@bastani/atomic 0.9.9 → 0.9.10-alpha.1

package/dist/builtin/subagents/src/runs/background/notify.ts

@@ -86,6 +86,32 @@ function getNotifySeen(pi: ExtensionAPI): Map<string, number> {
 	return seen;
 }
 
+function isPromiseLike(value: unknown): value is PromiseLike<void> {
+	return (typeof value === "object" || typeof value === "function")
+		&& value !== null
+		&& typeof (value as { then?: unknown }).then === "function";
+}
+
+async function dispatchFallback(
+	pi: ExtensionAPI,
+	prefix: TerminalPreludeMessage[],
+	terminalMessage: TerminalPreludeMessage,
+	deliveryOptions: Parameters<ExtensionAPI["sendMessage"]>[1],
+): Promise<void> {
+	let delivered = 0;
+	try {
+		for (const message of prefix) {
+			await pi.sendMessage(message, { deliverAs: "steer" });
+			delivered += 1;
+		}
+		await pi.sendMessage(terminalMessage, deliveryOptions);
+	} catch (error) {
+		const failure = new Error(error instanceof Error ? error.message : String(error), { cause: error });
+		Object.assign(failure, { terminalPreludeDelivered: delivered });
+		throw failure;
+	}
+}
+
 export default function registerSubagentNotify(pi: ExtensionAPI): () => void {
 	const registry = getNotifyRegistry();
 	const previous = registry.get(pi);
@@ -99,15 +125,15 @@ export default function registerSubagentNotify(pi: ExtensionAPI): () => void {
 	const seen = getNotifySeen(pi);
 	const ttlMs = 10 * 60 * 1000;
 
-	const emitTerminalOrderingBarrier = (result: SubagentResult, dispatch?: (prefix: TerminalPreludeMessage[]) => void): void => {
+	const emitTerminalOrderingBarrier = (result: SubagentResult, dispatch?: (prefix: TerminalPreludeMessage[]) => void | Promise<void>): Promise<void> | undefined => {
 		const runId = result.runId ?? result.id;
-		if (!runId) return;
+		if (!runId) return undefined;
 		const resultTargets = result.results?.map((child, arrayIndex) =>
 			child.intercomTarget?.trim() || resolveSubagentIntercomTarget(runId, child.agent, child.index ?? arrayIndex)) ?? [];
 		const sourceSessionTargets = resultTargets.length > 0
 			? resultTargets
 			: result.agent ? [resolveSubagentIntercomTarget(runId, result.agent, 0)] : [];
-		if (sourceSessionTargets.length === 0) return;
+		if (sourceSessionTargets.length === 0) return undefined;
 		const terminalId = result.notificationId?.startsWith("completion-notify-")
 			? result.notificationId.slice("completion-notify-".length)
 			: result.notificationId;
@@ -119,12 +145,15 @@ export default function registerSubagentNotify(pi: ExtensionAPI): () => void {
 			sourceSessionTargets,
 			...(dispatch ? { dispatch } : {}),
 		};
+		Object.defineProperty(payload, "terminalOwner", { value: pi });
 		pi.events.emit(SUBAGENT_TERMINAL_ORDERING_BARRIER_EVENT, payload);
 		const globalHandler = (globalThis as Record<string, unknown>).__atomicTerminalOrderingBarrierHandler;
 		if (typeof globalHandler === "function") (globalHandler as (value: unknown) => void)(payload);
+		return (payload as typeof payload & { completion?: Promise<void> }).completion;
 	};
+	const inFlight = new Map<string, Promise<void>>();
 	let registration: NotifyRegistration;
-	const handleComplete = (data: unknown) => {
+	const handleComplete = (data: unknown): void => {
 		if (registry.get(pi) !== registration) return;
 		const result = data as SubagentResult & Partial<CompletionNotificationEnvelope>;
 		const now = Date.now();
@@ -133,6 +162,15 @@ export default function registerSubagentNotify(pi: ExtensionAPI): () => void {
 			result.acknowledge?.(true);
 			return;
 		}
+		const pending = inFlight.get(key);
+		if (pending) {
+			result.defer?.();
+			void pending.then(() => result.acknowledge?.(true), () => result.acknowledge?.(false));
+			return;
+		}
+		const ownership = Promise.withResolvers<void>();
+		void ownership.promise.catch(() => {});
+		inFlight.set(key, ownership.promise);
 		const agent = result.agent ?? "unknown";
 		const summary = typeof result.summary === "string" ? result.summary : "";
 		const paused = !result.success && (
@@ -171,23 +209,46 @@ export default function registerSubagentNotify(pi: ExtensionAPI): () => void {
 			content,
 			display: true,
 		};
+		const deliveryOptions = { triggerTurn: true, stageAdmissionKey: `subagent:${key}` } as const;
+		const succeed = (): void => {
+			recordSeen(seen, key, Date.now());
+			inFlight.delete(key);
+			ownership.resolve();
+			result.acknowledge?.(true);
+		};
+		const fail = (error: unknown): void => {
+			inFlight.delete(key);
+			ownership.reject(error);
+			result.acknowledge?.(false);
+			console.error("Failed to deliver async subagent completion notification:", error);
+		};
+		const observe = (delivery: PromiseLike<void>): void => {
+			result.defer?.();
+			void Promise.resolve(delivery).then(succeed, fail);
+		};
 		try {
 			let dispatched = false;
-			emitTerminalOrderingBarrier(result, (prefix) => {
+			const barrierCompletion = emitTerminalOrderingBarrier(result, (prefix) => {
+				dispatched = true;
 				if (typeof pi.sendMessages === "function") {
-					pi.sendMessages([...prefix, terminalMessage], { triggerTurn: true });
-				} else {
-					for (const message of prefix) pi.sendMessage(message, { deliverAs: "steer" });
-					pi.sendMessage(terminalMessage, { triggerTurn: true });
+					return pi.sendMessages([...prefix, terminalMessage], deliveryOptions);
 				}
-				dispatched = true;
+				return dispatchFallback(pi, prefix, terminalMessage, deliveryOptions);
 			});
-			if (!dispatched) pi.sendMessage(terminalMessage, { triggerTurn: true });
-			recordSeen(seen, key, Date.now());
-			result.acknowledge?.(true);
+			if (barrierCompletion) {
+				observe(barrierCompletion);
+				return;
+			}
+			if (!dispatched) {
+				const delivery = pi.sendMessage(terminalMessage, deliveryOptions);
+				if (isPromiseLike(delivery)) {
+					observe(delivery);
+					return;
+				}
+			}
+			succeed();
 		} catch (error) {
-			result.acknowledge?.(false);
-			console.error("Failed to deliver async subagent completion notification:", error);
+			fail(error);
 		}
 	};
 

