@bubblebrain-ai/bubble 0.0.58 → 0.0.60

package/README.md

@@ -1,11 +1,39 @@
 # Bubble
 
-Bubble is a terminal coding agent. It works inside a local project folder: it reads and edits files, runs commands behind configurable approval controls, searches and navigates code with language-server intelligence, browses the web, loads reusable skills, connects MCP tools, fans work out to subagents, and keeps persistent memory across sessions.
+Bubble is a local coding agent with a desktop app and a terminal interface. It works inside a local project folder: it reads and edits files, runs commands behind configurable approval controls, searches and navigates code with language-server intelligence, browses the web, loads reusable skills, connects MCP tools, fans work out to subagents, and keeps persistent memory across sessions.
 
 It is provider-agnostic. Bring an API key for OpenAI, Anthropic, Google, DeepSeek, Moonshot/Kimi, Zhipu, Z.AI, MiniMax, Groq, Together, Fireworks, a local OpenAI-compatible endpoint, and more; sign in to ChatGPT with OAuth; or sign in with OAuth to use a ChatGPT or Grok subscription directly.
 
 ---
 
+## Desktop app
+
+The desktop app is the primary direction for interactive development. It uses the existing Bubble SDK, providers and session history, with the Aegis desktop layout, working trace, KanBan, automations, pull requests and settings adapted for a standalone Bubble agent. Skills and model selection use Bubble directly.
+
+```bash
+npm ci
+npm run desktop:install
+npm run dev
+```
+
+`npm run dev` (or `npm run desktop:dev`) starts Electron with Vite hot updates. UI edits refresh in place; Electron/preload/shared code and Agent SDK edits compile and restart the desktop automatically. The first launch compiles the SDK and host, without a renderer production build. Stop everything with Ctrl+C. Use `npm run dev:tui` for terminal development.
+
+`npm run desktop` still builds and starts the desktop without hot updates; `npm --prefix desktop start` opens the last compiled build. For a local macOS dogfood app and DMG, run `npm run desktop:package`; it includes the Agent runtime and never publishes. Use `npm run desktop:build` to check a build and `npm run desktop:test` to run desktop checks. See [desktop architecture and migration notes](docs/desktop-architecture.md) for runtime boundaries, data migration and development commands. The CLI remains available.
+
+In **Settings → Providers → Bubble**, OpenAI offers **ChatGPT subscription** browser sign-in and a separate **API key** mode. **Grok Subscription** uses browser sign-in only. You can cancel a pending login or sign out from the same panel; OAuth tokens stay in the selected profile's Agent home and are never shown in the API key editor.
+
+Desktop data is separated into three profiles (macOS paths shown):
+
+| Command | Purpose | Desktop data | Agent data |
+| --- | --- | --- | --- |
+| `npm run dev` | Your persistent development/test sessions | `~/Library/Application Support/Bubble Dev` | `~/.bubble-dev` |
+| `npm run desktop:qa` | Agent verification; a fresh profile each launch | System temporary directory `bubble-desktop-qa-*/desktop` | Same temporary root, `agent/` |
+| `npm run desktop` / `npm --prefix desktop start` | Normal use with production data | `~/Library/Application Support/Bubble` | `~/.bubble` |
+
+Sessions, board state, automations, UI preferences, model/account configuration, OAuth data, memory and MCP settings follow the selected profile. History import reads only that profile's Agent home. Dev sessions survive restarts; QA uses a different temporary root for every launch (and keeps that root across hot restarts). Configure development models separately: production history and credentials are not automatically copied. Existing production data is left in place. These profiles separate app data, not the project files you ask the Agent to edit.
+
+Run automated verification with `npm run desktop:test`; manual/agent desktop verification must use `npm run desktop:qa`. If your development server is already running, use `PORT=4337 npm run desktop:qa`. QA paths are logged at startup and retained in the system temporary directory for diagnostics. The normal launch commands select their own profile and ignore inherited data-directory overrides.
+
 ## Requirements
 
 - Node.js 22.19 or newer — Bubble's only runtime
@@ -50,7 +78,7 @@ bubble
 
 On first launch, connect a provider:
 
-- Run `/login` to sign in to ChatGPT (OAuth) and use the Codex models, or
+- Run `/login` and pick an account: ChatGPT (OAuth, Codex models) or Grok Subscription, or
 - Run `/provider` to select Grok Subscription or add a provider with an API key.
 
