@xopcai/xopc 0.0.244 → 0.0.246

package/dist/src/agent/orchestration/loop-guard.js

@@ -1,105 +1,20 @@
-import { createLogger } from "../../utils/logger/index.js";
-import { init_logger } from "../../utils/logger.js";
+import { createHash } from "node:crypto";
 //#region src/agent/orchestration/loop-guard.ts
-init_logger();
-const log = createLogger("LoopGuard");
-const DEFAULT_CONFIG = {
-	softThreshold: 2,
-	hideThreshold: 3
-};
-/**
-* Stable fingerprint for tool call comparison.
-* Recursively sorts object keys; truncates long string values.
-*/
-function stableJson(value) {
-	return JSON.stringify(value, (_key, item) => {
-		if (typeof item === "object" && item !== null && !Array.isArray(item)) return Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b)));
-		if (typeof item === "string" && item.length > 200) return `${item.slice(0, 80)}…[${item.length}]`;
-		return item;
-	});
-}
 function fingerprint(call) {
-	const result = call.resultPreview === void 0 ? "" : `::result=${stableJson(call.resultPreview)}`;
-	return `${call.name}::${stableJson(call.params)}${result}`;
-}
-/**
-* Analyze recent tool calls and produce loop guard result.
-*
-* Pure function — no side effects, no shared state.
-*/
-function detectToolLoops(recentCalls, config = {}) {
-	const { softThreshold, hideThreshold } = {
-		...DEFAULT_CONFIG,
-		...config
-	};
-	if (recentCalls.length === 0) return {
-		injection: null,
-		hiddenTools: /* @__PURE__ */ new Set()
-	};
-	const consecutiveGroups = findConsecutiveRepeats(recentCalls);
-	const frequencyMap = countFrequency(recentCalls);
-	const warnings = [];
-	const hiddenTools = /* @__PURE__ */ new Set();
-	for (const group of consecutiveGroups) if (group.count >= hideThreshold) {
-		hiddenTools.add(group.toolName);
-		warnings.push(`Tool '${group.toolName}' has been called ${group.count} times consecutively with identical arguments and is now unavailable. Use a completely different approach.`);
-		log.warn({
-			tool: group.toolName,
-			consecutiveCount: group.count
-		}, "Loop guard: hiding tool from LLM");
-	} else if (group.count >= softThreshold) {
-		warnings.push(`You have called '${group.toolName}' ${group.count} times with the same arguments. This is not producing new information. Do NOT call it again with the same arguments — try a different approach.`);
-		log.debug({
-			tool: group.toolName,
-			consecutiveCount: group.count
-		}, "Loop guard: soft warning injected");
-	}
-	for (const [fp, count] of frequencyMap) {
-		const toolName = fp.split("::")[0];
-		if (count >= hideThreshold + 1 && !hiddenTools.has(toolName)) {
-			if (!consecutiveGroups.some((g) => g.toolName === toolName && g.count >= softThreshold)) warnings.push(`Tool '${toolName}' has been called ${count} times this turn with the same arguments (interleaved). Stop repeating this pattern.`);
-		}
-	}
-	return {
-		injection: warnings.length > 0 ? `⚠️ LOOP DETECTION:\n${warnings.join("\n")}\n\nYou MUST take a different approach. Do not repeat the same tool calls.` : null,
-		hiddenTools
-	};
-}
-/**
-* Find consecutive runs of identical (tool+params) calls from the end of history.
-* Returns all groups with count >= 2 (most recent first).
-*/
-function findConsecutiveRepeats(calls) {
-	const groups = [];
-	let index = calls.length - 1;
-	while (index >= 0) {
-		const current = calls[index];
-		const fp = fingerprint(current);
-		let count = 1;
-		while (index - count >= 0) {
-			const prev = calls[index - count];
-			if (fingerprint(prev) !== fp) break;
-			count++;
-		}
-		if (count >= 2) groups.push({
-			toolName: current.name,
-			fingerprint: fp,
-			count
-		});
-		index -= count;
-	}
-	return groups;
+	const value = JSON.stringify(call, (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b))) : item);
+	return createHash("sha256").update(value).digest("hex");
 }
-/**
-* Count how many times each (tool+params) fingerprint appears.
-*/
-function countFrequency(calls) {
-	const map = /* @__PURE__ */ new Map();
-	for (const call of calls) {
-		const fp = fingerprint(call);
-		map.set(fp, (map.get(fp) ?? 0) + 1);
-	}
-	return map;
+/** Warn on a stalled tail, without removing tools needed to recover or verify a repair. */
+function detectToolLoops(recentCalls) {
+	const calls = recentCalls.slice(-12);
+	const last = calls.at(-1);
+	if (!last) return { injection: null };
+	const hashes = calls.map(fingerprint);
+	let count = 0;
+	for (let index = hashes.length - 1; index >= 0 && hashes[index] === hashes.at(-1); index--) count++;
+	const alternating = hashes.length >= 6 && hashes.slice(-6, -3).every((hash, index) => hash === hashes.at(-3 + index));
+	if (count < 2 && !alternating) return { injection: null };
+	return { injection: `Repeated tool calls are producing no new evidence (${last.name}, ${count >= 2 ? `${count} identical calls` : "repeated cycle"}). Change the query or fix the cause before retrying. For a running job use managed_job wait. Tools remain available for a different argument or a changed workspace.` };
 }
 //#endregion
 export { detectToolLoops };

