pantheon-opencode 1.3.5-beta.52.c75b04d → 1.3.5-beta.60.efa533f

package/src/agents/themis.md

@@ -1,13 +1,15 @@
 ---
 name: themis
 description: "Quality & security gate — Ruff/Biome linting, dead/legacy code detection, OWASP Top 10, coverage >80%, correctness, deprecation audit. Called by implementers; escalates blockers to zeus."
-mode: subagent
+mode: all
 reasoning_effort: high
 permission:
   read: allow
   grep: allow
   bash: allow
   edit: deny
+  task:
+    "*": deny
 temperature: 0.1
 steps: 30
 skills:

package/src/pantheon/delegation-enforce.ts

@@ -18,9 +18,9 @@
  *   - `task` is blocked too, which hard-enforces depth-2: a read-only agent
  *     cannot spawn its own subagents.
  *
- * Unknown sessions are ALLOWED by default — the guard only denies sessions
- * that are explicitly registered, so normal (non-delegated) agent work is
- * never blocked.
+ * Unknown sessions are allowed for ordinary tools. Delegation tools are
+ * fail-closed when the runtime matrix is wired: missing agent identity or
+ * target metadata is denied rather than inferred.
  *
  * The registry is populated by delegation.ts at delegate time: the CHILD
  * session is registered when the delegate call is read-only.
@@ -47,8 +47,100 @@ export interface ToolExecuteBeforeInput {
   callID: string
 }
 
+/** The output object supplied alongside `tool.execute.before`. */
+export interface ToolExecuteBeforeOutput {
+  args?: unknown
+}
+
 /** The `tool.execute.before` handler shape (throw ⇒ deny). */
-export type ToolExecuteBeforeHandler = (input: ToolExecuteBeforeInput) => Promise<void>
+export type ToolExecuteBeforeHandler = (
+  input: ToolExecuteBeforeInput,
+  output?: ToolExecuteBeforeOutput,
+) => Promise<void>
+
+/** Runtime session hierarchy, populated only from SDK session metadata. */
+export class SessionHierarchyRegistry {
+  private readonly roots = new Set<string>()
+  private readonly children = new Set<string>()
+  private seedState: 'unseeded' | 'pending' | 'seeded' | 'failed' = 'unseeded'
+
+  /** Mark the beginning of an authoritative session snapshot lookup. */
+  beginSeed(): void {
+    this.seedState = 'pending'
+  }
+
+  /** Complete the lookup and register the SDK's authoritative parentID data. */
+  completeSeed(sessions: ReadonlyArray<{ id: string; parentID?: string }>): void {
+    this.registerMany(sessions)
+    this.seedState = 'seeded'
+  }
+
+  /** Record an unavailable snapshot without classifying unknown sessions as children. */
+  failSeed(): void {
+    this.seedState = 'failed'
+  }
+
+  /** Register a session using its SDK parentID (or lack of one). */
+  register(session: { id: string; parentID?: string }): void {
+    if (session.parentID !== undefined) {
+      this.children.add(session.id)
+      this.roots.delete(session.id)
+      return
+    }
+    if (!this.children.has(session.id)) this.roots.add(session.id)
+  }
+
+  /** Register a snapshot returned by session.list(). */
+  registerMany(sessions: ReadonlyArray<{ id: string; parentID?: string }>): void {
+    for (const session of sessions) this.register(session)
+  }
+
+  /** Whether SDK metadata identified this session as a child. */
+  isChild(sessionID: string): boolean {
+    return this.children.has(sessionID)
+  }
+
+  /** Whether SDK metadata identified this session as a root. */
+  isRoot(sessionID: string): boolean {
+    if (this.children.has(sessionID)) return false
+    if (this.roots.has(sessionID)) return true
+    // Until the authoritative snapshot is available, an unknown session is
+    // deliberately unclassified. A valid root resumed after restart must not
+    // be denied merely because session.list() is slow or unavailable.
+    return this.seedState !== 'seeded'
+  }
+
+  /** Snapshot of known root IDs. */
+  rootIDs(): ReadonlySet<string> {
+    return new Set(this.roots)
+  }
+}
+
+/** Normalize an agent identity without guessing from prompts or tool names. */
+export function normalizeDelegationAgent(agent: unknown): string | undefined {
+  if (typeof agent !== 'string') return undefined
+  const normalized = agent.trim().toLowerCase()
+  return normalized === '' ? undefined : normalized
+}
+
+/** Runtime delegation matrix from Fase B2. */
+export function isDelegationAllowed(callerAgent: unknown, targetAgent: unknown): boolean {
+  const caller = normalizeDelegationAgent(callerAgent)
+  const target = normalizeDelegationAgent(targetAgent)
+  if (caller === undefined || target === undefined) return false
+  if (caller === 'zeus') return true
+  return (caller === 'athena' || caller === 'hermes') && target === 'apollo'
+}
+
+function targetFromTool(tool: string, args: unknown): string | undefined {
+  if (args === null || typeof args !== 'object') return undefined
+  const record = args as Record<string, unknown>
+  if (tool === 'pantheon_delegate') return normalizeDelegationAgent(record.agent)
+  if (tool === 'task') {
+    return normalizeDelegationAgent(record.subagent_type ?? record.subagentType)
+  }
+  return undefined
+}
 