 Then just type what you want done. Bubble plans, edits files, and runs commands, asking for approval where the current permission mode requires it.
@@ -139,7 +167,13 @@ Turns are driven by the SDK itself, not by iterator consumption: a returned
 iterator is a replay subscription, so dropping it never stalls or cancels the
 turn. `openSession(sessionId)` returns a durable handle whose `events` iterable
 replays the whole session log from sequence 1 and `eventsFrom(n)` resumes after
-the last sequence the host durably processed. `stop(sessionId)` is
+the last sequence the host durably processed. Snapshot `handle.latestSequence`
+before sending to subscribe only to new work, including automatic fallback
+turns. Each turn ends with a `terminal` record (`completed`, `failed`, or
+`cancelled`) after its execution slot is released. A completed turn may have
+already started a queued successor; hosts should drain buffered records and
+check `getSessionRunState(sessionId).active` before showing the session as idle.
+`stop(sessionId)` is
 Claude-style: it interrupts the active turn and keeps the queue; pass
 `{ cancelQueued: true }` to clear both. `clearQueue(sessionId)` cancels only
 queued turns, and `deleteSession(sessionId)` awaits teardown before the JSONL
@@ -179,6 +213,18 @@ Built-in providers include OpenAI, Anthropic, Google, DeepSeek, Moonshot (CN and
 
 For Doubao Seed models on Volcengine Ark, run `/provider --add doubao` and paste your Ark API key. The built-in endpoint is `https://ark.cn-beijing.volces.com/api/v3` and uses Ark's Responses API. The model picker exposes `minimal`, `low`, `medium`, and `high`, defaulting to `high`; `minimal` disables Ark thinking, while the other levels enable it.
 
+For **Xiaomi MiMo Token Plan**, choose **Xiaomi MiMo Token Plan** in desktop
+Settings → Providers, or run `/provider --add mimo-token-plan` in the CLI.
+Enter the Token Plan key (`tp-…` for personal plans, `ttp-…` for team plans),
+then select `/model mimo-token-plan:mimo-v2.6-pro` or `mimo-v2.6-flash`.
+Bubble uses Anthropic Messages at
+`https://token-plan-cn.xiaomimimo.com/anthropic/v1/messages`, with streaming,
+tools, and a thinking on/off switch (on by default). Both models have a 1M
+context window and a 128K output cap. V2.5 Pro and V2.5 are also available;
+their announced retirement date is October 21, 2026. Use the plan-specific key,
+not a pay-as-you-go API key. See the
+[official integration guide](https://mimo.mi.com/docs/zh-CN/tokenplan/integration/tools-overview).
+
 ### Custom providers and models
 
 For StepFun's standard API, run `/provider --add stepfun-api`, enter your API
@@ -216,7 +262,7 @@ Bubble gates risky actions behind a permission mode. Press `Tab` to cycle modes
 
 | Mode | Behavior |
 | --- | --- |
-| Default (Build) | File edits and writes auto-approve; bash and other tools prompt unless covered by an allow rule. |
+| Default (Build) | Workspace file edits and writes auto-approve, except protected files (`.git/`, `.bubble/settings*.json`, `.claude/settings*.json`). Bash, MCP tools and edits outside the workspace prompt unless covered by an allow rule or an "allow for this session" approval. |
 | Plan | Read-only investigation. The agent proposes a plan and waits for your approval before making changes. |
 | Bypass | Auto-approves every tool and disables all safety prompts. Enable deliberately with `--dangerously-skip-permissions`. |
 
@@ -226,6 +272,10 @@ Allow/deny rules are configured per scope and persisted across sessions. Manage
 - `<project>/.bubble/settings.json` — project scope (commit to share with your team)
 - `<project>/.bubble/settings.local.json` — local overrides (gitignore)
 
+The two project files arrive with the repository, so what they grant — allow rules, `mcpServers` (which Bubble would start) and LSP server definitions — only loads once you trust the folder. Like Kimi Code, Bubble asks when it opens such a folder (at startup in the terminal, on the first message in the desktop app), listing what would be enabled; any later change to those settings asks again. Deny rules, and switches that only turn LSP servers off, always apply; deny rules apply even in Bypass mode.
+
+Bash allow rules understand compound commands: every command in `a && b | c` must be covered by some allow rule, and commands with `$(...)`, backticks or file redirections always prompt. Deny rules match any part of the line. "Don't ask again this session" remembers the exact command only. MCP tools are named `mcp__<server>__<tool>`; `mcp__<server>` allows every tool of that server.
+
 Rules use a simple pattern syntax, for example:
 
 ```json
@@ -245,7 +295,7 @@ Rules use a simple pattern syntax, for example:
 
 ## What Bubble can do
 
-**Files and code.** Read, write, and make targeted edits; find files by glob; search contents with ripgrep; and navigate with language-server operations (go-to-definition, find references, hover, document/workspace symbols, call hierarchy).
+**Files and code.** Read, write, and make targeted edits; list directories with ls; find files through Bash with find or rg --files; search contents with ripgrep; and navigate with language-server operations (go-to-definition, find references, hover, document/workspace symbols, call hierarchy).
 
 **Shell and dev servers.** Run bounded bash commands with streaming output, and start/stop/inspect long-running dev servers (`npm run dev`, Vite, Next, etc.) with readiness checks and captured logs.
 
@@ -363,7 +413,7 @@ npm test           # run the test suite (vitest)
 npm start          # run the built agent
 ```
 