package/dist/src/agent/prompt/sections/tooling.js

@@ -34,8 +34,7 @@ const CORE_TOOL_ORDER = [
 	"text_to_speech",
 	"image",
 	"image_generate",
-	"create_share",
-	"execute_code"
+	"create_share"
 ];
 const CORE_TOOL_SUMMARIES = {
 	read_file: "Read targeted file contents before editing",
@@ -72,8 +71,7 @@ const CORE_TOOL_SUMMARIES = {
 	text_to_speech: "Send a standalone voice message",
 	image: "Analyze an image with the configured vision model",
 	image_generate: "Generate images with the configured image model",
-	create_share: "Create a shareable link for workspace files",
-	execute_code: "Run code in a sandbox with a restricted tool subset"
+	create_share: "Create a shareable link for workspace files"
 };
 function buildToolingSection(params) {
 	const rawToolNames = (params.toolNames ?? []).map((tool) => tool.trim()).filter(Boolean);

package/dist/src/agent/sandbox/types.d.ts

@@ -1,8 +1,8 @@
 /**
- * Sandbox type definitions for Phase 1 process-level isolation.
+ * Preflight command/path policy. OS isolation is provided by the command runtime.
  */
 /** Controls how strictly the sandbox enforces isolation. */
-export type SandboxMode = 'off' | 'basic' | 'container';
+export type SandboxMode = 'off' | 'basic';
 /** Result of path validation against the sandbox policy. */
 export type PathValidationResult = {
     allowed: boolean;

package/dist/src/agent/sandbox/types.js

@@ -3,7 +3,7 @@
 const DEFAULT_SANDBOX_CONFIG = {
 	mode: "basic",
 	allowedRoots: [],
-	maxExecutionTimeMs: 3e5,
+	maxExecutionTimeMs: 240 * 6e4,
 	maxOutputBytes: 50 * 1024
 };
 //#endregion

package/dist/src/agent/service/direct-turn-helpers.js

@@ -1,6 +1,6 @@
-import { buildTaskExecutionDirective } from "../../tasks/task-context-assembler.js";
 import { resolveImageHandlingStrategy } from "../image/vision-detection.js";
 import { hydrateUserTurnForLlm } from "../inbound/attachment-pipeline.js";
+import { buildTaskExecutionDirective } from "../../tasks/task-context-assembler.js";
 import { prependAgentContext } from "../../user-context/planner.js";
 import { extractAgentUserPlainText } from "../memory/user-message-text.js";
 import { shouldSkipResetOverlapCommand } from "../../session/reset-triggers.js";

