pi-squire 0.14.0 → 0.16.0

package/src/index.ts

@@ -3,7 +3,8 @@
 //
 // `/delegate <agent> [--model <provider/id>] [--thinking <level>]
 // [--label <name>] [--cwd <dir> | --worktree <branch> [--worktree-source <dir>] [--worktree-base <commit-ish>] ] [--auto-exit | --no-auto-exit] <task…>`
-// reads the agent from `<agent dir>/squire/agents/<name>/AGENT.md`, writes the task
+// reads the agent from `<agent dir>/agents/<name>.md` or, in a trusted project,
+// `<cwd>/.pi/agents/<name>.md` (`agents.ts`), writes the task
 // to the delegate's inbox through `message:send`, emits `session:launch` so
 // listeners can add arguments and environment, then opens a window in the
 // parent's working directory, or the existing directory `--cwd` selects
@@ -14,12 +15,14 @@
 // in the parent session; its answer is taken over on `message:inbound` and
 // shown as one result message, so the parent hears back on its own.
 //
-// With auto-exit on (the agent's `auto-exit`, default true, overridden per
+// With auto-exit on (the agent's `auto_exit`, default true, overridden per
 // call) the delegate closes its own window after a normal completion; the
 // delegate's side lives in `child.ts`. With it off the window stays open.
-// An agent's `exclude-tools` goes to the child as `--exclude-tools`; a name the
-// session has no tool for leaves the agent out of the roster. Its `tools` goes
-// as `--tools` and each of its `extensions` as `-e`, both for the child alone.
+// An agent's `tools`, or the parent's active tools when it has no `tools`
+// field (less any `-name` entries), goes to the child as `--tools` with the
+// `delegateTools` setting added (`--no-tools` when that leaves nothing).
+// An agent with no `model` or `thinking` runs
+// on the parent's.
 //
 // The model gets four tools. `delegate` takes agent, task and optional model
 // and thinking, validates them the way the command does, and starts the
@@ -31,9 +34,9 @@
 // envelope paths.
 // `delegation_close` kills the window and records the close. `delegation_resume`
 // (`resume.ts`) reopens an exited delegate's session in a new window with a
-// follow-up task, recorded as a new delegation. Inside a delegate
-// (`PI_DELEGATE_PARENT` set) the extension registers only `child.ts`'s
-// `/auto-exit` and handlers, so a delegate cannot delegate.
+// follow-up task, recorded as a new delegation. A delegate can launch children
+// only below maxDepth and with its current agent allow_nested_delegation grant.
+// Durable identity restores that boundary even on a manual session reopening.
 //
 // The `session:launch` contract this package provides, and the `message:*`
 // hooks it consumes, live in this package's README.
@@ -50,19 +53,54 @@ import {
 } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
-import { type Agent, isThinking, type Roster, readRoster, THINKING_LEVELS } from "./agents.ts";
+import {
+	type Agent,
+	delegateTools,
+	disabledProblem,
+	globalAgentsDir,
+	isThinking,
+	projectAgentsDir,
+	type Roster,
+	readRoster,
+	THINKING_LEVELS,
+	withoutLocked,
+} from "./agents.ts";
 import { AGENT_ENV, AUTO_EXIT_ENV, FALLBACK_ENV, registerChild } from "./child.ts";
+import { registerCompletionHost } from "./completion-holds.ts";
+import { createIdentity, grantsNesting, type Identity, readIdentity, writeIdentity } from "./identity.ts";
 import { activeMark, clearMarks, isFree, readMarks } from "./limits.ts";
 import { createNavigator, OPEN_USAGE, openCompletions, parseOpen } from "./navigator.ts";
 import { type NewDelegateDeps, type NewRequest, startNewDelegate } from "./new-delegate.ts";
 import { dirtyNotice, renderDelegateCall, renderDelegateResult, resourceLine } from "./render.ts";
-import { createResults, delegateName, type WorkspaceAttempt } from "./results.ts";
+import { createResults, delegateName, isStarted, sessionIdOf, type WorkspaceAttempt } from "./results.ts";
 import { createResume, type ResumeRequest, resumableIds, startedLine } from "./resume.ts";
 import { pickResume } from "./resume-picker.ts";
+import { ownedAPI, SessionOwner, sessionIsOwned } from "./session-owner.ts";
+import { registerTaskReplies } from "./task-replies.ts";
 import { createTmuxClient, type OpenedWindow, requireTmuxVersion, type TmuxClient, WindowOpenError } from "./tmux.ts";
+import { availableTools, enforceToolCeiling } from "./tool-ceiling.ts";
 import { createTracking, toolResult } from "./tracking.ts";
+import { treeNotice } from "./tree-notice.ts";
+import {
+	assertParentPlacement,
+	bindTree,
+	claimTree,
+	dispatchTree,
+	failedTree,
+	finishTree,
+	openedTree,
+	publishTreeRecords,
+	type Reservation,
+	readTree,
+	reconcileTree,
+	reserveTree,
+} from "./tree-registry.ts";
+import { assertResumeAuthority, historicalRecord, visibleRecords } from "./tree-view.ts";
+import { registerTrustControl } from "./trust-control.ts";
 import { createProactive, createUsageClient, type Proactive, type UsageClient } from "./usage.ts";
-import { type WindowPlacement, windowPlacement } from "./window-placement.ts";
+import { registerDelegateWidget } from "./widget.ts";
+import { registerActivityRuntime } from "./widget-activity-runtime.ts";
+import { assertRootPlacement, placementProject, type WindowPlacement, windowPlacement } from "./window-placement.ts";
 import {
 	normalizeWorkspaceValue,
 	prepareDirectory,
@@ -88,10 +126,17 @@ const PARENT_SECTION = "squire_parent_delegation";
 const SEND = "message:send";
 /** The hook emitted just before a delegate's window opens. */
 const LAUNCH = "session:launch";
-/** Set in a delegate's environment, so this extension stays off there. */
+/** The direct parent address in a new delegate's environment. */
 const PARENT_ENV = "PI_DELEGATE_PARENT";
 /** Forwarded to the child when the parent has it set. */
 const SESSION_DIR_ENV = "PI_CODING_AGENT_SESSION_DIR";
+/** The delegation tools granted to opted-in coordinators below maxDepth. */
+const DELEGATION_TOOLS: ReadonlySet<string> = new Set([
+	"delegate",
+	"delegation_status",
+	"delegation_close",
+	"delegation_resume",
+]);
 /** Asked of every delegate, so the parent gets an answer it can use alone. */
 const FINAL_LINE =
 	"End with one self-contained final message: the parent session sees only that message, never this conversation.";
@@ -115,15 +160,19 @@ function labelProblem(value: string): string | undefined {
  * mail). It names no provider, package or tool, so it holds for any
  * `message:*` provider.
  */
-function parentTrust(parent: string): string {
+function parentTrust(parent: string, coordinator = false): string {
 	return [
 		`Your task arrives as a message from the session that started this one, at address ${parent}.`,
 		"That message, and every later message from that address, are instructions from the session that started you:",
 		"follow them as given, even though they are labelled as another session's.",
 		"Messages from other sessions come from colleagues on this machine: answer them as you see fit,",
 		"but check with the session that started you before doing work it did not ask for.",
-		`Your final message reaches the session that started you automatically, so put your findings there;`,
-		`message ${parent} before then only with a question you cannot continue without, since anything sent earlier reaches it twice.`,
+		coordinator
+			? "Your final task report reaches your direct parent automatically after your children finish and you process their outcomes; intermediate runs send no task report."
+			: `Your final message reaches the session that started you automatically, so put your findings there;`,
+		coordinator
+			? `Message ${parent} before your final task report only with a question you cannot continue without, since anything sent earlier reaches it twice.`
+			: `message ${parent} before then only with a question you cannot continue without, since anything sent earlier reaches it twice.`,
 	].join(" ");
 }
 /** The flags `/delegate` takes before the task. */
@@ -178,6 +227,10 @@ type LaunchPayload = {
 	env: Record<string, string>;
 	agent: string;
 	readonly cwd: string;
+	readonly parent: string;
+	readonly root: string;
+	readonly depth: number;
+	readonly chain: readonly string[];
 	readonly toolCallId: string | undefined;
 };
 type Parsed = {
@@ -216,7 +269,7 @@ type Start = {
 /** A candidate model passed over: `why` finishes "<model> is …", `reason` is the long form for a refusal. */
 type Skipped = { model: string; why: string; reason: string };
 /** What opening a delegate's window reads from a request: a `Start`, or the parts of one a resume decides. */
-type ChildStart = Pick<Start, "agent" | "model" | "rest" | "thinking" | "autoExit">;
+type ChildStart = Pick<Start, "agent" | "model" | "rest" | "thinking" | "autoExit" | "notices">;
 /** A delegation that is open in a tmux window. */
 type Launched = {
 	id: string;
@@ -406,26 +459,49 @@ function modelProblem(value: string, registry: ModelRegistry): string | undefine
 	return `unknown model ${JSON.stringify(value)}${close.length > 0 ? `; close matches: ${close.join(", ")}` : ""}`;
 }
 
