@vellumai/assistant 0.12.2 → 0.12.3-staging.2

package/src/schedule/worker-mcp.ts

@@ -0,0 +1,85 @@
+/**
+ * Schedule-worker MCP bootstrap and reload.
+ *
+ * The worker hosts execute/wake/workflow turns in its own process, so it
+ * has to connect MCP servers itself. Tool-backed schedules must not fire
+ * until that pass has settled: a 20s grace lets notify/script start, and
+ * the readiness latch defers the rest until registration finishes or
+ * fails closed.
+ */
+
+import {
+  restartConfiguredMcpServers,
+  startConfiguredMcpServers,
+} from "../mcp/startup.js";
+import {
+  EMPTY_MCP_STARTUP_SNAPSHOT,
+  type McpStartupSnapshot,
+} from "../mcp/tool-caps.js";
+import { getLogger } from "../util/logger.js";
+import {
+  markScheduleToolSurfaceReady,
+  markScheduleToolSurfaceReloading,
+  markScheduleToolSurfaceStarting,
+} from "./tool-surface-readiness.js";
+
+export { MCP_NOT_READY_DEFER_MS } from "./tool-surface-readiness.js";
+
+const log = getLogger("schedule-worker-mcp");
+
+/**
+ * How long startup waits before arming notify/script ticks.
+ *
+ * Connecting is worth waiting for. It is not worth waiting for without
+ * limit: each server may take 30s to connect and 30s to list tools. Past
+ * this deadline those ticks start. Tool-backed schedules stay deferred
+ * until {@link markScheduleToolSurfaceReady}.
+ */
+export const MCP_STARTUP_GRACE_MS = 20_000;
+
+export async function bootstrapScheduleWorkerMcp(options?: {
+  start?: () => Promise<McpStartupSnapshot>;
+  graceMs?: number;
+}): Promise<void> {
+  const start = options?.start ?? startConfiguredMcpServers;
+  const graceMs = options?.graceMs ?? MCP_STARTUP_GRACE_MS;
+  markScheduleToolSurfaceStarting();
+  const startup = start()
+    .then((snapshot) => {
+      markScheduleToolSurfaceReady(snapshot);
+      log.info(snapshot, "MCP tool surface ready in schedule worker");
+      return snapshot;
+    })
+    .catch((err: unknown) => {
+      markScheduleToolSurfaceReady(EMPTY_MCP_STARTUP_SNAPSHOT);
+      log.error(
+        { err },
+        "MCP tool surface failed in schedule worker; continuing without MCP tools",
+      );
+      return EMPTY_MCP_STARTUP_SNAPSHOT;
+    });
+
+  await Promise.race([
+    startup,
+    new Promise<void>((resolve) => {
+      setTimeout(resolve, graceMs).unref();
+    }),
+  ]);
+}
+
+export async function reloadScheduleWorkerMcp(options?: {
+  restart?: () => Promise<McpStartupSnapshot>;
+}): Promise<McpStartupSnapshot> {
+  const restart = options?.restart ?? restartConfiguredMcpServers;
+  markScheduleToolSurfaceReloading();
+  try {
+    const snapshot = await restart();
+    markScheduleToolSurfaceReady(snapshot);
+    log.info(snapshot, "MCP servers reloaded in schedule worker");
+    return snapshot;
+  } catch (err) {
+    markScheduleToolSurfaceReady(EMPTY_MCP_STARTUP_SNAPSHOT);
+    log.warn({ err }, "MCP reload failed in schedule worker");
+    throw err;
+  }
+}