package/dist/src/agent/service/process-direct-streaming.js

@@ -1,4 +1,5 @@
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
+import { abortEmbeddedRun } from "../embedded/runs.js";
 import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
 import { formatAgentRunErrorForClient } from "../client-error-format.js";
 import { resolveConfiguredActivityDetailDefault, resolveEffectiveReasoningLevel } from "../../session/thinking-resolve.js";
@@ -6,7 +7,6 @@ import { initSessionTurn } from "../../session/init-session-turn.js";
 import "../../session/index.js";
 import { mergeSttConfigFromAppConfig } from "../../voice/stt/config.js";
 import "../../voice/stt/index.js";
-import { abortEmbeddedRun } from "../embedded/runs.js";
 import { isVoiceLikeAttachment, mergeVoiceTranscriptsIntoUserText } from "../../channels/attachments/voice-stt-webchat.js";
 import { applyReasoningVisibility } from "../streaming/reasoning-visibility.js";
 import { isSessionSourceBinding, summarizeSourceContext } from "../source-context/types.js";

package/dist/src/agent/service.d.ts

@@ -38,8 +38,6 @@ export declare class AgentService {
     private toolUsageAnalyzer;
     private toolChainTracker;
     private errorPatternMatcher;
-    private selfVerifyMiddleware;
-    private turnDiffTracker;
     private contextMiddleware;
     private messageRouter;
     private commandHandler;

package/dist/src/agent/service.js

@@ -15,10 +15,11 @@ import { removeSkillsLockEntry } from "./skills/hub-lock.js";
 import { installSkillFromZip } from "./skills/managed-store.js";
 import { pullSkillFromSource } from "./skills/hub-pull.js";
 import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
-import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
-import { normalizeSkillInstallTarget } from "./skills/install-target.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
 import { persistInboundAttachments } from "../channels/attachments/inbound-persist.js";
+import { runXopcEmbeddedTurn } from "./embedded/run-turn.js";
+import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
+import { normalizeSkillInstallTarget } from "./skills/install-target.js";
 import { AgentManager } from "./agent-manager.js";
 import { maybeRefineSessionTitleWithLlm, maybeSetProvisionalSessionTitle } from "../session/session-title.js";
 import { resolveCompactionPolicy } from "./memory/compaction-policy.js";
@@ -38,13 +39,10 @@ import { SystemReminder } from "./prompt/system-reminder.js";
 import { ToolUsageAnalyzer } from "./tools/usage-analyzer.js";
 import { ToolChainTracker } from "./tools/chain-tracker.js";
 import { ErrorPatternMatcher } from "./tools/error-pattern-matcher.js";
-import { SelfVerifyMiddleware } from "./middleware/self-verify.js";
 import { ContextMiddleware } from "./middleware/context.js";
