@livx.cc/agentx 0.99.40 → 0.99.42

package/README.md

@@ -86,6 +86,7 @@ Beyond file tools, the runtime ships the higher-altitude pieces too — each an
 
 - **Skills + memory** — VFS-backed (`skillsDir`/`memoryDir`); persistence is just the backend choice.
 - **Subagents** (`subagents`; **typed agents** via `agentsDir` — `<dir>/<name>.md` defines a persona + model + scoped tools, selected with the `Task` `agentType`), **hooks** (`hooks`: preToolUse/postToolUse/onStop — block or audit any tool call), **slash-commands** (`commandsDir`), **TodoWrite**, **MCP** (`mcpToolsToAgentTools`).
+- **A delegated child is a full agent**: it inherits the parent's **tools** (incl. host-injected/MCP ones), **system prompt**, and **providerOptions** (only when it stays on the same provider — cursor's `cwd`/`cursorSession` never leak onto an anthropic child; override with `providerOptionsFor(model)`). `Task({ model })` (and a `TaskBatch` task's `model`) runs one sub-task on another model — alias or full id, precedence **explicit `model` > `agentType` def's `model` > parent's**. A def's frontmatter `tools:` allowlist narrows the inherited set and may name a host-injected tool by name; its body still overrides the persona. The host's `preToolUse` gate is inherited too, so delegation is not a way around it (the observer/lifecycle hooks stay parent-only). Inherited tools that escape the VFS are re-bound per child (`AgentTool.withCwd`): a `isolation:"worktree"` child's real `Shell` runs in the WORKTREE, keeping any host rename (`Shell` -> `Bash`) (background shell jobs are off there, and the parent-bound `ShellOutput`/`ShellStatus`/`ShellKill` are dropped rather than pointed at the parent's jobs); an overlay child's shell writes straight to the working tree — an overlay isolates the VFS, not a process.
 - **Streaming** (`stream: true` → `text_delta` via `HostBridge.notify`) and **context compaction** (`compaction: { maxMessages }` → edge-safe summarize-and-boundary). Defaults preserve the original non-stream, drop-oldest behavior.
 - **Multi-turn + project context** — `Agent.send()` continues a conversation across turns (vs `run()`, which starts fresh); **project instructions** (`instructionFiles`: `AGENTS.md`/`CLAUDE.md` at the FS root) inject into the system prompt.
 - **DuplexAgent** (`src/duplex.ts`) — voice-optimized three-tier engine (reflex/act/think): a fast reflex agent streams instant replies and self-selects escalation — `Act` for standard tool work (Sonnet-class), `Think` for deep reasoning (Opus-class, configurable, default on). Results are pushed back and re-voiced by the reflex (turn mutex, coalesced completions, `TaskStatus`/`CancelTask`). See [`mind/10`](./mind/10-duplex.md).

package/dist/{Agent-D4-CLnxC.d.ts → Agent-DydgLoT-.d.ts}

@@ -1,5 +1,5 @@
 import { IFilesystem } from '@livx.cc/wcli/core';
-import { M as Message, H as HostBridge, A as AgentTool, C as ChatLike, g as MessageContent, U as UserQuestion } from './tools-BWzPQVy0.js';
+import { M as Message, H as HostBridge, A as AgentTool, C as ChatLike, g as MessageContent, U as UserQuestion } from './tools-S-ArIR3o.js';
 
 /**
  * Hooks — deterministic interception points around tool execution, run by the
@@ -375,6 +375,10 @@ declare class AgentOptions {
     };
     /** Provider-specific options forwarded to ai.chat() (e.g. cursor mcpServers, cwd). */
     providerOptions?: Record<string, unknown>;
+    /** Derive `providerOptions` for a DELEGATED child whose model may differ from this agent's