 /** Options for createEnforcementGuard(). */
 export interface EnforcementGuardOptions {
@@ -56,6 +148,14 @@ export interface EnforcementGuardOptions {
   blockedTools?: ReadonlySet<string>
   /** Prefix for the denial message. */
   messagePrefix?: string
+  /** Current agent by session, populated by the SDK chat.params hook. */
+  getSessionAgent?: (sessionID: string) => string | undefined
+  /** SDK-backed root check used for the delegation matrix. */
+  isRootSession?: (sessionID: string) => boolean
+  /** SDK-backed child check used to prevent native task() depth escalation. */
+  isChildSession?: (sessionID: string) => boolean
+  /** Audit sink for denied runtime delegation attempts. */
+  logger?: { warn?: (message: string) => void }
 }
 
 // ─── Defaults ──────────────────────────────────────────────────────────
@@ -129,7 +229,41 @@ export function createEnforcementGuard(input: {
   const blockedTools = input.options?.blockedTools ?? DEFAULT_BLOCKED_TOOLS
   const prefix = input.options?.messagePrefix ?? 'pantheon_delegate guard'
 
-  return async (hook: ToolExecuteBeforeInput): Promise<void> => {
+  return async (hook: ToolExecuteBeforeInput, output?: ToolExecuteBeforeOutput): Promise<void> => {
+    const isDelegationTool = hook.tool === 'task' || hook.tool === 'pantheon_delegate'
+    if (isDelegationTool && input.options?.isChildSession?.(hook.sessionID) === true) {
+      throw new Error(
+        `${prefix}: session ${hook.sessionID} is a child session — delegation tools are denied ` +
+          'to prevent nested delegation',
+      )
+    }
+    // pantheon_delegate has the authoritative ToolContext.agent at execution
+    // time, so its matrix check lives in delegation.ts. The hook only has the
+    // session-scoped agent learned from chat.params for native task().
+    if (
+      hook.tool === 'task' &&
+      input.options?.isRootSession !== undefined &&
+      input.options?.isChildSession?.(hook.sessionID) !== true
+    ) {
+      const caller = input.options.getSessionAgent?.(hook.sessionID)
+      const target = targetFromTool(hook.tool, output?.args)
+      if (!input.options.isRootSession(hook.sessionID)) {
+        input.options.logger?.warn?.(
+          `${prefix}: delegation denied for session ${hook.sessionID} — not an authorized root session`,
+        )
+        throw new Error(`${prefix}: session ${hook.sessionID} is not an authorized root session`)
+      }
+      if (!isDelegationAllowed(caller, target)) {
+        const reason =
+          caller === undefined ? 'caller agent is unavailable' : 'agent/target is not allowed'
+        input.options.logger?.warn?.(
+          `${prefix}: delegation denied for session ${hook.sessionID} — ${reason}`,
+        )
+        throw new Error(
+          `${prefix}: delegation denied — ${reason}; target must follow the runtime matrix`,
+        )
+      }
+    }
     if (!blockedTools.has(hook.tool)) return
     if (!input.getReadOnlySessions().has(hook.sessionID)) return
 

