agentwire-dev 1.77.2__tar.gz → 1.77.3__tar.gz

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/.github/workflows/pytest.yml

@@ -93,8 +93,9 @@ jobs:
         with:
           python-version: "3.9"
 
+      # The published engine, at the range agentwire declares (never a checkout copy, #1209 M8).
       - name: Install the damage_control package and test dependencies
-        run: python -m pip install pytest ./packages/damage-control-dev
+        run: python -m pip install pytest "$(grep -o 'damage-control-dev>=[^"]*' pyproject.toml)"
 
       # --noconftest: tests/conftest.py imports agentwire's full dependency set.
       - name: Run hook tests on the declared floor
@@ -106,4 +107,3 @@ jobs:
           tests/unit/test_hook_python_floor.py
           tests/unit/test_hook_fail_closed.py
           tests/unit/test_hook_fail_closed_matrix.py
-          tests/unit/test_engine_standalone.py

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/.github/workflows/security.yml

@@ -32,10 +32,8 @@ jobs:
           python-version: "3.12"
       - name: Sync dependencies
         run: uv sync --extra dev
-      - name: Bundled rule JSON is in sync with its YAML
-        run: >
-          uv run --no-sync python packages/damage-control-dev/tools/build_rules_json.py --check
-          packages/damage-control-dev/src/damage_control/rules packages/damage-control-dev/src/damage_control/tooldefs agentwire/safety/rules
+      - name: AgentWire rules-layer JSON is in sync with its YAML
+        run: uv run --no-sync python scripts/build_rules_json.py --check
       - name: Run bypass + hook fail-closed + control-plane corpus
         run: >
           uv run --no-sync pytest -q
@@ -57,7 +55,7 @@ jobs:
       # asserts), and we fail only on high-severity high-confidence findings.
       # Green on the clean tree today; red only on NEW genuinely-dangerous code.
       - name: Run bandit
-        run: uvx bandit==1.9.4 -c pyproject.toml -r agentwire packages/damage-control-dev/src --severity-level high --confidence-level high
+        run: uvx bandit==1.9.4 -c pyproject.toml -r agentwire --severity-level high --confidence-level high
 
   pip-audit:
     name: pip-audit (advisory)

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/.github/workflows/tts-smoke.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install base package
-        run: pip install ./packages/damage-control-dev .
+        run: pip install .
       - name: Import kokoro engine without torch
         # Windows is scoped to this import only — the portal/CLI use
         # fcntl/pty and don't support Windows; the kokoro path must still
@@ -91,7 +91,7 @@ jobs:
           path: ~/.cache/kokoro_onnx
           key: kokoro-model-files-v1.0-fp16
       - name: Install base package
-        run: pip install ./packages/damage-control-dev .
+        run: pip install .
       - name: Synthesize a sentence
         run: |
           python - <<'EOF'

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentwire-dev
-Version: 1.77.2
+Version: 1.77.3
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev
@@ -228,7 +228,7 @@ Requires-Dist: aiohttp-jinja2>=1.6
 Requires-Dist: aiohttp>=3.13.4
 Requires-Dist: av>=12.0.0
 Requires-Dist: certifi>=2026.10.23
-Requires-Dist: damage-control-dev<0.2,>=0.1.3
+Requires-Dist: damage-control-dev<0.2,>=0.1.4
 Requires-Dist: fastapi>=0.104.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: kokoro-onnx>=0.4.9; python_version < '3.14'

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/RELEASING.md

@@ -4,15 +4,19 @@ This project publishes the CLI and web app to PyPI as `agentwire-dev`. Packaging
 
 Every release does **both** a PyPI publish and a GitHub release. The **GitHub release is the changelog** — there is no `CHANGELOG.md`; release notes are built from the commits since the last tag (step 5).
 
-## Release order (two packages)
+## The engine is a separate project (single source)
 
-`agentwire-dev` depends on `damage-control-dev` (its own PyPI project, engine source in `packages/damage-control-dev/`). `pyproject.toml` pins it to a range — currently `damage-control-dev>=0.1.3,<0.2` — and `tests/unit/test_damage_control_pin.py` fails if the workspace version leaves that range. A checkout resolves the engine from the workspace; a PyPI install resolves it from PyPI. Order matters, because an `agentwire-dev` that names a version PyPI doesn't have yet is uninstallable:
+The damage-control engine has exactly one source: the `damage-control-dev` repo (<https://github.com/dotdevdotdev/damage-control-dev>), published on PyPI. `agentwire-dev` only *consumes* it through the range in `pyproject.toml` (currently `damage-control-dev>=0.1.4,<0.2`); a checkout and a PyPI install both resolve it from PyPI. There is no copy of the engine in this repo and nothing to release from here. `tests/unit/test_damage_control_pin.py` checks that the declared floor/ceiling parse and that the installed engine satisfies them.
 