+     *  (`Task({ model })` / an agentType def). Default: inherit `providerOptions` only when the child's
+     *  model is on the SAME provider — cursor's `cwd`/`cursorSession` on an anthropic child is a 400. */
+    providerOptionsFor?: (model: string) => Record<string, unknown> | undefined;
     /** Prompt caching (providers that support it, e.g. Anthropic): cache tools/system/conversation
      *  prefix across the loop's steps — reads cost 0.1x, writes 1.25x. A multi-step agent loop
      *  re-sends its whole prefix every step, so this is a large net cost cut. Default on. */

package/dist/cli.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
-import { H as Hooks, i as RunResult, R as ReasoningEffort, A as Agent } from './Agent-D4-CLnxC.js';
+import { H as Hooks, i as RunResult, R as ReasoningEffort, A as Agent } from './Agent-DydgLoT-.js';
 import { IFilesystem } from '@livx.cc/wcli/core';
-import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, g as MessageContent } from './tools-BWzPQVy0.js';
+import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, g as MessageContent } from './tools-S-ArIR3o.js';
 
 /**
  * On-disk session store for the CLI: each conversation is one JSON file at

package/dist/cli.js

@@ -1361,11 +1361,12 @@ function toolRegistry() {
   const all = [bashTool, readTool, editTool, grepTool, globTool, writeTool, multiEditTool, applyEditsTool, repoMapTool, reviewTool(), todoWriteTool, webFetchTool, webSearchTool, webSearchAnthropicTool];
   return Object.fromEntries(all.map((t) => [t.name, t]));
 }
-function toolsByName(names) {
+function toolsByName(names, available) {
   const reg = toolRegistry();
+  const extra = Object.fromEntries((available ?? []).map((t) => [t.name, t]));
   return names.map((n) => {
-    const t = reg[n];
-    if (!t) throw new Error(`unknown tool '${n}'. Known: ${Object.keys(reg).join(", ")}`);
+    const t = extra[n] ?? reg[n];
+    if (!t) throw new Error(`unknown tool '${n}'. Known: ${[.../* @__PURE__ */ new Set([...Object.keys(extra), ...Object.keys(reg)])].join(", ")}`);
     return t;
   });
 }
@@ -2159,8 +2160,26 @@ function makeRealShellTool(options) {
   };
   return {
     name: "Shell",
+    // Rebind for an isolated child agent (git worktree): same policy/env/timeouts, new cwd. The
+    // `registry` is deliberately dropped — it is bound to the PARENT's cwd (and, in hosts like
+    // shraga-ee, to the parent's session), so a background job started from the child would run
+    // outside the child's isolation and report into the parent. Background stays a parent capability
+    // (`makeShellJobTools`' companions drop out of an isolated child entirely — see their `withCwd`).
+    // Only `run` is rebuilt: everything else is carried over from THIS instance, because a host may
+    // have mutated the tool AFTER construction (shraga-ee renames `Shell` -> `Bash` and its system
+    // prompt says `Bash` everywhere). Rebuilding from `options` alone silently dropped that rename,
+    // so a worktree child advertised `Shell` while being told to call `Bash` — an unknown-tool error
+    // on its first call, and a hard failure for an agentType def whose allowlist names `Bash`.
+    // `description` is the ONE thing taken from the rebound tool instead: it is derived from the
+    // options and states whether `background:true` works — the rebind drops the registry, so carrying
+    // the parent's text over would advertise a background capability the child does not have. (The
+    // spread also collapses the getter below to a plain value, which is why this override is explicit.)
