@gajae-code/coding-agent 0.11.4 → 0.11.6

package/src/session/session-storage.ts

@@ -5,6 +5,11 @@ import * as path from "node:path";
 import * as native from "@gajae-code/natives";
 
 import { isEnoent, pathIsWithin, peekFile, toError } from "@gajae-code/utils";
+import {
+	assertManagedDirectoryRoot,
+	type ManagedDirectoryRoot,
+	validateNativeSecurityResult,
+} from "./internal/managed-session-storage";
 
 const utf8Decoder = new TextDecoder("utf-8");
 function canonicalPathSync(value: string): string {
@@ -89,8 +94,41 @@ export interface SessionStorageWriterOpenOptions {
 	onError?: (err: Error) => void;
 	/** Injectable OS-close dispatcher; defaults to `fs.closeSync`. */
 	closeAdapter?: SessionStorageWriterCloseAdapter;
+	/** Opaque authority for default-computed managed destinations only. */
+	securityContext?: SessionStorageSecurityContext;
 }
 
+/**
+ * Immutable authority attached only to a computed managed session destination.
+ * A caller-supplied pathname never receives this capability, even when it
+ * happens to equal the current default session directory.
+ */
+export interface ManagedSessionSecurityContext {
+	readonly kind: "managed";
+	readonly agentDir: string;
+	readonly sessionsRoot: string;
+	readonly sessionDir: string;
+	readonly rootAuthority: ManagedDirectoryRoot;
+	readonly retainedAuthority?: native.RecoveryFsRoot;
+}
+
+const managedSecurityContexts = new WeakSet<ManagedSessionSecurityContext>();
+
+/** @internal Create the only accepted managed writer authority object. */
+export function createManagedSessionSecurityContext(input: {
+	agentDir: string;
+	sessionsRoot: string;
+	sessionDir: string;
+	rootAuthority: ManagedDirectoryRoot;
+	retainedAuthority?: native.RecoveryFsRoot;
+}): ManagedSessionSecurityContext {
+	const context = Object.freeze({ kind: "managed" as const, ...input });
+	managedSecurityContexts.add(context);
+	return context;
+}
+
+export type SessionStorageSecurityContext = ManagedSessionSecurityContext | undefined;
+
 export interface SessionStorageWriter {
 	writeLine(line: string): Promise<void>;
 	/**
@@ -268,8 +306,6 @@ const defaultCloseAdapter: SessionStorageWriterCloseAdapter = {
 	},
 };
 
-type NativeSecurity = { ok: true } | { ok: false; code: string };
-
 type NativeExactUnlinkResult = { ok: true; detachedPath?: string } | { ok: false; code: string; detachedPath?: string };
 type NativeExactUnlink = (
 	path: string,
@@ -309,6 +345,7 @@ type NativeDirectoryTreeEntry = {
 	ino: string;
 	size: string;
 	mtimeNs: string;
+	ctimeNs: string;
 	sha256?: string;
 };
 export type NativeDirectoryTreeSnapshot = {
@@ -349,11 +386,57 @@ function exactUnlinkFailure(result: NativeExactUnlinkResult): SessionDeleteVerif
 				: "stat";
 	return new SessionDeleteVerificationError(kind, `Exact transcript deletion rejected: ${result.code}`);
 }
-function secureOwnerOnlyFile(pathname: string): void {
-	const applied = native.applyOwnerOnlyPathSecurity(pathname, "file") as NativeSecurity;
-	if (!applied.ok) throw new Error(`Owner-only security rejected ${pathname}: ${applied.code}`);
-	const verified = native.verifyOwnerOnlyPathSecurity(pathname, "file") as NativeSecurity;
-	if (!verified.ok) throw new Error(`Owner-only security rejected ${pathname}: ${verified.code}`);
+
+function isValidManagedSecurityContext(value: SessionStorageSecurityContext): value is ManagedSessionSecurityContext {
+	if (
+		value?.kind !== "managed" ||
+		!Object.isFrozen(value) ||
+		!managedSecurityContexts.has(value) ||
+		!pathIsWithin(value.agentDir, value.sessionsRoot) ||
+		!pathIsWithin(value.sessionsRoot, value.sessionDir)
+	) {
+		return false;
+	}
+	assertManagedDirectoryRoot(value.rootAuthority);
+	if (!pathIsWithin(value.rootAuthority.canonicalPath, value.agentDir)) return false;
+	return true;
+}
+
+function secureOwnerOnlyFileDescriptor(
+	pathname: string,
+	fd: number,
+	operation: "apply" | "verify",
+	securityContext: SessionStorageSecurityContext,
+): void {
+	if (securityContext && !isValidManagedSecurityContext(securityContext))
+		throw new Error("Invalid managed session security context");
+	if (process.platform !== "linux" || !securityContext) {
+		if (operation === "apply") {
+			const applied = validateNativeSecurityResult(
+				native.applyOwnerOnlyPathSecurity(pathname, "file"),
+				"apply",
+				"file",
+			);
+			if (!applied.ok) throw new Error(`Owner-only security rejected ${pathname}: ${applied.code}`);
+		}
+		const verified = validateNativeSecurityResult(
+			native.verifyOwnerOnlyPathSecurity(pathname, "file"),
+			"verify",
+			"file",
+		);
+		if (!verified.ok) throw new Error(`Owner-only security rejected ${pathname}: ${verified.code}`);
+		return;
+	}
+	if (!pathIsWithin(securityContext.sessionDir, pathname))
+		throw new Error(`Managed writer escaped its session directory: ${pathname}`);
+	const result = validateNativeSecurityResult(
+		operation === "apply"
+			? native.applyOwnerOnlyFdSecurity(pathname, "file", fd)
+			: native.verifyOwnerOnlyFdSecurity(pathname, "file", fd),
+		operation,
+		"file",
+	);
+	if (!result.ok) throw new Error(`Owner-only security rejected ${pathname}: ${result.code}`);
 }
 
