@bastani/atomic 0.9.12 → 0.9.13-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Added
+
+- `CreateAgentSessionOptions` and `ExtensionContext` now carry an immutable typed subagent child capability policy for in-process tool registration ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- `CreateAgentSessionOptions` now supports construction-time system-prompt and inherited-context transforms, allowing in-process child sessions to apply typed policy without extension injection ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Changed
+
+- Typed child policy now includes MCP direct-tool selection and admission-issued Intercom identity/capability, allowing in-process extensions to consume child policy without inheritable environment state ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Bundled subagent launches now use in-process `AgentSession` children with typed admission, canonical identities, and live async continuation; `async: true` work is owned by the parent process and does not survive parent exit ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Fixed
+
+- Workflow runs awaiting human input now use the blue `？` indicator in the BACKGROUND panel, `/workflow connect` picker, and `/workflow status` listing, including prompts raised by hidden nested workflow children; the indicator returns to the run's current state when the prompt resolves.
+- Fixed main-chat model fallback to classify provider failures consistently with workflows, advance rejected credentials and incompatible or unavailable models to the next candidate, and restore the user-selected model at the next turn without overriding an explicit `/model` choice. A failure that requesting the same model again cannot repair now takes that model out of the chain for the rest of the turn at every reasoning level, so a fallback entry differing only by its `:low`/`:high` suffix is skipped instead of retrying the same dead credential; transient rate-limit and transport failures keep those reasoning variants ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+- Fixed a context overflow that compaction cannot resolve to advance the configured `fallbackModels` chain instead of ending the turn, so a larger-context candidate can answer. Compaction still runs first, and a compactable overflow spends no fallback candidate ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+- Fixed a reasoning-level change during a model fallback stranding the session on the fallback model. Changing reasoning effort is not a model choice, so it no longer cancels the pending restore; the next turn returns to the user-selected primary and keeps the reasoning level that was chosen. Only an explicit `/model` selection or model cycle cancels the restore ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+- Fixed gRPC `ResourceExhausted` provider errors, seen from providers such as NVIDIA NIM, bypassing the same-model auto-retry budget. They are now retried like other transient provider failures, matching upstream pi-ai, and still advance a configured fallback chain when the retries are exhausted ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+
 ## [0.9.12] - 2026-08-04
 
 Cumulative release of the `0.9.12-alpha.1` prerelease. The summary below covers the user-visible outcome of that work; the per-change detail remains in the prerelease section below.

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Changed
+
+- In-process child identities and supervisor capabilities now arrive through typed admission policy and are captured on each `IntercomClient` at connect time instead of being read from environment for every message. Descendants cannot inherit a parent's supervisor grant through process environment; legacy Atomic/Pi bridge metadata remains available for older hosts ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
 ## [0.9.12] - 2026-08-04
 
 ### Fixed

package/dist/builtin/intercom/README.md

@@ -20,7 +20,7 @@ Sometimes you're running multiple Atomic/pi sessions — one researching, one ex
 
 Unlike pi-messenger (a shared chat room for multi-agent swarms), intercom is for targeted 1:1 communication where you pick the recipient.
 
-Intercom also integrates with delegated subagents: child agents get a child-only `contact_supervisor` tool when subagent bridge metadata is present. Atomic-prefixed bridge environment variables are supported, and legacy `PI_*` bridge metadata remains compatible. Atomic's subagent bridge also obtains a broker capability that binds the child session to the exact supervisor; client-authored channel flags are never trusted as cross-group authority. Use `reason: "need_decision"` for blocking clarification, `reason: "interview_request"` for multiple structured supervisor answers, and `reason: "progress_update"` for meaningful plan-changing updates. Normal sessions only see the regular `intercom` tool.
+Intercom also integrates with delegated subagents: in-process children receive a typed admission-issued identity for `contact_supervisor`, including their canonical run/agent/index metadata and any supervisor capability. The child identity is bound to its `IntercomClient` when it connects, so each message uses the same client-owned source and a descendant cannot inherit a parent's capability through process environment. Atomic-prefixed bridge environment variables and legacy `PI_*` metadata remain compatible for older integrations only. Use `reason: "need_decision"` for blocking clarification, `reason: "interview_request"` for multiple structured supervisor answers, and `reason: "progress_update"` for meaningful plan-changing updates. Normal sessions only see the regular `intercom` tool.
 
 ## In One Minute
 
@@ -227,20 +227,13 @@ The planner typically uses `send`. If you prefer manual approval for outgoing no
 
 ## Workflow: Subagent-to-Supervisor Escalation
 
-This workflow requires [`pi-subagents`](https://github.com/nicobailon/pi-subagents) to be installed and to supply child bridge metadata. When `pi-subagents` spawns a delegated child with that metadata, the child session gets a subagent-only `contact_supervisor` tool in addition to the regular `intercom` tool. Normal sessions never see `contact_supervisor`.
+This workflow uses Atomic's in-process subagent admission. When the runtime admits a delegated child with supervisor coordination, the child session gets a subagent-only `contact_supervisor` tool in addition to the regular `intercom` tool. Normal sessions never see `contact_supervisor`.
 