+    withCwd(cwd) {
+      const rebound = makeRealShellTool({ ...options, cwd, registry: void 0 });
+      return { ...this, description: rebound.description, run: rebound.run, withCwd: rebound.withCwd };
+    },
     get description() {
-      return `Run a shell command via /bin/sh in the working directory. Executes any installed binary \u2014 ls, cat, grep, git, bun, node, curl, scripts, etc. Returns combined stdout+stderr; non-zero exits are prefixed \`[exit N]\`. Runs non-interactively with no terminal (stdin is /dev/null): commands that prompt for input fail fast rather than hang \u2014 for privileged actions use a non-interactive flag (e.g. \`sudo -n\`), or ask the user to run the command themselves. Each command is killed after ${defaultTimeoutMs}ms (result \`[exit 124]\` with whatever output it produced) \u2014 pass \`timeoutMs\` (max ${maxTimeoutMs}) for a legitimately slower command, and always bound network commands yourself (e.g. \`curl -m 10\`). ` + backgroundDoc();
+      return "Run a shell command via /bin/sh in the working directory. Executes any installed binary \u2014 ls, cat, grep, git, bun, node, curl, scripts, etc. Returns combined stdout+stderr; non-zero exits are prefixed `[exit N]`. Runs non-interactively with no terminal (stdin is /dev/null): commands that prompt for input fail fast rather than hang \u2014 for privileged actions use a non-interactive flag (e.g. `sudo -n`), or ask the user to run the command themselves. " + (options.registry?.adopt ? `A command still running after ${defaultTimeoutMs}ms is NOT killed \u2014 it is handed to a background job and you get its id, so you can keep checking on it (\`[still running]\`). Pass \`timeoutMs\` (max ${maxTimeoutMs}) to wait longer in the foreground, and always bound network commands yourself (e.g. \`curl -m 10\`). ` : `Each command is killed after ${defaultTimeoutMs}ms (result \`[exit 124]\` with whatever output it produced) \u2014 pass \`timeoutMs\` (max ${maxTimeoutMs}) for a legitimately slower command, and always bound network commands yourself (e.g. \`curl -m 10\`). `) + backgroundDoc();
     },
     // Declared so transports above the agent loop can size their own deadline with headroom (see AgentTool.maxDurationMs).
     maxDurationMs: maxTimeoutMs,
@@ -2199,9 +2218,12 @@ function makeRealShellTool(options) {
         else ctx.signal.addEventListener("abort", onAbort, { once: true });
       }
       let timedOut = false;
-      const timer = setTimeout(() => {
+      let onDeadline = () => {
         timedOut = true;
         ctl.abort();
+      };
+      const timer = setTimeout(() => {
+        onDeadline();
       }, timeoutMs);
       let pend = "";
       let flushTimer = null;
@@ -2232,6 +2254,18 @@ function makeRealShellTool(options) {
           }
           if (ctl.signal.aborted) killGroup(proc, "SIGKILL");
           else ctl.signal.addEventListener("abort", () => killGroup(proc, "SIGKILL"), { once: true });
+          const registry = options.registry;
+          if (registry?.adopt) {
+            onDeadline = () => {
+              timedOut = true;
+              if (settled) return;
+              flushEmit(ctx);
+              proc.stdout?.off?.("data", collect);
+              proc.stderr?.off?.("data", collect);
+              const id = registry.adopt(cmd, proc, out);
+              finish(handoffFor(timeoutMs, id, clean(out), !!registry.notifiesOnExit));
+            };
+          }
           const collect = (chunk) => {
             const s = typeof chunk === "string" ? chunk : chunk?.toString?.("utf8") ?? "";
             out += s;
@@ -2264,6 +2298,12 @@ function makeRealShellTool(options) {
     }
   };
 }
+function handoffFor(timeoutMs, id, body, notifies) {
+  const head = `[still running] exceeded ${timeoutMs}ms, so it was handed to background job ${id} \u2014 NOT killed, it is still going. Check on it with ShellOutput({id:"${id}"}) / ShellStatus({id:"${id}"}), stop it with ShellKill({id:"${id}"}). ` + (notifies ? "Its completion will be reported to you, so you may continue with other work meanwhile." : "Nothing will tell you when it finishes \u2014 poll it yourself before you rely on its result.");
+  return body ? `${head}
+Output so far:
+${body}` : head;
+}
 function reasonFor(timedOut, timeoutMs, body) {
   const head = timedOut ? `[exit 124] timed out after ${timeoutMs}ms (killed). Re-running this command unchanged will time out again. Either re-run it with background:true (returns a job id immediately; poll with ShellOutput/ShellStatus, stop with ShellKill) or narrow it so it can finish \u2014 bound it, scope it, or ask for less.` : "[exit 130] cancelled (killed)";
