools(config, cache, prefix, directTools === undefined ? undefined : [...directTools]);
     for (const spec of directSpecs) {
       if (registeredDirectToolNames.has(spec.prefixedName)) continue;
       registeredDirectToolNames.add(spec.prefixedName);
@@ -92,13 +85,13 @@ export default function mcpAdapter(pi: ExtensionAPI) {
     refreshTools?.();
     return {
       directToolCount: directSpecs.length,
-      missingConfiguredDirectToolServers: getMissingConfiguredDirectToolServers(config, cache, envDirectTools),
+      missingConfiguredDirectToolServers: getMissingConfiguredDirectToolServers(config, cache, directTools),
     };
   }
 
-  async function registerDirectTools(nextState: McpExtensionState): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
+  async function registerDirectTools(nextState: McpExtensionState, subagentPolicy?: SubagentChildPolicy): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
     const { loadMetadataCache } = await import("./metadata-cache.js");
-    return registerDirectToolsFromConfig(nextState.config, loadMetadataCache());
+    return registerDirectToolsFromConfig(nextState.config, loadMetadataCache(), subagentPolicy);
   }
 
   async function shutdownOAuthFlow(reason: string): Promise<void> {
@@ -196,7 +189,7 @@ export default function mcpAdapter(pi: ExtensionAPI) {
         throw new Error(`${STALE_INITIALIZATION_PREFIX} after startup`);
       }
 
-      const directToolState = await registerDirectTools(initializedState);
+      const directToolState = await registerDirectTools(initializedState, session.ctx.subagentPolicy);
       if (!isCurrentSession(session) || initPromise !== expectedPromise.current) {
         throw new Error(`${STALE_INITIALIZATION_PREFIX} after tool registration`);
       }
@@ -211,10 +204,11 @@ export default function mcpAdapter(pi: ExtensionAPI) {
       updateStatusBar(initializedState);
       let cancelWarmup: (() => void) | null = null;
       const warmup = scheduleMcpStartupWarmup(initializedState, {
+        subagentPolicy: session.ctx.subagentPolicy,
         shouldContinue: () => isCurrentSession(session) && state === initializedState,
         onDirectToolsChanged: async () => {
           if (!isCurrentSession(session) || state !== initializedState) return;
-          await registerDirectTools(initializedState);
+          await registerDirectTools(initializedState, session.ctx.subagentPolicy);
         },
         onSettled: () => {
           if (isCurrentSession(session) && state === initializedState && startupWarmupCancel === cancelWarmup) {

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.12-alpha.1",
+  "version": "0.9.13-alpha.1",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/mcp/startup-warmup.ts

@@ -1,3 +1,4 @@
+import type { SubagentChildPolicy } from "@bastani/atomic";
 import type { McpExtensionState } from "./state.js";
 import { getMissingConfiguredDirectToolServers } from "./direct-tools.ts";
 import { loadMetadataCache } from "./metadata-cache.js";
@@ -7,9 +8,11 @@ import { logger } from "./logger.ts";
 import { updateMetadataCache, updateStatusBar } from "./init.js";
 
 export interface McpStartupWarmupOptions {
-  shouldContinue?: () => boolean;
-  onDirectToolsChanged?: () => void | Promise<void>;
-  onSettled?: () => void;
+	/** Typed child selection issued during in-process admission. */
+	subagentPolicy?: SubagentChildPolicy;
+	shouldContinue?: () => boolean;
+	onDirectToolsChanged?: () => void | Promise<void>;
+	onSettled?: () => void;
 }
 
 export interface McpStartupWarmupHandle {
@@ -17,6 +20,17 @@ export interface McpStartupWarmupHandle {
   cancel(): void;
 }
 
+export interface McpDirectToolsSelection {
+  readonly disabled: boolean;
+  readonly tools?: readonly string[];
+}
+
+/** Resolve direct-tool selection exclusively from typed admission policy. */
+export function resolveMcpDirectToolsSelection(subagentPolicy?: SubagentChildPolicy): McpDirectToolsSelection {
+	const tools = subagentPolicy?.mcpDirectTools;
+	return { disabled: tools !== undefined && tools.length === 0, ...(tools === undefined ? {} : { tools: [...tools] }) };
+}
+
 function deferToMacrotask(): Promise<void> {
   return new Promise((resolve) => setImmediate(resolve));
 }
@@ -31,12 +45,10 @@ export function scheduleMcpStartupWarmup(
   const promise = (async () => {
     await deferToMacrotask();
     if (!shouldContinue()) return;
+    const selection = resolveMcpDirectToolsSelection(options.subagentPolicy);
+    if (selection.disabled) return;
 
-    const envDirect = process.env.MCP_DIRECT_TOOLS;
-    if (envDirect === "__none__") return;
-
-    const envDirectTools = envDirect?.split(",").map((item) => item.trim()).filter(Boolean);
-    const missingCacheServers = getMissingConfiguredDirectToolServers(state.config, loadMetadataCache(), envDirectTools)
+    const missingCacheServers = getMissingConfiguredDirectToolServers(state.config, loadMetadataCache(), selection.tools)
       .filter((name) => state.manager.getConnection(name)?.status !== "connected");
     if (missingCacheServers.length === 0) return;