package/src/pantheon/delegation-finalize.ts

@@ -65,6 +65,16 @@ export interface DelegationOptions {
   rootSessions?: ReadonlySet<string>
   /** Custom depth-guard predicate — overrides rootSessions and the default. */
   isRootSession?: (sessionID: string) => boolean
+  /** SDK-backed child predicate; authoritative when supplied by the plugin. */
+  isChildSession?: (sessionID: string) => boolean
+  /**
+   * Enforce the runtime B2 delegation matrix; createDelegationTools defaults
+   * this to true. Set false only for an explicitly legacy host that cannot
+   * provide ToolContext.agent.
+   */
+  enforceRuntimeMatrix?: boolean
+  /** Record a child returned by the SDK session.create call. */
+  registerChildSession?: (sessionID: string, parentID: string) => void
   /**
    * Agents whose delegated child sessions are registered as read-only
    * (Phase 4 enforcement). Mirrors routing.yml
@@ -78,6 +88,20 @@ export interface DelegationOptions {
    * from routing.yml agent entries. Higher priority than the active preset.
    */
   agentModels?: Readonly<Record<string, string>>
+  /**
+   * Fase B3: Per-exception delegation budgets. Keys use
+   * `<parent-agent>-><target-agent>` (for example `athena->apollo`). The
+   * count is tracked per parent session for this process. It is intentionally
+   * not persisted across restart because this layer has no reliable store.
+   * An absent key has no budget limit.
+   */
+  delegationBudgets?: ReadonlyMap<string, number>
+  /**
+   * Fase B3: Wall-clock timeout (ms) for individual delegation sessions.
+   * The plugin resolves `PANTHEON_DELEGATION_TIMEOUT_MS` into this option;
+   * direct callers may provide it here instead.
+   */
+  wallClockTimeoutMs?: number
   /**
    * Env override for the active-preset resolution (see resolveActivePreset).
    * Defaults to process.env. Primarily for tests.

package/src/pantheon/delegation.ts

@@ -19,19 +19,13 @@
  * Depth guard (root-session detection): the ToolContext carries NO parentID
  * (spike), so root detection is configurable. Resolution order:
  *   1. `options.isRootSession(sessionID)` custom predicate;
- *   2. `options.rootSessions` explicit allowlist — with a knownChildren
- *      fallback (compaction-134): a session is a sub-session ONLY if WE
- *      created it as a child (`session.create` via pantheon_delegate).
- *      Sessions in neither set are treated as root, so a resumed root can
- *      delegate after a restart even when the allowlist is incomplete
- *      (opencode does not replay `session.created` events for pre-existing
- *      sessions — the plugin seeds the registry from session.list() at
- *      startup, and this fallback covers a failed/incomplete seed);
+ *   2. `options.rootSessions` explicit allowlist, with `options.isChildSession`
+ *      authoritative when supplied by the plugin. SDK session metadata is
+ *      registered from parentID; no prompt/name inference is used.
  *   3. default (no rootSessions): any session WE created via
  *      `session.create` is a sub-session; everything else is treated as
- *      root. Phase 3 should pass the root registry derived from
- *      `session.created` events (Session.parentID undefined ⇒ root) for
- *      authoritative enforcement.
+ *      root for standalone compatibility. The plugin supplies the SDK-backed
+ *      hierarchy at runtime.
  *
  * Read-only enforcement is Phase 4 — `read_only` is exposed on the delegate
  * args and the child session is registered in the read-only registry when the
@@ -44,7 +38,11 @@
 import { z } from 'zod'
 
 import type { BackgroundJobBoard, BackgroundJobRecord } from './background-job-board.ts'
-import { readOnlyRegistry } from './delegation-enforce.ts'
+import {
+  isDelegationAllowed,
+  normalizeDelegationAgent,
+  readOnlyRegistry,
+} from './delegation-enforce.ts'
 import {
   DELEGATION_DEFAULTS,
   type DelegationClient,
@@ -67,6 +65,49 @@ export type {
 } from './delegation-finalize.ts'
 export { DELEGATION_DEFAULTS } from './delegation-finalize.ts'
 