   return body ? `${head}
@@ -2272,8 +2312,10 @@ ${body}` : head;
 }
 function makeShellJobTools(registry) {
   const idParam = { type: "object", properties: { id: { type: "string", description: "the job id from Shell({background:true})" } } };
+  const dropOnRebind = { withCwd: () => void 0 };
   return [
     {
+      ...dropOnRebind,
       name: "ShellOutput",
       description: "Read the accumulated output (tail) of a background Shell job by id.",
       parameters: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
@@ -2286,6 +2328,7 @@ ${clean(out) || "(no output yet)"}`;
       }
     },
     {
+      ...dropOnRebind,
       name: "ShellStatus",
       description: "Status of a background Shell job (running/exited/killed + exit code). Omit `id` to list all jobs.",
       parameters: idParam,
@@ -2299,6 +2342,7 @@ ${clean(out) || "(no output yet)"}`;
       }
     },
     {
+      ...dropOnRebind,
       name: "ShellKill",
       description: "Stop a running background Shell job by id (SIGTERM).",
       parameters: { type: "object", required: ["id"], properties: { id: { type: "string" } } },
@@ -2399,6 +2443,41 @@ var init_tools_shell = __esm({
       list() {
         return [...this.jobs].map(([id, j]) => ({ id, command: j.command, status: j.status }));
       }
+      /**
+       * Take over an ALREADY-RUNNING child as a background job. A foreground command that outruns its
+       * timeout is not necessarily a hung command — killing it throws away work that was nearly done and,
+       * worse, a launcher that spawned its own detached worker leaves that worker running with nothing
+       * tracking it. Adopting hands the model a handle instead: the command keeps going, its completion
+       * is reported like any other job, and `seed` carries the output produced before the handoff.
+       */
+      adopt(command, proc, seed = "") {
+        const id = `job-${++this.seq}`;
+        const max = this.cfg.maxBuffer ?? 256 * 1024;
+        const job = { command, buf: seed.slice(-max), status: "running", proc };
+        const append = (chunk) => {
+          const s = typeof chunk === "string" ? chunk : chunk?.toString?.("utf8") ?? "";
+          job.buf = (job.buf + s).slice(-max);
+        };
+        proc.stdout?.on("data", append);
+        proc.stderr?.on("data", append);
+        proc.on("error", (err2) => {
+          if (job.status === "running") {
+            job.status = "error";
+            append(`
+[error] ${err2?.message ?? err2}`);
+            this.notifyExit(id, job);
+          }
+        });
+        proc.on("close", (code) => {
+          if (job.status === "running") {
+            job.status = "exited";
+            job.exitCode = code ?? void 0;
+            this.notifyExit(id, job);
+          }
+        });
+        this.jobs.set(id, job);
+        return id;
+      }
       kill(id) {
         const j = this.jobs.get(id);
         if (!j) return false;
@@ -3131,6 +3210,32 @@ ${sections.join("\n\n---\n\n")}`;
 init_tools();
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
+
+// src/models.ts
+var MODEL_ALIASES = {
+  fable: "claude-fable-5",
+  "fable-5": "claude-fable-5",
+  opus: "claude-opus-4-8",
+  "opus-4-8": "claude-opus-4-8",
+  "opus-4-7": "claude-opus-4-7",
+  "opus-4-6": "claude-opus-4-6",
+  sonnet: "claude-sonnet-4-6",
+  haiku: "claude-haiku-4-5-20251001"
+};
+function resolveModelAlias(input) {
+  const slash = input.indexOf("/");
+  const prefix = slash === -1 ? "" : input.slice(0, slash + 1);
+  const rest = slash === -1 ? input : input.slice(slash + 1);
+  return prefix + (MODEL_ALIASES[rest.toLowerCase()] ?? rest);
+}
+function modelProvider(model) {
+  const i = model.indexOf("/");
+  if (i !== -1) return model.slice(0, i);
+  if (/^claude-/i.test(model)) return "anthropic";
+  return `?${model}`;
+}
+
+// src/subagent.ts
 init_OverlayFilesystem();
 init_worktree();
 init_NodeDiskFilesystem();
@@ -3189,6 +3294,14 @@ function createWorktreeFs(cwd, label, index) {
 function releaseWorktree(handle) {
   return cleanupWorktree(handle.repoRoot, handle.slug, { force: true });
 }
+function rebindTools(tools, root) {
+  if (!tools || !root) return tools;
+  return tools.flatMap((t) => {
+    if (!t.withCwd) return [t];
+    const rebound = t.withCwd(root);
+    return rebound ? [rebound] : [];
+  });
+}
 function worktreePromptPrefix(branch) {
   return `You are running in an isolated git worktree on branch "${branch}". When you finish making changes, commit them with a clear message before replying with your summary. Your worktree will be removed after you finish \u2014 only committed work survives (on the branch).