 ### When the Tool Appears
 
-`contact_supervisor` only registers when `pi-subagents` sets all of these environment variables:
+`contact_supervisor` is registered from the typed admission record. The record binds the supervisor target, canonical child identity, child index, session name, and broker-issued capability to the child session; these values are not inherited from environment variables. If the parent does not grant supervisor coordination, the session falls back to the regular `intercom` tool.
 
-- `PI_SUBAGENT_ORCHESTRATOR_TARGET` — the supervisor session name or ID
-- `PI_SUBAGENT_RUN_ID` — the run identifier
-- `PI_SUBAGENT_CHILD_AGENT` — the agent type
-- `PI_SUBAGENT_CHILD_INDEX` — the child index within the run
-
-Atomic's bundled subagent bridge additionally supplies internal `ATOMIC_SUBAGENT_SUPERVISOR_CAPABILITY` and `ATOMIC_SUBAGENT_SUPERVISOR_SESSION_ID` values issued by the broker. They are not user-configurable authentication flags: the broker accepts the capability only for the child scope and supervisor session that requested it, and the parent restores the same secret if the broker reconnects. Legacy `PI_*` aliases remain readable where applicable.
-
-If any are missing, the session falls back to the regular `intercom` tool.
+The child identity remains stable across foreground continuation, `async: true`, interruption, and cold resume. Intercom detach uses the same in-process continuation as async work, so the jobs widget and terminal envelope retain one canonical path.
 
 ### Three Reasons
 
@@ -254,7 +247,7 @@ Do not use `contact_supervisor` for routine completion handoffs. Return the fina
 
 Cross-group delivery uses a dedicated broker protocol. Ordinary raw `send` frames always remain group-isolated and are rejected if they include a forged `channel: "supervisor"` marker. A child can cross groups only after its broker-issued capability has bound its registered socket to the exact supervisor. The broker adds the `supervisor` channel marker to validated inbound traffic so parent relays can distinguish it. Replies cross back only when `replyTo` matches a recorded supervisor message in the exact reverse direction; fabricated thread IDs do not bypass isolation.
 
-During a foreground subagent run, Atomic probes for an exact live foreground owner before delivery. The matching child reserves the request, accepts a generation-scoped detach commit, and acknowledges it before asks, sends, decisions, interviews, and progress updates enter the parent's model-visible steering queue. A busy workflow stage first reserves the message in its AgentSession generation boundary, then waits inside that admission for the same detach handshake before model-visible queue insertion. This prevents terminal stage close from overtaking the handshake while still preventing the active subagent tool from blocking the child request that would release it; unclaimed traffic and a still-current receiver whose owner disappears before commit fall back to ordinary queue insertion. One accepted commit releases foreground supervision for every active member of a parallel group while retaining each child process and eventual result. Blocking calls remain alive until the parent sends the exact threaded reply; fire-and-forget calls create no reply waiter. Background and unmatched traffic for ordinary sessions keeps queued-until-idle behavior, and generation cancellation/replacement invalidates stale handshakes.
+During a foreground subagent run, Atomic probes for an exact live foreground owner before delivery. The matching child reserves the request, accepts a generation-scoped detach commit, and acknowledges it before asks, sends, decisions, interviews, and progress updates enter the parent's model-visible steering queue. A busy workflow stage first reserves the message in its AgentSession generation boundary, then waits inside that admission for the same detach handshake before model-visible queue insertion. This prevents terminal stage close from overtaking the handshake while still preventing the active subagent tool from blocking the child request that would release it; unclaimed traffic and a still-current receiver whose owner disappears before commit fall back to ordinary queue insertion. One accepted commit releases foreground supervision for every active member of a parallel group while retaining each in-process session and eventual result. Blocking calls remain alive until the parent sends the exact threaded reply; fire-and-forget calls create no reply waiter. Background and unmatched traffic for ordinary sessions keeps queued-until-idle behavior, and generation cancellation/replacement invalidates stale handshakes.
 