package/src/schedule/worker.ts

@@ -22,10 +22,6 @@ import { rehydratePlatformCredentials } from "../config/platform-rehydration.js"
 import { startConversationEvictor } from "../daemon/conversation-evictor.js";
 import { stopMcpServerManager } from "../mcp/manager.js";
 import { MCP_RELOAD_SIGNAL_FILE } from "../mcp/reload-signal.js";
-import {
-  restartConfiguredMcpServers,
-  startConfiguredMcpServers,
-} from "../mcp/startup.js";
 import { resetDb } from "../persistence/db-connection.js";
 import { registerWorkerPluginSurface } from "../plugins/worker-plugin-surface.js";
 import { disableStreamSeqStamping } from "../runtime/assistant-stream-state.js";
@@ -37,6 +33,10 @@ import {
   startWorkerPidFileGuard,
 } from "../util/worker-process.js";
 import { runDueSchedulesOnce } from "./scheduler.js";
+import {
+  bootstrapScheduleWorkerMcp,
+  reloadScheduleWorkerMcp,
+} from "./worker-mcp.js";
 
 const log = getLogger("schedule-worker-process");
 
@@ -46,19 +46,6 @@ const TICK_INTERVAL_MS = 15_000;
 /** How often this process re-reads flag overrides from the gateway. */
 const FLAG_REFRESH_INTERVAL_MS = 60_000;
 
-/**
- * How long startup waits for MCP servers before arming the tick.
- *
- * Connecting is worth waiting for: a schedule that fires first would fail its
- * `mcp__*` calls as unknown tools. It is not worth waiting for without limit.
- * `McpServerManager.start()` walks servers one at a time and allows each 30s to
- * connect and 30s more to list its tools, so a handful of unreachable ones can
- * hold the first tick for minutes, including the notify and script schedules
- * that never touch MCP. Past this deadline the connect continues in the
- * background and the tick starts without it.
- */
-const MCP_STARTUP_GRACE_MS = 20_000;
-
 /**
  * Rebuild this process's MCP connections whenever the daemon reports a reload.
  *
@@ -85,10 +72,7 @@ function watchForMcpReload(): void {
       restartQueued = true;
       return;
     }
-    restarting = restartConfiguredMcpServers()
-      .then((toolCount) => {
-        log.info({ toolCount }, "MCP servers reloaded in schedule worker");
-      })
+    restarting = reloadScheduleWorkerMcp()
       .catch((err: unknown) => {
         log.warn({ err }, "MCP reload failed in schedule worker");
       })
@@ -193,16 +177,10 @@ async function main(): Promise<void> {
   // keeps this process independent of the daemon's event loop, which is the
   // reason it is a separate process at all.
   //
-  // Bounded by MCP_STARTUP_GRACE_MS: unreachable servers must not hold the
-  // schedules that do not use them. The connect runs on past the deadline.
-  const mcpStartup = startConfiguredMcpServers();
-  await Promise.race([
-    mcpStartup,
-    // Unref'd so a connect that beats the deadline leaves nothing pending.
-    new Promise((resolve) => {
-      setTimeout(resolve, MCP_STARTUP_GRACE_MS).unref();
-    }),
-  ]);
+  // Bounded by MCP_STARTUP_GRACE_MS so notify/script can fire. Execute, wake,
+  // and workflow schedules stay deferred until the connect settles and the
+  // tool surface is marked ready.
+  await bootstrapScheduleWorkerMcp();
 
   // React to an MCP reload in the daemon. The server set belongs to the config
   // and the daemon owns the watcher that notices it change; this process holds