package/dist/builtin/subagents/src/runs/background/stale-run-reconciler.ts

@@ -286,7 +286,7 @@ function writeFailedRepair(asyncDir: string, status: AsyncStatus, resultPath: st
 			message: repair.message,
 		});
 	} catch (error) {
-		console.error(`Failed to append stale-repair event for '${asyncDir}'; publishing the recoverable result:`, error);
+		console.error(`Failed to append stale-repair event for '${asyncDir}'; publishing the recoverable result: ${getErrorMessage(error)}`);
 	}
 	return publishStagedRepair(resultPath, repair.status, repair.result, publish);
 }

package/dist/builtin/subagents/src/runs/background/subagent-runner-dynamic.ts

@@ -6,6 +6,7 @@ import { aggregateParallelOutputs, mapConcurrent, MAX_PARALLEL_CONCURRENCY } fro
 import { collectDynamicResults, DynamicFanoutError, materializeDynamicParallelStep, validateDynamicCollection } from "../shared/dynamic-fanout.ts";
 import { runSingleStep } from "./subagent-runner-step.ts";
 import type { RunnerExecutionState, RunnerStatusStep, RunnerStep, SubagentStep } from "./subagent-runner-types.ts";
+import type { SupervisorAuthorization } from "../../intercom/supervisor-authorization.ts";
 import { createMutatingFailureState } from "../shared/long-running-guard.ts";
 import { markDynamicGraphGroup, resetStepLiveDetail, updateStepFromChildEvent, updateStepModel, writeStatusPayload } from "./subagent-runner-state.ts";
 