 ### Example: Blocked Subagent Asks for Guidance
 

package/dist/builtin/intercom/broker/client.ts

@@ -38,6 +38,8 @@ export class IntercomClient extends EventEmitter {
   private socket: net.Socket | null = null;
   private _sessionId: string | null = null;
   private _supervisorSessionId: string | null = null;
+  /** Source identity is captured once at connect, never read from env per message. */
+  private _messageSource: Message["source"] | undefined;
   private pendingSends = new PendingSendRegistry();
   private pendingLists = new Map<string, { resolve: (sessions: SessionInfo[]) => void; reject: (e: Error) => void }>();
   private pendingSupervisorAuthorizations = new Map<string, {
@@ -85,10 +87,16 @@ export class IntercomClient extends EventEmitter {
     return socket;
   }
 
-  connect(session: Omit<SessionInfo, "id">, supervisor?: SupervisorRegistration, supervisorOwnerToken?: string): Promise<void> {
+  connect(
+    session: Omit<SessionInfo, "id">,
+    supervisor?: SupervisorRegistration,
+    supervisorOwnerToken?: string,
+    messageSource?: Message["source"],
+  ): Promise<void> {
     if (this.socket) {
       return Promise.reject(new Error("Already connected"));
     }
+    this._messageSource = messageSource ?? readSubagentMessageSource();
 
     return new Promise((resolve, reject) => {
       const socket = net.connect(BROKER_SOCKET);
@@ -141,6 +149,7 @@ export class IntercomClient extends EventEmitter {
         }
         this._sessionId = null;
         this._supervisorSessionId = null;
+        this._messageSource = undefined;
         this.disconnectError = null;
         if (connectionEstablished && !wasDisconnecting) {
           this.emit("disconnected", disconnectError);
@@ -463,7 +472,7 @@ export class IntercomClient extends EventEmitter {
       replyTo: options.replyTo,
       expectsReply: options.expectsReply,
       replyError: options.replyError,
-      source: readSubagentMessageSource(),
+      source: this._messageSource,
       content: { text: options.text, attachments: options.attachments },
     };
     try {

package/dist/builtin/intercom/contact-supervisor-tool.ts

@@ -19,7 +19,7 @@ import {
 } from "./intercom-utils.js";
 
 interface ContactSupervisorDeps {
-  childOrchestratorMetadata: ChildOrchestratorMetadata | null;
+  childOrchestratorMetadata: ChildOrchestratorMetadata | null | (() => ChildOrchestratorMetadata | null);
   ensureConnected(reason: "tool"): Promise<IntercomClient>;
   syncPresenceIdentity(sessionId: string): void;
   resolveSessionTarget(activeClient: IntercomClient, nameOrId: string): Promise<string | null>;
@@ -35,7 +35,10 @@ interface ContactSupervisorDeps {
 
 export function registerContactSupervisorTool(pi: ExtensionAPI, deps: ContactSupervisorDeps): void {
   const { childOrchestratorMetadata, ensureConnected, syncPresenceIdentity, resolveSessionTarget, beginReplyWait, hasReplyWaiter } = deps;
-  if (childOrchestratorMetadata) {
+  const getMetadata = typeof childOrchestratorMetadata === "function"
+    ? childOrchestratorMetadata
+    : () => childOrchestratorMetadata;
+  if (childOrchestratorMetadata !== null) {
     pi.registerTool({
       name: "contact_supervisor",
       label: "Contact Supervisor",
@@ -116,7 +119,14 @@ export function registerContactSupervisorTool(pi: ExtensionAPI, deps: ContactSup
           };
         }
 
-        const metadata = childOrchestratorMetadata;
+        const metadata = getMetadata();
+        if (!metadata) {
+          return {
+            content: [{ type: "text", text: "Supervisor contact is unavailable for this session" }],
+            isError: true,
+            details: { error: true },
+          };
+        }
         let sendTo: string;
         if (connectedClient.supervisorSessionId || metadata.supervisor) {
           sendTo = connectedClient.supervisorSessionId ?? metadata.supervisor!.supervisorSessionId;

package/dist/builtin/intercom/index-heavy.ts

@@ -15,6 +15,7 @@ import { registerSubagentRelay } from "./subagent-relay.js";
 import { ForegroundDetachHandoff, handleForegroundInboundDelivery } from "./foreground-detach-handoff.js";
 import { routeIncomingReply } from "./reply-routing.js";
 import { INBOUND_FLUSH_DELAY_MS, INBOUND_IDLE_RETRY_MS, buildPresenceIdentity, formatAttachments, readChildOrchestratorMetadata, toError } from "./intercom-utils.js";
+import { readSubagentMessageSource } from "./source-ownership.js";
 import { buildIncomingCustomMessage, createIncomingMessageSender } from "./incoming-message-delivery.js";
 import { InboundIdleQueue } from "./inbound-idle-queue.js";
 import { registerTerminalOrderingBarrier } from "./terminal-ordering-barrier.js";
@@ -46,8 +47,13 @@ export default function piIntercomExtension(pi: ExtensionAPI, testOverrides: Int
   };
   let client: IntercomClient | null = null;
   const config: IntercomConfig = loadConfig();
-  const childOrchestratorMetadata = readChildOrchestratorMetadata();
+  const legacyChildOrchestratorMetadata = readChildOrchestratorMetadata();
   let runtimeContext: ExtensionContext | null = null;
+  function currentChildOrchestratorMetadata() {
+    return runtimeContext?.subagentPolicy !== undefined
+      ? readChildOrchestratorMetadata(runtimeContext.subagentPolicy)
+      : legacyChildOrchestratorMetadata;
+  }
   let currentSessionId: string | null = null;
   let currentModel = "unknown";
   let sessionStartedAt: number | null = null;
@@ -389,8 +395,12 @@ export default function piIntercomExtension(pi: ExtensionAPI, testOverrides: Int
       attachClientHandlers(nextClient);
       try {
         await spawnBrokerIfNeeded(config.brokerCommand, config.brokerArgs);
+        const childMetadata = currentChildOrchestratorMetadata();
         await nextClient.connect(
-          buildRegistration(), childOrchestratorMetadata?.supervisor, supervisorAuthorizations.ownerToken,
+          buildRegistration(),
+          childMetadata?.supervisor,
+          supervisorAuthorizations.ownerToken,
+          readSubagentMessageSource(runtimeContext?.subagentPolicy),
         );
         await supervisorAuthorizations.restore(nextClient);
         if (!getLiveContext(contextAtStart, generationAtStart)) {
@@ -470,7 +480,7 @@ export default function piIntercomExtension(pi: ExtensionAPI, testOverrides: Int
   });
 