-1. **Engine changed?** Bump `__version__` in `packages/damage-control-dev/src/damage_control/__init__.py`, merge, then build and publish it **first** (commands in step 3). Skip entirely when the engine didn't change — the existing pin keeps resolving.
-2. **Pin still admits the engine?** A patch/minor bump inside the range needs no `agentwire-dev` change. A bump outside it (e.g. `0.2.0`) requires widening the range in `pyproject.toml` (`>=0.2.0,<0.3`) in the agentwire PR — the pin test enforces this.
-3. **Verify against the published wheel** before releasing agentwire: in a scratch venv, install the agentwire wheel plus `damage-control-dev=={DC_VERSION}` from PyPI (not the workspace), then run `scripts/golden_snapshot.py check`, the fast suite, `agentwire doctor` and a hook subprocess smoke under a temp `HOME`. Diff the PyPI wheel's tree against `uv build --package damage-control-dev --wheel` at HEAD; code and JSON rules must be identical.
+To ship an engine change:
+
+1. **Land it in the damage-control-dev repo**, tag and release it there (its own release flow). Do not tag or release from this repo.
+2. **Raise the floor here** in a normal agentwire PR: bump the `>=` in `pyproject.toml` (and the `<` ceiling too if the engine crossed it, e.g. `>=0.2.0,<0.3`), run `uv lock`, and re-run `scripts/golden_snapshot.py check` and `scripts/effective_rules.py --check` — re-record the golden only if the behavior change is intended, in that same PR.
+3. **Verify against the published wheel** before releasing agentwire: in a scratch venv, install the agentwire wheel (it pulls the engine from PyPI), then run the fast suite, `agentwire doctor` and a hook subprocess smoke under a temp `HOME`.
 4. **Then** bump and publish `agentwire-dev` (steps below), then the GitHub release.
 
+An `agentwire-dev` whose floor names an engine version PyPI doesn't have yet is uninstallable, so step 1 always completes (published) before step 2 merges.
+
 ## Steps
 
 ### 1. Bump version
@@ -35,13 +39,6 @@ uv build
 
 Produces `dist/agentwire_dev-{VERSION}-py3-none-any.whl` and `dist/agentwire_dev-{VERSION}.tar.gz`.
 