@@ -85,6 +86,17 @@ export async function runDynamicGroup(state: RunnerExecutionState, step: RunnerS
 	}));
 	statusPayload.steps.splice(groupStartFlatIndex, 1, ...dynamicStatusSteps);
 	if (config.childIntercomTargets) config.childIntercomTargets = statusPayload.steps.map((statusStep, index) => resolveSubagentIntercomTarget(id, statusStep.agent, index));
+	const dynamicAuthorizations = config.dynamicSupervisorAuthorizations?.[stepIndex];
+	if (dynamicAuthorizations) {
+		const authorizations = config.supervisorAuthorizations
+			?? new Array<SupervisorAuthorization | undefined>(statusPayload.steps.length - dynamicStatusSteps.length + 1).fill(undefined);
+		authorizations.splice(
+			groupStartFlatIndex,
+			1,
+			...dynamicSteps.map((_, index) => dynamicAuthorizations[index]),
+		);
+		config.supervisorAuthorizations = authorizations;
+	}
 	state.mutatingFailureStates.splice(groupStartFlatIndex, 1, ...dynamicStatusSteps.map(() => createMutatingFailureState()));
 	state.pendingToolResults.splice(groupStartFlatIndex, 1, ...dynamicStatusSteps.map(() => undefined));
 	const materializedDelta = dynamicStatusSteps.length - 1;
@@ -162,6 +174,7 @@ export async function runDynamicGroup(state: RunnerExecutionState, step: RunnerS
 			piArgv1: config.piArgv1,
 			childIntercomTarget: config.childIntercomTargets?.[fi],
 			orchestratorIntercomTarget: config.controlIntercomTarget,
+			supervisorAuthorization: config.supervisorAuthorizations?.[fi],
 			nestedRoute: config.nestedRoute,
 			registerInterrupt: (interrupt) => {
 				state.activeChildInterrupt = interrupt;

package/dist/builtin/subagents/src/runs/background/subagent-runner-parallel.ts

@@ -95,6 +95,7 @@ export async function runParallelGroup(state: RunnerExecutionState, group: Paral
 				piArgv1: config.piArgv1,
 				childIntercomTarget: config.childIntercomTargets?.[fi],
 				orchestratorIntercomTarget: config.controlIntercomTarget,
+				supervisorAuthorization: config.supervisorAuthorizations?.[fi],
 				nestedRoute: config.nestedRoute,
 				registerInterrupt: (interrupt) => {
 					state.activeChildInterrupt = interrupt;

package/dist/builtin/subagents/src/runs/background/subagent-runner-sequential.ts

@@ -37,6 +37,7 @@ export async function runSequentialStep(state: RunnerExecutionState, seqStep: Su
 		piArgv1: config.piArgv1,
 		childIntercomTarget: config.childIntercomTargets?.[flatIndex],
 		orchestratorIntercomTarget: config.controlIntercomTarget,
+		supervisorAuthorization: config.supervisorAuthorizations?.[flatIndex],
 		nestedRoute: config.nestedRoute,
 		registerInterrupt: (interrupt) => {
 			state.activeChildInterrupt = interrupt;

package/dist/builtin/subagents/src/runs/background/subagent-runner-step.ts

@@ -122,7 +122,8 @@ export async function runSingleStep(
 				cwd: step.cwd ?? ctx.cwd,
 				promptFileStem: step.agent,
 				intercomSessionName: ctx.childIntercomTarget,
-				orchestratorIntercomTarget: ctx.orchestratorIntercomTarget,
+				orchestratorIntercomTarget: ctx.supervisorAuthorization ? ctx.orchestratorIntercomTarget : undefined,
+				supervisorAuthorization: ctx.supervisorAuthorization,
 				runId: ctx.id,
 				childAgentName: step.agent,
 				childIndex: ctx.flatIndex,

package/dist/builtin/subagents/src/runs/background/subagent-runner-types.ts

@@ -17,6 +17,7 @@ import type {
 import type { TokenUsage } from "../../shared/types.ts";
 import type { RunnerStep, RunnerSubagentStep as SubagentStep } from "../shared/parallel-utils.ts";
 import type { WorktreeSetup } from "../shared/worktree.ts";
+import type { SupervisorAuthorization } from "../../intercom/supervisor-authorization.ts";
 
 export interface SubagentRunConfig {
 	id: string;
@@ -40,6 +41,8 @@ export interface SubagentRunConfig {
 	controlConfig?: ResolvedControlConfig;
 	controlIntercomTarget?: string;
 	childIntercomTargets?: Array<string | undefined>;
+	supervisorAuthorizations?: Array<SupervisorAuthorization | undefined>;
+	dynamicSupervisorAuthorizations?: Record<number, SupervisorAuthorization[]>;
 	resultMode?: SubagentRunMode;
 	dynamicFanoutMaxItems?: number;
 	workflowGraph?: WorkflowGraphSnapshot;
@@ -128,6 +131,7 @@ export interface SingleStepContext {
 	registerInterrupt?: (interrupt: (() => void) | undefined) => void;
 	childIntercomTarget?: string;
 	orchestratorIntercomTarget?: string;
+	supervisorAuthorization?: SupervisorAuthorization;
 	nestedRoute?: NestedRouteInfo;
 	onAttemptStart?: (attempt: { model?: string; thinking?: string; fastMode?: boolean }) => void;
 	onChildEvent?: (event: ChildEvent) => void;

package/dist/builtin/subagents/src/runs/foreground/chain-execution-parallel-runner.ts