   registerContactSupervisorTool(pi, {
-    childOrchestratorMetadata,
+    childOrchestratorMetadata: currentChildOrchestratorMetadata,
     ensureConnected,
     syncPresenceIdentity,
     resolveSessionTarget: resolveSessionTargetId,

package/dist/builtin/intercom/index.ts

@@ -92,10 +92,10 @@ function renderHeavyToolResult(loadedHeavy: CapturedHeavy | null, name: string,
 	return renderIntercomToolResult(name, args);
 }
 export default function intercom(pi: ExtensionAPI, options: LightweightIntercomOptions = {}) {
-	const delegatedSessionName = readSubagentEnv("INTERCOM_SESSION_NAME");
-	let heavyAttempt: HeavyAttempt | null = null;
-	let loadedHeavy: IntercomHeavyHandle | null = null;
-	let sessionSnapshot: SessionSnapshot | null = null;
+  const inheritedDelegatedSessionName = readSubagentEnv("INTERCOM_SESSION_NAME");
+  let heavyAttempt: HeavyAttempt | null = null;
+  let loadedHeavy: IntercomHeavyHandle | null = null;
+  let sessionSnapshot: SessionSnapshot | null = null;
 	let lifecycleGeneration = 0;
 	let nextLeaseId = 1;
 	let activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++);
@@ -229,21 +229,45 @@ export default function intercom(pi: ExtensionAPI, options: LightweightIntercomO
 		);
 		return promise;
 	}
-	pi.on("session_start", async (event, ctx) => {
-		if (delegatedSessionName && typeof pi.setSessionName === "function") pi.setSessionName(delegatedSessionName);
-		if (activeLease.retired) activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++, activeLease.cleanupBarrier);
-		const lease = activeLease;
-		await waitForPriorCleanup(lease);
-		if (sessionSnapshot) {
-			activeLifecycle.turnStart = null;
-			activeLifecycle.agentStart = null;
-			activeLifecycle.activeTools.clear();
-			activeLifecycle.modelSelect = null;
-		}
-		const generation = ++lifecycleGeneration;
-		sessionSnapshot = { event, ctx, generation, lease };
-		if (loadedHeavy) await ensureSessionStartReplayed(loadedHeavy.heavy, lease);
-	});
+  let typedContactSupervisorRegistered = hasSubagentIntercomEnv();
+  const registerTypedContactSupervisor = (): void => {
+    if (typedContactSupervisorRegistered) return;
+    typedContactSupervisorRegistered = true;
+    pi.registerTool({
+      name: "contact_supervisor",
+      label: "Contact Supervisor",
+      description: "Subagent-only tool for contacting the supervisor agent that delegated this task.",
+      promptSnippet: "Subagent-only: contact the supervisor for decisions, interviews, or meaningful updates.",
+      parameters: Type.Object({
+        reason: Type.String({ enum: ["need_decision", "progress_update", "interview_request"] }),
+        message: Type.Optional(Type.String()),
+        interview: Type.Optional(Type.Unknown()),
+      }),
+      execute: (...args) => executeHeavyTool(loadHeavy, "contact_supervisor", args),
+      renderResult: (...args) => renderHeavyToolResult(loadedHeavy?.heavy ?? null, "contact_supervisor", args),
+    });
+  };
+  pi.on("session_start", async (event, ctx) => {
+    const typedIdentity = ctx.subagentPolicy?.intercom;
+    if (typedIdentity) {
+      if (typedIdentity.sessionName && typeof pi.setSessionName === "function") pi.setSessionName(typedIdentity.sessionName);
+      registerTypedContactSupervisor();
+    } else if (inheritedDelegatedSessionName && typeof pi.setSessionName === "function") {
+      pi.setSessionName(inheritedDelegatedSessionName);
+    }
+    if (activeLease.retired) activeLease = createLifecycleLease<ShutdownSnapshot>(nextLeaseId++, activeLease.cleanupBarrier);
+    const lease = activeLease;
+    await waitForPriorCleanup(lease);
+    if (sessionSnapshot) {
+      activeLifecycle.turnStart = null;
+      activeLifecycle.agentStart = null;
+      activeLifecycle.activeTools.clear();
+      activeLifecycle.modelSelect = null;
+    }
+    const generation = ++lifecycleGeneration;
+    sessionSnapshot = { event, ctx, generation, lease };
+    if (loadedHeavy) await ensureSessionStartReplayed(loadedHeavy.heavy, lease);
+  });
 	pi.on("session_shutdown", async (event, ctx) => {
 		const lease = activeLease;
 		const generation = ++lifecycleGeneration;