 /** Reject a symlink/junction/reparse component before a storage path is created or opened. */
@@ -383,35 +466,41 @@ const writerRegistry = new FinalizationRegistry<number>(fd => {
 
 class FileSessionStorageWriter implements SessionStorageWriter {
 	#fd: number;
+	#path: string;
+
 	#closeState: SessionStorageWriterCloseState = "open";
 	#closeError: Error | undefined;
 	#error: Error | undefined;
 	#onError: ((err: Error) => void) | undefined;
 	#closeAdapter: SessionStorageWriterCloseAdapter;
+	#securityContext: SessionStorageSecurityContext;
 
 	constructor(fpath: string, options?: SessionStorageWriterOpenOptions) {
 		this.#onError = options?.onError;
 		this.#closeAdapter = options?.closeAdapter ?? defaultCloseAdapter;
+		this.#securityContext = options?.securityContext;
 		const flags = options?.flags ?? "a";
 		const dir = path.dirname(fpath);
 		assertNoReparsePath(dir);
 		if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
 		assertNoReparsePath(dir);
 		assertNoReparsePath(fpath);
-		// The creation mode prevents a POSIX exposure before the native verifier runs.
+		// Never truncate before the descriptor and its terminal pathname have passed native security.
 		const openFlags =
 			(flags === "w"
-				? fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC
+				? fs.constants.O_WRONLY | fs.constants.O_CREAT
 				: fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND) | (fs.constants.O_NOFOLLOW ?? 0);
 		const fd = fs.openSync(fpath, openFlags, 0o600);
 		try {
-			// Do not rely on directory inheritance: secure and verify every file independently.
-			secureOwnerOnlyFile(fpath);
+			secureOwnerOnlyFileDescriptor(fpath, fd, "apply", this.#securityContext);
+			if (flags === "w") fs.ftruncateSync(fd, 0);
 		} catch (error) {
 			fs.closeSync(fd);
 			throw error;
 		}
 		this.#fd = fd;
+		this.#path = fpath;
+
 		writerRegistry.register(this, this.#fd, this);
 	}
 