-When the engine's version is new (see [Release order](#release-order-two-packages)), build and publish `damage-control-dev` **before** agentwire. Its version lives in `packages/damage-control-dev/src/damage_control/__init__.py`:
-
-```bash
-uv build --package damage-control-dev     # -> dist/damage_control_dev-{DC_VERSION}*
-uv publish --token "$(grep '^PYPI_TOKEN=' ~/.agentwire/.env | cut -d= -f2-)" dist/damage_control_dev-{DC_VERSION}*
-```
-
 Optional sanity check — confirm `agentwire/templates/` and `agentwire/static/` are bundled:
 
 ```bash

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.77.2"
+__version__ = "1.77.3"

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/core.py

@@ -943,12 +943,18 @@ def _same_project(path_a: Path, path_b: Path) -> bool:
     return common_a == common_b
 
 
-def resolve_default_created_by(caller: str | None, target_path: Path) -> str | None:
+def resolve_default_created_by(
+    caller: str | None, target_path: Path, delegated: bool = False
+) -> str | None:
     """The default ``created_by`` when none was explicitly given.
 
     Inherit the caller only when the new session's project is the one the
     caller is already running in — a cross-project spawn gets its own root
-    instead of flattening into the caller's subtree (#715). An explicit
+    instead of flattening into the caller's subtree (#715). EXCEPT delegated
+    work (``delegated=True``: the spawn carries a task prompt): that is a
+    child whose completion the caller is waiting on, so it parents to the
+    caller in any project — nobody should have to pass their own session
+    name to be told when their worker finishes (#1261). An explicit
     --created-by always wins and never reaches this function.
 
     Uses ``_live_session_cwd`` rather than ``_get_session_project_path`` —
@@ -975,9 +981,92 @@ def resolve_default_created_by(caller: str | None, target_path: Path) -> str | N
     caller_path = _live_session_cwd(caller)
     if caller_path is None:
         return None
+    if delegated:
+        return caller
     return caller if _same_project(caller_path, target_path) else None
 
 
+def closest_sessions(name: str, candidates, limit: int = 3) -> list[str]:
+    """Candidate session names nearest to ``name`` (typo or repo-vs-session mixup)."""
+    import difflib
+
+    pool = sorted(set(candidates))
+    close = difflib.get_close_matches(name, pool, n=limit, cutoff=0.5)
+    # A repo/project name vs its session name is a prefix/substring relation
+    # (`agentwire-dev` vs `agentwire`) that edit distance under-ranks.
+    related = [c for c in pool if c not in close and (c in name or name in c)]
+    return (close + related)[:limit]
+
+
+def unknown_session_error(
+    name: str, live: "set[str] | None", *, require_live: bool, what: str
+) -> str | None:
+    """Why ``name`` can't be a ``what`` target, or None when it's acceptable.
+
+    Fails at the moment a wrong name is NAMED instead of hours later as a
+    dead-letter (#1261). ``''`` (explicitly standalone), ``name@machine``
+    (remote — unverifiable from here) and an unreachable tmux (``live is
+    None``: an outage is not a gone session) always pass.
+
+    ``require_live`` (spawn parents): the session must be running now.
+    Otherwise (message targets) a session is KNOWN if it is live OR has a
+    record in ``~/.agentwire/sessions/`` — so a busy or restarting session is
+    still deferred to, never refused.
+    """
+    if not name or "@" in name or live is None:
+        return None
+    if name in live:
+        return None
+    if not require_live and session_metadata_path(name).exists():
+        return None
+    near = closest_sessions(name, live)
+    hint = f" — did you mean: {', '.join(near)}?" if near else ""
+    listing = f" Live sessions: {', '.join(sorted(live))}." if live and not near else ""
+    return (
+        f"{what} '{name}' is not a live session{hint}{listing} Your session "
+        "name is NOT your repo name: `agentwire list` / `tmux display -p '#S'` "
+        "tells you."
+    )
+
+
+NO_REPORT_PATH_HINT = (
+    "state explicitly, as the LAST line of your final message, that you have no "
+    "parent session to report to, then stop. Do not guess a session name."
+)
+
+
+def unparented_delegation_warning(
+    session_name: str,
+    caller: str | None,
+    created_by: str | None,
+    first_message: str | None,
+) -> str | None:
+    """Warn when a delegated task was spawned with no parent to report to (#1259).
+
+    A cross-project spawn deliberately records no parent (#715), but a spawn
+    that carries a task prompt is clearly delegated work: the child's
+    ``notify-parent`` has no target and its completion is invisible. The
+    spawner is the only party that can fix that, and only at spawn time.
+    ``created_by == ''`` is an explicit rootless request (orchestrators,
+    ``--created-by ''``) and never warns; services are not spawners.
+    """
+    if not first_message or created_by is not None or not caller:
+        return None
+    if caller == session_name:
+        return None
+    from .services import is_service_session
+
+    if is_service_session(caller):
+        return None
+    return (
+        f"session '{session_name}' was given a task but has NO parent "
+        f"('{caller}' is not a live agentwire session that delegation could "
+        f"auto-parent to): it cannot notify-parent and its completion will "
+        f"not reach you. Re-spawn from a live session, or pass "
+        f"--created-by <live session>."
+    )
+
+
 def tmux_session_has_agent(name: str) -> bool:
     """Check if a tmux session has an agent running (not just a bare shell).
 

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/inbox.py

@@ -65,6 +65,13 @@ PASSIVE_KINDS = ("ingest",)