-`npm run dev` compiles and launches in one step. The interactive TUI is built on React Ink.
+`npm run dev:tui` compiles and launches the terminal interface in one step.
 
 ## Feishu host (optional)
 

package/dist/agent/child-runner.js

@@ -101,7 +101,7 @@ export class ChildRunner {
                 options.abortSignal,
                 record.abortController.signal,
             ]);
-            for await (const event of subAgent.run(input, runCwd, { abortSignal: childAbortSignal, resumeWithoutInput })) {
+            for await (const event of subAgent.run(input, runCwd, { abortSignal: childAbortSignal, resumeWithoutInput, inputController: record.inputQueue, continueOnPendingInput: true })) {
                 if (event.type === "turn_start") {
                     // Leftovers here belong to a half-built attempt the agent discarded
                     // (stream-interruption retry re-issues the whole request); keeping
@@ -135,6 +135,10 @@ export class ChildRunner {
                     turnSummaryBuffer = "";
                     turnHadToolCall = false;
                 }
+                if (event.type === "input_applied")
+                    record.inputDelivery = "applied";
+                if (event.type === "input_rejected")
+                    record.inputDelivery = "rejected";
                 record.updatedAt = Date.now();
                 emit("running", event);
             }

package/dist/agent/internal-reminder-sanitizer.d.ts

@@ -18,7 +18,7 @@ export declare function formatInternalReminderBlock(kind: string, content: strin
 export declare function formatInternalContextBlock(kind: string, content: string): string;
 export declare function sanitizeInternalReminderBlocks(text: string): string;
 export declare function sanitizeInternalReasoningText(text: string): string;
-export declare function sanitizeAssistantProviderMetadata(metadata: AssistantProviderMetadata | undefined): AssistantProviderMetadata | undefined;
+export declare function sanitizeAssistantProviderMetadata(metadata: AssistantProviderMetadata | undefined, model?: string): AssistantProviderMetadata | undefined;
 export declare function createStreamingInternalReminderSanitizer(): {
     push(delta: string): string;
     flush(): string;

package/dist/agent/internal-reminder-sanitizer.js

@@ -1,3 +1,4 @@
+import { isClaudeWithBoundThinking } from "../anthropic-thinking.js";
 const INTERNAL_TAG_PREFIX = "<bubble_internal_";
 const MEMORY_CITATION_TAG = "<oai-mem-citation";
 const INTERNAL_TAG_NAMES = ["reminder", "context"];
@@ -71,7 +72,12 @@ export function sanitizeInternalReasoningText(text) {
         .filter((paragraph) => !containsInternalReminderReference(paragraph))
         .join("\n\n");
 }
-export function sanitizeAssistantProviderMetadata(metadata) {
+export function sanitizeAssistantProviderMetadata(metadata, model) {
+    // These blocks are wire data, not display text. Removing thinking or editing
+    // earlier text invalidates later signatures. The separate content/reasoning
+    // fields remain sanitized for display; context checkpoints reset wire thinking.
+    if (isClaudeWithBoundThinking(model))
+        return metadata;
     const anthropic = metadata?.anthropic;
     const blocks = anthropic?.contentBlocks;
     if (!metadata || !anthropic || !blocks?.length)