@@ -469,6 +558,7 @@ class FileSessionStorageWriter implements SessionStorageWriter {
 		if (this.#error) throw this.#error;
 		try {
 			fs.fsyncSync(this.#fd);
+			secureOwnerOnlyFileDescriptor(this.#path, this.#fd, "verify", this.#securityContext);
 		} catch (err) {
 			throw this.#recordError(err);
 		}
@@ -481,6 +571,14 @@ class FileSessionStorageWriter implements SessionStorageWriter {
 		// for this numeric fd again; surface the stored non-quiescent error.
 		if (this.#closeState === "close_unknown") throw this.#closeError!;
 		// State is "open" or "close_failed_retryable": a close may be dispatched.
+		try {
+			secureOwnerOnlyFileDescriptor(this.#path, this.#fd, "verify", this.#securityContext);
+		} catch (err) {
+			// Verification happens before the OS-close dispatch, so descriptor ownership remains proven.
+			this.#closeState = "close_failed_retryable";
+			this.#closeError = toError(err);
+			throw this.#closeError;
+		}
 		try {
 			this.#closeAdapter.close(this.#fd);
 		} catch (err) {

package/src/session/streaming-output.ts

@@ -54,6 +54,10 @@ export interface OutputSummary {
 }
 
 export interface OutputSinkOptions {
+	/**
+	 * Deprecated managed artifact pathname. Bare paths are deliberately ignored:
+	 * streaming output must be terminally published through ArtifactManager.
+	 */
 	artifactPath?: string;
 	artifactId?: string;
 	/** Tail buffer budget (bytes). Default DEFAULT_MAX_BYTES. */
@@ -736,6 +740,8 @@ export class OutputSink {
 			artifactMaxBytes = DEFAULT_ARTIFACT_MAX_BYTES,
 			coalesceSanitize = process.env.PI_OUTPUT_SANITIZE_COALESCE === "1",
 		} = options ?? {};
+		// Managed callers omit artifactPath at the allocation boundary; explicit callers
+		// retain the existing pathname-backed streaming contract.
 		this.#artifactPath = artifactPath;
 		this.#artifactId = artifactId;
 		this.#spillThreshold = spillThreshold;

package/src/session/yield-queue.ts

@@ -107,6 +107,26 @@ export class YieldQueue {
 		this.#idleFlushPending = false;
 	}
 
+	/** Drop only the queued entries of a single kind, leaving other kinds intact. */
+	clearKind(kind: string): void {
+		this.#entries.delete(kind);
+	}
+
+	/**
+	 * Re-schedule an idle flush if work remains and the session is idle. Used after
+	 * a transition (e.g. handoff) releases a delivery fence so entries queued while
+	 * fenced are not stranded until an unrelated enqueue or agent yield.
+	 */
+	rearmIdle(): void {
+		if (this.#options.isStreaming()) return;
+		for (const entries of this.#entries.values()) {
+			if (entries.length > 0) {
+				this.#scheduleIdleFlush();
+				return;
+			}
+		}
+	}
+
 	#scheduleIdleFlush(): void {
 		if (this.#idleFlushPending) return;
 		this.#idleFlushPending = true;

package/src/slash-commands/builtin-registry.ts

@@ -1435,6 +1435,42 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 			await runtime.ctx.handleCompactCommand(customInstructions);
 		},
 	},
+	{
+		name: "handoff",
+		priority: 71,
+		description: "Generate a handoff and continue in a new session",
+		acpDescription: "Generate a handoff document and start a new session",
+		inlineHint: "[focus instructions]",
+		acpInputHint: "[focus instructions]",
+		allowArgs: true,
+		handle: async (command, runtime) => {
+			let result: Awaited<ReturnType<typeof runtime.session.handoff>>;
+			try {
+				result = await runtime.session.handoff(command.args || undefined);
+			} catch (err) {
+				// Handoff precondition failures (nothing to hand off, streaming),
+				// cancellation, and provider errors propagate as plain Errors; the
+				// switch is non-destructive so the current session is unchanged.
+				return usage(`Handoff failed: ${errorMessage(err)}; current session is unchanged.`, runtime);
+			}
+			if (!result) {
+				return usage(
+					"Handoff not created (cancelled or nothing to hand off); current session is unchanged.",
+					runtime,
+				);
+			}
+			await runtime.output(
+				result.savedPath
+					? `Handoff created; new session started. Handoff document saved to: ${result.savedPath}`
+					: "Handoff created; new session started with handoff context.",
+			);
+			return commandConsumed();
+		},
+		handleTui: async (command, runtime) => {
+			runtime.ctx.editor.setText("");
+			await runtime.ctx.handleHandoffCommand(command.args || undefined);
+		},
+	},
 	{
 		name: "contribute-pr",
 		aliases: ["contribution-prep"],