+// Fase B3: these are runtime controls, not routing/frontmatter fields. The
+// plugin reads them from the environment, while tests and embedders can pass
+// the same values through DelegationOptions.
+export const B3_DEFAULT_EXCEPTION_BUDGET = 5
+
+function readIntegerEnv(
+  env: Record<string, string | undefined>,
+  name: string,
+  fallback: number,
+  minimum: number,
+): number {
+  const raw = env[name]?.trim()
+  if (raw === undefined || raw === '') return fallback
+  const value = Number(raw)
+  return Number.isSafeInteger(value) && value >= minimum ? value : fallback
+}
+
+/** Resolve the two supported read-only delegation exception budgets. */
+export function resolveDelegationBudgets(
+  env: Record<string, string | undefined> = process.env,
+): ReadonlyMap<string, number> {
+  return new Map([
+    [
+      'athena->apollo',
+      readIntegerEnv(env, 'PANTHEON_ATHENA_APOLLO_BUDGET', B3_DEFAULT_EXCEPTION_BUDGET, 0),
+    ],
+    [
+      'hermes->apollo',
+      readIntegerEnv(env, 'PANTHEON_HERMES_APOLLO_BUDGET', B3_DEFAULT_EXCEPTION_BUDGET, 0),
+    ],
+  ])
+}
+
+/** Resolve an optional positive wall-clock timeout from the environment. */
+export function resolveDelegationTimeoutMs(
+  env: Record<string, string | undefined> = process.env,
+): number | undefined {
+  const raw = env.PANTHEON_DELEGATION_TIMEOUT_MS?.trim()
+  if (raw === undefined || raw === '') return undefined
+  const value = Number(raw)
+  return Number.isSafeInteger(value) && value > 0 ? value : undefined
+}
+
 // ─── Types ─────────────────────────────────────────────────────────────
 
 // Silence-by-default TUI policy (pantheon-hooks L42-58): console output in a
@@ -79,6 +120,11 @@ export interface ToolContextLike {
   sessionID: string
   directory?: string
   worktree?: string
+  /**
+   * The OpenCode SDK's ToolContext declares this as required. It remains
+   * optional here because the structural test/embedding surface can be
+   * supplied by older hosts; B3 must skip enforcement when it is absent.
+   */
   agent?: string
 }
 
@@ -146,6 +192,9 @@ function stateLabel(state: BackgroundJobRecord['state']): string {
   }
 }
 
+/** Normalize the SDK-provided caller agent without inventing an identity. */
+const normalizeToolAgent = normalizeDelegationAgent
+
 // ─── Agent activity sampling ────────────────────────────────────────────
 //
 // Visibility for `pantheon_delegation_read` / `pantheon_delegation_list`
@@ -478,16 +527,24 @@ export function collectRootSessionIDs(
  */
 export function createDelegationTools(input: CreateDelegationToolsInput): DelegationToolset {
   const { board, client } = input
-  const options: DelegationOptions = input.options ?? {}
+  // Runtime matrix enforcement is the safe default for every host. A legacy
+  // structural embedder must opt out explicitly with `false`; omission must
+  // never silently widen the delegation surface.
+  const options: DelegationOptions = { enforceRuntimeMatrix: true, ...(input.options ?? {}) }
   const deps: DelegationDeps = { board, client, options }
   const outputDir = options.outputDir ?? DELEGATION_DEFAULTS.outputDir
-  const timeoutMs = options.timeoutMs ?? DELEGATION_DEFAULTS.timeoutMs
+  const timeoutMs = options.wallClockTimeoutMs ?? options.timeoutMs ?? DELEGATION_DEFAULTS.timeoutMs
   const readTimeoutMs = options.readTimeoutMs ?? DELEGATION_DEFAULTS.readTimeoutMs
 
   const knownChildren = new Set<string>()
   const timers = new Map<string, NodeJS.Timeout>()
+  // Fase B3: per-parent-session delegation budget tracking, scoped to this
+  // factory/process instance. Keyed by `${parentSessionID}:${parentAgent}->${targetAgent}`;
+  // it is not restart-persistent because the factory has no reliable store.
+  const budgetUsage = new Map<string, number>()
 
   function isRootSession(sessionID: string): boolean {
+    if (options.isChildSession?.(sessionID) === true) return false
     if (options.isRootSession !== undefined) return options.isRootSession(sessionID)
     if (options.rootSessions !== undefined) {
       // compaction-134 (fix layer 2): the allowlist alone is NOT
@@ -540,6 +597,54 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
         )
       }
 