 import "./middleware/index.js";
-import { TurnDiffTracker } from "./coding/turn-diff-tracker.js";
 import { LifecycleManager } from "./lifecycle/manager.js";
 import "./lifecycle/index.js";
-import { runXopcEmbeddedTurn } from "./embedded/run-turn.js";
 import { runWithEmbeddedExecutionSession } from "./embedded/execution-context.js";
 import { MessageRouter } from "./messaging/message-router.js";
 import { CommandHandler } from "./messaging/command-handler.js";
@@ -106,8 +104,6 @@ var AgentService = class {
 	toolUsageAnalyzer;
 	toolChainTracker;
 	errorPatternMatcher;
-	selfVerifyMiddleware;
-	turnDiffTracker;
 	contextMiddleware;
 	messageRouter;
 	commandHandler;
@@ -242,19 +238,16 @@ var AgentService = class {
 			onSkillsUpdated: config.onSkillsUpdated,
 			installSkillFromSource: (opts) => this.installSkillFromSource(opts),
 			installSkillFromMarketplace: (opts) => this.installSkillFromMarketplace(opts),
-			isWorkspaceTrusted: config.isWorkspaceTrusted,
-			getSelfVerifyPromptContext: (sessionKey, agentId) => [this.selfVerifyMiddleware.getPendingVerificationContext(sessionKey, agentId), this.turnDiffTracker.buildFinalGuardContext(sessionKey)].filter(Boolean).join("\n\n")
+			isWorkspaceTrusted: config.isWorkspaceTrusted
 		});
 		this.agentEventHandler = new AgentEventHandler({
 			errorTracker: this.errorTracker,
 			requestLimiter: this.requestLimiter,
 			lifecycleManager: this.lifecycleManager,
 			toolChainTracker: this.toolChainTracker,
-			selfVerifyMiddleware: this.selfVerifyMiddleware,
 			systemReminder: this.systemReminder,
 			toolUsageAnalyzer: this.toolUsageAnalyzer,
-			errorPatternMatcher: this.errorPatternMatcher,
-			turnDiffTracker: this.turnDiffTracker
+			errorPatternMatcher: this.errorPatternMatcher
 		});
 		this.agentEventHandler.registerListener("message_end", (event, context) => {
 			const message = event.message;
@@ -438,13 +431,6 @@ var AgentService = class {
 			maxTotalFailures: 5,
 			resetOnTurnEnd: true
 		});
-		this.selfVerifyMiddleware = new SelfVerifyMiddleware({
-			maxEditsPerFile: 5,
-			enablePreCompletionCheck: true,
-			minTurnsForVerification: 4,
-			resetOnVerification: true
-		});
-		this.turnDiffTracker = new TurnDiffTracker();
 		this.requestLimiter = new RequestLimiter({
 			maxRequestsPerTurn: 50,
 			warnThreshold: .8,
@@ -836,10 +822,7 @@ var AgentService = class {
 	handleSessionEvent(sessionKey, event) {
 		const currentContext = this.sessionContextManager.getContext();
 		if (!currentContext) return;
-		if (currentContext.sessionKey !== sessionKey) {
-			this.agentEventHandler.handle(event, currentContext);
-			return;
-		}
+		if (currentContext.sessionKey !== sessionKey) return;
 		if (event.type === "message_update") {
 			const msgEvent = event;
 			if (msgEvent.message?.role === "assistant") {