package/dist/builtin/intercom/intercom-utils.ts

@@ -1,5 +1,4 @@
-import type { ExtensionAPI } from "@bastani/atomic";
-import { APP_NAME, getEnvValue } from "@bastani/atomic";
+import { type ExtensionAPI, type SubagentChildPolicy } from "@bastani/atomic";
 import type { Attachment, Message, SessionInfo, SupervisorRegistration } from "./types.js";
 import { DEFAULT_GROUP, normalizeGroup } from "./group.js";
 
@@ -12,14 +11,6 @@ export const SUBAGENT_SUPERVISOR_AUTHORIZATION_EVENT = "subagent:supervisor-auth
 export const INBOUND_FLUSH_DELAY_MS = 200;
 export const INBOUND_IDLE_RETRY_MS = 500;
 export const DEFAULT_UNNAMED_SESSION_ALIAS_PREFIX = "subagent-chat";
-const ENV_PREFIX = APP_NAME.toUpperCase();
-const SUBAGENT_ORCHESTRATOR_TARGET_ENV = `${ENV_PREFIX}_SUBAGENT_ORCHESTRATOR_TARGET`;
-const SUBAGENT_RUN_ID_ENV = `${ENV_PREFIX}_SUBAGENT_RUN_ID`;
-const SUBAGENT_CHILD_AGENT_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_AGENT`;
-const SUBAGENT_CHILD_INDEX_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_INDEX`;
-const SUBAGENT_INTERCOM_SESSION_NAME_ENV = `${ENV_PREFIX}_SUBAGENT_INTERCOM_SESSION_NAME`;
-const SUBAGENT_SUPERVISOR_CAPABILITY_ENV = `${ENV_PREFIX}_SUBAGENT_SUPERVISOR_CAPABILITY`;
-const SUBAGENT_SUPERVISOR_SESSION_ID_ENV = `${ENV_PREFIX}_SUBAGENT_SUPERVISOR_SESSION_ID`;
 
 export interface ChildOrchestratorMetadata {
   orchestratorTarget: string;
@@ -76,28 +67,23 @@ export function formatAttachments(attachments: Attachment[]): string {
   }
   return text;
 }
-export function readChildOrchestratorMetadata(): ChildOrchestratorMetadata | null {
-  const orchestratorTarget = getEnvValue(SUBAGENT_ORCHESTRATOR_TARGET_ENV)?.trim();
-  const runId = getEnvValue(SUBAGENT_RUN_ID_ENV)?.trim();
-  const agent = getEnvValue(SUBAGENT_CHILD_AGENT_ENV)?.trim();
-  const index = getEnvValue(SUBAGENT_CHILD_INDEX_ENV)?.trim();
-  if (!orchestratorTarget || !runId || !agent || !index) {
-    return null;
-  }
-  const sessionName = getEnvValue(SUBAGENT_INTERCOM_SESSION_NAME_ENV)?.trim();
-  const capability = getEnvValue(SUBAGENT_SUPERVISOR_CAPABILITY_ENV)?.trim();
-  const supervisorSessionId = getEnvValue(SUBAGENT_SUPERVISOR_SESSION_ID_ENV)?.trim();
+export function childOrchestratorMetadataFromPolicy(policy?: SubagentChildPolicy): ChildOrchestratorMetadata | null {
+  const identity = policy?.intercom;
+  if (!identity) return null;
   return {
-    orchestratorTarget,
-    runId,
-    agent,
-    index,
-    ...(sessionName ? { sessionName } : {}),
-    ...(capability && supervisorSessionId
-      ? { supervisor: { capability, supervisorSessionId } }
-      : {}),
+    orchestratorTarget: identity.orchestratorTarget,
+    runId: identity.runId,
+    agent: identity.agent,
+    index: String(identity.index),
+    ...(identity.sessionName ? { sessionName: identity.sessionName } : {}),
+    ...(identity.supervisor ? { supervisor: identity.supervisor } : {}),
   };
 }
+
+/** Resolve metadata only from the admission-issued typed child identity. */
+export function readChildOrchestratorMetadata(policy?: SubagentChildPolicy): ChildOrchestratorMetadata | null {
+	return childOrchestratorMetadataFromPolicy(policy);
+}
 export function formatChildOrchestratorMessage(kind: "ask" | "update" | "interview", metadata: ChildOrchestratorMetadata, message: string): string {
   const heading = kind === "ask"
     ? "Subagent needs a supervisor decision."