+/** The registry's model for an exact `provider/id`; undefined for anything else, such as a pattern. */
+function registered(value: string, registry: ModelRegistry): { provider: string; id: string } | undefined {
+	const slash = value.indexOf("/");
+	if (slash <= 0 || slash === value.length - 1) return undefined;
+	return registry.find(value.slice(0, slash), value.slice(slash + 1));
+}
+
+/** An agent's own models in order: its `model`, or the parent's when it has none, then its fallbacks. */
+function agentModels(agent: Agent, parentModel: string | undefined): string[] {
+	const first = agent.model ?? parentModel;
+	return [...(first === undefined ? [] : [first]), ...agent.fallback];
+}
+
 /**
  * The model for a launch. An explicit model is the only candidate; otherwise
- * the agent's model then its fallbacks. The first candidate that passes
- * `modelProblem` and has no active mark wins; the rest are returned as skipped.
- * A paid candidate on a provider with a quota check is read first, and
- * skipped when its quota is used up. Refuses, listing every candidate, when
- * none is left. `preferred` replaces the agent's own list when there is no
- * explicit model, as a resume does.
+ * `preferred`, by default `own`: the agent's model then its fallbacks. The
+ * first candidate that passes `modelProblem` and has no active mark wins; the
+ * rest are returned as skipped. A paid candidate on a provider with a quota
+ * check is read first, and skipped when its quota is used up. A candidate from
+ * the agent file that is not an exact `provider/id` the registry knows, such
+ * as a pattern, is passed to the child unchanged for Pi to resolve. Refuses,
+ * listing every candidate, when none is left. A resume passes its own
+ * `preferred`.
  */
 async function chooseModel(
 	explicit: string | undefined,
 	agent: Agent,
 	models: ModelRegistry,
 	proactive: Proactive,
-	preferred: readonly string[] = [agent.model, ...agent.fallback],
+	own: readonly string[],
+	preferred: readonly string[] = own,
 ): Promise<{ model: string; skipped: Skipped[]; notices: string[]; rest: string[] }> {
 	const candidates = explicit !== undefined ? [explicit] : [...preferred];
+	if (candidates.length === 0)
+		throw new Error(
+			`agent ${agent.name} names no model and this session has none; add model to ${agent.path}, or pass one`,
+		);
 	const skipped: Skipped[] = [];
 	const notices: string[] = [];
 	for (const model of candidates) {
+		const rest = () => candidates.slice(candidates.indexOf(model) + 1);
+		if (explicit === undefined && registered(model, models) === undefined)
+			return { model, skipped, notices, rest: rest() };
 		const problem = modelProblem(model, models);
 		if (problem !== undefined) {
 			skipped.push({ model, why: `unavailable (${problem})`, reason: problem });
@@ -445,7 +521,7 @@ async function chooseModel(
 			if (checked.notice !== undefined && !notices.includes(checked.notice)) notices.push(checked.notice);
 			mark = activeMark(models, provider, id) ?? checked.mark;
 		}
-		if (mark === undefined) return { model, skipped, notices, rest: candidates.slice(candidates.indexOf(model) + 1) };
+		if (mark === undefined) return { model, skipped, notices, rest: rest() };
 		const what = mark.scope.includes("/") ? `model ${mark.scope}` : `provider ${mark.scope}`;
 		const until = new Date(mark.clearsAt).toISOString();
 		skipped.push({
@@ -458,8 +534,10 @@ async function chooseModel(
 		const [only] = skipped;
 		if (!only.why.startsWith("usage-limited")) throw new Error(only.reason);
 		// An explicit model is never substituted, but the refusal names the agent's models still open.
-		const open = [agent.model, ...agent.fallback].filter((model) => {
-			if (model === only.model || modelProblem(model, models) !== undefined) return false;
+		const open = own.filter((model) => {
+			if (model === only.model) return false;
+			if (registered(model, models) === undefined) return true;
+			if (modelProblem(model, models) !== undefined) return false;
 			const slash = model.indexOf("/");
 			return activeMark(models, model.slice(0, slash), model.slice(slash + 1)) === undefined;
 		});
@@ -508,32 +586,100 @@ function delegateVisible(options: { selectedTools: string[]; hiddenTools: string
 	return options.selectedTools.includes("delegate") && !options.hiddenTools.includes("delegate");
 }
 
