shortcutxl 0.2.0 → 0.2.2

package/README.md

@@ -1,59 +1,26 @@
-# Shortcut Desktop Agent
+# ShortcutXL
 
-A general agent that lives on your computer and has Excel superpowers through [Shortcut](https://shortcut.ai).
+An AI agent that lives on your computer and has Excel superpowers. Made by the Shortcut team [Shortcut](https://shortcut.ai).
 
 ```bash
 npm install -g shortcutxl
 shortcut
 ```
 
-> **Important:** This is a CLI tool. You must install it globally with `-g`. Do not use `npm install shortcutxl` without the `-g` flag — it won't work as intended.
+> **Important:** Install globally with `-g`. Do not use `npm install shortcutxl` without it.
 
 ## Capabilities
 
-Shortcut Desktop Agent full power compared to any Excel plugin:
-
-- **Data lives locally** - Your workbooks, files, and skills stay on your machine and are never sent to our servers.
+- **Data lives locally** — Workbooks, files, and skills stay on your machine.
 - **Multi-workbook operations** — Read and write across multiple open workbooks simultaneously.
-- **Deep feature control** — Full manipulation of pivots, charts, sensitivity tables, iterative recalculations, and more.
+- **Deep feature control** — Pivots, charts, sensitivity tables, iterative recalculations, and more.
 - **VBA access** — Read, write, and run macros. Create VBA modules programmatically.
 - **File system access** — Save to arbitrary paths, open files from disk, export PDFs.
-- **Extensible** — Integrate any API or data source (Daloopa, Box, internal tools, etc.) by adding a skill file or a custom tool extension. Your API key is local.
-- **User-defined functions (UDFs)** — Create custom Excel formulas powered by Python to pull live data from APIs, run calculations, or query databases.
+- **Extensible** — Integrate any API or data source by adding a skill file or a custom tool extension.
+- **User-defined functions (UDFs)** — Custom Excel formulas powered by Python for live data, calculations, or database queries.
 - **External data connections** — ODBC, OLE DB, QueryTables, Power Query.
 
-## Quick Start
-
-### Prerequisites
-
-- **Windows 10 or 11** with **Microsoft Excel 2016 or later** (64-bit)
-- **Node.js >= 20** — This gives you `npm`, the package manager used to install the agent.
-
-If you don't have Node.js installed, open a terminal (Command Prompt, PowerShell, or Windows Terminal) and run:
-
-```
-winget install OpenJS.NodeJS.LTS
-```
-
-This will prompt you to approve a Windows admin dialog (UAC) — click **Yes**. After it finishes, **close and reopen your terminal** so the `npm` command is available.
-
-> **No winget?** Download the installer directly from [nodejs.org](https://nodejs.org) and run it — accept the defaults.
-
-### Install
-
-```bash
-npm install -g shortcutxl
-shortcut
-```
-
-On first launch the agent guides you through setup step by step:
-
-1. **Git Bash** — Required for the agent's shell. If missing, the agent installs it for you via `winget` (admin approval needed).
-2. **Python 3.12** — The agent checks for Python 3.12 and installs it if needed (with your permission, per-user, no admin required).
-3. **Excel add-in** — Registered with Excel so it loads automatically on startup. The agent opens Excel for you after this step.
-
-After setup, just run `shortcut` — Excel opens automatically with the agent connected.
-
-## Links
+## Prerequisites
 
-- [shortcut.ai](https://shortcut.ai)
+- **Windows 10/11** with **Excel 2016+** (64-bit)
+- **Node.js >= 20** — If missing: `winget install OpenJS.NodeJS.LTS`

package/dist/core/session-retry.js

@@ -11,7 +11,7 @@ import { sleep } from '../utils/sleep.js';
 // ============================================================================
 // Error Classification
 // ============================================================================
-const RETRYABLE_ERROR_PATTERN = /overloaded|rate.?limit|too many requests|429|500|502|503|504|service.?unavailable|server error|internal error|connection.?error|connection.?refused|other side closed|fetch failed|upstream.?connect|reset before headers|terminated|retry delay/i;
+const RETRYABLE_ERROR_PATTERN = /overloaded|rate.?limit|too many requests|429|500|502|503|504|524|service.?unavailable|server error|internal error|connection.?error|connection.?refused|other side closed|fetch failed|upstream.?connect|reset before headers|terminated|retry delay/i;
 export function isRetryableError(message, isContextOverflow) {
     if (message.stopReason !== 'error' || !message.errorMessage)
         return false;