package/src/task/executor.ts

@@ -5,7 +5,6 @@
  */
 
 import { createHash } from "node:crypto";
-import * as fs from "node:fs/promises";
 import path from "node:path";
 import type {
 	AgentEvent,
@@ -50,6 +49,7 @@ import { ToolAbortError } from "../tools/tool-errors";
 import type { EventBus } from "../utils/event-bus";
 import { buildNamedToolChoiceResult } from "../utils/tool-choice";
 import type { WorkspaceTree } from "../workspace-tree";
+import { validateAllocatedTaskId } from "./id";
 import { subprocessToolRegistry } from "./subprocess-tool-registry";
 import { persistTaskTokenLog, taskTokenLogFromUsage } from "./token-log";
 import {
@@ -227,6 +227,7 @@ export interface ExecutorOptions {
 	 * artifacts directory (no per-subagent subdir).
 	 */
 	parentArtifactManager?: ArtifactManager;
+	managedPersistence?: ManagedTaskPersistence;
 	parentHindsightSessionState?: HindsightSessionState;
 	/**
 	 * Parent agent's OpenTelemetry configuration. When defined, the subagent's
@@ -242,6 +243,45 @@ export interface ExecutorOptions {
 	forkContextSeed?: ForkContextSeed;
 }
 
+export class ManagedTaskPersistence {
+	readonly #artifacts: ArtifactManager;
+	readonly #taskId: string;
+
+	constructor(artifacts: ArtifactManager, taskId: string) {
+		this.#artifacts = artifacts;
+		this.#taskId = validateAllocatedTaskId(taskId);
+		if (!artifacts.getManagedSubtreeRootAuthority())
+			throw new Error("Managed task persistence authority is unavailable");
+	}
+
+	async openSession(): Promise<SessionManager> {
+		const store = this.#artifacts.getManagedStore();
+		if (!store) throw new Error("Managed task persistence authority is unavailable");
+		this.#artifacts.assertManagedBinding();
+		const sessionFile = path.join(this.#artifacts.dir, `${this.#taskId}.jsonl`);
+		const session = await SessionManager.openNestedManaged(
+			sessionFile,
+			SessionManager.nestedManagedDestination(store, this.#artifacts.dir),
+			store,
+		);
+		this.#artifacts.assertManagedBinding();
+		return session;
+	}
+
+	async publishOutput(rawOutput: string, metadata: Uint8Array): Promise<void> {
+		await this.#artifacts.publishManagedOutputGeneration(
+			`${this.#taskId}.md.selector.json`,
+			`${this.#taskId}.md`,
+			Buffer.from(rawOutput, "utf8"),
+			metadata,
+		);
+	}
+}
+
+export function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string): ManagedTaskPersistence {
+	return new ManagedTaskPersistence(artifacts, taskId);
+}
+
 export function renderSubagentUserPrompt(assignment: string, independentMode: boolean): string {
 	return prompt.render(subagentUserPromptTemplate, { assignment: assignment.trim(), independentMode });
 }
@@ -888,7 +928,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				task,
 				assignment,
 				progress: { ...progress },
-				sessionFile: subtaskSessionFile,
+				sessionFile: null,
 			});
 		}
 		lastProgressEmitMs = Date.now();
@@ -1354,9 +1394,13 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				: (thinkingLevel ?? resolvedThinkingLevel);
 			effectiveThinkingLevelForWarning = effectiveThinkingLevel;
 