+/** Where agent files go, for the messages that say how to add one. */
+function whereAgentsGo(): string {
+	return `${join(globalAgentsDir(getAgentDir()), "<name>.md")} (or .pi/agents/<name>.md in a trusted project), with the delegate's instructions as its body and optional frontmatter: description, model, thinking, tools, fallback, auto_exit, prompt_mode, display_name, locked and enabled`;
+}
+
+/** One roster line for the `delegate` tool's description. */
+function rosterLine(agent: Agent): string {
+	const models = [agent.model ?? "this session's model", ...agent.fallback.map((model) => `fallback ${model}`)];
+	const details = [
+		`default ${models.join(", ")}`,
+		`thinking ${agent.thinking ?? "this session's"}`,
+		...(agent.autoExit ? [] : ["auto-exit off"]),
+		...toolsDetail(agent),
+		...(agent.locked.length > 0 ? [`locked: ${agent.locked.join("/")}`] : []),
+	];
+	const shown = agent.displayName === undefined ? "" : ` "${agent.displayName}"`;
+	return `- ${agent.name}${shown} — ${agent.description} (${details.join(", ")})`;
+}
+
+/**
+ * The entry that makes Pi filter MCP tools by `--tools`. Pi keeps every MCP
+ * tool registered (callable from codemode, loadable by tool_search) unless an
+ * entry starts with `mcp__`; this one does and names no tool, since an MCP
+ * tool is `mcp__<server>__<tool>`.
+ */
+const MCP_FILTER = "mcp__";
+
+/**
+ * The child's tool arguments for a selection: `--tools` with exactly those
+ * tools, MCP tools included, or `--no-tools` (which Pi applies to MCP tools
+ * too) when it is empty. Always explicit: no flag would give the child the
+ * parent's tools rather than Pi's defaults.
+ */
+function toolArgs(tools: readonly string[]): string[] {
+	if (tools.length === 0) return ["--no-tools"];
+	const filtered = tools.some((name) => name.startsWith(MCP_FILTER)) ? tools : [...tools, MCP_FILTER];
+	return ["--tools", filtered.join(",")];
+}
+
+/** The roster line's word on an agent's tools; nothing for the parent's tools unchanged. */
+function toolsDetail(agent: Agent): string[] {
+	if (agent.tools !== undefined) return [agent.tools.length > 0 ? `tools: ${agent.tools.join("/")}` : "no tools"];
+	return agent.toolsExcept.length > 0 ? [`tools: this session's except ${agent.toolsExcept.join("/")}`] : [];
+}
+
+/** Whether tool `name` is `pattern`, where `*` matches any characters, as in Pi's tool lists. */
+function toolMatches(pattern: string, name: string): boolean {
+	const source = pattern
+		.split("*")
+		.map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+		.join(".*");
+	return new RegExp(`^${source}$`).test(name);
+}
+
+/**
+ * The delegate's tool selection, always a plain list: the agent's `tools`
+ * names, or `parentTools` less its `-name` entries when it has none, then
+ * `extra` (the `delegateTools` setting), with the delegation tools left out.
+ * Empty means the delegate gets no tools.
+ */
+function toolSelection(agent: Agent, parentTools: readonly string[], extra: readonly string[]): string[] {
+	const base =
+		agent.tools ?? parentTools.filter((name) => !agent.toolsExcept.some((pattern) => toolMatches(pattern, name)));
+	return [...new Set([...base, ...extra])].filter((name) => !DELEGATION_TOOLS.has(name));
+}
+
+/** The delegate's appended prompt: the agent's body, then the lines every delegate gets. */
+function delegatePrompt(agent: Agent, parent: string, managedContext: string, coordinator: boolean): string {
+	const final = coordinator
+		? "End the task with one self-contained final report to your direct parent after your child tasks finish and you process their outcomes."
+		: FINAL_LINE;
+	const tail = `${final}\n\n${parentTrust(parent, coordinator)}${managedContext}`;
+	if (agent.prompt === "") return tail;
+	// `replace` is how every delegate was built before `prompt_mode`, byte for byte.
+	const body =
+		agent.promptMode === "replace" ? agent.prompt : `<agent_instructions>\n${agent.prompt}\n</agent_instructions>`;
+	return `${body}\n\n${tail}`;
+}
+
 /** The `delegate` tool's description: what delegation does, and the roster as it stands. */
 function toolDescription(agents: readonly Agent[]): string {
 	const intro =
 		"Hand a self-contained task to a delegate Pi session in a background tmux window, so it works while you do not. Each call starts the delegation at once; the delegate runs in this session's working directory, or the cwd given, with this session's agent root, and reports back later as one message. While it runs, keep working or end your turn: its result starts your next turn on its own. Do not poll delegation_status or send a blocking mail request merely to wait for the result; send a substantive follow-up only when you have something to add or ask. Use it when the work is self-contained and you would rather keep your own context for it.";
 	if (agents.length === 0) {
-		return `${intro}\n\nNo agents are defined yet. Add ${join(
-			getAgentDir(),
-			"squire",
-			"agents",
-			"<name>",
-			"AGENT.md",
-		)} with frontmatter description, model and thinking (optionally auto-exit, exclude-tools, tools, extensions and fallback) and the prompt as its body; /delegate explains the format too.`;
+		return `${intro}\n\nNo agents are defined yet. Add ${whereAgentsGo()}.`;
 	}
 	return [
 		intro,
 		"",
 		"Agents:",
-		...agents.map(
-			(agent) =>
-				`- ${agent.name} — ${agent.description} (default ${[agent.model, ...agent.fallback.map((model) => `fallback ${model}`)].join(", ")}, thinking ${agent.thinking}${agent.autoExit ? "" : ", auto-exit off"}${
-					agent.excludeTools.length > 0 ? `, no ${agent.excludeTools.join("/")}` : ""
-				}${agent.tools.length > 0 ? `, tools: ${agent.tools.join("/")}` : ""})`,
-		),
+		...agents.map(rosterLine),
 		"",
 		"`cwd` runs the delegate in another existing directory. Alternatively, `worktree` creates a new local branch and checkout from this repository's committed HEAD, or `worktree_source` selects another existing Git checkout; `worktree_base` selects a commit in that source. Source dirt is reported but not copied. `cwd` and `worktree` are mutually exclusive, and source/base require worktree.",
-		"`model` and `thinking` override the agent's defaults for this call; an unknown value is refused with close matches. `label` names the delegate's window and session; give one that says what the task is. `delegation_status` reports a delegation, and `delegation_close` ends one. `delegation_resume` continues an exited delegate in its own session with a follow-up task, for work that needs the context it already built.",
+		"`model` and `thinking` override the agent's defaults for this call, except a field the agent locks; an unknown value is refused with close matches. `label` names the delegate's window and session; give one that says what the task is. `delegation_status` reports a delegation, and `delegation_close` ends one. `delegation_resume` continues an exited delegate in its own session with a follow-up task, for work that needs the context it already built.",
 		"`auto_exit` (default the agent's, normally true) closes the delegate's window once it finishes. Set it false when you mean to keep talking to the delegate by mail after its result; the user can also keep a window open by typing in it.",
 		"",
 		"Writing the task: the delegate sees nothing of this session, so the task must stand alone. State the question, the decision its answer feeds, what is already known or ruled out, and the files or paths to start from. When the work produces a report, name the path to write it to and ask for the conclusion back, not the contents.",
@@ -546,62 +692,201 @@ function toolDescription(agents: readonly Agent[]): string {
  * passes only `pi`, so they are not part of the package's documented contract.
  */
 export default function delegate(
-	pi: ExtensionAPI,
+	api: ExtensionAPI,
 	tmux: TmuxClient = createTmuxClient(),
 	usage: UsageClient = createUsageClient(),
 ): void {
-	// A delegate registers only its auto-exit side: `delegate` is one level deep (Q27).
-	const parentId = process.env[PARENT_ENV] ?? "";
-	if (parentId !== "") {
-		registerChild(pi, parentId);
-		return;
-	}
-
-	const results = createResults(pi);
+	const owner = new SessionOwner();
+	const host = api;
+	host.on("session_start", (_event, ctx) => owner.start(ctx));
+	host.events.on("message:inbound", (payload) => owner.receive(payload as import("./results.ts").Inbound));
+	const pi = ownedAPI(host, owner);
+	const externalReady = registerCompletionHost(pi);
+	const identity = createIdentity(pi);
+	const results = createResults(
+		pi,
+		() => identity.current() !== undefined,
+		(ctx, records) =>
+			publishTreeRecords(
+				identity.current()?.root ?? ctx.sessionManager.getSessionId(),
+				ctx.sessionManager.getSessionId(),
+				records,
+			),
+		() => owner.active(),
+		(ctx) =>
+			readTree(identity.current()?.root ?? ctx.sessionManager.getSessionId())
+				.entries.filter((entry) => entry.identity.parent === ctx.sessionManager.getSessionId() && entry.closed)
+				.map((entry) => entry.id),
+	);
+	pi.on("session_start", (_event, ctx) => tracking.restore(ctx));
+	const replies = registerTaskReplies(
+		pi,
+		() => identity.current()?.parent,
+		() => {
+			try {
+				owner.assert();
+				identity.current();
+				return results.completionReady() && externalReady();
+			} catch {
+				return false;
+			}
+		},
+		(ctx) => coordinates(currentRoster(ctx)),
+		(ctx, ids) => {
+			owner.assert();
+			const own = identity.current();
+			if (own) finishTree(own.root, ctx.sessionManager.getSessionId(), ids);
+		},
+	);
+	registerChild(pi, replies, identity.current, () => owner.active());
+	host.on("session_start", () => owner.arm());
+	// Restore answers synchronously before this potentially slow tmux read.
+	pi.on("session_start", async (_event, ctx) => {
+		try {
+			const own = identity.current();
+			if (!own) return;
+			const window = await tmux.currentWindow?.();
+			owner.assert();
+			claimTree(own.root, ctx.sessionManager.getSessionId(), window);
+		} catch (error) {
+			ctx.ui.notify(
+				`delegate: could not publish startup accounting: ${String(error)}; uncertain reservations remain charged.`,
+				"error",
+			);
+		}
+	});
 