package/dist/agent/profiles.js

@@ -5,7 +5,7 @@ import { randomInt } from "node:crypto";
 import { getSubtaskPolicy } from "./subtask-policy.js";
 const READONLY_PRESET = [
     "read",
-    "glob",
+    "ls",
     "grep",
     "lsp",
     "web_search",
@@ -123,12 +123,12 @@ export function builtinAgentProfiles() {
             "You are an explorer subagent for codebase reconnaissance.",
             "Answer the specific question by inspecting the repository directly. Prefer precise file paths and line-level evidence.",
             "Keep the answer compact and avoid broad refactors or implementation plans unless asked.",
-        ].join("\n"), ["read", "glob", "grep", "lsp", "memory", "skill"]),
+        ].join("\n"), ["read", "ls", "grep", "lsp", "memory", "skill"]),
         roleProfile("worker", "Implementation-planning worker subagent", [
             "You are a worker subagent. In this Phase 1 runtime you are read-only, so you must not modify files.",
             "Analyze the assigned implementation slice, identify exact files to change, and return a concrete patch plan or findings.",
             "If write-capable worker mode is needed, say so explicitly.",
-        ].join("\n"), ["read", "glob", "grep", "lsp", "memory", "skill"]),
+        ].join("\n"), ["read", "ls", "grep", "lsp", "memory", "skill"]),
         toProfile("search"),
         toProfile("security_investigation"),
         toProfile("evidence_correlation"),
@@ -145,7 +145,7 @@ export function builtinAgentProfiles() {
             model: "inherit",
             tools: {
                 preset: "explicit",
-                include: ["read", "glob", "grep", "edit", "write", "bash", "lsp"],
+                include: ["read", "ls", "grep", "edit", "write", "bash", "lsp"],
                 exclude: [],
             },
             approval: "fail",

package/dist/agent/routing-catalog.d.ts

@@ -10,7 +10,7 @@
  */
 import { type ModelTier } from "../model-catalog.js";
 import type { ProviderRegistry } from "../provider-registry.js";
-import { selectTierCandidates, type AgentCategoriesConfig, type TierRoutingContext } from "./categories.js";
+import { selectTierCandidates, type AgentCategoriesConfig, type TierCatalogEntry, type TierRoutingContext } from "./categories.js";
 import type { ThinkingLevel } from "../types.js";
 export interface AgentRoutingConfig {
     /** Automatic builtin-tier downgrade routing (§3.2). */
@@ -36,6 +36,15 @@ export interface RoutingSnapshot {
         model: string;
         tier?: ModelTier;
     };
+    /**
+     * Subscription (OAuth) catalogs are account-scoped: the server decides which
+     * models this account may use, so only models the CURRENT identity's
+     * discovery snapshot (or the user's models.json) confirmed may be chosen by
+     * automatic tier routing. API-key providers keep their builtin tiers routable.
+     */
+    accountScopedCatalog: boolean;
+    /** Models automatic tier routing may pick from (see accountScopedCatalog). */
+    tierCatalog: TierCatalogEntry[];
     /** Catalog-effective provider id (openai OAuth -> "openai-codex" alias). */
     effectiveProviderId: string;
     membershipSource: RoutingMembershipSource;
@@ -74,6 +83,15 @@ export declare function buildRoutingSnapshot(registry: ProviderRegistry, parent:
     providerId: string;
     model: string;
 }, agentCategories: AgentCategoriesConfig, agentRouting: AgentRoutingConfig): RoutingSnapshot;
+/**
+ * Catalog visible to automatic tier routing. On an account-scoped catalog only
+ * models confirmed by the current identity's discovery snapshot, or listed by
+ * the user in models.json, are candidates. A builtin-only entry (e.g. a static
+ * fast-tier model the ChatGPT plan does not include) or an overlay entry left
+ * by another account's cache would otherwise be routed to and rejected
+ * server-side. Without a snapshot nothing but user-listed models qualifies.
+ */
+export declare function tierCatalogEntries(models: readonly RoutingModelEntry[], accountScopedCatalog: boolean, confirmedIds?: ReadonlySet<string>): TierCatalogEntry[];
 /** Tier-resolution context derived from a snapshot (consumed by categories §3.2). */
 export declare function tierContextFromSnapshot(snapshot: RoutingSnapshot, agentRouting: AgentRoutingConfig): TierRoutingContext;
 /**