@@ -43,8 +43,19 @@ export async function runParallelChainTasks(input: ParallelChainRunInput): Promi
 	const concurrency = input.step.concurrency ?? MAX_CONCURRENCY;
 	const failFast = input.step.failFast ?? false;
 	let aborted = false;
+	const intercomDetachController = new AbortController();
 
 	return mapConcurrent(input.step.parallel, concurrency, async (task, taskIndex) => {
+		if (intercomDetachController.signal.aborted) {
+			return {
+				agent: task.agent,
+				task: input.parallelTemplates[taskIndex] ?? task.task ?? "{previous}",
+				exitCode: -1,
+				messages: [],
+				usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, turns: 0 },
+				error: "Skipped after foreground group detached for intercom coordination",
+			};
+		}
 		if (aborted && failFast) {
 			return {
 				agent: task.agent,
@@ -126,6 +137,8 @@ export async function runParallelChainTasks(input: ParallelChainRunInput): Promi
 			orchestratorIntercomTarget: input.orchestratorIntercomTarget,
 			nestedRoute: input.nestedRoute,
 			onDetachedExit: (recovered) => input.onDetachedExit?.(input.globalTaskIndex + taskIndex, recovered),
+			intercomDetachSignal: intercomDetachController.signal,
+			onIntercomDetachCommit: () => intercomDetachController.abort(),
 			modelOverride: effectiveModel,
 			availableModels: input.availableModels,
 			knownModelProviders: input.knownModelProviders,

package/dist/builtin/subagents/src/runs/foreground/chain-execution-parallel-step.ts

@@ -22,6 +22,7 @@ import { validateFileOnlyOutputMode } from "../shared/single-output.ts";
 import { buildChainExecutionDetails, buildChainExecutionErrorResult } from "./chain-execution-details.ts";
 import { appendParallelWorktreeSummary, ensureParallelProgressFile, runParallelChainTasks } from "./chain-execution-parallel-runner.ts";
 import type { ChainExecutionMutableState, ChainExecutionResult, ChainRuntimeContext } from "./chain-execution-types.ts";
+import { createDetachedCleanupBarrier } from "./detached-cleanup-barrier.ts";
 
 export async function runStaticParallelChainStep(input: {
 	context: ChainRuntimeContext;
@@ -33,6 +34,7 @@ export async function runStaticParallelChainStep(input: {
 	const { context, state, step, stepIndex, parallelTemplates } = input;
 	const parallelCwd = resolveChildCwd(context.cwd ?? context.ctx.cwd, step.cwd);
 	let worktreeSetup: WorktreeSetup | undefined;
+	let worktreeCleanupDeferred = false;
 	if (step.worktree) {
 		const worktreeTaskCwdConflict = findWorktreeTaskCwdConflict(step.parallel, parallelCwd);
 		if (worktreeTaskCwdConflict) {
@@ -56,6 +58,12 @@ export async function runStaticParallelChainStep(input: {
 
 	try {
 		const agentNames = step.parallel.map((task) => task.agent);
+		const parallelBaseIndex = state.globalTaskIndex;
+		const detachedCleanup = createDetachedCleanupBarrier(() => {
+			if (!worktreeSetup) return;
+			appendParallelWorktreeSummary("", worktreeSetup, path.join(context.chainDir, "worktree-diffs", `step-${stepIndex}`), agentNames);
+			cleanupWorktrees(worktreeSetup);
+		});
 		const parallelBehaviors = resolveParallelBehaviors(step.parallel, context.agents, stepIndex, context.chainSkills)
 			.map((behavior, taskIndex) => suppressProgressForReadOnlyTask(behavior, parallelTemplates[taskIndex] ?? step.parallel[taskIndex]?.task, context.originalTask));
 		for (let taskIndex = 0; taskIndex < step.parallel.length; taskIndex++) {
@@ -112,8 +120,17 @@ export async function runStaticParallelChainStep(input: {
 			maxSubagentDepth: context.params.maxSubagentDepth,
 			workflowStageSubagentGuard: context.params.workflowStageSubagentGuard,
 			runSync: context.executeRunSync,
-			onDetachedExit: context.onDetachedExit,
+			onDetachedExit: (index, result) => {
+				try {
+					context.onDetachedExit?.(index, result);
+				} finally {
+					detachedCleanup.recover(index);
+				}
+			},
 		});
+		worktreeCleanupDeferred = detachedCleanup.defer(
+			parallelResults.flatMap((result, index) => result.detached ? [parallelBaseIndex + index] : []),
+		);
 		state.globalTaskIndex += step.parallel.length;
 		for (const result of parallelResults) {
 			state.results.push(result);
@@ -182,6 +199,6 @@ export async function runStaticParallelChainStep(input: {
 		state.prev = appendParallelWorktreeSummary(state.prev, worktreeSetup, path.join(context.chainDir, "worktree-diffs", `step-${stepIndex}`), agentNames);
 		return undefined;
 	} finally {
-		if (worktreeSetup) cleanupWorktrees(worktreeSetup);
+		if (worktreeSetup && !worktreeCleanupDeferred) cleanupWorktrees(worktreeSetup);
 	}
 }