package/src/security/secure-keys.ts

@@ -1,24 +1,22 @@
 /**
- * Unified secure key storage — single-backend routing through CredentialBackend
+ * Unified secure key storage: single-backend routing through CredentialBackend
  * adapters.
  *
  * Backend selection (`resolveBackendAsync`) is the single async decision point:
- *   1. CES RPC (primary) — injected via `setCesClient()`: delegates credential
- *      operations to the CES process over Unix socket RPC. This is the default
- *      path for the daemon (which calls startCes() at boot) and for non-daemon
- *      processes that lazily connect via the CES_LOCAL_SOCKET path (see below).
- *   2. CES HTTP — containerized mode (IS_CONTAINERIZED + CES_CREDENTIAL_URL):
- *      delegates to the CES sidecar over HTTP. Used in Docker/managed mode,
- *      including failover when the bootstrap RPC transport dies later.
- *   3. Lazy CES RPC connect — non-daemon processes (workers, CLI subprocesses)
- *      that inherit CES_LOCAL_SOCKET but never call startCes(). On first
- *      credential resolution, a direct CES connection is established and
- *      cached. On failure, falls through to the encrypted file store.
- *   4. Encrypted file store (fallback) — used when CES is unavailable.
+ *   1. CES RPC (primary) - connect to the CES bootstrap socket and talk RPC.
+ *      `openCesRpcSession` is the one client constructor. The assistant
+ *      claims session ownership at boot (`startCes`) and hands CES the
+ *      assistant API key. Child processes open a session on first credential
+ *      read only when this process has no client and no reconnect owner.
+ *   2. CES HTTP - containerized failover when IPC is unavailable
+ *      (`IS_CONTAINERIZED` + `CES_CREDENTIAL_URL`). Used if the assistant's
+ *      bootstrap RPC transport is down, or if a process with HTTP env could
+ *      not open the socket.
+ *   3. Encrypted file store (fallback) - used when CES is unavailable locally.
  *
  * All operations (reads, writes, lists, deletes) go to exactly one backend.
  * There are no cross-store fallbacks or merges. The only transport failover is
- * CES RPC → CES HTTP in managed mode; both backends target the same CES
+ * CES RPC to CES HTTP in managed mode; both backends target the same CES
  * sidecar and credential data.
  */
 
@@ -33,13 +31,11 @@ import type {
 
 import { getIsContainerized } from "../config/env-registry.js";
 import {
-  type CesClient,
-  createCesClient,
-} from "../credential-execution/client.js";
-import {
-  CesUnavailableError,
-  createCesProcessManager,
-} from "../credential-execution/process-manager.js";
+  openCesRpcSession,
+  reconnectCesRpcSession,
+} from "../credential-execution/ces-connect.js";
+import { type CesClient } from "../credential-execution/client.js";
+import { discoverCes } from "../credential-execution/executable-discovery.js";
 import { getAnyProviderEnvVar } from "../providers/provider-env-vars.js";
 import { getLogger } from "../util/logger.js";
 import { getProtectedDir } from "../util/platform.js";
@@ -82,13 +78,13 @@ let _resolvedBackend: CredentialBackend | undefined;
 let _resolvePromise: Promise<CredentialBackend> | undefined;
 
 /**
- * In-flight lazy CES connection promise for non-daemon processes.
+ * In-flight CES RPC session promise for processes that did not call startCes().
  *
- * Workers and CLI subprocesses inherit CES_LOCAL_SOCKET but never call
- * startCes(). When they hit resolveBackendAsync() with no _cesClient and
- * no _cesReconnect (daemon-only), this promise memoizes a direct CES
- * connection attempt so concurrent credential reads in the same process
- * share a single connect+handshake rather than racing.
+ * Workers and CLI subprocesses never call startCes(). When they hit
+ * resolveBackendAsync() with no _cesClient and no _cesReconnect
+ * (assistant-boot only), this promise memoizes `openCesRpcSession` so
+ * concurrent credential reads in the same process share a single
+ * connect+handshake rather than racing.
  */
 let _lazyConnectPromise: Promise<CesClient | undefined> | undefined;
 
@@ -203,14 +199,14 @@ function getEncryptedStoreBackend(): CredentialBackend {
  * Resolve the primary credential backend for this process (async).
  *
  * Priority:
- *   1. CES RPC client → primary path for all local modes.
- *   2. Containerized + CES_CREDENTIAL_URL → CES HTTP client (Docker/managed).
- *   3. Encrypted file store → fallback when CES is unavailable.
+ *   1. CES RPC: live client, or open one via `openCesRpcSession`.
+ *   2. Containerized + CES_CREDENTIAL_URL: CES HTTP, only if IPC is down.
+ *   3. Encrypted file store: local fallback when CES is unavailable.
  *
  * Once resolved, the backend is cached. If it becomes unavailable (e.g. the
  * CES transport dies), we attempt to reconnect via `_cesReconnect` rather
  * than falling back to a different backend. In managed cloud mode CES is the
- * primary credential source — falling back to the encrypted file store would
+ * primary credential source. Falling back to the encrypted file store would
  * silently serve stale or empty data.
  *
  * In managed mode, if the CES bootstrap RPC transport dies, we first fail
@@ -411,17 +407,19 @@ export async function attemptCesReconnection(
 }
 