package/dist/custom/agents/clone.js

@@ -0,0 +1,22 @@
+/**
+ * Clone subagent — a full copy of the action agent that can spawn leaf subagents
+ * (general, document_reader) but cannot spawn other clones.
+ */
+import { BASH, EDIT, EXCEL_EXEC, GREP, READ, TASK, WRITE } from '../../tool-names.js';
+import { buildActionPrompt } from '../prompts/action.js';
+const NAME = 'clone';
+const DESCRIPTION = `\
+A full clone of the main agent with tools (read, bash, edit, write, grep, excel_exec, task).
+Can spawn general and document_reader subagents but cannot spawn other clones.
+Use only for independent batches of tasks that are perfectly parallelizable.`;
+const SYSTEM_PROMPT = buildActionPrompt();
+export const cloneAgent = {
+    name: NAME,
+    description: DESCRIPTION,
+    systemPrompt: SYSTEM_PROMPT,
+    tools: [READ, BASH, EDIT, WRITE, GREP, EXCEL_EXEC, TASK],
+    model: 'shortcut/claude-opus-4-6',
+    thinkingLevel: 'low',
+    timeoutSeconds: 900
+};
+//# sourceMappingURL=clone.js.map

package/dist/custom/agents/document-reader.js

@@ -5,14 +5,13 @@
  * Tools: bash (programmatic extraction) + llm_analysis (multimodal LLM).
  */
 import { BASH, LLM_ANALYSIS } from '../../tool-names.js';
-export const documentReaderAgent = {
-    name: 'document_reader',
-    description: `\
+const NAME = 'document_reader';
+const DESCRIPTION = `\
 Extract structured data from PDFs, images, and documents with high accuracy.
 Tools: bash (Python packages for programmatic extraction) and llm_analysis (multimodal LLM for visual/complex content).
 Use for: PDF table extraction, financial statement parsing, image/chart analysis, document scanning, and data verification.
-Prefers programmatic extraction for large structured data (>500 data points), multimodal LLMs for visual content and verification.`,
-    systemPrompt: `\
+Prefers programmatic extraction for large structured data (>500 data points), multimodal LLMs for visual content and verification.`;
+const SYSTEM_PROMPT = `\
 ======================
 DOCUMENT READER AGENT
 ======================
@@ -21,11 +20,11 @@ You must extract values exactly as they appear in the source: preserve original
 
 WORKFLOW:
 1. Scan the document structure first using llm_analysis to understand the layout, sections, and where key data lives.
-2. For structured data (>500 data points): use programmatic extraction via bash (Python packages). This is fast, cheap, and deterministic.
+2. For structured data (>500 data points): ALWAYS use programmatic extraction via bash. This is fast, cheap, and deterministic.
 3. For everything else (images, charts, complex layouts, scanned docs): use llm_analysis with multimodal LLMs.
 4. Always sanity-check and verify extractions — use both methods and compare when accuracy is critical.
 
-PROGRAMMATIC EXTRACTION (bash + Python):
+PROGRAMMATIC EXTRACTION (bash): IMPORTANT -- pip install any packages you currently do not have
 - camelot: Default for tables. Returns pre-split DataFrame columns. Use flavor='stream' for borderless tables.
 - pdftotext -layout: Cleanest column-aligned output (CLI tool).
 - PyMuPDF (fitz): Fastest Python-native option. Use sort=True for layout-aware extraction.
@@ -61,7 +60,11 @@ OUTPUT:
 - Large structured outputs (>500 entries): JSON format. Smaller/unstructured: markdown.
 - Do NOT create summary, README, or "simplified" files.
 - Do NOT consolidate data into a single file unless you can do it programmatically.
-- Once data is extracted, list file paths and STOP.`,
+- Once data is extracted, list file paths and STOP.`;
+export const documentReaderAgent = {
+    name: NAME,
+    description: DESCRIPTION,
+    systemPrompt: SYSTEM_PROMPT,
     tools: [BASH, LLM_ANALYSIS],
     model: 'shortcut/claude-opus-4-6',
     thinkingLevel: 'low',