-			const sessionManager = sessionFile
-				? await awaitAbortable(SessionManager.open(sessionFile))
-				: SessionManager.inMemory(worktree ?? cwd);
+			const sessionManager = options.managedPersistence
+				? await awaitAbortable(options.managedPersistence.openSession())
+				: sessionFile
+					? await awaitAbortable(
+							SessionManager.open(sessionFile, SessionManager.explicitDestination(path.dirname(sessionFile))),
+						)
+					: SessionManager.inMemory(worktree ?? cwd);
 			if (options.parentArtifactManager) {
 				sessionManager.adoptArtifactManager(options.parentArtifactManager);
 			}
@@ -1556,7 +1600,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 					agentSource: agent.source,
 					description: options.description,
 					status: "started",
-					sessionFile: subtaskSessionFile,
+					sessionFile: null,
 					index,
 				});
 			}
@@ -1915,37 +1959,38 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 	// Write output artifact (input and jsonl already written in real-time)
 	// Compute output metadata for agent:// URL integration
 	let outputMeta: { lineCount: number; charCount: number; byteSize?: number; sha256?: string } | undefined;
-	let outputPath: string | undefined;
-	if (options.artifactsDir) {
-		const candidateOutputPath = path.join(options.artifactsDir, `${id}.md`);
+	// Never overwrite the artifact with empty output: a failed/no-op resume leg
+	// carries no new information and must preserve the previous retained output.
+	if (options.artifactsDir && rawOutput.length > 0) {
+		const managedPersistence = options.managedPersistence;
 		try {
-			await Bun.write(candidateOutputPath, rawOutput);
 			const byteSize = Buffer.byteLength(rawOutput, "utf8");
 			const lineCount = rawOutput.split("\n").length;
 			const sha256 = createHash("sha256").update(rawOutput).digest("hex");
 			const createdAt = new Date().toISOString();
-			await Bun.write(
-				`${candidateOutputPath}.meta.json`,
+			if (!managedPersistence) await Bun.write(path.join(options.artifactsDir, `${id}.md`), rawOutput);
+			const metadataBytes = Buffer.from(
 				JSON.stringify({ id, kind: "agent-output", sizeBytes: byteSize, lineCount, sha256, createdAt }, null, 2),
+				"utf8",
 			);
-			outputPath = candidateOutputPath;
+			if (managedPersistence) await managedPersistence.publishOutput(rawOutput, metadataBytes);
+			else await Bun.write(path.join(options.artifactsDir, `${id}.md.meta.json`), metadataBytes);
 			outputMeta = {
 				lineCount,
 				charCount: rawOutput.length,
 				byteSize,
 				sha256,
 			};
-		} catch {
-			// Output or metadata write failed: never advertise an unverifiable
-			// artifact. Best-effort remove any orphaned `.md`/sidecar so a later
-			// agent:// read cannot serve unverified content. Non-fatal.
-			outputPath = undefined;
-			outputMeta = undefined;
-			try {
-				await fs.rm(candidateOutputPath, { force: true });
-				await fs.rm(`${candidateOutputPath}.meta.json`, { force: true });
-			} catch {
-				// best-effort cleanup; ignore
+		} catch (error) {
+			if (!managedPersistence) {
+				// A missing sidecar keeps a partial immutable output invisible to agent://.
+				outputMeta = undefined;
+			} else {
+				const message = error instanceof Error ? error.message : String(error);
+				stderr = `${stderr}${stderr ? "\n" : ""}Managed output publication failed: ${message}`;
+				exitCode = 1;
+				paused = false;
+				progress.retryFailure = { attempt: 0, errorMessage: `Managed output publication failed: ${message}` };
 			}
 		}
 	}
@@ -1978,7 +2023,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			agentSource: agent.source,
 			description: options.description,
 			status: progress.status as "completed" | "failed" | "aborted" | "paused",
-			sessionFile: subtaskSessionFile,
+			sessionFile: null,
 			index,
 		});
 	}
@@ -2008,7 +2053,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 		paused,
 		usage: hasUsage ? accumulatedUsage : undefined,
 		usageCostBreakdownComplete: hasUsage && usageCostBreakdownComplete ? true : undefined,
-		outputPath,
+		outputPath: undefined,
 		extractedToolData: progress.extractedToolData,
 		retryFailure: progress.retryFailure,
 		outputMeta,