 # Broadcast token: deliver to every live agent session except the sender.
 BROADCAST_TOKEN = "@all"
 
+# Words a role prompt or a worker's own phrasing uses for "the session that
+# spawned me". They are never session names; sent to one that isn't actually
+# running, the message just dead-letters ~5 min later (#1259). Deliberately NOT
+# the kind words (orchestrator/worker/reviewer): `agentwire orchestrator`
+# names a session "orchestrator" by default, so those are real addresses.
+ROLE_WORDS = frozenset({"parent", "creator"})
+
 # After this many failed/deferred delivery attempts a message is dead-lettered
 # rather than retried forever (40 * 60s watchdog tick ≈ 40 min of a session
 # being permanently busy/typed-in).
@@ -709,9 +716,33 @@ def resolve_targets(to: str, sender: "str | None") -> list[str]:
             s for s in _live_agent_sessions()
             if s != sender and not is_service_session(s)
         ]
+    if to in ROLE_WORDS and to not in (live_sessions() or set()):
+        raise ValueError(
+            f"{to!r} is a role word, not a session name — no such session is "
+            "running, so the message would dead-letter. Address a real session; "
+            "if you have no parent to report to, state that explicitly as the "
+            "LAST line of your final message and stop. Do not guess a session name."
+        )
     return [_validate_session(to)]
 
 
+def unknown_target_error(to: str) -> "str | None":
+    """Why ``to`` can't receive a message, or None when it's a KNOWN session.
+
+    Known = live in tmux OR recorded in ``~/.agentwire/sessions/`` — so a busy
+    or restarting session still defers instead of failing (#1261). A name that
+    is neither is a typo or a repo-vs-session mixup, and enqueueing it only
+    moves the failure to a dead-letter hours later. ``@all`` and role words
+    are judged by ``resolve_targets`` and pass here.
+    """
+    if to == BROADCAST_TOKEN or to in ROLE_WORDS:
+        return None
+    from .core import unknown_session_error
+
+    return unknown_session_error(
+        to, live_sessions(), require_live=False, what="message target")
+
+
 def enqueue(
     to: str, text: str, kind: str = "note", sender: "str | None" = None, ref: str = ""
 ) -> list[Message]:

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/msg_cli.py

@@ -75,6 +75,13 @@ def cmd_msg_send(args) -> int:
             print(f"Error: {msg}")
         return 1
     sender = claimed or detected or "unknown"
+    unknown = inbox.unknown_target_error(args.to)
+    if unknown:
+        if getattr(args, "json", False):
+            print(json.dumps({"success": False, "error": unknown}))
+        else:
+            print(f"Error: {unknown}")
+        return 1
     try:
         written = inbox.enqueue(args.to, text, kind=args.kind, sender=sender,
                                 ref=getattr(args, "ref", ""))

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/notify_cli.py

@@ -14,6 +14,7 @@ import urllib.request
 
 from . import pane_manager
 from .core import (
+    NO_REPORT_PATH_HINT,
     _get_portal_url,
     _output_json,
     _output_result,
@@ -108,7 +109,9 @@ def cmd_notify_parent(args) -> int:
     else:
         return _output_result(
             False, json_mode,
-            "No target session (set 'parent' in .agentwire.yml or use --to)")
+            "No target session: this session has no recorded parent (set "
+            "'parent' in .agentwire.yml or use --to <real session name>). "
+            f"If you were delegated this task, {NO_REPORT_PATH_HINT}")
 
     # --queued (#667): route through the polite msg inbox (kind=done) instead
     # of a direct paste. The drain owns everything the direct path lacks — the
@@ -124,6 +127,9 @@ def cmd_notify_parent(args) -> int:
         # typed discriminator the cohort ledger keys on — sentinel text is
         # defeated by any child that happens to write the same words.
         kind = "idle" if getattr(args, 'on_idle', False) else "done"
+        unknown = inbox.unknown_target_error(target_session)
+        if unknown:
+            return _output_result(False, json_mode, unknown)
         try:
             msgs = inbox.enqueue(
                 to=target_session, text=text, kind=kind,

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/pane_cli.py

@@ -557,6 +557,9 @@ def cmd_info(args) -> int:
             "pane_count": pane_count,
             "panes": panes,
             "is_remote": False,
+            # Who this session reports to (its recorded creator), so a worker
+            # never has to guess a parent name; None for a standalone root.
+            "parent": load_session_metadata(session).get("created_by") or None,
         }
 
     if json_mode:

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/roles/reviewer-worktree.md

@@ -36,3 +36,5 @@ When your review reaches a conclusion, `notify_parent` with a structured verdict
 - **blocked** — you can't finish the review (missing context, can't reproduce, PR is in a broken state) — say what's blocking you
 
 Silence is not a verdict. If you're still working, say so before you go idle.
+
+**No report path?** If `notify-parent` (or `notify_parent`) reports no target, you were spawned without a parent. State that explicitly as the LAST line of your final message and stop — do not guess a session name, and never `msg send --to parent` (there is no session by that name; it dead-letters and emails the owner).

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/roles/reviewer.md

@@ -27,3 +27,5 @@ When your review reaches a conclusion, `notify_parent` with a structured verdict
 - **blocked** — you can't finish the review (missing context, can't reproduce, PR is in a broken state) — say what's blocking you
 
 Silence is not a verdict. If you're still working, say so before you go idle.
+