package/dist/src/agent/tasks/task-judge-service.d.ts

@@ -1,6 +1,7 @@
 import type { TaskJudgment } from '@xopcai/gateway-contract';
 import { type Config } from '../../config/schema.js';
 import type { SessionStore } from '../../session/store.js';
+import type { TranscriptStoredRow } from '../../session/session-context-for-llm.js';
 import type { ModelManager } from '../models/index.js';
 export interface TaskTurnCompletion {
     sessionKey: string;
@@ -19,6 +20,12 @@ export interface TaskJudgeDecision {
     judgment: TaskJudgment;
 }
 export declare function parseTaskJudgeDecision(raw: string, criteriaCount: number): TaskJudgeDecision;
+export declare function codingCompletionEvidence(rows: readonly TranscriptStoredRow[]): {
+    allowed: boolean;
+    workspace?: string;
+    revision?: string;
+    evidence?: unknown;
+};
 export declare class TaskJudgeService {
     #private;
     private readonly options;

package/dist/src/agent/tasks/task-judge-service.js

@@ -6,6 +6,7 @@ import { getApiKey, init_providers, resolveModel } from "../../providers/index.j
 import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { TaskRunRepository } from "../../tasks/task-run-repository.js";
+import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
 import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
@@ -51,6 +52,21 @@ function parseTaskJudgeDecision(raw, criteriaCount) {
 		}
 	};
 }
+function codingCompletionEvidence(rows) {
+	const entries = rows;
+	const start = entries.findLastIndex((row) => row.type === "custom" && row.customType === "coding_run_started");
+	const final = entries.findLastIndex((row) => row.type === "custom" && row.customType === "coding_verification");
+	const checkpoint = entries[Math.max(start, final)]?.data;
+	if (!checkpoint?.required) return { allowed: true };
+	if (start > final) return { allowed: false };
+	const evidence = Array.isArray(checkpoint.evidence) ? checkpoint.evidence : [];
+	return {
+		allowed: checkpoint.changed !== true || evidence.some((item) => item.kind === "check" && item.status === "passed") && evidence.some((item) => item.kind === "diff-review" && item.status === "passed") && evidence.every((item) => item.status === "passed"),
+		evidence,
+		workspace: typeof checkpoint.workspace === "string" ? checkpoint.workspace : void 0,
+		revision: typeof checkpoint.revision === "string" ? checkpoint.revision : void 0
+	};
+}
 function resolveJudgeModel(config, sessionKey, runtimeModel) {
 	if (config) {
 		const profile = resolveEffectiveAgentProfileForSession(config, sessionKey);
@@ -94,12 +110,14 @@ var TaskJudgeService = class {
 			return;
 		}
 		const history = compactHistory(await this.options.sessionStore.loadMessages(payload.sessionKey));
+		const proof = codingCompletionEvidence(await this.options.sessionStore.loadTranscriptRows(payload.sessionKey));
 		const criteria = task.contract.acceptanceCriteria;
 		const request = {
 			role: "user",
 			content: [
 				"You are an independent task verifier. Be strict and evidence-driven.",
-				"Mark a criterion complete only when the transcript or latest response directly proves it.",
+				"Mark a criterion complete only when observed tool results or user-provided facts prove it. An assistant completion claim is not verification evidence.",
+				`Runtime coding evidence: ${JSON.stringify(proof)}`,
 				"needsUser is true only when a specific decision, permission, credential, or missing fact must come from the user.",
 				"Make one clear recommendation. Explain the decisive reasons, rejected alternatives, uncertainty, and calibrated confidence.",
 				"Return only JSON: {\"completedCriteria\":[0],\"needsUser\":false,\"nextAction\":\"...\",\"recommendation\":\"...\",\"reasons\":[\"...\"],\"rejectedAlternatives\":[{\"option\":\"...\",\"reason\":\"...\"}],\"uncertainty\":\"...\",\"confidence\":0.8}.",
@@ -120,6 +138,10 @@ var TaskJudgeService = class {
 			const modelError = getAssistantMessageErrorReason(response);
 			if (modelError) throw new Error(modelError);
 			const decision = parseTaskJudgeDecision(extractAssistantText(response.content), criteria.length);
+			if (!proof.allowed || proof.workspace && (!proof.revision || await readWorkspaceRevision(proof.workspace) !== proof.revision)) {
+				decision.completedCriteria = [];
+				decision.judgment.reasons.unshift("Current workspace verification is missing, failed or stale.");
+			}
 			const now = Date.now();
 			const evidence = decision.completedCriteria.map((index) => ({
 				kind: "state",
@@ -181,4 +203,4 @@ var TaskJudgeService = class {
 	}
 };
 //#endregion
-export { TaskJudgeService, parseTaskJudgeDecision };
+export { TaskJudgeService, codingCompletionEvidence, parseTaskJudgeDecision };

package/dist/src/agent/tools/delegate-tool.d.ts

@@ -15,7 +15,6 @@ export interface DelegateToolDeps {
         to?: string;
         threadId?: string | number;
     } | null;
-    hookRunner?: import('../../extensions/index.js').ExtensionHookRunner;
     toolExecutorConfig?: Partial<import('./executor.js').ToolExecutorConfig>;
     /**
      * Construct the child agent's tool set. Injected by `AgentToolsFactory` so
@@ -24,4 +23,6 @@ export interface DelegateToolDeps {
      */
     buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];
 }
+export declare const INSPECTION_TOOLS: Set<string>;
+export declare function delegateToolNames(mode: 'inspect' | 'review' | 'implement', requested?: string[]): string[];
 export declare function createDelegateTool(deps: DelegateToolDeps): AgentTool;