 	const proactive = createProactive(usage);
-	const tracking = createTracking(pi, results, tmux, proactive.errors);
+	let viewContext: ExtensionContext | undefined;
+	pi.on("session_start", (_event, ctx) => {
+		viewContext = ctx;
+	});
+	pi.on("session_start", async (_event, ctx) => {
+		if (!identity.current() && results.list().length === 0) {
+			try {
+				await treeNotice(ctx, tmux, () => owner.active());
+			} catch (error) {
+				ctx.ui.notify(`delegate: owner discovery unavailable: ${String(error)}`, "warning");
+			}
+		}
+	});
+	const viewResults = {
+		...results,
+		list: () => (viewContext ? visibleRecords(results, viewContext) : results.list()),
+		find: (id: string) =>
+			viewContext ? visibleRecords(results, viewContext).find((record) => record.id === id) : results.find(id),
+	};
+	const tracking = createTracking(pi, results, tmux, proactive.errors, viewResults, () => owner.assert());
+	const trustControl = registerTrustControl(pi, identity.current);
+	// Factual lifecycle observation survives failed action processing; only creation needs ownership.
+	registerActivityRuntime(host, () => owner.active(), tmux, owner.token);
+	registerDelegateWidget(
+		pi,
+		results,
+		tmux,
+		async (ctx, sessionId) => {
+			owner.assert();
+			await navigator.panel(ctx, sessionId);
+		},
+		() => owner.assert(),
+	);
 
 	/** Captured because `getArgumentCompletions` is called without a context. */
 	let registry: ModelRegistry | undefined;
+	/** The latest context, for the roster a completion reads; undefined before the session starts. */
+	let latest: ExtensionContext | undefined;
 
 	const modelIds = (source: ModelRegistry | undefined): string[] =>
 		(source?.getAll() ?? []).map((model) => `${model.provider}/${model.id}`);
 
-	/**
-	 * The session's tool names, which `exclude-tools` must name; undefined
-	 * while Pi is still loading extensions and cannot list them yet.
-	 */
-	function sessionTools(): string[] | undefined {
+	/** The project's agents folder when `ctx`'s project is trusted; undefined otherwise or without a context. */
+	function trustedProject(ctx: ExtensionContext | undefined): string | undefined {
+		if (ctx === undefined) return undefined;
+		try {
+			return ctx.isProjectTrusted() ? projectAgentsDir(ctx.cwd) : undefined;
+		} catch {
+			return undefined; // a stale context after a session replacement
+		}
+	}
+
+	/** The roster as it stands: the global agents, and the project's when it is trusted. */
+	const currentRoster = (ctx: ExtensionContext | undefined = latest): Roster =>
+		readRoster(getAgentDir(), trustedProject(ctx));
+
+	/** What an agent with no `model` or `thinking` runs on: the parent's model and level now. */
+	function parentDefaults(ctx: ExtensionContext): { model?: string; thinking: string } {
+		let thinking = "medium";
 		try {
-			return pi.getAllTools().map((tool) => tool.name);
+			thinking = pi.getThinkingLevel();
 		} catch {
-			return undefined;
+			// Pi binds this before any call can reach here; the default only covers a host without it.
 		}
+		return { ...(ctx.model === undefined ? {} : { model: `${ctx.model.provider}/${ctx.model.id}` }), thinking };
 	}
 