 
@@ -3256,22 +3369,30 @@ async function runChildTraced(args) {
   await opts.hooks?.onSubagentStop?.(result, { label, agentType });
   return { res, result };
 }
-function childOptionsFor(opts, fs, depth, maxDepth, agentType) {
+function childOptionsFor(opts, fs, depth, maxDepth, agentType, model, root) {
   let def;
   if (agentType) {
     def = (opts.agents ?? []).find((a) => a.name === agentType);
     if (!def) return `no subagent type '${agentType}'. Available: ${(opts.agents ?? []).map((a) => a.name).join(", ") || "(none defined)"}`;
   }
-  const childOpts = { ai: opts.ai, fs, model: def?.model ?? opts.model, subagents: true, depth: depth + 1, maxDepth, traceDir: opts.traceDir };
+  const childModel = resolveModelAlias(model || def?.model || opts.model);
+  const childOpts = { ai: opts.ai, fs, model: childModel, subagents: true, depth: depth + 1, maxDepth, traceDir: opts.traceDir };
   if (opts.maxSteps != null) childOpts.maxSteps = opts.maxSteps;
-  if (def?.systemPrompt) childOpts.systemPrompt = def.systemPrompt;
+  const childPrompt = def?.systemPrompt ?? opts.systemPrompt;
+  if (childPrompt) childOpts.systemPrompt = childPrompt;
+  const inherited = rebindTools(opts.tools, root);
   if (def?.tools?.length) {
     try {
-      childOpts.tools = toolsByName(def.tools);
+      childOpts.tools = toolsByName(def.tools, inherited);
     } catch (e) {
       return `subagent '${agentType}' declares an unknown tool \u2014 ${e.message}`;
     }
+  } else if (inherited?.length) {
+    childOpts.tools = inherited;
   }
+  const po = opts.providerOptionsFor?.(childModel);
+  if (po) childOpts.providerOptions = po;
+  if (opts.hooks?.preToolUse) childOpts.hooks = { preToolUse: opts.hooks.preToolUse.bind(opts.hooks) };
   return childOpts;
 }
 function makeTaskTool(opts) {
@@ -3279,7 +3400,7 @@ function makeTaskTool(opts) {
   const maxDepth = opts.maxDepth ?? 2;
   return {
     name: "Task",
-    description: 'Delegate a self-contained sub-task to a child agent over the same filesystem. It runs autonomously with its own step budget and a wall-clock deadline, and returns a concise summary \u2014 use to isolate context-heavy work (broad search, a scoped refactor). Provide a short `description` and a full `prompt`. If it is interrupted or fails, the result is a STATUS HINT with a pointer to its full transcript (Read it to recover what it did, then decide whether to continue or restart) \u2014 do not assume an incomplete sub-task succeeded. Set `background: true` to run it detached (returns a job id to poll with JobOutput while you keep working); its file edits are overlay-isolated and commit when it finishes. Set `isolation: "worktree"` to run in a real git worktree (needed when the child uses real shell commands that must see/modify actual files) \u2014 slower (~200ms setup), auto-cleaned if no changes.',
+    description: 'Delegate a self-contained sub-task to a child agent over the same filesystem. It runs autonomously with its own step budget and a wall-clock deadline, and returns a concise summary \u2014 use to isolate context-heavy work (broad search, a scoped refactor). Provide a short `description` and a full `prompt`. If it is interrupted or fails, the result is a STATUS HINT with a pointer to its full transcript (Read it to recover what it did, then decide whether to continue or restart) \u2014 do not assume an incomplete sub-task succeeded. Set `background: true` to run it detached (returns a job id to poll with JobOutput while you keep working); its VFS file edits are overlay-isolated and commit when it finishes \u2014 but a child that uses the real `Shell` writes straight to the working tree (an overlay cannot isolate a real process), so pair shell-heavy work with `isolation: "worktree"`. Set `isolation: "worktree"` to run in a real git worktree (needed when the child uses real shell commands that must see/modify actual files \u2014 its shell is re-bound to the worktree \u2014 keeping any name your host gave it \u2014 and background shell jobs, including inspecting or killing MINE, are unavailable there) \u2014 slower (~200ms setup), auto-cleaned if no changes. The child inherits YOUR tools and system prompt by default (and is subject to the same tool-use gate); pass `model` to run this one sub-task on a different model (e.g. a cheap one for bulk search, a stronger one for hard reasoning) \u2014 it overrides the agentType default.',