package/dist/src/agent/tools/delegate-tool.js

@@ -1,9 +1,12 @@
+import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
 import "../external-tools/index.js";
 import { createDelegateChildHandle } from "../child-agent-factory.js";
+import { runGit } from "../../execution-environments/git.js";
+import { LocalWorktreeManager } from "../../execution-environments/local-worktree-manager.js";
+import { SessionEnvironmentService } from "../../execution-environments/session-environment-service.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/delegate-tool.ts
-const DEFAULT_MAX_ITERATIONS = 30;
 const DEFAULT_DELEGATE_TOOLS = [
 	"exec_command",
 	"read_file",
@@ -36,160 +39,135 @@ const DELEGATE_BLOCKED_TOOLS = new Set([
 	EXTERNAL_TOOL_NAMES.execute,
 	"managed_job"
 ]);
+const INSPECTION_TOOLS = new Set([
+	"read_file",
+	"grep",
+	"find",
+	"list_dir",
+	"review_workspace"
+]);
 const DelegateTaskSchema = Type.Object({
-	goal: Type.String({ description: "Clear description of what the sub-agent should accomplish" }),
-	context: Type.Optional(Type.String({ description: "Additional context the sub-agent needs (file paths, constraints, etc.)" })),
-	toolset: Type.Optional(Type.Array(Type.String(), { description: "Tool names the sub-agent may use. Defaults to exec_command, read_file, write_file, apply_patch, grep, find, list_dir, web_search, web_fetch. Dangerous or interactive tools are always removed." })),
-	maxIterations: Type.Optional(Type.Number({
-		description: "Maximum tool executions in the sub-agent (default: 30)",
-		default: DEFAULT_MAX_ITERATIONS
+	goal: Type.String({ minLength: 1 }),
+	context: Type.Optional(Type.String()),
+	mode: Type.Optional(Type.Union([
+		Type.Literal("inspect"),
+		Type.Literal("review"),
+		Type.Literal("implement")
+	])),
+	toolset: Type.Optional(Type.Array(Type.String())),
+	maxIterations: Type.Optional(Type.Integer({
+		minimum: 1,
+		maximum: 60
 	}))
 });
+function delegateToolNames(mode, requested) {
+	const available = mode === "implement" ? new Set([
+		...DEFAULT_DELEGATE_TOOLS,
+		"review_workspace",
+		"language_diagnostics"
+	]) : INSPECTION_TOOLS;
+	return [...new Set(requested ?? [...available])].filter((name) => available.has(name) && !DELEGATE_BLOCKED_TOOLS.has(name));
+}
 function createDelegateTool(deps) {
 	return {
 		name: "delegate_task",
-		label: "🤖 Delegate",
-		description: "Spawn a sub-agent for an isolated subtask with a fresh conversation (no parent transcript).\n\nThe sub-agent returns a text summary only — tool traces stay out of your context.\n\nWHEN TO USE:\n- Independent work (research, multi-file exploration) where you only need the task\n- Avoiding context bloat from long intermediate tool output\n\nWHEN NOT TO USE:\n- Tasks that need this chat history or user clarification\n- Single trivial steps\n\nSub-agents cannot use clarify, messaging, memory tools, todo, or nested delegate_task.",
+		label: "Delegate task",
 		parameters: DelegateTaskSchema,
-		async execute(_toolCallId, params, signal) {
-			const p = params;
-			const maxIterations = p.maxIterations ?? DEFAULT_MAX_ITERATIONS;
-			if (!Number.isFinite(maxIterations) || maxIterations < 1 || maxIterations > 200) return {
-				content: [{
-					type: "text",
-					text: "Invalid maxIterations (use 1–200)."
-				}],
-				details: {
-					summary: "",
-					iterations: 0
-				}
-			};
-			const requested = p.toolset ?? [...DEFAULT_DELEGATE_TOOLS];
-			const allowedNames = [...new Set(requested.map((t) => String(t).trim()).filter(Boolean).filter((t) => !DELEGATE_BLOCKED_TOOLS.has(t)))];
-			if (allowedNames.length === 0) return {
-				content: [{
-					type: "text",
-					text: "No allowed tools remain after applying the delegation blocklist. Expand `toolset` with safe tools."