package/src/task/index.ts

@@ -43,11 +43,11 @@ import {
 
 // Import review tools for side effects (registers subagent tool handlers)
 import "../tools/review";
-import type { LocalProtocolOptions } from "../internal-urls";
+import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { generateCommitMessage } from "../utils/commit-message-generator";
 import * as git from "../utils/git";
 import { discoverAgents, filterVisibleAgents, getAgent } from "./discovery";
-import { renderSubagentUserPrompt, runSubprocess } from "./executor";
+import { createManagedTaskPersistence, renderSubagentUserPrompt, runSubprocess } from "./executor";
 import { adviseForkContextMode } from "./fork-context-advisory";
 import { FORK_CONTEXT_TOKEN_BUDGET_BY_MODE } from "./fork-context-budget";
 import { getTaskIdValidationError, validateAllocatedTaskId } from "./id";
@@ -581,7 +581,15 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						);
 						const finalText = result.content.find(part => part.type === "text")?.text ?? "(no output)";
 						const singleResult = result.details?.results[0];
-						return singleResult?.paused ? { kind: "paused" } : finalText;
+						if (singleResult?.paused) return { kind: "paused" };
+						// A resumed subprocess that aborted or exited non-zero is a failed
+						// resume, not a completed one. Throw the rendered failure summary
+						// (finalText) so the leg is reported failed instead of being
+						// returned as successful continuation.
+						if (singleResult && ((singleResult.aborted ?? false) || singleResult.exitCode !== 0)) {
+							throw new Error(finalText);
+						}
+						return finalText;
 					},
 					{
 						id: `${descriptor.task.id}-resume-${Snowflake.next()}`,
@@ -623,8 +631,20 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			});
 		};
 		const frozenForkSeeds = new Map<string, ForkContextSeed>();
+		const asyncParentArtifactManager = this.session.getArtifactManager?.() ?? undefined;
 		const parentSessionFileForBatch = this.session.getSessionFile();
 		const batchArtifactsDir = parentSessionFileForBatch ? parentSessionFileForBatch.slice(0, -6) : null;
+		let externalTaskSessionsDir: string | undefined;
+		if (!batchArtifactsDir) {
+			const asyncLocalOptions: LocalProtocolOptions = {
+				getArtifactsDir: this.session.getArtifactsDir ?? (() => null),
+				isManagedDestination: this.session.isManagedSessionDestination,
+				getSessionId: this.session.getSessionId ?? (() => null),
+			};
+			await initializeLocalRoot(asyncLocalOptions);
+			externalTaskSessionsDir = resolveLocalUrlToPath("local://subagents/sessions", asyncLocalOptions);
+			await fs.mkdir(externalTaskSessionsDir, { recursive: true, mode: 0o700 });
+		}
 
 		for (let i = 0; i < taskItems.length; i++) {
 			const taskItem = taskItems[i];
@@ -652,7 +672,12 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			const singleParams: TaskParams = { ...params, tasks: [taskItem] };
 			const label = uniqueId;
 			try {
-				const subtaskSessionFile = batchArtifactsDir ? path.join(batchArtifactsDir, `${uniqueId}.jsonl`) : null;
+				const managedPersistence = asyncParentArtifactManager?.getManagedStore()
+					? createManagedTaskPersistence(asyncParentArtifactManager, uniqueId)
+					: undefined;
+				const subtaskSessionFile = managedPersistence
+					? null
+					: path.join(batchArtifactsDir ?? externalTaskSessionsDir!, `${uniqueId}.jsonl`);
 				const jobId = manager.register(
 					"task",
 					label,
@@ -810,8 +835,8 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						currentJobId: jobId,
 						historicalJobIds: [],
 						status: manager.getJob(jobId)?.status ?? "running",
-						sessionFile: subtaskSessionFile,
-						resumable: !!batchArtifactsDir,
+						sessionFile: null,
+						resumable: true,
 					});
 				}
 			} catch (error) {
@@ -1132,6 +1157,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		// Share the parent session's local:// root with subagents so they read/write the same scratch space
 		const localProtocolOptions: LocalProtocolOptions = {
 			getArtifactsDir: this.session.getArtifactsDir ?? (() => null),
+			isManagedDestination: this.session.isManagedSessionDestination,
 			getSessionId: this.session.getSessionId ?? (() => null),
 		};
 
@@ -1141,6 +1167,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 
 		// Initialize progress tracking
 		const progressMap = new Map<number, AgentProgress>();
+		const isolatedPatchBytes = new Map<string, Buffer>();
 
 		// Update callback
 		const emitProgress = () => {
@@ -1201,14 +1228,16 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 				};
 			}
 