package/dist/custom/agents/general.js

@@ -1,24 +1,47 @@
 /**
  * General-purpose subagent — research, computation, and Excel tasks.
  */
-import { BASH, EXCEL_EXEC } from '../../tool-names.js';
-export const generalAgent = {
-    name: 'general',
-    description: `\
-General-purpose agent for research, computation, and Excel tasks.
-Tools: bash (includes curl/wget for web) and excel_exec (Excel COM API via Python).
-Use for: data analysis, web research, file manipulation, spreadsheet operations, multi-step computations.
-Each agent can handle approximately 50 tool calls per task. Launch multiple concurrently for large workloads.`,
-    systemPrompt: `\
-You are a general-purpose agent. You handle research, computation, data processing, and Excel tasks.
-Use bash for computation, file processing, and fetching URLs (curl/wget).
-Use excel_exec to read/write Excel workbooks via the COM API.
+import { BASH, EXCEL_EXEC, LLM_ANALYSIS } from '../../tool-names.js';
+const NAME = 'general';
+const DESCRIPTION = `\
+General-purpose agent for research, computation, and web tasks. Uses include:
+- parallelizable classification tasks. Each agent can handle approximately <50 natural language queries (LLM calls / tool uses) and <10 web search queries per task, and should be launched concurrently to optimize performance.
+- when the task involves reading or classifying spreadsheet data, the agent has full excel_exec access to read the workbook directly — never transcribe cell values into the query.
+Tools: bash (includes curl/wget for URLs), excel_exec (Excel COM API via Python), llm_analysis (offload classification batches).`;
+const SYSTEM_PROMPT = `\
+======================
+GENERAL AGENT
+======================
+
+## YOUR ROLE: GENERAL-PURPOSE AGENT
+
+You handle research, computation, data processing, and web tasks.
+You have access to bash, excel_exec, and llm_analysis.
+Use bash for computation, file processing, and fetching specific URLs (curl/wget).
+Use excel_exec to read/write Excel workbooks.
+Use llm_analysis to parallelize classification/extraction work.
+
+NOTE:
+- You are often invoked for the purpose of performing difficult classification tasks that evade easy programmatic parsing
+- Always read all relevant information, extractions, web searches, per entry to ensure that categorizations are done correctly
+- To do this, alternate between reading relevant information and writing categorizations to file
+- NEVER try to parse or categorize programmatically unless the task is simple enough to be done this way with perfect fidelity
+
+HOW TO CATEGORIZE:
+- You can only handle on the order of 5 difficult classifications per batch, 10-20 medium classifications, and 50 easy classifications.
+- For llm_analysis tool calls, this may require dividing files into bite-sized pieces
+- When you have a lot of categorizations to perform (>30), parallelize by offloading work via llm_analysis tool calls instead of doing it yourself
 
 OUTPUT:
-- Be concise and precise. Report findings directly.
-- If you create files, list the file paths at the end.
-- Do NOT create summary or README files unless asked.`,
-    tools: [BASH, EXCEL_EXEC],
+- Your final outputs should be files containing clear and very concise analyses.
+- Do NOT create "simplified", "visual summary", "quick reference", or "README" files. Never try to "improve" or "simplify" or "summarize"
+- You NEVER need to consolidate or organize data into a single file unless you can do it programmatically. Re-listing data takes time, output tokens, and is extremely error-prone.
+- Once analysis is performed, LIST the file paths and STOP.`;
+export const generalAgent = {
+    name: NAME,
+    description: DESCRIPTION,
+    systemPrompt: SYSTEM_PROMPT,
+    tools: [BASH, EXCEL_EXEC, LLM_ANALYSIS],
     model: 'shortcut/claude-opus-4-6',
     thinkingLevel: 'low',
     timeoutSeconds: 900

package/dist/custom/agents/index.js

@@ -11,10 +11,11 @@
  */
 export { actionAgent } from './action.js';
 export { installationAgent } from './installation.js';
+import { cloneAgent } from './clone.js';
 import { documentReaderAgent } from './document-reader.js';
 import { generalAgent } from './general.js';
 /** All subagent definitions (used internally by accessor functions below) */
-const SUBAGENTS = [documentReaderAgent, generalAgent];
+const SUBAGENTS = [cloneAgent, documentReaderAgent, generalAgent];
 /** Get a subagent config by name */
 export function getSubagent(name) {
     return SUBAGENTS.find((a) => a.name === name);
@@ -34,8 +35,9 @@ Include file paths, sheet names, cell ranges, and specific instructions in the q
 When multiple tasks are needed, launch them concurrently. NEVER call them sequentially — each agent takes time to complete.
 