package/dist/agent/routing-catalog.js

@@ -37,6 +37,7 @@ export function buildRoutingSnapshot(registry, parent, agentCategories, agentRou
     const effectiveProviderId = parent.providerId === "openai" && configured?.authType === "oauth"
         ? "openai-codex"
         : parent.providerId;
+    const accountScopedCatalog = configured?.authType === "oauth";
     const builtins = listBuiltinModels(effectiveProviderId);
     const builtinIndex = new Map(builtins.map((model, index) => [model.id, index]));
     const dynamic = listDynamicModelMetadata(effectiveProviderId);
@@ -101,8 +102,16 @@ export function buildRoutingSnapshot(registry, parent, agentCategories, agentRou
     const parentTier = models.find((model) => model.id === parent.model)?.tier
         ?? getBuiltinModel(effectiveProviderId, parent.model)?.tier;
     const runnableProviderIds = registry.getEnabled().map((provider) => provider.id);
+    // The dynamic overlay is provider-wide and is rebuilt from EVERY unexpired
+    // disk-cache entry at startup (other accounts, older client pins included),
+    // so "dynamic" membership alone does not prove this account can use a model.
+    // Only the current identity's own COMPLETE discovery does: a failed fetch is
+    // cached briefly as a builtin fallback and must not confirm anything.
+    const tierCatalog = tierCatalogEntries(models, accountScopedCatalog, discovery?.complete ? new Set(discovery.models.map((model) => model.id)) : undefined);
     return {
         parent: { ...parent, tier: parentTier },
+        accountScopedCatalog,
+        tierCatalog,
         effectiveProviderId,
         membershipSource,
         models,
@@ -110,19 +119,34 @@ export function buildRoutingSnapshot(registry, parent, agentCategories, agentRou
         registryRevision: registry.getRoutingRevision(),
         discoveryExpiresAt: discovery?.expiresAt,
         runnableProviderIds,
-        resolvedCategories: resolveCategoriesForMenu(parent, parentTier, models, agentCategories, agentRouting),
+        resolvedCategories: resolveCategoriesForMenu(parent, parentTier, tierCatalog, agentCategories, agentRouting),
     };
 }
+/**
+ * Catalog visible to automatic tier routing. On an account-scoped catalog only
+ * models confirmed by the current identity's discovery snapshot, or listed by
+ * the user in models.json, are candidates. A builtin-only entry (e.g. a static
+ * fast-tier model the ChatGPT plan does not include) or an overlay entry left
+ * by another account's cache would otherwise be routed to and rejected
+ * server-side. Without a snapshot nothing but user-listed models qualifies.
+ */
+export function tierCatalogEntries(models, accountScopedCatalog, confirmedIds) {
+    return models
+        .filter((model) => (!accountScopedCatalog
+        || model.source === "custom"
+        || (confirmedIds?.has(model.id) ?? false)))
+        .map((model) => ({
+        id: model.id,
+        tier: model.tier,
+        routingPriority: model.routingPriority,
+        builtinIndex: model.builtinIndex,
+    }));
+}
 /** Tier-resolution context derived from a snapshot (consumed by categories §3.2). */
 export function tierContextFromSnapshot(snapshot, agentRouting) {
     return {
         parentTier: snapshot.parent.tier,
-        models: snapshot.models.map((model) => ({
-            id: model.id,
-            tier: model.tier,
-            routingPriority: model.routingPriority,
-            builtinIndex: model.builtinIndex,
-        })),
+        models: snapshot.tierCatalog,
         autoTier: agentRouting.autoTier,
     };
 }
@@ -150,12 +174,7 @@ function resolveCategoriesForMenu(parent, parentTier, models, agentCategories, a
     const merged = mergeAgentCategoriesWithProvenance(agentCategories);
     const tierContext = {
         parentTier,
-        models: models.map((model) => ({
-            id: model.id,
-            tier: model.tier,
-            routingPriority: model.routingPriority,
-            builtinIndex: model.builtinIndex,
-        })),
+        models,
         autoTier: agentRouting.autoTier,
     };
     return Object.entries(merged).map(([name, entry]) => {

package/dist/agent/subagent/runtime.d.ts

@@ -1,3 +1,28 @@
+/**
+ * Subagent thread lifecycle + dynamic-workflow execution.
+ *
+ * Extracted from Agent: spawn/wait/send/close, the scheduler dispatch and its
+ * terminal callbacks, admission, ingestion, worktree-backed child construction
+ * and the QuickJS workflow driver all lived on the Agent class alongside the
+ * conversation loop, sharing its private fields.
+ *
+ * Two rules keep the boundary honest:
+ *  - Everything the runtime needs from the parent arrives through
+ *    `SubagentRuntimeParent` as a LIVE accessor, never a construction-time
+ *    snapshot: `/model` reassigns the parent's provider/model/thinking
+ *    mid-session and children must inherit the current values.
+ *  - Conversation state is never pushed back into the parent. Tool updates
+ *    and ingestion notices are PULLED (`drainToolUpdates` /
+ *    `drainIngestionNotices`). The only direct sink is a terminal,
+ *    fail-closed provider diagnostic that contains no child transcript.
+ *
+ * `new Agent(...)` stays on Agent, reached through `parent.createChild`. That
+ * is the only genuine call back into the parent, and keeping it there is what
+ * guarantees the child-construction argument set — including the fields that
+ * must stay ABSENT (onMessageAppend, sessionID, routing catalog) — has exactly
+ * one definition site.
+ */
+import type { SkillSummary } from "../../skills/types.js";
 import { type AgentProfile, type SubagentRunResult } from "../profiles.js";
 import { type SubagentThreadRecord, type SubagentThreadSnapshot } from "../subagent-control.js";
 import { SubagentStore } from "../subagent-store.js";
@@ -36,6 +61,9 @@ export interface SubagentRuntimeParent {
     readonly apiModel: string;
     readonly thinkingLevel: ThinkingLevel;
     readonly memoryPrompt: string | undefined;
+    /** Optional so lightweight parents (tests, embedders) need not provide a catalog. */
+    getSkillSummaries?(): SkillSummary[];
+    getSkillCatalogChars?(): number | undefined;
     readonly providerFactory: ((route: ResolvedSubagentRoute) => Provider | Promise<Provider>) | undefined;
     /**
      * The UNFILTERED tool map — deferred-but-unlocked entries included. Profile