+      // Fase B3: only the two read-only exceptions are budgeted. The official
+      // SDK provides the current agent on ToolContext. If a structural/older
+      // host omits it, do NOT infer identity from prompt, target, or process
+      // state: the budget is explicitly skipped and the delegation continues.
+      const parentAgent = normalizeToolAgent(ctx.agent)
+      const targetAgent = args.agent.toLowerCase()
+      if (options.enforceRuntimeMatrix === true && !isDelegationAllowed(parentAgent, targetAgent)) {
+        const reason =
+          parentAgent === undefined
+            ? 'ToolContext.agent is unavailable'
+            : `${parentAgent}->${targetAgent} is not allowed`
+        options.logger?.warn?.(
+          `[pantheon-delegate] runtime delegation denied for session ${ctx.sessionID}: ${reason}`,
+        )
+        throw new Error(`pantheon_delegate rejected: runtime delegation matrix denied (${reason})`)
+      }
+      if (
+        parentAgent === undefined &&
+        !options.enforceRuntimeMatrix &&
+        (options.delegationBudgets?.size ?? 0) > 0
+      ) {
+        const message =
+          `[pantheon-delegate] B3 budget skipped: current agent unavailable for session ${ctx.sessionID}; ` +
+          `no budget limit applied to ${targetAgent}. Runtime must provide ToolContext.agent ` +
+          '(the official SDK field) to enforce the configured exception budget.'
+        ;(options.logger?.warn ?? ((msg: string) => log.warn(msg)))(message)
+      }
+      const budgetKey =
+        parentAgent === undefined ? undefined : `${ctx.sessionID}:${parentAgent}->${targetAgent}`
+      const budget =
+        parentAgent === undefined
+          ? undefined
+          : options.delegationBudgets?.get(`${parentAgent}->${targetAgent}`)
+      let budgetReserved = false
+      if (budgetKey !== undefined && budget !== undefined) {
+        const used = budgetUsage.get(budgetKey) ?? 0
+        if (used >= budget) {
+          throw new Error(
+            `pantheon_delegate rejected: delegation budget exhausted for ${parentAgent}->${targetAgent} ` +
+              `(${used}/${budget} dispatches used in this session). ` +
+              'Configure the corresponding PANTHEON_*_APOLLO_BUDGET environment variable or DelegationOptions.',
+          )
+        }
+        // Reserve before the first await so concurrent calls cannot overshoot.
+        budgetUsage.set(budgetKey, used + 1)
+        budgetReserved = true
+      }
+
       // session.create failure → return a clear error as TEXT (tools return
       // errors as text, not thrown) and register NO job on the board — an
       // unhandled rejection here would otherwise lose the failure entirely.
@@ -551,7 +656,11 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
       // opencode/deepseek-v4-flash-free; if nothing usable remains the
       // failure is returned as TEXT below — no session, no board job.
       const resolved = resolveUsableChildModel(options, args.agent, args.model)
-      if (resolved.error !== undefined) return resolved.error
+      if (resolved.error !== undefined) {
+        if (budgetReserved && budgetKey !== undefined)
+          budgetUsage.set(budgetKey, (budgetUsage.get(budgetKey) ?? 1) - 1)
+        return resolved.error
+      }
       const childModel = resolved.model
       let created: { id: string }
       try {
@@ -564,10 +673,14 @@ export function createDelegationTools(input: CreateDelegationToolsInput): Delega
         })
       } catch (err: unknown) {
         const reason = err instanceof Error ? err.message : String(err)
+        if (budgetReserved && budgetKey !== undefined) {
+          budgetUsage.set(budgetKey, Math.max(0, (budgetUsage.get(budgetKey) ?? 1) - 1))
+        }
         return `pantheon_delegate failed to create child session: ${reason}`
       }
       const childSessionID = created.id
       knownChildren.add(childSessionID)
+      options.registerChildSession?.(childSessionID, ctx.sessionID)
 