 Choose the subagent_type carefully based on the task:
+- clone: agent clone with bash, edit, excel_exec, and task — use for complex tasks needing editing and subagent delegation
 - document_reader: PDFs, images, document extraction (has llm_analysis for multimodal + bash for programmatic extraction)
-- general: research, computation, Excel tasks (has excel_exec + bash)`;
+- general: research, computation, Excel tasks (has excel_exec + bash + llm_analysis)`;
     const lines = [preamble];
     for (const agent of SUBAGENTS) {
         lines.push('');

package/dist/custom/constants.js

@@ -1,18 +1,29 @@
 /**
- * Shortcut production constants.
+ * Shortcut infrastructure constants.
  *
- * These are the defaults when no .env file is present (i.e. installed product).
- * For local development, create a .env file to override — see .env.development.
- *
- * Every env var listed here can be overridden via process.env.
+ * Toggle ACTIVE_ENV between 'prod' and 'staging' to switch environments.
+ * Every env var can still be overridden via process.env.
  */
+const ACTIVE_ENV = 'staging';
+const ENV = {
+    prod: {
+        llmProxyUrl: 'https://agent.shortcut.ai',
+        authUrl: 'https://auth.shortcut.ai',
+        apiUrl: 'https://api.shortcut.ai'
+    },
+    staging: {
+        llmProxyUrl: 'https://staging-agent.shortcut.ai',
+        authUrl: 'https://auth-staging.shortcut.ai',
+        apiUrl: 'https://api-staging.shortcut.ai'
+    }
+};
 // -- Shortcut infrastructure URLs ------------------------------------------
 /** LLM proxy — routes LLM calls through the Python backend (auth, credits, model allowlist). */
-export const SHORTCUT_LLM_PROXY_URL = process.env.SHORTCUT_LLM_PROXY_URL ?? 'https://agent.shortcut.ai';
+export const SHORTCUT_LLM_PROXY_URL = process.env.SHORTCUT_LLM_PROXY_URL ?? ENV[ACTIVE_ENV].llmProxyUrl;
 /** Auth service — device code OAuth flow, token refresh. */
-export const SHORTCUT_AUTH_URL = process.env.SHORTCUT_AUTH_URL ?? 'https://auth.shortcut.ai';
+export const SHORTCUT_AUTH_URL = process.env.SHORTCUT_AUTH_URL ?? ENV[ACTIVE_ENV].authUrl;
 /** API service — credit balance, billing. */
-export const SHORTCUT_API_URL = process.env.SHORTCUT_API_URL ?? 'https://api.shortcut.ai';
+export const SHORTCUT_API_URL = process.env.SHORTCUT_API_URL ?? ENV[ACTIVE_ENV].apiUrl;
 // -- Dev mode --------------------------------------------------------------
 // DEV_MODE lives in config.ts (layer-0) so modes/ can import it without boundary violations.
 // -- Excel XLL -------------------------------------------------------------

package/dist/custom/prompts/api.js

@@ -22,6 +22,7 @@ Multiple agents may operate on the same Excel instance concurrently. Follow thes
 - For new workbooks, we must skip the splash screen. To do this, create a workbook in the temp dir via openpyxl or use an existing one. Then open it via start
 - Do NOT use /e or other command-line flags — Excel interprets them as file paths
 - If the user references a file that isn't open, explore the filesystem to locate it, then open it
+- For files that you are only reading from (attached workbooks, reference files): open them headlessly. This avoids cluttering the user's Excel with files they don't need to see or edit
 
 ### Workbook References — NEVER use ActiveWorkbook
 - At the start of a task, list workbooks to find the right name: [wb.Name for wb in app.Workbooks]

package/dist/custom/tools/task/task.js

@@ -25,8 +25,11 @@ const TOOL_NAME = TASK;
 const TOOL_LABEL = 'Task';
 const TOOL_DESCRIPTION = buildTaskToolDescription();
 const SUBAGENT_MODELS = ['shortcut/claude-opus-4-6', 'shortcut/gpt-5.4-2026-03-05'];
-function buildSchema() {
-    const names = getSubagentNames();
+function buildSchema(excludeSubagents) {
+    const allNames = getSubagentNames();
+    const names = excludeSubagents
+        ? allNames.filter((n) => !excludeSubagents.includes(n))
+        : allNames;
     return Type.Object({
         subagent_type: StringEnum(names, {
             description: 'The type of specialized agent to use for this task'
@@ -44,8 +47,8 @@ function buildSchema() {
     });
 }
 export function createTaskTool(options = {}) {
-    const { cwd: cwdOverride, extraArgs = [] } = options;
-    const schema = buildSchema();
+    const { cwd: cwdOverride, extraArgs = [], excludeSubagents } = options;
+    const schema = buildSchema(excludeSubagents);
     return {
         name: TOOL_NAME,
         label: TOOL_LABEL,