package/dist/agent/subagent/runtime.js

@@ -1,27 +1,4 @@
-/**
- * Subagent thread lifecycle + dynamic-workflow execution.
- *
- * Extracted from Agent: spawn/wait/send/close, the scheduler dispatch and its
- * terminal callbacks, admission, ingestion, worktree-backed child construction
- * and the QuickJS workflow driver all lived on the Agent class alongside the
- * conversation loop, sharing its private fields.
- *
- * Two rules keep the boundary honest:
- *  - Everything the runtime needs from the parent arrives through
- *    `SubagentRuntimeParent` as a LIVE accessor, never a construction-time
- *    snapshot: `/model` reassigns the parent's provider/model/thinking
- *    mid-session and children must inherit the current values.
- *  - Conversation state is never pushed back into the parent. Tool updates
- *    and ingestion notices are PULLED (`drainToolUpdates` /
- *    `drainIngestionNotices`). The only direct sink is a terminal,
- *    fail-closed provider diagnostic that contains no child transcript.
- *
- * `new Agent(...)` stays on Agent, reached through `parent.createChild`. That
- * is the only genuine call back into the parent, and keeping it there is what
- * guarantees the child-construction argument set — including the fields that
- * must stay ABSENT (onMessageAppend, sessionID, routing catalog) — has exactly
- * one definition site.
- */
+import { AgentRunInputQueue } from "../input-controller.js";
 import { randomUUID } from "node:crypto";
 import { buildSystemPrompt } from "../../system-prompt.js";
 import { buildToolPromptOptions } from "../../tools/index.js";
@@ -78,6 +55,12 @@ export class SubagentRuntime {
             recordProviderError: (record, error, request) => this.recordSubagentProviderError(record, error, request),
             notifyWaiters: (record) => this.store.notifyWaiters(record),
             onFinal: (record, options) => {
+                if ((record.inputQueue?.pendingInputCount() ?? 0) > 0) {
+                    record.inputQueue?.closePendingInputs();
+                    record.inputDelivery = "rejected";
+                    record.toolNotes.push("Pending supplementary input was not delivered because the run ended.");
+                    this.emitSubagentLifecycle(record, options, record.status === "closed" ? "cancelled" : record.status);
+                }
                 this.reclaimWorktree(record);
                 // Workflow-internal agents are not persisted (they never re-import into
                 // the store on restart) and never ingest into parent context (option C).
@@ -240,17 +223,31 @@ export class SubagentRuntime {
         }
         if (record.status === "running" || record.status === "queued") {
             if (!options.interrupt) {
-                throw new Error(`Subagent ${agentId} is still running. Call wait_agent first or pass interrupt:true.`);
+                if (typeof input !== "string")
+                    throw new Error("Running subagents currently accept text follow-ups only.");
+                record.inputQueue ??= new AgentRunInputQueue(`child-${agentId}`);
+                if (record.inputQueue.tryEnqueue(input)) {
+                    record.inputDelivery = "queued";
+                    record.updatedAt = Date.now();
+                    this.queueSubagentUpdate(record, record.status, undefined, "Supplementary input queued for the next safe boundary.");
+                    return this.snapshotSubagent(record);
+                }
+                // Admission closed at the final boundary. Resume only after the old
+                // run has fully settled; never run the same child concurrently.
+                await record.promise?.catch(() => undefined);
+            }
+            if (options.interrupt) {
+                record.abortController.abort(new SubagentAbortError(`Subagent ${agentId} interrupted.`, "interrupt"));
+                await record.promise?.catch(() => undefined);
             }
-            record.abortController.abort(new SubagentAbortError(`Subagent ${agentId} interrupted.`, "interrupt"));
-            await record.promise?.catch(() => undefined);
-            record.abortController = new AbortController();
         }
         if (record.status === "closed") {
             throw new Error(`Subagent ${agentId} is closed.`);
         }
-        record.parentToolCallId = options.parentToolCallId ?? record.parentToolCallId;
-        record.parentToolName = "send_input";
+        // Identity and trace anchor belong to the child, not a follow-up tool call.
+        record.abortController = new AbortController();
+        record.inputQueue = new AgentRunInputQueue(`child-${agentId}-${Date.now()}`);
+        record.inputDelivery = undefined;
         record.task = typeof input === "string" ? input : "(multimodal task)";
         record.summary = "";
         record.toolNotes = [];
@@ -638,6 +635,7 @@ export class SubagentRuntime {
             toolNotes: [],
             createdAt: now,
             updatedAt: now,
+            inputQueue: new AgentRunInputQueue(`child-input-${randomUUID()}`),
             abortController: new AbortController(),
             waiters: new Set(),
         };
@@ -692,6 +690,10 @@ export class SubagentRuntime {
             mode: childMode,
             workingDir: childCwd,
             ...buildToolPromptOptions(tools),
+            // A child that can load skills sees the same catalog as its parent.
+            ...(childToolNames.includes("skill")
+                ? { skills: this.parent.getSkillSummaries?.(), skillCatalogChars: this.parent.getSkillCatalogChars?.() }
+                : {}),
             memoryPrompt: childToolNames.some((name) => name === "memory")
                 ? this.parent.memoryPrompt
                 : undefined,
@@ -779,6 +781,8 @@ export class SubagentRuntime {
                         error: record.error,
                         createdAt: record.createdAt,
                         updatedAt: record.updatedAt,
+                        pendingInputCount: record.inputQueue?.pendingInputCount() ?? 0,
+                        inputDelivery: record.inputDelivery,
                     }],
             },
         };