       // Phase 4 read-only enforcement: register the child session in the
       // read-only registry when the delegate is read-only — explicit

package/src/pantheon/vision.ts

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url'
 import type { Hooks, PluginInput } from '@opencode-ai/plugin'
 import type { FilePart, Part, TextPart, UserMessage } from '@opencode-ai/sdk'
 import type { ResolvedPreset } from './presets.mjs'
-import { hasVision, resolveActivePreset, visionBrokenOnGateway } from './presets.mjs'
+import { CAPABILITY_TABLE, hasVision, resolveActivePreset, visionBrokenOnGateway } from './presets.mjs'
 
 // ─── Constants ────────────────────────────────────────────────────────────
 
@@ -121,9 +121,30 @@ type NativeVisionEndpoint = { modelID: string; baseURL: string }
 
 export type VisionMode = 'native' | 'tool' | 'auto'
 
+/**
+ * Check whether a provider is text-only by examining CAPABILITY_TABLE.
+ * A provider is text-only if ALL provider-qualified entries (prefix starting
+ * with `providerID/`) have `vision: false`. If no provider-qualified entries
+ * exist, the provider is unknown → returns false (fail-open).
+ */
+export function providerIsTextOnly(providerID: string): boolean {
+  const providerEntries = CAPABILITY_TABLE.filter((entry) =>
+    entry.prefix.startsWith(`${providerID}/`),
+  )
+  if (providerEntries.length === 0) return false
+  return providerEntries.every((entry) => !entry.vision)
+}
+
 /** Return whether OpenCode's current model is known to accept image input. */
-export function modelAcceptsImages(model: ModelInfo | undefined): boolean {
-  if (!model) return true
+export function modelAcceptsImages(
+  model: ModelInfo | undefined,
+  providerID?: string,
+): boolean {
+  if (!model) {
+    // Fail-closed for known text-only providers
+    if (providerID && providerIsTextOnly(providerID)) return false
+    return true
+  }
   try {
     const id = `${model.providerID}/${model.modelID}`
     // Provider/gateway-aware: a model can be vision-capable per models.dev
@@ -1230,7 +1251,7 @@ export function createVisionHandler(input: PluginInput) {
       const message: UserMessage | undefined = output?.message
       if (!message || message.role !== 'user') return
       const model = hookInput?.model ?? message.model
-      if (modelAcceptsImages(model)) {
+      if (modelAcceptsImages(model, model?.providerID)) {
         nativeVisionSessions.add(hookInput.sessionID)
         return
       }

package/src/plugin.ts

@@ -7,9 +7,15 @@ import {
   collectRootSessionIDs,
   createDelegationTools,
   type DelegationClient,
+  resolveDelegationBudgets,
+  resolveDelegationTimeoutMs,
 } from './pantheon/delegation.ts'
 import { buildCompactionContext } from './pantheon/delegation-compaction.ts'
-import { createEnforcementGuard, readOnlyRegistry } from './pantheon/delegation-enforce.ts'
+import {
+  createEnforcementGuard,
+  readOnlyRegistry,
+  SessionHierarchyRegistry,
+} from './pantheon/delegation-enforce.ts'
 import { handleDelegationEvent } from './pantheon/delegation-notify.ts'
 import { FilePersistenceAdapter } from './pantheon/file-persistence.ts'
 import { GOAL_LOOP_DEFAULTS, GoalLoop, GoalStore } from './pantheon/goal-loop.ts'
@@ -94,6 +100,12 @@ setInterval(
 // from tool.execute.before; unknown sessions are allowed (safe default).
 const enforcementGuard = createEnforcementGuard({
   getReadOnlySessions: () => readOnlyRegistry.sessionIDs(),
+  options: {
+    getSessionAgent: (sessionID) => sessionAgents.get(sessionID),
+    isRootSession: (sessionID) => rootSessions.has(sessionID) || sessionHierarchy.isRoot(sessionID),
+    isChildSession: (sessionID) => sessionHierarchy.isChild(sessionID),
+    logger: log,
+  },
 })
 
 // Mirrors routing.yml background_delegation.max_compaction_items.
@@ -111,6 +123,8 @@ const COMPACTION_MAX_ITEMS = 10
 // created is a sub-session; unknown sessions are roots") so the depth guard
 // works even when this set is incomplete.
 const rootSessions = new Set<string>()
+const sessionHierarchy = new SessionHierarchyRegistry()
+const sessionAgents = new Map<string, string>()
 