-				}],
-				details: {
-					summary: "",
-					iterations: 0
-				}
-			};
-			let model;
-			try {
-				model = deps.getSubagentModel();
-			} catch (e) {
-				return {
-					content: [{
-						type: "text",
-						text: `delegate_task: ${e instanceof Error ? e.message : String(e)}`
-					}],
-					details: {
-						summary: "",
-						iterations: 0
-					}
-				};
+		description: "Run one bounded leaf worker with a fresh context. inspect/review receive only read tools; review reports findings against a workspace revision. implement requires an attached project and clean Git workspace, creates a separate managed worktree, and returns its patch for parent review. Child changes are never merged automatically. No nested delegation, external messages or background jobs. Up to 60 tool calls, 100k tokens and five minutes per child.",
+		supportsParallel: false,
+		idempotent: false,
+		async execute(_id, input, signal) {
+			signal?.throwIfAborted();
+			const mode = input.mode ?? "inspect";
+			const tools = delegateToolNames(mode, input.toolset);
+			if (!tools.length) throw new Error("No permitted tools in the requested toolset");
+			const parentSessionKey = deps.getCurrentContext?.()?.sessionKey;
+			const model = deps.getSubagentModel();
+			let workspace = deps.workspace, environmentId;
+			if (mode === "implement") {
+				if (!parentSessionKey) throw new Error("Implementation delegation requires a project session");
+				const parent = new SessionEnvironmentService().get(parentSessionKey);
+				if (!parent?.projectId) throw new Error("Attach this session to a project before implementation delegation");
+				const environment = await new LocalWorktreeManager().provisionManagedWorktree({
+					projectId: parent.projectId,
+					repositoryPath: workspace
+				});
+				workspace = environment.rootPath;
+				environmentId = environment.id;
 			}
-			const ctx = deps.getCurrentContext?.() ?? null;
-			const parentSessionKey = ctx?.sessionKey;
-			const childOptions = {
-				workspace: deps.workspace,
-				goal: p.goal,
-				context: p.context,
+			const revision = await readWorkspaceRevision(workspace);
+			const child = createDelegateChildHandle({
+				workspace,
+				goal: mode === "review" ? `Independently review the actual changes. Inspect review_workspace and relevant source/tests. Report actionable defects with file and line evidence, severity and a concrete failure example. If there are no findings, state the checks and remaining uncertainty. Do not treat the parent's completion claim as evidence.\n\n${input.goal}` : input.goal,
+				context: input.context,
 				requesterSessionKey: parentSessionKey,
-				allowedToolNames: allowedNames,
-				maxIterations,
+				allowedToolNames: tools,
+				maxIterations: input.maxIterations ?? 30,
 				model,
 				bus: deps.bus,
 				getConfig: deps.getConfig,
 				toolExecutorConfig: deps.toolExecutorConfig,
-				buildChildTools: deps.buildChildTools
-			};
-			let childSessionKey;
-			try {
-				if (deps.hookRunner && parentSessionKey) {
-					const { parseSessionKey, buildSessionKey } = await import("../../routing/session-key.js");
-					const parsed = parseSessionKey(parentSessionKey);
-					if (parsed) childSessionKey = buildSessionKey({
-						agentId: "subagent",
-						source: parsed.agentId,
-						accountId: parsed.accountId,
-						peerKind: parsed.peerKind,
-						peerId: parsed.peerId,
-						threadId: parsed.threadId,
-						scopeId: parsed.scopeId
-					});
-					if (childSessionKey) {
-						const r = await deps.hookRunner.runHooksWithResult("subagent_spawning", {
-							childSessionKey,
-							requester: {
-								channel: ctx?.channel,
-								accountId: ctx?.accountId,
-								to: ctx?.to,