package/dist/agent/subagent-control.d.ts

@@ -1,3 +1,4 @@
+import type { AgentRunInputQueue } from "./input-controller.js";
 import type { AgentProfile, AgentProfileSource, SubagentRunResult } from "./profiles.js";
 import type { ResolvedSubagentRoute } from "./categories.js";
 import type { SubagentWorktree } from "./worktree.js";
@@ -31,6 +32,8 @@ export interface SubagentThreadSnapshot {
     createdAt: number;
     updatedAt: number;
     deliveredAt?: number;
+    pendingInputCount?: number;
+    inputDelivery?: "queued" | "applied" | "rejected";
     /** 1-based position in the scheduler queue while status is "queued". */
     queuePosition?: number;
     /** Present for write_worktree children: where the isolated checkout lives. */
@@ -72,12 +75,16 @@ export interface SubagentThreadRecord {
     hookStopPending?: boolean;
     abortController: AbortController;
     waiters: Set<() => void>;
+    inputQueue?: AgentRunInputQueue;
+    inputDelivery?: "queued" | "applied" | "rejected";
     agent?: {
         messages: Message[];
         injectSystemReminder(content: string): void;
         run(input: string | ContentPart[], cwd: string, options?: {
             abortSignal?: AbortSignal;
             resumeWithoutInput?: boolean;
+            inputController?: import("../types.js").AgentInputController;
+            continueOnPendingInput?: boolean;
         }): AsyncIterable<AgentEvent>;
     };
     messages?: Message[];

package/dist/agent/subagent-control.js

@@ -33,6 +33,8 @@ export function snapshotSubagentThread(record) {
         createdAt: record.createdAt,
         updatedAt: record.updatedAt,
         deliveredAt: record.deliveredAt,
+        pendingInputCount: record.inputQueue?.pendingInputCount() ?? 0,
+        inputDelivery: record.inputDelivery,
         worktree: record.worktree ? { ...record.worktree } : undefined,
     };
 }