 /**
  * Seed resumed root sessions without making OpenCode startup depend on the
@@ -127,18 +141,23 @@ function seedRootSessionsInBackground(input: PluginInput): void {
   // the seed is always safe.
   const session = input.client.session
   if (typeof session?.list !== 'function') return
+  sessionHierarchy.beginSeed()
   void session
     .list()
     .then((result) => {
       if (!result.error && Array.isArray(result.data)) {
+        sessionHierarchy.completeSeed(result.data)
         const seeded = collectRootSessionIDs(result.data)
         if (seeded.size > 0) {
           for (const id of seeded) rootSessions.add(id)
           log.info(`[Pantheon Plugin] Seeded ${seeded.size} root session(s) from session.list`)
         }
+      } else {
+        sessionHierarchy.failSeed()
       }
     })
     .catch((err) => {
+      sessionHierarchy.failSeed()
       log.warn('[Pantheon Plugin] Root session seed failed (fail-open):', err)
     })
 }
@@ -264,13 +283,26 @@ const plugin: Plugin = async (input: PluginInput) => {
   // Phase 2/3: background delegation toolset + the bound finalize lifecycle
   // hook. Completion is observed through the event hook below
   // (session.idle / session.error on a child) → finalizeDelegation.
+  // Fase B3: runtime controls for the two read-only exceptions and the real
+  // per-child wall-clock timer. No task_budget field is injected into the
+  // plugin/frontmatter; these are enforced by delegation.ts itself.
+  const delegationBudgets = resolveDelegationBudgets()
+  const wallClockTimeoutMs = resolveDelegationTimeoutMs()
+
   const delegation = createDelegationTools({
     board,
     client: adaptDelegationClient(input.client),
     options: {
       rootSessions,
+      isChildSession: (sessionID) => sessionHierarchy.isChild(sessionID),
+      registerChildSession: (sessionID, parentID) => {
+        sessionHierarchy.register({ id: sessionID, parentID })
+      },
+      enforceRuntimeMatrix: true,
       readOnlyAgents: new Set(['apollo', 'gaia']),
       agentModels: routingAgentModels,
+      delegationBudgets,
+      ...(wallClockTimeoutMs !== undefined ? { wallClockTimeoutMs } : {}),
     },
   })
 
@@ -393,12 +425,20 @@ const plugin: Plugin = async (input: PluginInput) => {
       // user-activity gate skips injection for userActivityQuietMs afterwards.
       todoEnforcer.noteUserActivity(hookInput.sessionID)
     },
+    'chat.params': async (hookInput) => {
+      // The SDK exposes the active agent here; tool.execute.before has no
+      // agent field. Never infer identity from a prompt or tool name.
+      sessionAgents.set(hookInput.sessionID, hookInput.agent)
+    },
     'experimental.chat.messages.transform': vision.messagesTransform,
     event: async ({ event: ev }) => {
       // Phase 3: sessions created without a parent are roots for the depth guard.
       if (ev.type === 'session.created') {
         const info = ev.properties.info
-        if (info && info.parentID === undefined) rootSessions.add(info.id)
+        if (info) {
+          sessionHierarchy.register(info)
+          if (info.parentID === undefined) rootSessions.add(info.id)
+        }
       }
       // release-134 Phase 3: activate the todo snapshot captured at
       // compacting time — the first todowrite within the restore window is
@@ -449,7 +489,7 @@ const plugin: Plugin = async (input: PluginInput) => {
       // first post-compaction `todowrite` with the captured todo snapshot.
       // Both are no-ops for non-matching sessions/tools; the preserver is
       // fail-open (only its intentional restore denial throws).
-      await enforcementGuard(input)
+      await enforcementGuard(input, output)
       await todoPreserver.beforeTodoWrite(input, output)
     },
     // Wave 2 (PR #46): augment `read` output with hashline tags. Additive —

package/src/plugins/tui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pantheon-tui",
   "type": "module",
-  "version": "1.3.5-beta.52.c75b04d",
+  "version": "1.3.5-beta.60.efa533f",
   "description": "Pantheon TUI plugin — sidebar (version, preset, sessions, real-time delegations) + AI subscription usage gauges incl. OpenCode Go/Zen dollar limits (vendored, MIT)",
   "license": "MIT",
   "exports": {