package/dist/main.js

@@ -408,7 +408,11 @@ export async function main(args) {
     }
     extensionsResult.runtime.pendingProviderRegistrations = [];
     // Register Shortcut as a provider with custom stream through the Python backend
-    registerShortcutProvider(modelRegistry, SHORTCUT_LLM_PROXY_URL);
+    // Print mode uses non-streaming invoke (like subagents) — no UI needs deltas
+    const isPrintMode = firstPass.print || firstPass.mode === 'text' || firstPass.mode === 'json';
+    registerShortcutProvider(modelRegistry, SHORTCUT_LLM_PROXY_URL, {
+        streaming: !isPrintMode
+    });
     // Keep Shortcut OAuth tokens fresh while the TUI is idle.
     // Without this, the access token (7-min TTL on staging) expires silently
     // and the next LLM request fails with 401.

package/dist/modes/interactive/interactive-mode.js

@@ -330,8 +330,8 @@ export class InteractiveMode {
             const textLines = [
                 logoText,
                 rawKeyHint('/', 'for commands'),
-                rawKeyHint('/clear', 'new chat'),
-                rawKeyHint('/resume', 'resume previous session'),
+                rawKeyHint('/clear', 'for new chat'),
+                rawKeyHint('/resume', 'to resume prior sessions'),
                 rawKeyHint(`${appKey(kb, 'pasteImage')} or drop files`, 'to attach files'),
                 hint('interrupt', 'to interrupt agent'),
                 rawKeyHint(`${appKey(kb, 'clear')} twice`, 'to exit out of shortcutXL')

package/dist/modes/print-mode.js

@@ -2,9 +2,28 @@
  * Print mode (single-shot): Send prompts, output result, exit.
  *
  * Used for:
- * - `pi -p "prompt"` - text output
+ * - `pi -p "prompt"` - text output with tool call summaries and streamed text
  * - `pi --mode json "prompt"` - JSON event stream
  */
+import chalk from 'chalk';
+/**
+ * Format a tool call for display.
+ * If the tool has a description arg, show "name: description".
+ * Otherwise show each arg as indented colored key: value lines.
+ */
+function formatToolCall(toolName, args) {
+    if (!args || typeof args !== 'object' || Object.keys(args).length === 0) {
+        return chalk.cyan(toolName);
+    }
+    if (args.description) {
+        return `${chalk.cyan(toolName)}: ${args.description}`;
+    }
+    const lines = Object.entries(args).map(([key, value]) => {
+        const str = typeof value === 'string' ? value : JSON.stringify(value);
+        return `        ${chalk.dim(key)}: ${str}`;
+    });
+    return `${chalk.cyan(toolName)}\n${lines.join('\n')}`;
+}
 /**
  * Run in print (single-shot) mode.
  * Sends prompts to the agent and outputs the result.
@@ -53,11 +72,57 @@ export async function runPrintMode(session, options) {
             console.error(`Extension error (${err.extensionPath}): ${err.error}`);
         }
     });
+    // Track whether we're mid-text-block (for newline management)
+    let inTextBlock = false;
     // Always subscribe to enable session persistence via _handleAgentEvent
     session.subscribe((event) => {
-        // In JSON mode, output all events
         if (mode === 'json') {
             console.log(JSON.stringify(event));
+            return;
+        }
+        // Text mode: stream tool calls and text as they happen
+        if (mode === 'text') {
+            switch (event.type) {
+                case 'tool_execution_start': {
+                    if (inTextBlock) {
+                        process.stdout.write('\n');
+                        inTextBlock = false;
+                    }
+                    const line = formatToolCall(event.toolName, event.args);
+                    console.error(chalk.dim('  ▶ ') + line);
+                    break;
+                }
+                case 'message_end': {
+                    // Print text from completed assistant message
+                    if (event.message.role === 'assistant') {
+                        const msg = event.message;
+                        for (const content of msg.content) {
+                            if (content.type === 'text' && content.text) {
+                                process.stdout.write(content.text);
+                                inTextBlock = true;
+                            }
+                        }
+                    }
+                    break;
+                }
+                case 'agent_end': {
+                    if (inTextBlock) {
+                        process.stdout.write('\n');
+                        inTextBlock = false;
+                    }
+                    // Check for errors
+                    const msgs = event.messages;
+                    const last = msgs[msgs.length - 1];
+                    if (last?.role === 'assistant') {
+                        const msg = last;
+                        if (msg.stopReason === 'error' || msg.stopReason === 'aborted') {
+                            console.error(msg.errorMessage || `Request ${msg.stopReason}`);
+                            process.exit(1);
+                        }
+                    }
+                    break;
+                }
+            }
         }
     });
     // Send initial message with attachments
@@ -68,25 +133,6 @@ export async function runPrintMode(session, options) {
     for (const message of messages) {
         await session.prompt(message);
     }
-    // In text mode, output final response
-    if (mode === 'text') {
-        const state = session.state;
-        const lastMessage = state.messages[state.messages.length - 1];
-        if (lastMessage?.role === 'assistant') {
-            const assistantMsg = lastMessage;
-            // Check for error/aborted
-            if (assistantMsg.stopReason === 'error' || assistantMsg.stopReason === 'aborted') {
-                console.error(assistantMsg.errorMessage || `Request ${assistantMsg.stopReason}`);
-                process.exit(1);
-            }
-            // Output text content
-            for (const content of assistantMsg.content) {
-                if (content.type === 'text') {
-                    console.log(content.text);
-                }
-            }
-        }
-    }
     // Ensure stdout is fully flushed before returning
     // This prevents race conditions where the process exits before all output is written
     await new Promise((resolve, reject) => {