     parameters: {
       type: "object",
       required: ["description", "prompt"],
@@ -3287,6 +3408,7 @@ function makeTaskTool(opts) {
         description: { type: "string", description: "a short (3-5 word) label for the sub-task" },
         prompt: { type: "string", description: "the full instructions the child agent should carry out" },
         agentType: { type: "string", description: "optional named subagent type (its persona, model, and scoped tools) \u2014 see the catalog" },
+        model: { type: "string", description: 'optional model for THIS sub-task (alias like "haiku"/"opus"/"sonnet", or a full id). Overrides the agentType default; otherwise the child runs on your model.' },
         background: { type: "boolean", description: "run detached (overlay-isolated, commits on finish); returns a job id to poll with JobOutput instead of blocking" },
         isolation: { type: "string", enum: ["overlay", "worktree"], description: 'isolation mode: "overlay" (default, VFS layer) or "worktree" (real git worktree for shell-heavy work)' }
       }
@@ -3297,7 +3419,7 @@ function makeTaskTool(opts) {
     maxDurationMs: opts.maxDurationMs ?? SUBAGENT_MAX_DURATION_MS,
     maxDurationEnforced: true,
     // the wall clock below ABORTS the child at this bound — it cannot be overrun, so the transport needs slack, not a doubling
-    async run({ description, prompt, agentType, background, isolation }, ctx) {
+    async run({ description, prompt, agentType, model, background, isolation }, ctx) {
       if (depth >= maxDepth) {
         return `Error: Task depth limit reached (maxDepth ${maxDepth}). Cannot spawn another child agent \u2014 do this work directly instead.`;
       }
@@ -3320,7 +3442,7 @@ function makeTaskTool(opts) {
             fs2 = overlay;
             commit = () => overlay.commit();
           }
-          const childOpts2 = childOptionsFor(opts, fs2, depth, maxDepth, agentType);
+          const childOpts2 = childOptionsFor(opts, fs2, depth, maxDepth, agentType, model, wtHandle2?.worktreePath);
           if (typeof childOpts2 === "string") throw new Error(childOpts2);
           const childPrompt = wtHandle2 ? worktreePromptPrefix(wtHandle2.branch) + String(prompt ?? "") : String(prompt ?? "");
           const { res, result } = await runChildTraced({ opts, childOpts: childOpts2, prompt: childPrompt, label, agentType, childDepth: depth + 1, signal });
@@ -3350,7 +3472,7 @@ function makeTaskTool(opts) {
       } else {
         fs = opts.fs;
       }
-      const childOpts = childOptionsFor(opts, fs, depth, maxDepth, agentType);
+      const childOpts = childOptionsFor(opts, fs, depth, maxDepth, agentType, model, wtHandle?.worktreePath);
       if (typeof childOpts === "string") {
         wtHandle && releaseWorktree(wtHandle);
         return `Error: ${childOpts}`;
@@ -3379,7 +3501,7 @@ function makeTaskBatchTool(opts) {
   const maxParallel = opts.maxParallel ?? 4;
   return {
     name: "TaskBatch",
-    description: 'Delegate SEVERAL independent sub-tasks to child agents that run concurrently; returns all their summaries. Each child is write-isolated (its file edits are merged back in array order). Use for parallel fan-out (review/search/scoped refactors across files). Provide `tasks: [{ description, prompt, agentType? }]`. Set `isolation: "worktree"` to run each child in its own git worktree (needed for real shell commands) \u2014 slower, auto-cleaned if no changes.',