-	/** The roster as it stands, checked against the session's tools. */
-	const currentRoster = (): Roster => readRoster(getAgentDir(), sessionTools());
+	/**
+	 * The delegate's tools for a launch or resume starting now: the agent's
+	 * named tools, or the parent's current tools (including indirect callable
+	 * tools when nested, less any `-name` entries), then `delegateTools`.
+	 * Throws, naming the file, on an invalid setting.
+	 */
+	function childTools(agent: Agent): string[] {
+		const selected = toolSelection(
+			agent,
+			agent.tools === undefined ? (identity.current() ? availableTools(pi) : pi.getActiveTools()) : [],
+			delegateTools(getAgentDir()),
+		);
+		if (grantsNesting(agent, (identity.current()?.depth ?? 0) + 1)) selected.push(...DELEGATION_TOOLS);
+		return [...new Set(selected)];
+	}
+
+	function coordinates(roster: Roster): boolean {
+		const own = identity.current();
+		const agent = roster.agents.find((item) => item.name === own?.agent);
+		return own !== undefined && agent !== undefined && grantsNesting(agent, own.depth);
+	}
+
+	function admit(agent: string, roster: Roster): void {
+		owner.assert();
+		results.checkStorage();
+		identity.admit(agent, roster);
+	}
+
+	function exposeDelegation(roster: Roster): void {
+		if (!identity.current()) return;
+		const enabled = coordinates(roster);
+		const base = pi.getActiveTools().filter((name) => !DELEGATION_TOOLS.has(name));
+		pi.setActiveTools(enabled ? [...base, ...DELEGATION_TOOLS] : base);
+	}
 
 	/** Read the roster now, warning about every file left out. */
 	function rosterFor(ctx: ExtensionContext): Roster {
-		const roster = currentRoster();
+		const roster = currentRoster(ctx);
 		for (const warning of roster.warnings) ctx.ui.notify(`delegate: ${warning}`, "warning");
 		return roster;
 	}
 
+	/** The roster warnings already shown this session, so a run shows only new ones. */
+	const announced = new Set<string>();
+
+	/** Show each roster warning not yet shown this session, such as a file that is disabled. */
+	function announce(roster: Roster, ctx: ExtensionContext): void {
+		for (const warning of roster.warnings) {
+			if (announced.has(warning)) continue;
+			announced.add(warning);
+			ctx.ui.notify(`delegate: ${warning}`, "warning");
+		}
+	}
+
 	/** The refusal for an empty roster. */
-	const noAgents = (): string =>
-		`no agents are defined; add ${join(
-			getAgentDir(),
-			"squire",
-			"agents",
-			"<name>",
-			"AGENT.md",
-		)} with frontmatter description, model and thinking (optionally auto-exit, exclude-tools, tools, extensions and fallback), and the prompt as its body`;
+	const noAgents = (): string => `no agents are defined; add ${whereAgentsGo()}`;
 