 /**
- * Lazily connect to a CES sibling socket from a non-daemon process.
+ * Open a CES RPC session from a process that did not call startCes().
  *
- * Workers and CLI subprocesses inherit CES_LOCAL_SOCKET from the daemon's
- * environment but never call startCes(). This function establishes a direct
- * CES connection on first credential resolution, memoizing the in-flight
- * promise so concurrent callers share a single connect+handshake.
+ * Workers and CLI subprocesses never call startCes(). This function
+ * opens the same `openCesRpcSession` path the assistant uses at boot,
+ * memoizing the in-flight promise so concurrent callers share a single
+ * connect+handshake. Discovery uses the shared CES bootstrap socket; a
+ * missing socket fails immediately so callers can fall through without
+ * polling.
  *
  * On success, the client is injected via setCesClient() so subsequent
- * resolveBackendAsync() calls take the fast CES RPC path (step 1). A
- * reconnect callback is also registered so the lazy connection can heal
- * if the transport drops mid-process.
+ * resolveBackendAsync() calls take the live CES RPC path. A reconnect
+ * callback is also registered so the session can heal if the transport
+ * drops mid-process.
  *
  * Returns undefined on any failure (socket not found, handshake rejected,
  * timeout) so the caller falls through to the encrypted file store.
@@ -432,62 +430,30 @@ async function tryLazyCesConnect(): Promise<CesClient | undefined> {
   }
 
   _lazyConnectPromise = (async () => {
-    try {
-      const pm = createCesProcessManager({});
-      const transport = await pm.start();
-      const client = createCesClient(transport);
-      const { accepted, reason } = await client.handshake();
-      if (!accepted) {
-        log.warn(
-          { reason },
-          "Lazy CES connection handshake rejected — falling back to encrypted file store",
-        );
-        client.close();
-        await pm.stop().catch(() => {});
-        return undefined;
-      }
+    const discovery = discoverCes();
+    if (discovery.mode === "unavailable") {
       log.info(
-        "Lazy CES connection established — credential operations routed through CES RPC",
+        { reason: discovery.reason },
+        "CES socket not reachable for lazy connect, falling back to encrypted file store",
       );
-      setCesClient(client);
-      // Register a reconnect callback so the lazy connection self-heals
-      // if the transport drops, mirroring the daemon's proactive reconnect.
-      setCesReconnect(async () => {
-        try {
-          await pm.stop();
-          const newTransport = await pm.start();
-          const newClient = createCesClient(newTransport);
-          const { accepted: ok } = await newClient.handshake();
-          if (ok) {
-            log.info("Lazy CES reconnection successful");
-            return newClient;
-          }
-          newClient.close();
-          await pm.stop().catch(() => {});
-          return undefined;
-        } catch (err) {
-          log.warn(
-            { error: err instanceof Error ? err.message : String(err) },
-            "Lazy CES reconnection failed",
-          );
-          return undefined;
-        }
-      });
-      return client;
-    } catch (err) {
-      if (err instanceof CesUnavailableError) {
-        log.info(
-          { reason: err.message },
-          "CES socket not reachable for lazy connect — falling back to encrypted file store",
-        );
-      } else {
-        log.warn(
-          { error: err instanceof Error ? err.message : String(err) },
-          "Lazy CES connection failed — falling back to encrypted file store",
-        );
-      }
       return undefined;
     }
+    const session = await openCesRpcSession();
+    if (!session) {
+      return undefined;
+    }
+    log.info(
+      "CES RPC session established; credential operations route through CES RPC",
+    );
+    setCesClient(session.client);
+    setCesReconnect(async () => {
+      const client = await reconnectCesRpcSession(session.processManager);
+      if (client) {
+        log.info("CES RPC reconnection successful");
+      }
+      return client;
+    });
+    return session.client;
   })();
 