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.12",
+  "version": "0.9.13-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/intercom/source-ownership.ts

@@ -1,11 +1,6 @@
-import { APP_NAME, getEnvValue } from "@bastani/atomic";
+import { type SubagentChildPolicy } from "@bastani/atomic";
 import type { Message } from "./types.js";
 
-const ENV_PREFIX = APP_NAME.toUpperCase();
-const SUBAGENT_RUN_ID_ENV = `${ENV_PREFIX}_SUBAGENT_RUN_ID`;
-const SUBAGENT_CHILD_AGENT_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_AGENT`;
-const SUBAGENT_CHILD_INDEX_ENV = `${ENV_PREFIX}_SUBAGENT_CHILD_INDEX`;
-
 export function buildSubagentMessageSource(
   runIdValue: string | undefined,
   agentValue: string | undefined,
@@ -25,10 +20,12 @@ export function buildSubagentMessageSource(
   };
 }
 
-export function readSubagentMessageSource(): Message["source"] | undefined {
-  return buildSubagentMessageSource(
-    getEnvValue(SUBAGENT_RUN_ID_ENV),
-    getEnvValue(SUBAGENT_CHILD_AGENT_ENV),
-    getEnvValue(SUBAGENT_CHILD_INDEX_ENV),
-  );
+export function readSubagentMessageSource(policy?: SubagentChildPolicy): Message["source"] | undefined {
+	const identity = policy?.intercom;
+	if (!identity) return undefined;
+	return {
+		subagentRunId: identity.runId,
+		subagentAgent: identity.agent,
+		subagentIndex: identity.index,
+	};
 }

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Changed
+
+- In-process subagents now receive MCP direct-tool selection through typed admission policy. Omitted selection preserves MCP configuration defaults, a list selects exact server/tool entries, and an empty list disables direct tools; the process-era environment bridge has been removed ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
 ## [0.9.12] - 2026-08-04
 
 ### Fixed

package/dist/builtin/mcp/README.md

@@ -240,7 +240,9 @@ To exclude specific tools while still using `directTools: true`, add `excludeToo
 
 Each direct tool costs ~150-300 tokens in the system prompt (name + description + schema). Good for targeted sets of 5-20 tools. For servers with 75+ tools, stick with the proxy or pick specific tools with a `string[]`.
 
-Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup when the cache is warm. On the first session after adding `directTools` to a new server, or when a child/subagent selects tools through `MCP_DIRECT_TOOLS`, the cache may not exist yet — tools fall back to proxy-only while the selected/configured direct-tool servers populate in the background, then the extension refreshes tool registration so the warmed direct tools become available in the current session. To force it immediately: `/mcp reconnect <server>`.
+Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup when the cache is warm. On the first session after adding `directTools` to a new server, or when a child/subagent selects tools, the cache may not exist yet — tools fall back to proxy-only while the selected/configured direct-tool servers populate in the background, then the extension refreshes tool registration so the warmed direct tools become available in the current session. To force it immediately: `/mcp reconnect <server>`.
+
+In-process subagents receive direct-tool selection through the typed admission policy rather than an environment bridge. An omitted `mcpDirectTools` field preserves the session's MCP configuration defaults, a list selects exactly those server/tool names, and an empty list explicitly disables direct tools. The legacy environment override is removed; parent sessions should use MCP configuration instead.
 
 When you change direct-tool toggles in `/mcp` or write new config through `/mcp setup`, the extension triggers Pi's normal reload flow automatically. That refreshes extensions, prompts, skills, and MCP tool registration in one shot, so newly configured direct tools can appear without a manual restart.
 