package/dist/builtin/subagents/src/runs/foreground/detached-cleanup-barrier.ts

@@ -0,0 +1,26 @@
+/** Defers run-owned resource cleanup until every detached child closes. */
+export function createDetachedCleanupBarrier(onReady: () => void): {
+  readonly recover: (index: number) => void;
+  readonly defer: (indices: readonly number[]) => boolean;
+} {
+  const recovered = new Set<number>();
+  let expected: ReadonlySet<number> | undefined;
+  let cleaned = false;
+  const finishIfReady = () => {
+    if (cleaned || !expected || ![...expected].every((index) => recovered.has(index))) return;
+    cleaned = true;
+    onReady();
+  };
+  return {
+    recover(index) {
+      recovered.add(index);
+      finishIfReady();
+    },
+    defer(indices) {
+      if (indices.length === 0) return false;
+      expected = new Set(indices);
+      finishIfReady();
+      return true;
+    },
+  };
+}

package/dist/builtin/subagents/src/runs/foreground/execution-attempt.ts

@@ -2,10 +2,7 @@ import { spawn } from "node:child_process";
 import { existsSync, unlinkSync } from "node:fs";
 import type { Message } from "@earendil-works/pi-ai/compat";
 import type { AgentConfig } from "../../agents/agents.ts";
-import {
-	type AgentProgress, type RunSyncOptions, type SingleResult,
-	INTERCOM_DETACH_REQUEST_EVENT, INTERCOM_DETACH_RESPONSE_EVENT, getSubagentDepthEnv,
-} from "../../shared/types.ts";
+import { type AgentProgress, type RunSyncOptions, type SingleResult, getSubagentDepthEnv } from "../../shared/types.ts";
 import { extractTextFromContent, extractToolArgsPreview, getFinalOutput } from "../../shared/utils.ts";
 import { createJsonlWriter } from "../../shared/jsonl-writer.ts";
 import { attachPostExitStdioGuard, trySignalChild } from "../../shared/post-exit-stdio-guard.ts";
@@ -14,8 +11,6 @@ import { formatPiSpawnError, getPiSpawnCommand, validatePiSpawnCwd } from "../sh
 import { assistantStopReason, isAssistantFailureStopReason, shouldStartSubagentFinalDrain } from "../shared/final-drain.ts";
 import { modelFailureMessage } from "../shared/model-fallback.ts";
 import { createAttemptWatchdog } from "../shared/attempt-watchdog.ts";
-import { matchesIntercomDetachRoute, type IntercomDetachRoute } from "./execution-detach-route.ts";
-import { IntercomDetachReservations } from "./execution-detach-reservations.ts";
 import {
 	createMutatingFailureState,
 	didMutatingToolFail,
@@ -30,7 +25,9 @@ import { resolveSubagentModelFastMode } from "../../shared/fast-mode.ts";
 import { appendRecentOutput, emptyUsage, modelFailureSignalByResult, snapshotProgress, snapshotResult } from "./execution-utils.ts";
 import { createAttemptControlRuntime } from "./execution-attempt-control.ts";
 import { finalizeSingleAttempt } from "./execution-attempt-finalize.ts";
+import { registerExecutionIntercomDetach } from "./execution-intercom-detach.ts";
 import type { RunSingleAttemptShared } from "./execution-attempt-types.ts";
+import { requestSupervisorAuthorization } from "../../intercom/supervisor-authorization.ts";
 export async function runSingleAttempt(
 	runtimeCwd: string,
 	agent: AgentConfig,
@@ -47,6 +44,9 @@ export async function runSingleAttempt(
 		settings: shared.fastModeSettings,
 		scope: shared.fastModeScope,
 	});
+	const supervisorAuthorization = options.orchestratorIntercomTarget && options.intercomSessionName
+		? await requestSupervisorAuthorization(options.intercomEvents, options.intercomSessionName)
+		: undefined;
 	const { args, env: sharedEnv, tempDir } = buildPiArgs({
 		baseArgs: ["--mode", "json", "-p"],
 		task,
@@ -65,7 +65,9 @@ export async function runSingleAttempt(
 		cwd: runCwd,
 		promptFileStem: agent.name,
 		intercomSessionName: options.intercomSessionName,
-		orchestratorIntercomTarget: options.orchestratorIntercomTarget,
+		orchestratorIntercomTarget: supervisorAuthorization ? options.orchestratorIntercomTarget : undefined,