   try {
@@ -498,7 +464,10 @@ async function tryLazyCesConnect(): Promise<CesClient | undefined> {
 }
 
 async function doResolveBackend(): Promise<CredentialBackend> {
-  // 1. CES RPC — primary credential backend for all local modes
+  // 1. CES RPC. Primary credential backend in every environment. Boot
+  //    claims reconnect ownership before it reads handshake identity, so
+  //    that read cannot open a second session. Children open here only
+  //    when this process has no client and no reconnect owner.
   if (_cesClient) {
     const cesRpc = new CesRpcCredentialBackend(_cesClient);
     if (cesRpc.isAvailable()) {
@@ -511,7 +480,19 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     );
   }
 
-  // 2. CES HTTP — containerized / Docker / managed mode
+  if (!_cesClient && !_cesReconnect) {
+    const client = await tryLazyCesConnect();
+    if (client) {
+      const cesRpc = new CesRpcCredentialBackend(client);
+      if (cesRpc.isAvailable()) {
+        _resolvedBackend = cesRpc;
+        log.info("Resolved credential backend: ces-rpc");
+        return cesRpc;
+      }
+    }
+  }
+
+  // 2. CES HTTP. Managed failover when IPC is unavailable.
   if (getIsContainerized() && process.env.CES_CREDENTIAL_URL) {
     const ces = createCesCredentialBackend();
     if (ces.isAvailable()) {
@@ -525,25 +506,6 @@ async function doResolveBackend(): Promise<CredentialBackend> {
     );
   }
 
-  // 2.5. Lazy CES RPC connect — non-daemon processes (workers, CLI
-  //      subprocesses) inherit CES_LOCAL_SOCKET but never call startCes().
-  //      When the daemon's setCesReconnect() is NOT registered, attempt a
-  //      direct connection to the CES sibling socket. On success, inject
-  //      the client via setCesClient() and re-resolve through the CES RPC
-  //      path. On failure, fall through to the encrypted file store.
-  if (!_cesClient && !_cesReconnect && process.env.CES_LOCAL_SOCKET) {
-    const lazyClient = await tryLazyCesConnect();
-    if (lazyClient) {
-      const cesRpc = new CesRpcCredentialBackend(lazyClient);
-      if (cesRpc.isAvailable()) {
-        _resolvedBackend = cesRpc;
-        log.info("Resolved credential backend: ces-rpc (lazy connect)");
-        return cesRpc;
-      }
-    }
-    // Lazy connect failed; fall through.
-  }
-
   // 3. On a containerized pod the local encrypted store does not exist and CES
   //    owns credentials. Never resolve to the encrypted store here; it would
   //    report a provisioned credential as absent. Return an unreachable backend

package/src/skills/clawhub.ts

@@ -11,11 +11,6 @@ import {
 
 const log = getLogger("clawhub");
 
-// Managed skills directory — where installed skill folders live
-function getManagedSkillsDir(): string {
-  return getWorkspaceSkillsDir();
-}
-
 // ClaWHub project root — clawhub creates a `skills/` subdir inside its cwd,
 // so we use the parent of the managed skills dir as the project root.
 function getClawhubProjectRoot(): string {
@@ -39,7 +34,7 @@ interface IntegrityRecord {
 type IntegrityManifest = Record<string, IntegrityRecord>;
 
 function getIntegrityPath(): string {
-  return join(getManagedSkillsDir(), ".integrity.json");
+  return join(getWorkspaceSkillsDir(), ".integrity.json");
 }
 