-								threadId: ctx?.threadId
-							},
-							threadRequested: true,
-							agentId: "subagent",
-							label: "delegate_task"
-						}, {
-							sessionKey: parentSessionKey,
-							agentId: ctx?.channel
-						});
-						if (r && r.status === "error") return {
-							content: [{
-								type: "text",
-								text: `delegate_task: ${String(r.error || "subagent spawn blocked")}`
-							}],
-							details: {
-								summary: "",
-								iterations: 0
-							}
-						};
-					}
-				}
-			} catch {}
-			const child = createDelegateChildHandle(childOptions);
-			if (signal) signal.addEventListener("abort", () => child.abort(), { once: true });
+				buildChildTools: deps.buildChildTools,
+				verifyChanges: mode === "implement"
+			});
+			const abort = () => child.abort();
+			signal?.addEventListener("abort", abort, { once: true });
+			if (signal?.aborted) abort();
 			try {
-				const { summary, toolIterations } = await child.run();
-				try {
-					if (deps.hookRunner && childSessionKey) await deps.hookRunner.runHooks("subagent_ended", {
-						targetSessionKey: childSessionKey,
-						accountId: ctx?.accountId
-					}, { sessionKey: parentSessionKey });
-				} catch {}
+				const result = await child.run();
+				const currentRevision = await readWorkspaceRevision(workspace);
+				const stale = mode !== "implement" && (!revision || revision !== currentRevision);
+				const patch = mode === "implement" ? await runGit(workspace, [
+					"diff",
+					"--no-ext-diff",
+					"--no-textconv",
+					"--binary",
+					"HEAD"
+				]).catch(() => "") : void 0;
 				return {
 					content: [{
 						type: "text",
-						text: `Sub-agent completed:\n\n${summary}`
+						text: [
+							result.summary,
+							stale ? "Workspace changed or could not be fingerprinted; review findings require revalidation." : "",
+							environmentId ? `Changes retained in ${workspace} (environment ${environmentId}). Review and integrate from this workspace, then verify the parent workspace again.` : "",
+							patch ? `Patch preview:\n${patch.slice(0, 3e4)}` : ""
+						].filter(Boolean).join("\n\n")
 					}],
 					details: {
-						summary,
-						iterations: toolIterations
+						status: stale && result.status === "success" ? "partial" : result.status,
+						mode,
+						summary: result.summary,
+						iterations: result.toolIterations,
+						revision: currentRevision,
+						reviewedRevision: revision,
+						...result.verification ? { childVerification: result.verification } : {},
+						...environmentId ? {
+							environmentId,
+							workspace,
+							patchTruncated: (patch?.length ?? 0) > 3e4
+						} : {}
 					}
 				};
 			} catch (error) {
-				child.abort();
-				try {
-					if (deps.hookRunner && childSessionKey) await deps.hookRunner.runHooks("subagent_ended", {
-						targetSessionKey: childSessionKey,
-						accountId: ctx?.accountId
-					}, { sessionKey: parentSessionKey });
-				} catch {}
 				return {
 					content: [{
 						type: "text",
-						text: `Sub-agent failed: ${error instanceof Error ? error.message : String(error)}`
+						text: `Delegation failed: ${String(error)}${environmentId ? `; work retained in ${workspace} (${environmentId})` : ""}`
 					}],
 					details: {
-						summary: "",
-						iterations: 0
+						status: signal?.aborted ? "cancelled" : "failed",
+						...environmentId ? {
+							environmentId,
+							workspace
+						} : {}
 					}
 				};
+			} finally {
+				signal?.removeEventListener("abort", abort);
 			}
 		}
 	};
 }
 //#endregion
-export { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, createDelegateTool };
+export { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, INSPECTION_TOOLS, createDelegateTool, delegateToolNames };