package/dist/subagent-entry.js

@@ -11,7 +11,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { parseArgs } from './cli/args.js';
-import { getAgentDir } from './config.js';
+import { DEV_MODE, getAgentDir } from './config.js';
 import { AuthStorage } from './core/auth-storage.js';
 import { ModelRegistry } from './core/model-registry.js';
 import { resolveCliModel } from './core/model-resolver.js';
@@ -27,8 +27,9 @@ import { fetchWorkbookSummary, formatSummaryForLlm, parseWorkbookNames } from '.
 import { registerShortcutProvider } from './custom/providers/register-shortcut-provider.js';
 import { createExcelExecTool } from './custom/tools/excel-exec.js';
 import { createLlmAnalysisTool } from './custom/tools/llm-analysis.js';
+import { createTaskTool } from './custom/tools/task/index.js';
 import { runPrintMode } from './modes/print-mode.js';
-import { EXCEL_EXEC, LLM_ANALYSIS } from './tool-names.js';
+import { EXCEL_EXEC, LLM_ANALYSIS, TASK } from './tool-names.js';
 export async function runSubagent(args) {
     const parsed = parseArgs(args);
     // Read-only auth: reads auth.json without file locking so concurrent
@@ -82,7 +83,9 @@ export async function runSubagent(args) {
         noExtensions: true,
         noSkills: true,
         noPromptTemplates: true,
-        noThemes: true
+        noThemes: true,
+        // AGENTS.md / CLAUDE.md context files are dev-only (not useful for end users)
+        agentsFilesOverride: DEV_MODE ? undefined : () => ({ agentsFiles: [] })
     });
     await resourceLoader.reload();
     // Build tools
@@ -92,7 +95,7 @@ export async function runSubagent(args) {
         }
         return parsed.tools?.map((name) => allTools[name]);
     })();
-    // Build custom tools (no task tool — subagents don't spawn sub-subagents)
+    // Build custom tools
     const customTools = [];
     if (!parsed.noCustomTools) {
         const customToolSet = parsed.customTools ? new Set(parsed.customTools) : null;
@@ -102,6 +105,10 @@ export async function runSubagent(args) {
         if (!customToolSet || customToolSet.has(LLM_ANALYSIS)) {
             customTools.push(createLlmAnalysisTool(SHORTCUT_LLM_PROXY_URL));
         }
+        if (customToolSet?.has(TASK)) {
+            // Clone agents can spawn leaf subagents but not other clones
+            customTools.push(createTaskTool({ excludeSubagents: ['clone'] }));
+        }
     }
     const { session } = await createAgentSession({
         model,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shortcutxl",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "files": [
     "dist/",