 	/** The request as a start, or an error naming what to fix. */
-	async function validate(request: Parsed, roster: Roster, models: ModelRegistry): Promise<Start> {
+	async function validate(request: Parsed, roster: Roster, ctx: ExtensionContext): Promise<Start> {
+		admit(request.agent, roster);
+		results.checkStorage(true);
+		const disabled = disabledProblem(roster, request.agent);
+		if (disabled !== undefined) throw new Error(disabled);
 		if (roster.agents.length === 0) throw new Error(noAgents());
 		const agent = roster.agents.find((candidate) => candidate.name === request.agent);
 		if (agent === undefined) {
@@ -610,8 +895,14 @@ export default function delegate(
 			);
 		}
 		if (request.task.trim() === "") throw new Error("a task is required");
-		const thinking = request.thinking ?? agent.thinking;
-		const { model, skipped, notices, rest } = await chooseModel(request.model, agent, models, proactive);
+		const parent = parentDefaults(ctx);
+		const own = agentModels(agent, parent.model);
+		const defaultThinking = agent.thinking ?? parent.thinking;
+		const unlocked = withoutLocked(agent, request, { model: own[0], thinking: defaultThinking });
+		const thinking = unlocked.request.thinking ?? defaultThinking;
+		const chosen = await chooseModel(unlocked.request.model, agent, ctx.modelRegistry, proactive, own);
+		const { model, skipped, rest } = chosen;
+		const notices = unlocked.notice === undefined ? chosen.notices : [unlocked.notice, ...chosen.notices];
 		const badThinking = thinkingProblem(thinking);
 		if (badThinking !== undefined) throw new Error(badThinking);
 		const badLabel = request.label === undefined ? undefined : labelProblem(request.label);
@@ -667,7 +958,11 @@ export default function delegate(
 		ctx: ExtensionContext;
 		/** Chosen once, when the launch or resume began, so no later settings change can refuse it after mail. */
 		placement: WindowPlacement;
+		/** The delegate's tools, from `toolSelection`, read when the launch began; empty means none. */
+		tools: readonly string[];
 		onWindowOpened?: () => void;
+		identity: Identity;
+		sessionId?: string;
 	}): Promise<OpenedWindow> {
 		const {
 			id,
@@ -681,16 +976,27 @@ export default function delegate(
 			toolCallId,
 			ctx,
 			placement,
+			tools,
 			onWindowOpened,
 		} = input;
-		const parent = ctx.sessionManager.getSessionId();
+		admit(start.agent.name, currentRoster(ctx));
+		results.checkStorage(true);
+		if (input.sessionId && sessionIsOwned(input.sessionId))
+			throw new Error(`delegate session ${input.sessionId} is already open; resume refused before spawn`);
+		const own = input.identity;
+		assertRootPlacement(own.rootPlacement);
+		own.autoExit = start.autoExit;
+		writeIdentity(input.sessionId ?? id, own);
+		const parent = own.parent;
 		const managedContext =
 			workspace.mode === "managed"
 				? `\n\nYour managed worktree is ${workspace.cwd}, branch ${workspace.createdBranch}, based on commit ${workspace.baseCommit}.`
 				: workspace.mode === "existing"
 					? `\n\nThe session that started you chose your working directory: ${workspace.cwd}`
 					: "";
-		const prompt = writePromptFile(`${start.agent.prompt}\n\n${FINAL_LINE}\n\n${parentTrust(parent)}${managedContext}`);
+		const prompt = writePromptFile(
+			delegatePrompt(start.agent, parent, managedContext, grantsNesting(start.agent, own.depth)),
+		);
 		const argv = [
 			...parentCommand(),
 			...session,
@@ -702,15 +1008,18 @@ export default function delegate(
 			start.model,
 			"--thinking",
 			start.thinking,
-			...start.agent.extensions.flatMap((extension) => ["-e", extension]),
-			...(start.agent.tools.length > 0 ? ["--tools", start.agent.tools.join(",")] : []),
-			...(start.agent.excludeTools.length > 0 ? ["--exclude-tools", start.agent.excludeTools.join(",")] : []),
+			...toolArgs(tools),
 			"--append-system-prompt",
 			prompt,
 		];
 		const env: Record<string, string> = {
 			PI_CODING_AGENT_DIR: getAgentDir(),
+			// Private live metadata correlation: resume retains session id, not launch id.
+			PI_SQUIRE_LIVE_LAUNCH: JSON.stringify({ version: 1, sessionId: input.sessionId ?? id, launchId: id }),
 			[PARENT_ENV]: parent,
+			PI_DELEGATE_ROOT: own.root,
+			PI_DELEGATE_DEPTH: String(own.depth),
+			PI_DELEGATE_CHAIN: own.chain.join(","),
 			[AUTO_EXIT_ENV]: start.autoExit ? "1" : "0",
 			[AGENT_ENV]: start.agent.name,
 			// A general signal for any extension: no human watches this session, so don't wait on a dialog.
@@ -721,22 +1030,72 @@ export default function delegate(
 		const envSessionDir = process.env[SESSION_DIR_ENV];
 		if (envSessionDir !== undefined && envSessionDir !== "") env[SESSION_DIR_ENV] = envSessionDir;
 		// Listeners may only append to `args` and add to `env`; there is no veto.
-		const payload: LaunchPayload = { args: argv, env, agent: start.agent.name, cwd, toolCallId };
+		const payload: LaunchPayload = {
+			args: argv,
+			env,
+			agent: start.agent.name,
+			cwd,
+			toolCallId,
+			parent: own.parent,
+			root: own.root,
+			depth: own.depth,
+			chain: Object.freeze([...own.chain]),
+		};
+		for (const key of ["parent", "root", "depth", "chain"] as const)
+			Object.defineProperty(payload, key, { writable: false, configurable: false });
 		pi.events.emit(LAUNCH, payload);
+		if (identity.current()) {
+			const prefix = parentCommand().length;
+			const args = payload.args.slice(prefix);
+			enforceToolCeiling({
+				args,
+				available: availableTools(pi).filter(
+					(name) => grantsNesting(start.agent, own.depth) || !DELEGATION_TOOLS.has(name),
+				),
+				registered: pi.getAllTools().map((tool) => tool.name),
+				cwd,
+				agentDir: payload.env.PI_CODING_AGENT_DIR,
+				trusted,
+				notices: start.notices,
+			});
+			payload.args.splice(prefix, payload.args.length - prefix, ...args);
+		}
+		const token: Reservation = { root: own.root, id };
+		bindTree(token, { windowName: name, cwd, workspace });
+		dispatchTree(token);
 		let opened: OpenedWindow;
 		try {
-			opened = await tmux.openWindow({ name, cwd, argv: payload.args, env: payload.env }, placement);
-			onWindowOpened?.();
+			opened = await tmux.openWindow({ name, cwd, argv: payload.args, env: payload.env }, placement, own.rootPlacement);
 		} catch (err) {
+			if (err instanceof WindowOpenError && err.certainty === "not-opened") {
+				try {
+					failedTree(token, true);
+				} catch (accounting) {
+					ctx.ui.notify(
+						`delegate: could not refund the pre-start reservation: ${String(accounting)}; it remains charged.`,
+						"warning",
+					);
+				}
+			}
 			if (err instanceof WindowOpenError) {
 				throw new WindowOpenError(`could not open window ${name} for ${id}: ${err.message}`, err.certainty);
 			}
 			throw new WindowOpenError(`could not open window ${name} for ${id}: ${(err as Error).message}`, "unknown");
 		}
+		onWindowOpened?.();
+		try {
+			openedTree(token, opened.id);
+		} catch (error) {
+			ctx.ui.notify(
+				`delegate: window ${opened.id} opened, but shared accounting publication failed: ${String(error)}. Local tracking continues; the reservation remains charged until accounting reconciles.`,
+				"warning",
+			);
+		}
 		return opened;
 	}
 