 function loadIntegrityManifest(): IntegrityManifest {
@@ -66,7 +61,7 @@ function loadIntegrityManifest(): IntegrityManifest {
  * from skills that haven't been migrated yet.
  */
 export function verifyAndRecordSkillHash(slug: string): void {
-  const skillDir = join(getManagedSkillsDir(), slug);
+  const skillDir = join(getWorkspaceSkillsDir(), slug);
   const hash = computeSkillHash(skillDir);
   if (!hash) {
     log.warn({ slug }, "Could not compute content hash for installed skill");
@@ -232,7 +227,7 @@ function getSkillNameFromSlug(slug: string): string {
 }
 
 function getClawhubSkillsDir(projectRoot?: string): string {
-  return projectRoot ? join(projectRoot, "skills") : getManagedSkillsDir();
+  return projectRoot ? join(projectRoot, "skills") : getWorkspaceSkillsDir();
 }
 
 function hasRootSkillFile(skillDir: string): boolean {

package/src/skills/managed-store.ts

@@ -44,13 +44,9 @@ export function validateManagedSkillId(id: string): string | null {
 
 // ─── Path helpers ────────────────────────────────────────────────────────────
 
-function getManagedSkillsDir(): string {
-  return getWorkspaceSkillsDir();
-}
-
 /** Absolute path of a managed skill's directory (whether or not it exists). */
 export function getManagedSkillDir(id: string): string {
-  return join(getManagedSkillsDir(), id);
+  return join(getWorkspaceSkillsDir(), id);
 }
 
 interface ResolvedCompanionPath {

package/src/stt/types.ts

@@ -436,6 +436,10 @@ export interface SttStreamServerTurnEndEvent {
    * provider does not surface a score.
    */
   readonly confidence?: number;
+  /** Provider-reported cause of the turn boundary, when available. */
+  readonly trigger?: "model" | "manual" | "timeout";
+  /** End of the decoded audio window, in seconds from stream start. */
+  readonly audioWindowEndSeconds?: number;
   /**
    * Provider's index for the turn being closed, matching the
    * {@link SttStreamServerTurnStartEvent} that opened it. A consumer can

package/src/subagent/notify.ts

@@ -8,16 +8,20 @@
  * manager out of the import graph lets tool modules import these helpers without
  * pulling in the conversation/agent-loop core.
  *
- * Delivery targets the parent's in-process `Conversation` via the conversation
- * registry: a notification is injected only when the parent is live here. A
- * stale idle parent is rebuilt through `getOrCreateConversation` first so the
- * injected turn uses the current provider, prompt, and credentials.
+ * An active live-voice session owns delivery for its conversation. Otherwise,
+ * delivery targets the parent's in-process `Conversation` via the registry.
+ * A stale idle parent is rebuilt through `getOrCreateConversation` first so
+ * the injected turn uses the current provider, prompt, and credentials.
  */
 
+import { getConfig } from "../config/loader.js";
+import { resolveTurnCommitWaitMs } from "../daemon/abort-watchdog.js";
 import {
   findConversation,
   findConversationOrSubagent,
 } from "../daemon/conversation-registry.js";
+import { startAfterTurnFinalization } from "../daemon/turn-finalization.js";
+import { deliverSubagentNotificationToLiveVoice } from "../live-voice/live-voice-manager.js";
 import { getSubagentRecordByConversationId } from "../persistence/subagent-store.js";
 import { getLogger } from "../util/logger.js";
 import { type SubagentStatus, TERMINAL_STATUSES } from "./types.js";
@@ -25,9 +29,9 @@ import { type SubagentStatus, TERMINAL_STATUSES } from "./types.js";
 const log = getLogger("subagent-notify");
 