package/dist/builtin/mcp/index.ts

@@ -1,4 +1,4 @@
-import type { AgentToolUpdateCallback, ExtensionAPI, ExtensionContext, ToolInfo } from "@bastani/atomic";
+import type { AgentToolUpdateCallback, ExtensionAPI, ExtensionContext, SubagentChildPolicy, ToolInfo } from "@bastani/atomic";
 import type { McpExtensionState } from "./state.js";
 import type { McpConfig } from "./types.ts";
 import type { MetadataCache } from "./metadata-cache.js";
@@ -55,22 +55,15 @@ export default function mcpAdapter(pi: ExtensionAPI) {
   async function registerDirectToolsFromConfig(
     config: McpConfig,
     cache: MetadataCache | null,
+    subagentPolicy?: SubagentChildPolicy,
   ): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
     const [{ resolveDirectTools, createDirectToolExecutor, getMissingConfiguredDirectToolServers }, { truncateAtWord }] = await Promise.all([
       import("./direct-tools.ts"),
       import("./utils.js"),
     ]);
     const prefix = config.settings?.toolPrefix ?? "server";
-    const envRaw = process.env.MCP_DIRECT_TOOLS;
-    const envDirectTools = envRaw?.split(",").map(s => s.trim()).filter(Boolean);
-    const directSpecs = envRaw === "__none__"
-      ? []
-      : resolveDirectTools(
-          config,
-          cache,
-          prefix,
-          envDirectTools,
-        );
+    const directTools = subagentPolicy?.mcpDirectTools;
+    const directSpecs = resolveDirectTools(config, cache, prefix, directTools === undefined ? undefined : [...directTools]);
     for (const spec of directSpecs) {
       if (registeredDirectToolNames.has(spec.prefixedName)) continue;
       registeredDirectToolNames.add(spec.prefixedName);
@@ -92,13 +85,13 @@ export default function mcpAdapter(pi: ExtensionAPI) {
     refreshTools?.();
     return {
       directToolCount: directSpecs.length,
-      missingConfiguredDirectToolServers: getMissingConfiguredDirectToolServers(config, cache, envDirectTools),
+      missingConfiguredDirectToolServers: getMissingConfiguredDirectToolServers(config, cache, directTools),
     };
   }
 
-  async function registerDirectTools(nextState: McpExtensionState): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
+  async function registerDirectTools(nextState: McpExtensionState, subagentPolicy?: SubagentChildPolicy): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
     const { loadMetadataCache } = await import("./metadata-cache.js");
-    return registerDirectToolsFromConfig(nextState.config, loadMetadataCache());
+    return registerDirectToolsFromConfig(nextState.config, loadMetadataCache(), subagentPolicy);
   }
 
   async function shutdownOAuthFlow(reason: string): Promise<void> {
@@ -196,7 +189,7 @@ export default function mcpAdapter(pi: ExtensionAPI) {
         throw new Error(`${STALE_INITIALIZATION_PREFIX} after startup`);
       }
 
-      const directToolState = await registerDirectTools(initializedState);
+      const directToolState = await registerDirectTools(initializedState, session.ctx.subagentPolicy);
       if (!isCurrentSession(session) || initPromise !== expectedPromise.current) {
         throw new Error(`${STALE_INITIALIZATION_PREFIX} after tool registration`);
       }
@@ -211,10 +204,11 @@ export default function mcpAdapter(pi: ExtensionAPI) {
       updateStatusBar(initializedState);
       let cancelWarmup: (() => void) | null = null;
       const warmup = scheduleMcpStartupWarmup(initializedState, {
+        subagentPolicy: session.ctx.subagentPolicy,
         shouldContinue: () => isCurrentSession(session) && state === initializedState,
         onDirectToolsChanged: async () => {
           if (!isCurrentSession(session) || state !== initializedState) return;
-          await registerDirectTools(initializedState);
+          await registerDirectTools(initializedState, session.ctx.subagentPolicy);
         },
         onSettled: () => {
           if (isCurrentSession(session) && state === initializedState && startupWarmupCancel === cancelWarmup) {

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.12",
+  "version": "0.9.13-alpha.1",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/mcp/startup-warmup.ts

@@ -1,3 +1,4 @@
+import type { SubagentChildPolicy } from "@bastani/atomic";
 import type { McpExtensionState } from "./state.js";
 import { getMissingConfiguredDirectToolServers } from "./direct-tools.ts";
 import { loadMetadataCache } from "./metadata-cache.js";
@@ -7,9 +8,11 @@ import { logger } from "./logger.ts";
 import { updateMetadataCache, updateStatusBar } from "./init.js";
 
 export interface McpStartupWarmupOptions {
-  shouldContinue?: () => boolean;
-  onDirectToolsChanged?: () => void | Promise<void>;
-  onSettled?: () => void;
+	/** Typed child selection issued during in-process admission. */
+	subagentPolicy?: SubagentChildPolicy;
+	shouldContinue?: () => boolean;
+	onDirectToolsChanged?: () => void | Promise<void>;
+	onSettled?: () => void;
 }
 
 export interface McpStartupWarmupHandle {
@@ -17,6 +20,17 @@ export interface McpStartupWarmupHandle {
   cancel(): void;
 }
 