 	async function launchWindow(input: {
+		identity: Identity;
 		id: string;
 		requestId: string;
 		workspace: Workspace;
@@ -747,15 +1106,17 @@ export default function delegate(
 		toolCallId: string | undefined;
 		ctx: ExtensionContext;
 		placement: WindowPlacement;
+		tools: readonly string[];
 		onWindowOpened: () => void;
 	}): Promise<Launched> {
 		const { id, requestId, workspace, trusted, cwd, sessionDir, start, toolCallId, ctx, placement, onWindowOpened } =
 			input;
-		const name = delegateName(start.agent.name, id, start.label);
+		const name = delegateName(start.agent.displayName ?? start.agent.name, id, start.label);
 		const { id: windowId, session: windowSession } = await openChild({
 			id,
 			name,
 			session: ["--session-id", id, "--name", name],
+			identity: input.identity,
 			workspace,
 			trusted,
 			cwd,
@@ -764,13 +1125,16 @@ export default function delegate(
 			toolCallId,
 			ctx,
 			placement,
+			tools: input.tools,
 			onWindowOpened,
 		});
 		// No task text in the record: the request copy in `sent/` has it.
 		results.recordStart(
 			{
 				id,
+				identity: readIdentity(id),
 				agent: start.agent.name,
+				...(start.agent.displayName === undefined ? {} : { displayName: start.agent.displayName }),
 				model: start.model,
 				thinking: start.thinking,
 				name,
@@ -794,10 +1158,21 @@ export default function delegate(
 		signal?: AbortSignal,
 		toolCallId?: string,
 	): Promise<Launched> {
+		admit(start.agent.name, currentRoster(ctx));
+		results.checkStorage(true);
 		if (!tmux.insideTmux()) throw new Error(NOT_IN_TMUX);
 		await requireTmuxVersion(tmux);
-		// Read once, before anything is created or mailed; the launch keeps this value.
+		// Read once, before anything is created or mailed; the launch keeps these values.
 		const placement = windowPlacement(getAgentDir());
+		const parentIdentity = identity.current();
+		const project = parentIdentity
+			? { companion: parentIdentity.rootPlacement, notices: [] }
+			: placementProject(ctx.cwd);
+		assertRootPlacement(project.companion);
+		const own = identity.child(start.agent, ctx, project.companion);
+		if (parentIdentity) assertParentPlacement(readTree(own.root), own);
+		if (placement === "companion") start.notices.push(...project.notices);
+		const tools = childTools(start.agent);
 		const sessionDir = ctx.sessionManager.getSessionDir();
 		if (!isAbsolute(sessionDir))
 			throw new Error(
@@ -829,13 +1204,23 @@ export default function delegate(
 				getAgentDir(),
 			);
 			if (combined?.aborted) throw new Error("the launch was aborted");
-			const trust = await trustPlannedWorktree(plan, ctx, getAgentDir(), combined);
+			const trust = await trustPlannedWorktree(
+				plan,
+				ctx,
+				getAgentDir(),
+				combined,
+				trustControl.forAgent(start.agent.name, ctx),
+			);
 			if (combined?.aborted) throw new Error("the launch was aborted");
 			trusted = trust.trusted;
 			revalidateTrust = trust.revalidate;
 			plan.trusted = trusted;
 		} else {
-			const prepared = await prepareDirectory({ cwd: cwdOption, signal }, ctx, getAgentDir());
+			const prepared = await prepareDirectory(
+				{ cwd: cwdOption, signal, trust: trustControl.forAgent(start.agent.name, ctx) },
+				ctx,
+				getAgentDir(),
+			);
 			directory = prepared.workspace;
 			trusted = prepared.trusted;
 		}
@@ -844,7 +1229,14 @@ export default function delegate(
 		let attempt: WorkspaceAttempt | undefined;
 		let managed: Extract<Workspace, { mode: "managed" }> | undefined;
 		let windowOpened = false;
+		let reservation: Reservation | undefined;
 		const run = async (): Promise<Launched> => {
+			admit(start.agent.name, currentRoster(ctx));
+			results.checkStorage(true);
+			await reconcileTree(own.root, tmux);
+			admit(start.agent.name, currentRoster(ctx));
+			if (combined?.aborted) throw new Error("the launch was aborted");
+			reservation = reserveTree({ id, sessionId: id, identity: own, sessionDir });
 			if (plan !== undefined) {
 				revalidate(plan);
 				revalidateTrust?.();
@@ -894,11 +1286,13 @@ export default function delegate(
 			// at session start without a handshake, and a window that fails leaves
 			// mail that is reported rather than cleaned up.
 			const requestId = sendTask(id, start.task);
+			bindTree(reservation, { requestId });
 			if (attempt !== undefined) {
 				attempt = { ...attempt, requestId };
 				results.recordAttempt(attempt, ctx);
 			}
 			return launchWindow({
+				identity: own,
 				id,
 				requestId,
 				workspace,
@@ -909,6 +1303,7 @@ export default function delegate(
 				toolCallId,
 				ctx,
 				placement,
+				tools,
 				onWindowOpened: () => {
 					windowOpened = true;
 				},
@@ -918,6 +1313,13 @@ export default function delegate(
 			try {
 				return await run();
 			} catch (error) {
+				if (reservation) {
+					try {
+						failedTree(reservation);
+					} catch (accounting) {
+						ctx.ui.notify(`delegate: reservation remains charged: ${String(accounting)}`, "error");
+					}
+				}
 				if (attempt !== undefined && managed !== undefined) {
 					const cause = (error as Error).message;
 					if (windowOpened || (error instanceof WindowOpenError && error.certainty === "unknown")) {
@@ -982,15 +1384,55 @@ export default function delegate(
 		startPolling: tracking.startPolling,
 		placement: () => windowPlacement(getAgentDir()),
 		roster: rosterFor,
-		chooseModel: (explicit, agent, models, preferred) => chooseModel(explicit, agent, models, proactive, preferred),
+		admit: (agent, ctx) => admit(agent, currentRoster(ctx)),
+		authorize: (id, ctx) => {
+			owner.assert();
+			results.checkStorage();
+			const record = results.find(id) ?? viewResults.find(id) ?? historicalRecord(id, ctx);
+			if (record && isStarted(record)) assertResumeAuthority(record, ctx);
+		},
+		reserve: async (record, id, ctx) => {
+			const own = record.identity;
+			if (!own) throw new Error(`delegation ${record.id} has no original root placement identity; resume refused`);
+			assertRootPlacement(own.rootPlacement);
+			await reconcileTree(own.root, tmux);
+			admit(record.agent, currentRoster(ctx));
+			return reserveTree({
+				id,
+				sessionId: sessionIdOf(record),
+				identity: own,
+				resumedFrom: record.id,
+				sessionDir: record.sessionDir,
+			});
+		},
+		parentDefaults,
+		chooseModel: (explicit, agent, models, preferred) =>
+			chooseModel(explicit, agent, models, proactive, agentModels(agent, undefined), preferred),
 		thinkingProblem,
-		prepareDirectory: (cwd, ctx, signal) => prepareDirectory({ cwd, signal }, ctx, getAgentDir()),
+		prepareDirectory: (cwd, ctx, signal, agent) =>
+			prepareDirectory({ cwd, signal, trust: trustControl.forAgent(agent, ctx) }, ctx, getAgentDir()),
 		sendTask,
-		open: ({ id, name, sessionPath, workspace, trusted, cwd, sessionDir, start, toolCallId, ctx, placement }) =>
+		open: ({
+			id,
+			name,
+			sessionPath,
+			workspace,
+			trusted,
+			cwd,
+			sessionDir,
+			start,
+			toolCallId,
+			ctx,
+			placement,
+			identity: own,
+			sessionId,
+		}) =>
 			openChild({
 				id,
 				name,
 				session: ["--session", sessionPath],
+				identity: own,
+				sessionId,
 				workspace,
 				trusted,
 				cwd,
@@ -999,6 +1441,8 @@ export default function delegate(
 				toolCallId,
 				ctx,
 				placement,
+				// Read before the window opens, and a resume mails only after it opens.
+				tools: childTools(start.agent),
 			}),
 	});
 