package/dist/agent/subagent-lifecycle-reminder.js

@@ -1,3 +1,4 @@
+import { SUBAGENT_WAIT_GUIDANCE } from "./subagent-wait-guidance.js";
 const FINAL_STATUSES = new Set(["completed", "failed", "blocked", "cancelled", "closed"]);
 const STATUS_ORDER = ["queued", "running", "completed", "blocked", "failed", "cancelled", "closed"];
 export function buildSubagentLifecycleReminder(snapshots, toolResults) {
@@ -17,7 +18,7 @@ export function buildSubagentLifecycleReminder(snapshots, toolResults) {
         ...subagents.map(formatSubagentLine),
         "- Count unique agent_id values only; do not count repeated spawn_agent/wait_agent tool calls or repeated UI Subagents blocks as additional subagents.",
         "- Do not describe a subagent as running or still working if its status above is completed, failed, blocked, cancelled, or closed.",
-        "- After spawn_agent, call wait_agent before user-facing progress narration unless you are doing concrete non-overlapping local work.",
+        ...SUBAGENT_WAIT_GUIDANCE.map((guidance) => `- ${guidance}`),
         "- When writing a synthesis, use the exact unique subagent count and statuses above.",
     ];
     return lines.join("\n");

package/dist/agent/subagent-wait-guidance.d.ts

@@ -0,0 +1,2 @@
+/** Scheduling advice, not a timeout policy: the model keeps control of each wait. */
+export declare const SUBAGENT_WAIT_GUIDANCE: readonly ["Coordinate around dependencies: after delegation, continue useful non-overlapping work that does not require the child's result; wait_agent when that result is needed for your next meaningful step or final synthesis.", "Choose a wait timeout according to the task and your next decision. It is an upper bound, not a mandatory delay: wait_agent returns early when a target finishes, so a generous timeout does not slow down a short task.", "A short wait is appropriate when its outcome informs a concrete scheduling decision. Avoid repeated short checks solely to see whether time has passed; use list_agents for a status snapshot when that information is useful.", "The same decision-value principle applies to list_agents: do not replace short waits with repeated status polling. With multiple children, wait_agent may return as soon as any target finishes; use explicit IDs for the remaining children whose results you still need, rather than repeatedly collecting an already-finished child.", "A timeout ends only that wait, not the child's work. Reassess available independent work and whether the result still blocks progress before waiting again; do not duplicate the delegated task."];

package/dist/agent/subagent-wait-guidance.js

@@ -0,0 +1,8 @@
+/** Scheduling advice, not a timeout policy: the model keeps control of each wait. */
+export const SUBAGENT_WAIT_GUIDANCE = [
+    "Coordinate around dependencies: after delegation, continue useful non-overlapping work that does not require the child's result; wait_agent when that result is needed for your next meaningful step or final synthesis.",
+    "Choose a wait timeout according to the task and your next decision. It is an upper bound, not a mandatory delay: wait_agent returns early when a target finishes, so a generous timeout does not slow down a short task.",
+    "A short wait is appropriate when its outcome informs a concrete scheduling decision. Avoid repeated short checks solely to see whether time has passed; use list_agents for a status snapshot when that information is useful.",
+    "The same decision-value principle applies to list_agents: do not replace short waits with repeated status polling. With multiple children, wait_agent may return as soon as any target finishes; use explicit IDs for the remaining children whose results you still need, rather than repeatedly collecting an already-finished child.",
+    "A timeout ends only that wait, not the child's work. Reassess available independent work and whether the result still blocks progress before waiting again; do not duplicate the delegated task.",
+];

package/dist/agent/subtask-policy.js

@@ -1,11 +1,11 @@
 const POLICY_MAP = {
     search: {
         type: "search",
-        allowedTools: ["read", "glob", "grep", "web_search", "web_fetch", "skill"],
+        allowedTools: ["read", "ls", "grep", "web_search", "web_fetch", "skill"],
         reminder: [
             "Subtask policy: search",
             "- Focus on locating relevant files, symbols, and evidence quickly.",
-            "- Use glob for file discovery and grep for content search.",
+            "- Use ls for directory contents and grep for content search.",
             "- Return a concise summary of what you found and where.",
         ].join("\n"),
         resultStatus: "success",
@@ -13,7 +13,7 @@ const POLICY_MAP = {
     },
     security_investigation: {
         type: "security_investigation",
-        allowedTools: ["read", "glob", "grep", "web_search", "web_fetch", "skill"],
+        allowedTools: ["read", "ls", "grep", "web_search", "web_fetch", "skill"],
         reminder: [
             "Subtask policy: security_investigation",
             "- Investigate only in read-only mode.",
@@ -37,7 +37,7 @@ const POLICY_MAP = {
     },
     general_readonly: {
         type: "general_readonly",
-        allowedTools: ["read", "glob", "grep", "web_search", "web_fetch", "skill"],
+        allowedTools: ["read", "ls", "grep", "web_search", "web_fetch", "skill"],
         reminder: [
             "Subtask policy: general_readonly",
             "- Stay in read-only mode.",