+export interface McpDirectToolsSelection {
+  readonly disabled: boolean;
+  readonly tools?: readonly string[];
+}
+
+/** Resolve direct-tool selection exclusively from typed admission policy. */
+export function resolveMcpDirectToolsSelection(subagentPolicy?: SubagentChildPolicy): McpDirectToolsSelection {
+	const tools = subagentPolicy?.mcpDirectTools;
+	return { disabled: tools !== undefined && tools.length === 0, ...(tools === undefined ? {} : { tools: [...tools] }) };
+}
+
 function deferToMacrotask(): Promise<void> {
   return new Promise((resolve) => setImmediate(resolve));
 }
@@ -31,12 +45,10 @@ export function scheduleMcpStartupWarmup(
   const promise = (async () => {
     await deferToMacrotask();
     if (!shouldContinue()) return;
+    const selection = resolveMcpDirectToolsSelection(options.subagentPolicy);
+    if (selection.disabled) return;
 
-    const envDirect = process.env.MCP_DIRECT_TOOLS;
-    if (envDirect === "__none__") return;
-
-    const envDirectTools = envDirect?.split(",").map((item) => item.trim()).filter(Boolean);
-    const missingCacheServers = getMissingConfiguredDirectToolServers(state.config, loadMetadataCache(), envDirectTools)
+    const missingCacheServers = getMissingConfiguredDirectToolServers(state.config, loadMetadataCache(), selection.tools)
       .filter((name) => state.manager.getConnection(name)?.status !== "connected");
     if (missingCacheServers.length === 0) return;
 

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Breaking Changes
+
+- `async: true` no longer survives parent exit. Async subagents now run as in-process children of the parent session on the same foreground executor, so quitting Atomic ends any in-flight async run. The child's canonical identity and its session file persist on disk and can be reloaded on a later start, but the running work does not continue in the background across a restart. The detached runner process that previously provided parent-exit survival has been deleted ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Removed the `ATOMIC_SUBAGENT_*` process-era environment bridge variables consumed by the deleted spawn path and the synthesized numeric child-result exit-code protocol (`0/1/-1/-2/143`). Child identity, policy, supervisor capability, and terminal outcomes now cross typed admission; results use required `status` (`ok | error | skipped | interrupted | continued`) plus `cause` and `stats` ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Added
+
+- Added the in-process subagent control-plane doors and `InProcessChildRunner` foundation backed by the Rust N-API registry, typed statuses, session statistics, and bounded result envelopes ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Changed
+
+- Nested in-process children now route live `interrupt` and cold `resume` actions directly through the Rust control plane. Nested event and control records use an in-memory host route while retaining the validated file shape for cold-start compatibility; session JSONL is flushed before forced interruption, and the former 200 ms nested-control polling loop is replaced by event-driven delivery ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- In-process children now advance through their model-fallback ladder via the SDK session's `fallbackModels` — the exact classification, same-model retry, and candidate-advancement behavior main chat and workflow stages converged on ([#2170](https://github.com/bastani-inc/atomic/issues/2170)) — instead of a subagents-local walk. Pre-spawn auth filtering still builds the ladder, and results report the effective `model`, `attemptedModels`, and skipped pre-spawn attempts ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Foreground subagent attempts now enter through the in-process session runner, expose typed terminal status and `SessionStats`, and record typed run-history statuses; the foreground process-attempt implementation was removed ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- In-process admission now resolves child management and fanout capabilities as a typed policy carried into the session and tool executor; restricted children cannot create, update, or delete agent definitions, and fanout authorization cannot be widened by a descendant ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- `async: true` chain and parallel runs now execute on the same in-process foreground executor as their synchronous counterparts, un-awaited, instead of a separately serialized detached runner. Chain `{previous}` substitution, chain output bindings, dynamic fanout, worktree setup and cleanup, structured-output schemas, skills resolution, progress files, fail-fast, and per-step model-candidate ladders are now served by one implementation for both modes ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Child prompt behavior now enters in-process `AgentSession` construction through typed admission policy: boundary instructions, project-context and inherited-skill filtering, orchestration-skill removal, and parent-only message filtering no longer depend on the process-era extension injection path ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Child MCP direct-tool selection and Intercom identity/capability now cross the in-process admission boundary as typed policy; omitted MCP selection preserves defaults, empty selection disables direct tools, and supervisor grants are never inherited through environment ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
+### Fixed
+
+- Fixed in-process parallel siblings colliding on the same canonical identity and terminal artifact path, and fixed async completions omitting their persisted result envelope from the parent notification ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+- Fixed model-failure classification sharing so subagent fallback decisions stay aligned with main chat and workflow candidates for auth, unavailable-model, request-incompatible, quota, and transport failures ([#2170](https://github.com/bastani-inc/atomic/issues/2170)).
+
+### Removed
+
+- Removed every remaining OS child-process code path from subagent execution, satisfying the spec's zero-process goal: the detached jiti async runner and its twelve `subagent-runner*` modules, the `async-execution-*` spawn layer, the async event journal, the idle/wall attempt watchdog, the stdout drain grace, the CLI spawn resolver, the environment-bridge builder, and the post-exit stdio guard ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
 ## [0.9.12] - 2026-08-04
 
 ### Fixed