-			// Write parent conversation context for subagents. When IRC is available,
-			// subagents should ask live peers instead of reading a stale markdown dump.
-			await fs.mkdir(effectiveArtifactsDir, { recursive: true });
+			// Place fork-context handoff material in the session-scoped external local
+			// root. Subagent prompts may expose this path to subprocesses, so it must
+			// never carry managed transcript/artifact authority.
 			const shouldWriteConversationContext = !hasAvailableIrcTool(this.session);
 			const compactContext = shouldWriteConversationContext ? this.session.getCompactContext?.() : undefined;
 			let contextFilePath: string | undefined;
 			if (compactContext) {
-				contextFilePath = path.join(effectiveArtifactsDir, "context.md");
+				await initializeLocalRoot(localProtocolOptions);
+				contextFilePath = resolveLocalUrlToPath("local://subagents/context.md", localProtocolOptions);
+				await fs.mkdir(path.dirname(contextFilePath), { recursive: true, mode: 0o700 });
 				await Bun.write(contextFilePath, compactContext);
 			}
 
@@ -1307,7 +1336,12 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 					recommendedMode: advisory.recommendedMode,
 					reasons: advisory.reasons,
 				};
-				const taskSessionFile = overrides?.sessionFile ?? executionOverrides?.sessionFiles?.get(task.id) ?? null;
+				const managedPersistence = parentArtifactManager?.getManagedStore()
+					? createManagedTaskPersistence(parentArtifactManager, task.id)
+					: undefined;
+				const taskSessionFile = managedPersistence
+					? null
+					: (overrides?.sessionFile ?? executionOverrides?.sessionFiles?.get(task.id) ?? null);
 				if (!isIsolated) {
 					const result = await runSubprocess({
 						cwd: this.session.cwd,
@@ -1330,6 +1364,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						sessionFile: taskSessionFile,
 						persistArtifacts: !!artifactsDir,
 						artifactsDir: effectiveArtifactsDir,
+						managedPersistence,
 						contextFile: contextFilePath,
 						ircAvailable: hasAvailableIrcTool(this.session),
 						enableLsp: subagentLspEnabled,
@@ -1394,6 +1429,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						sessionFile: taskSessionFile,
 						persistArtifacts: !!artifactsDir,
 						artifactsDir: effectiveArtifactsDir,
+						managedPersistence,
 						contextFile: contextFilePath,
 						ircAvailable: hasAvailableIrcTool(this.session),
 						enableLsp: subagentLspEnabled,
@@ -1465,9 +1501,15 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 					if (resultWithForkContext.exitCode === 0) {
 						try {
 							const delta = await captureDeltaPatch(isolationDir, taskBaseline);
+							await initializeLocalRoot(localProtocolOptions);
 							const artifactId = validateAllocatedTaskId(task.id);
-							const patchPath = path.join(effectiveArtifactsDir, `${artifactId}.patch`);
+							const patchPath = resolveLocalUrlToPath(
+								`local://subagents/${artifactId}.patch`,
+								localProtocolOptions,
+							);
+							await fs.mkdir(path.dirname(patchPath), { recursive: true, mode: 0o700 });
 							await Bun.write(patchPath, delta.rootPatch);
+							isolatedPatchBytes.set(patchPath, Buffer.from(delta.rootPatch, "utf8"));
 							const producedChanges = Boolean(delta.rootPatch.trim() || delta.nestedPatches.length);
 							return {
 								...resultWithForkContext,
@@ -1622,19 +1664,20 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 							changesApplied = false;
 							hadAnyChanges = false;
 						} else {
-							const patchStats = await Promise.all(
-								patchesInOrder.map(async patchPath => ({
-									patchPath,
-									size: (await fs.stat(patchPath)).size,
-								})),
-							);
+							const patchStats = patchesInOrder.map(patchPath => ({
+								patchPath,
+								size: isolatedPatchBytes.get(patchPath)?.byteLength ?? -1,
+							}));
+							if (patchStats.some(patch => patch.size < 0)) {
+								throw new Error("Captured isolated patch bytes are unavailable");
+							}
 							const nonEmptyPatches = patchStats.filter(patch => patch.size > 0).map(patch => patch.patchPath);
 							if (nonEmptyPatches.length === 0) {
 								changesApplied = true;
 								hadAnyChanges = false;
 							} else {
-								const patchTexts = await Promise.all(
-									nonEmptyPatches.map(async patchPath => Bun.file(patchPath).text()),
+								const patchTexts = nonEmptyPatches.map(patchPath =>
+									isolatedPatchBytes.get(patchPath)!.toString("utf8"),
 								);
 								const combinedPatch = patchTexts
 									.map(text => (text.endsWith("\n") ? text : `${text}\n`))