+    description: 'Delegate SEVERAL independent sub-tasks to child agents that run concurrently; returns all their summaries. Each child is write-isolated at the VFS level (its file edits are merged back in array order); real `Shell` commands are NOT \u2014 use `isolation: "worktree"` for those. Use for parallel fan-out (review/search/scoped refactors across files). Provide `tasks: [{ description, prompt, agentType?, model? }]` \u2014 each child inherits your tools and system prompt, and `model` runs that one child on a different model. Set `isolation: "worktree"` to run each child in its own git worktree (needed for real shell commands) \u2014 slower, auto-cleaned if no changes.',
     parameters: {
       type: "object",
       required: ["tasks"],
@@ -3393,7 +3515,8 @@ function makeTaskBatchTool(opts) {
             properties: {
               description: { type: "string", description: "a short (3-5 word) label" },
               prompt: { type: "string", description: "the full instructions for this child" },
-              agentType: { type: "string", description: "optional named subagent type" }
+              agentType: { type: "string", description: "optional named subagent type" },
+              model: { type: "string", description: "optional model for this child (alias or full id); overrides the agentType default" }
             }
           }
         },
@@ -3426,7 +3549,7 @@ function makeTaskBatchTool(opts) {
           overlay = new OverlayFilesystem(opts.fs);
           fs = overlay;
         }
-        const childOpts = childOptionsFor(opts, fs, depth, maxDepth, t?.agentType);
+        const childOpts = childOptionsFor(opts, fs, depth, maxDepth, t?.agentType, t?.model, wtHandle?.worktreePath);
         if (typeof childOpts === "string") return { label, error: childOpts, ok: false };
         try {
           const childPrompt = wtHandle ? worktreePromptPrefix(wtHandle.branch) + String(t?.prompt ?? "") : String(t?.prompt ?? "");
@@ -3853,6 +3976,10 @@ var AgentOptions = class {
   autoTest;
   /** Provider-specific options forwarded to ai.chat() (e.g. cursor mcpServers, cwd). */
   providerOptions;
+  /** Derive `providerOptions` for a DELEGATED child whose model may differ from this agent's
+   *  (`Task({ model })` / an agentType def). Default: inherit `providerOptions` only when the child's
+   *  model is on the SAME provider — cursor's `cwd`/`cursorSession` on an anthropic child is a 400. */
+  providerOptionsFor;
   /** Prompt caching (providers that support it, e.g. Anthropic): cache tools/system/conversation
    *  prefix across the loop's steps — reads cost 0.1x, writes 1.25x. A multi-step agent loop
    *  re-sends its whole prefix every step, so this is a large net cost cut. Default on. */
@@ -4076,7 +4203,19 @@ var Agent = class _Agent {
         agents = loaded.agents;
         if (loaded.catalog) systemPrompt += "\n\n" + loaded.catalog;
       }
-      const taskOpts = { ai: o.ai, model: o.model, fs, depth: o.depth, maxDepth: o.maxDepth, agents, hooks: o.hooks, traceDir: o.traceDir };
+      const taskOpts = {
+        ai: o.ai,
+        model: o.model,
+        fs,
+        depth: o.depth,
+        maxDepth: o.maxDepth,
+        agents,
+        hooks: o.hooks,
+        traceDir: o.traceDir,
+        tools: [...o.tools, ...this.injectedTools],
+        systemPrompt: o.systemPrompt,
+        providerOptionsFor: o.providerOptionsFor ?? ((m) => modelProvider(m) === modelProvider(o.model) ? o.providerOptions : void 0)
+      };
       tools = [...tools, makeTaskTool(taskOpts), makeTaskBatchTool(taskOpts)];
     }
     if (o.checkpoints) tools = [...tools, ...checkpointTools()];