@@ -1022,11 +1466,7 @@ export default function delegate(
 			const worktree = normalizeWorkspaceValue(parsed.worktree, "--worktree");
 			if (worktree_source !== undefined && worktree === undefined)
 				throw new Error("--worktree-source requires --worktree");
-			const start = await validate(
-				{ ...parsed, cwd, worktree, worktree_base, worktree_source },
-				rosterFor(ctx),
-				ctx.modelRegistry,
-			);
+			const start = await validate({ ...parsed, cwd, worktree, worktree_base, worktree_source }, rosterFor(ctx), ctx);
 			const launched = await launch(start, ctx);
 			ctx.ui.notify(started(launched, start), "info");
 		} catch (err) {
@@ -1039,6 +1479,11 @@ export default function delegate(
 		unavailable: () => (tmux.insideTmux() ? undefined : NOT_IN_TMUX),
 		roster: rosterFor,
 		noAgents,
+		defaults: (agent, ctx) => {
+			const parent = parentDefaults(ctx);
+			const model = agentModels(agent, parent.model)[0];
+			return { ...(model === undefined ? {} : { model }), thinking: agent.thinking ?? parent.thinking };
+		},
 		labelProblem,
 		start: (request: NewRequest, context) => runDelegate(request, context),
 	};
@@ -1057,9 +1502,10 @@ export default function delegate(
 		await runDelegate(outcome.parsed, ctx);
 	}
 
-	async function resumeCommand(input: string, ctx: ExtensionContext): Promise<void> {
-		if (input.trim() === "") {
-			await pickResume(ctx, {
+	async function resumePicker(ctx: ExtensionContext, id?: string): Promise<void> {
+		await pickResume(
+			ctx,
+			{
 				unavailable: () => (tmux.insideTmux() ? undefined : NOT_IN_TMUX),
 				eligible: resumer.eligible,
 				resume: async (request, context) => {
@@ -1069,9 +1515,13 @@ export default function delegate(
 						context.ui.notify(`delegate: ${(err as Error).message}`, "error");
 					}
 				},
-			});
-			return;
-		}
+			},
+			id,
+		);
+	}
+
+	async function resumeCommand(input: string, ctx: ExtensionContext): Promise<void> {
+		if (input.trim() === "") return resumePicker(ctx);
 		const outcome = parseResume(input);
 		if ("error" in outcome) {
 			ctx.ui.notify(`delegate: ${outcome.error}`, "error");
@@ -1096,9 +1546,16 @@ export default function delegate(
 			task: Type.String({
 				description: "The task for the delegate. It sees this and its agent prompt, nothing else of this session.",
 			}),
-			model: Type.Optional(Type.String({ description: "provider/id model for this call; defaults to the agent's." })),
+			model: Type.Optional(
+				Type.String({
+					description:
+						"provider/id model for this call; defaults to the agent's, or this session's when it names none. Not used when the agent locks model.",
+				}),
+			),
 			thinking: Type.Optional(
-				Type.String({ description: `Thinking level (${THINKING_LEVELS.join(", ")}); defaults to the agent's.` }),
+				Type.String({
+					description: `Thinking level (${THINKING_LEVELS.join(", ")}); defaults to the agent's, or this session's when it names none. Not used when the agent locks thinking.`,
+				}),
 			),
 			label: Type.Optional(
 				Type.String({
@@ -1179,7 +1636,7 @@ export default function delegate(
 					task: params.task ?? "",
 				},
 				rosterFor(ctx),
-				ctx.modelRegistry,
+				ctx,
 			);
 			const launched = await launch(start, ctx, signal, toolCallId);
 			ctx.ui.notify(started(launched, start), "info");
@@ -1212,17 +1669,29 @@ export default function delegate(
 
 	pi.on("session_start", (_event, ctx) => {
 		registry = ctx.modelRegistry;
-		tracking.restore(ctx);
+		latest = ctx;
 		// The roster is read at call time; the description is rebuilt here and before each run.
-		registerDelegate(toolDescription(currentRoster().agents));
+		const roster = currentRoster(ctx);
+		announced.clear();
+		announce(roster, ctx);
+		registerDelegate(toolDescription(roster.agents));
+		exposeDelegation(roster);
 	});
 
 	// One roster/prompt snapshot prepares this run: refresh the description only when
 	// it changed, and replace only this extension's prompt section from the same snapshot.
 	pi.on("before_agent_start", (event, ctx) => {
-		const description = toolDescription(currentRoster().agents);
+		latest = ctx;
+		const own = identity.current();
+		const roster = currentRoster(ctx);
+		if (own)
+			event.systemPromptOptions.sections.squire_delegate_task = `You are a delegate. ${parentTrust(own.parent, coordinates(roster))}`;
+		else delete event.systemPromptOptions.sections.squire_delegate_task;
+		exposeDelegation(roster);
+		announce(roster, ctx);
+		const description = toolDescription(roster.agents);
 		const prompt = readParentPrompt();
-		const visible = delegateVisible(event.systemPromptOptions);
+		const visible = delegateVisible(event.systemPromptOptions) && pi.getActiveTools().includes("delegate");
 		// Report a read failure even when guidance cannot be used, so it does not go unseen.
 		if (prompt.error !== undefined) ctx.ui.notify(`delegate: ${prompt.error}`, "warning");
 		if (visible && description !== registeredDescription) registerDelegate(description);
@@ -1236,6 +1705,7 @@ export default function delegate(
 	pi.on("session_shutdown", () => {
 		tracking.stop();
 	});
+	host.on("session_shutdown", () => owner.stop());
 
 	/** Agent names, flags, model ids and thinking levels, at the cursor's token. */
 	function completions(prefix: string): { value: string; label: string }[] | null {
@@ -1279,12 +1749,20 @@ export default function delegate(
 		handler: resumeCommand,
 	});
 
-	const navigator = createNavigator(results, tmux, tracking, (ctx: ExtensionContext) =>
-		startNewDelegate(ctx, newDelegateDeps),
+	const navigator = createNavigator(
+		viewResults,
+		tmux,
+		tracking,
+		(ctx: ExtensionContext) => startNewDelegate(ctx, newDelegateDeps),
+		{
+			assertActive: () => owner.assert(),
+			close: (id, ctx) => tracking.close(id, ctx),
+			resume: (id, ctx) => resumePicker(ctx, id),
+		},
 	);
 
 	pi.registerCommand("delegates", {
-		description: "Open the panel of delegates whose window is open: switch, peek, close",
+		description: "Open the shared delegate dashboard: details, switch, peek, close, resume",
 		handler: async (_args: string, ctx: ExtensionContext) => navigator.panel(ctx),
 	});