+		intercomGroup: options.intercomGroup,
+		supervisorAuthorization,
 		runId: options.runId,
 		childAgentName: agent.name,
 		childIndex: options.index ?? 0,
@@ -148,13 +150,14 @@ export async function runSingleAttempt(
 		let removeInterruptListener: (() => void) | undefined;
 		let activityTimer: NodeJS.Timeout | undefined;
 		const detachForIntercom = () => {
+			if (detached || processClosed) return;
 			detached = true;
 			result.detached = true;
 			result.detachedReason = "intercom coordination";
 			progress.status = "detached";
 			progress.durationMs = Date.now() - startTime;
 			result.progressSummary = { toolCount: progress.toolCount, tokens: progress.tokens, durationMs: progress.durationMs };
-			// Settle the foreground tool call, but retain process lifecycle ownership.
+			// Settle foreground supervision while retaining process lifecycle ownership.
 			finish(-2, true);
 		};
 		const FINAL_STOP_GRACE_MS = 1000;
@@ -192,24 +195,6 @@ export async function runSingleAttempt(
 			}, FINAL_STOP_GRACE_MS);
 			finalDrainTimer.unref?.();
 		};
-		const detachReservations = new IntercomDetachReservations();
-		const unsubscribeIntercomDetach = options.intercomEvents?.on?.(INTERCOM_DETACH_REQUEST_EVENT, (payload) => {
-			if (!options.allowIntercomDetach || processClosed || options.signal?.aborted) return;
-			if (!payload || typeof payload !== "object") return;
-			const event = payload as IntercomDetachRoute;
-			const reservationKeyValid = typeof event.requestId === "string";
-			if (!reservationKeyValid || !matchesIntercomDetachRoute(event, {
-				childIntercomTarget: options.intercomSessionName,
-			})) return;
-			if (event.phase === "probe") {
-				if (detached || !detachReservations.reserve(event)) return;
-				options.intercomEvents?.emit?.(INTERCOM_DETACH_RESPONSE_EVENT, { ...event, accepted: true });
-				return;
-			}
-			if (event.phase !== "commit" || detached || !detachReservations.commit(event)) return;
-			detachForIntercom();
-			options.intercomEvents?.emit?.(INTERCOM_DETACH_RESPONSE_EVENT, { ...event, accepted: true });
-		});
 		const finish = (code: number, retainLifecycleOwner = false) => {
 			if (settled) return;
 			settled = true;
@@ -218,8 +203,7 @@ export async function runSingleAttempt(
 				clearStdioGuard();
 				attemptWatchdog.clear();
 				removeAbortListener?.();
-				detachReservations.clear();
-				unsubscribeIntercomDetach?.();
+				cleanupIntercomDetach();
 			}
 			if (activityTimer) {
 				clearInterval(activityTimer);
@@ -228,6 +212,11 @@ export async function runSingleAttempt(
 			removeInterruptListener?.();
 			resolve(code);
 		};
+		const cleanupIntercomDetach = registerExecutionIntercomDetach(options, {
+			isUnavailable: () => processClosed || options.signal?.aborted === true,
+			isDetached: () => detached,
+			detach: detachForIntercom,
+		});
 		let pendingToolResult: { tool: string; path?: string; mutates: boolean; startedAt?: number } | undefined;
 		const mutatingFailures = createMutatingFailureState();
 		const mutatingFailureWindowMs = 5 * 60_000;
@@ -409,8 +398,7 @@ export async function runSingleAttempt(
 			attemptWatchdog.clear();
 			removeAbortListener?.(); removeAbortListener = undefined;
 			removeInterruptListener?.(); removeInterruptListener = undefined;
-			detachReservations.clear();
-			unsubscribeIntercomDetach?.();
+			cleanupIntercomDetach();
 			void jsonlWriter.close().catch(() => undefined);
 			cleanupTempDir(tempDir);
 			if (buf.trim()) processLine(buf);
@@ -438,6 +426,7 @@ export async function runSingleAttempt(
 			clearFinalDrainTimers();
 			clearStdioGuard();
 			attemptWatchdog.clear();
+			cleanupIntercomDetach();
 			void jsonlWriter.close().catch(() => undefined);
 			cleanupTempDir(tempDir);
 			if (!result.error) result.error = formatPiSpawnError(error, spawnSpec, runCwd);