 /**
- * Enqueue (or persist + run) `message` as a user-role turn in the parent
- * conversation. No-op with a warning when the parent conversation is not live
- * in this process.
+ * Deliver task updates through the parent's live voice session when present,
+ * otherwise enqueue a parent turn. No-op with a warning
+ * when neither the session nor the parent conversation is live here.
  *
  * Shared by the child-triggered {@link notifyParentFromChild} and the
  * manager's terminal/abort injections so every subagent → parent turn lands
@@ -37,8 +41,30 @@ export function injectMessageIntoParent(
   parentConversationId: string,
   message: string,
   metadata?: Record<string, unknown>,
-  opts?: { cronRunId?: string | null },
+  opts?: { cronRunId?: string | null; bypassLiveVoice?: boolean },
 ): void {
+  const notification = metadata?.subagentNotification;
+  // The live child's conversation ID is stable even if its cosmetic record changes.
+  if (
+    !opts?.bypassLiveVoice &&
+    notification !== null &&
+    typeof notification === "object" &&
+    "subagentId" in notification &&
+    typeof notification.subagentId === "string" &&
+    metadata !== undefined &&
+    deliverSubagentNotificationToLiveVoice(parentConversationId, {
+      taskId:
+        "conversationId" in notification &&
+        typeof notification.conversationId === "string"
+          ? notification.conversationId
+          : notification.subagentId,
+      message,
+      metadata,
+      cronRunId: opts?.cronRunId,
+    })
+  ) {
+    return;
+  }
   const existing = findConversation(parentConversationId);
   if (!existing) {
     log.warn(
@@ -76,17 +102,10 @@ function deliverToParent(
       content: string;
       metadata?: Record<string, unknown>;
       isInteractive: boolean;
+      queueWhenIdle: boolean;
       cronRunId?: string | null;
     }) => { queued: boolean; rejected?: boolean };
-    persistUserMessage: (options: {
-      content: string;
-      metadata?: Record<string, unknown>;
-    }) => Promise<{ id: string }>;
-    runAgentLoop: (
-      message: string,
-      messageId: string,
-      options: { isInteractive: boolean; cronRunId?: string | null },
-    ) => Promise<unknown>;
+    kickDrainQueue: (reason: "loop_complete", origin: string) => Promise<void>;
   },
   parentConversationId: string,
   message: string,
@@ -95,33 +114,34 @@ function deliverToParent(
 ): void {
   // The continuation this notification starts is still the scheduled firing's
   // work, so it carries the same run id as the child whose result triggered it.
-  // Both delivery paths need it: the queued one drains after the enqueuing turn
-  // has ended, so the id has to travel on the message.
+  // The queue drains after the enqueuing turn, so the id travels on the message.
   const cronRunId = opts?.cronRunId ?? null;
   // Machine-injected with no human asserted present, so the notification
   // turn runs non-interactive; it still streams to whoever is watching
   // through the parent's sink.
   const enqueueResult = parentConversation.enqueueMessage({
     content: message,
-    metadata,
+    metadata: { ...metadata, scripted: true },
     isInteractive: false,
+    queueWhenIdle: true,
     ...(cronRunId ? { cronRunId } : {}),
   });
-  if (!enqueueResult.queued && !enqueueResult.rejected) {
-    parentConversation
-      .persistUserMessage({ content: message, metadata })
-      .then(({ id: messageId }) =>
-        parentConversation.runAgentLoop(message, messageId, {
-          isInteractive: false,
-          ...(cronRunId ? { cronRunId } : {}),
-        }),
-      )
-      .catch((err) => {
-        log.error(
-          { parentConversationId, err },
-          "Failed to process subagent notification in parent",
+  if (enqueueResult.queued) {
+    startAfterTurnFinalization(
+      parentConversationId,
+      resolveTurnCommitWaitMs(getConfig().workspaceGit?.turnCommitMaxWaitMs),
+      () => {
+        void parentConversation.kickDrainQueue(
+          "loop_complete",
+          "subagent_notification",
         );
-      });
+      },
+    );
+  } else {
+    log.error(
+      { parentConversationId },
+      "Parent queue rejected subagent notification",
+    );
   }
 }
 

package/src/subagent/parent-notification.ts

@@ -0,0 +1,6 @@
+export interface SubagentParentNotification {
+  taskId: string;
+  message: string;
+  metadata: Record<string, unknown>;
+  cronRunId?: string | null;
+}