package/dist/builtin/subagents/src/runs/foreground/execution-intercom-detach.ts

@@ -0,0 +1,47 @@
+import {
+  INTERCOM_DETACH_REQUEST_EVENT,
+  INTERCOM_DETACH_RESPONSE_EVENT,
+  type RunSyncOptions,
+} from "../../shared/types.ts";
+import { matchesIntercomDetachRoute, type IntercomDetachRoute } from "./execution-detach-route.ts";
+import { IntercomDetachReservations } from "./execution-detach-reservations.ts";
+
+interface ExecutionIntercomDetachState {
+  readonly isUnavailable: () => boolean;
+  readonly isDetached: () => boolean;
+  readonly detach: () => void;
+}
+
+/** Registers exact-owner and foreground-group detach listeners for one live child attempt. */
+export function registerExecutionIntercomDetach(
+  options: RunSyncOptions,
+  state: ExecutionIntercomDetachState,
+): () => void {
+  const reservations = new IntercomDetachReservations();
+  const unsubscribe = options.intercomEvents?.on?.(INTERCOM_DETACH_REQUEST_EVENT, (payload) => {
+    if (!options.allowIntercomDetach || state.isUnavailable()) return;
+    if (!payload || typeof payload !== "object") return;
+    const event = payload as IntercomDetachRoute;
+    if (typeof event.requestId !== "string" || !matchesIntercomDetachRoute(event, {
+      childIntercomTarget: options.intercomSessionName,
+    })) return;
+    if (event.phase === "probe") {
+      if (state.isDetached() || !reservations.reserve(event)) return;
+      options.intercomEvents?.emit?.(INTERCOM_DETACH_RESPONSE_EVENT, { ...event, accepted: true });
+      return;
+    }
+    if (event.phase !== "commit" || state.isDetached() || !reservations.commit(event)) return;
+    options.onIntercomDetachCommit?.();
+    state.detach();
+    options.intercomEvents?.emit?.(INTERCOM_DETACH_RESPONSE_EVENT, { ...event, accepted: true });
+  });
+  const detachSibling = () => state.detach();
+  options.intercomDetachSignal?.addEventListener("abort", detachSibling, { once: true });
+  if (options.intercomDetachSignal?.aborted) detachSibling();
+
+  return () => {
+    reservations.clear();
+    unsubscribe?.();
+    options.intercomDetachSignal?.removeEventListener("abort", detachSibling);
+  };
+}

package/dist/builtin/subagents/src/runs/foreground/subagent-executor-async.ts

@@ -12,13 +12,55 @@ import {
 	workflowSessionMetadataFromContext,
 	wrapForkTask,
 } from "../../shared/types.ts";
-import { resolveSingleProgress, type ChainStep } from "../../shared/settings.ts";
+import { isDynamicParallelStep, isParallelStep, resolveSingleProgress, type ChainStep, type SequentialStep } from "../../shared/settings.ts";
 import { normalizeSingleOutputOverride } from "../shared/single-output.ts";
 import type { ExecutionContextData, ResolvedExecutorDeps } from "./subagent-executor-types.ts";
 import { collectChainSessionFiles, wrapChainTasksForFork } from "./subagent-executor-input.ts";
 import { buildChainWorktreeTaskCwdError, buildParallelModeError, buildParallelWorktreeTaskCwdError } from "./subagent-executor-worktree.ts";
+import { requestSupervisorAuthorization, type SupervisorAuthorization } from "../../intercom/supervisor-authorization.ts";
 
-export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorDeps): import("../../shared/types.ts").SubagentToolResult | null {
+async function authorizeChild(deps: ResolvedExecutorDeps, childName: string | undefined): Promise<SupervisorAuthorization | undefined> {
+	return await requestSupervisorAuthorization(deps.pi.events, childName);
+}
+
+async function authorizeAsyncChain(
+	chain: ChainStep[],
+	childTarget: ((agent: string, index: number) => string | undefined) | undefined,
+	dynamicMaxItems: number | undefined,
+	deps: ResolvedExecutorDeps,
+): Promise<{
+	authorizations?: Array<SupervisorAuthorization | undefined>;
+	dynamic?: Record<number, SupervisorAuthorization[]>;
+}> {
+	if (!childTarget) return {};
+	const authorizations: Array<SupervisorAuthorization | undefined> = [];
+	const dynamic: Record<number, SupervisorAuthorization[]> = {};
+	for (let stepIndex = 0; stepIndex < chain.length; stepIndex++) {
+		const step = chain[stepIndex]!;
+		if (isDynamicParallelStep(step)) {
+			authorizations.push(undefined);
+
+			const count = Math.max(0, dynamicMaxItems ?? 0);
+			dynamic[stepIndex] = (await Promise.all(
+				Array.from({ length: count }, () => authorizeChild(deps, "*")),
+			)).filter((value): value is SupervisorAuthorization => value !== undefined);
+			continue;
+		}
+		const agents = isParallelStep(step)
+			? step.parallel.map((task) => task.agent)
+			: [(step as SequentialStep).agent];
+		for (let index = 0; index < agents.length; index++) {
+			authorizations.push(await authorizeChild(deps, "*"));
+		}
+	}
+	return {
+		authorizations,
+		...(Object.keys(dynamic).length > 0 ? { dynamic } : {}),
+	};
+}
+
+
+export async function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorDeps): Promise<import("../../shared/types.ts").SubagentToolResult | null> {
 	const {
 		params,
 		effectiveCwd,
@@ -103,6 +145,9 @@ export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorD
 			...(task.reads !== undefined && task.reads !== true ? { reads: task.reads } : {}),
 			...(task.progress !== undefined ? { progress: task.progress } : {}),
 		}));
+		const supervisorAuthorizations = childIntercomTarget
+			? await Promise.all(params.tasks.map((task, index) => authorizeChild(deps, childIntercomTarget(task.agent, index))))
+			: undefined;
 		return deps.runtime.executeAsyncChain(id, {
 			chain: [{
 				parallel: parallelTasks,
@@ -129,6 +174,7 @@ export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorD
 			controlConfig,
 			controlIntercomTarget,
 			childIntercomTarget,
+			supervisorAuthorizations,
 			nestedRoute,
 		});
 	}
@@ -137,6 +183,12 @@ export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorD
 		const normalized = normalizeSkillInput(params.skill);
 		const chainSkills = normalized === false ? [] : (normalized ?? []);
 		const chain = wrapChainTasksForFork(params.chain as ChainStep[], params.context);
+		const supervisor = await authorizeAsyncChain(
+			chain,
+			childIntercomTarget,
+			deps.config.chain?.dynamicFanout?.maxItems,
+			deps,
+		);
 		return deps.runtime.executeAsyncChain(id, {
 			chain,
 			task: params.task,
@@ -160,6 +212,8 @@ export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorD
 			controlConfig,
 			controlIntercomTarget,
 			childIntercomTarget,
+			supervisorAuthorizations: supervisor.authorizations,
+			dynamicSupervisorAuthorizations: supervisor.dynamic,
 			nestedRoute,
 		});
 	}
@@ -181,6 +235,9 @@ export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorD
 		const maxSubagentDepth = resolveChildMaxSubagentDepth(currentMaxSubagentDepth, a.maxSubagentDepth);
 		const modelOverride = resolveModelCandidate((params.model as string | undefined) ?? a.model, availableModels, currentProvider);
 		const progress = resolveSingleProgress(a, params.progress, params.task);
+		const supervisorAuthorization = childIntercomTarget
+			? await authorizeChild(deps, childIntercomTarget(params.agent!, 0))
+			: undefined;
 		return deps.runtime.executeAsyncSingle(id, {
 			agent: params.agent!,
 			task: params.context === "fork" ? wrapForkTask(params.task ?? "") : (params.task ?? ""),
@@ -207,6 +264,7 @@ export function runAsyncPath(data: ExecutionContextData, deps: ResolvedExecutorD
 			controlConfig,
 			controlIntercomTarget,
 			childIntercomTarget: childIntercomTarget ? (agent, index) => childIntercomTarget(agent, index) : undefined,
+			supervisorAuthorization,
 			nestedRoute,
 		});
 	}