+**No report path?** If `notify-parent` (or `notify_parent`) reports no target, you were spawned without a parent. State that explicitly as the LAST line of your final message and stop — do not guess a session name, and never `msg send --to parent` (there is no session by that name; it dead-letters and emails the owner).

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/roles/worker-worktree.md

@@ -37,3 +37,5 @@ When the task is done:
    `agentwire msg` queues the message and delivers it only when their input box is empty; `notify-parent` / `session_send` paste + Enter **immediately** and overwrite any uncommitted draft — reserve those for something that genuinely can't wait.
 
 Don't merge the PR yourself — your creator or a reviewer handles merge and worktree cleanup.
+
+**No report path?** If `notify-parent` (or `notify_parent`) reports no target, you were spawned without a parent. State that explicitly as the LAST line of your final message and stop — do not guess a session name, and never `msg send --to parent` (there is no session by that name; it dead-letters and emails the owner).

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/roles/worker.md

@@ -37,3 +37,5 @@ complete | incomplete | error
 After writing the summary, stop. The system detects idle and auto-exits your pane.
 
 **If you're a standalone session** (your own tmux session, no separate worktree — no pane to auto-reap): there is no automatic idle-kill. Send the same summary content as your final message to the parent/creator instead (`agentwire msg send --to <parent> --kind done "..."`), then stop and wait — whoever created you is responsible for noticing you're idle and cleaning up.
+
+**No report path?** If `notify-parent` (or `notify_parent`) reports no target, you were spawned without a parent. State that explicitly as the LAST line of your final message and stop — do not guess a session name, and never `msg send --to parent` (there is no session by that name; it dead-letters and emails the owner).

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/safety/provenance.py

@@ -182,28 +182,23 @@ def rebuild_refusal_lines(repo_root: Path) -> List[str]:
 
 
 def rebuild_package_refusal_lines(repo_root: Path) -> List[str]:
-    """Refusal when either package ``rebuild`` would install is not wholly inside a primary checkout.
+    """Refusal when the ``agentwire`` package ``rebuild`` would install is not wholly inside a primary checkout.
 
-    ``rebuild`` installs agentwire AND its damage-control sibling from one checkout. The
-    worktree check above covers the checkout; this covers the packages themselves — a missing
-    sibling would install an agentwire whose hooks cannot start (``onFailure: block`` then
-    refuses every tool call), and one that resolves into a linked worktree would make that
-    worktree canonical for the engine alone.
+    The worktree check above covers the checkout; this covers the package itself — a missing
+    one would install nothing runnable, and one that resolves (e.g. through a symlink) into a
+    linked worktree would make that worktree canonical. The damage-control engine is no longer
+    built from the checkout (#1209 M8): it comes from PyPI, and its own provenance (a copy
+    running out of a worktree venv) is still judged by ``install_provenance`` over ``PACKAGES``.
     """
-    sources = {
-        "agentwire": repo_root / "agentwire",
-        "damage_control": repo_root / "packages" / "damage-control-dev" / "src" / "damage_control",
-    }
-    for package, path in sources.items():
-        if not path.is_dir():
-            return [f"REFUSED: rebuild would install without the {package} package.",
-                    f"  expected : {path}",
-                    "  An install missing it registers hooks that cannot start."]
-        worktree = _enclosing_worktree(path.resolve())
-        if worktree is not None:
-            return [f"REFUSED: rebuild would install the {package} package from the linked worktree {worktree}.",
-                    "  The worktree would BECOME canonical for that package (#936, doubled by #1209).",
-                    "  Fix: rebuild from the primary checkout, or pass --allow-foreign-source."]
+    path = repo_root / "agentwire"
+    if not path.is_dir():
+        return ["REFUSED: rebuild would install without the agentwire package.",
+                f"  expected : {path}"]
+    worktree = _enclosing_worktree(path.resolve())
+    if worktree is not None:
+        return [f"REFUSED: rebuild would install the agentwire package from the linked worktree {worktree}.",
+                "  The worktree would BECOME canonical for that package (#936).",
+                "  Fix: rebuild from the primary checkout, or pass --allow-foreign-source."]
     return []
 
 

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/session_cli.py

@@ -41,6 +41,7 @@ from .core import (
     record_session_launch,
     resolve_default_created_by,
     tmux_session_exists,
+    unparented_delegation_warning,
 )
 from .project_config import (
     DEFAULT_POSTURE,
@@ -133,6 +134,21 @@ def _shared_dir_conflicts(panes_output: str, session_name: str, target: str) ->
     return conflicting
 
 
+def created_by_error(created_by: "str | None") -> "str | None":
+    """Why an explicit ``--created-by`` can't be this spawn's parent, or None.
+
+    Called BEFORE any worktree/session exists so a wrong name leaves nothing
+    behind (#1261). ``None`` (derive it) and ``''`` (standalone) always pass.
+    """
+    if not created_by:
+        return None
+    from . import inbox
+    from .core import unknown_session_error
+
+    return unknown_session_error(
+        created_by, inbox.live_sessions(), require_live=True, what="--created-by")
+
+
 def cmd_new(args) -> int:
     """Create a new agent session.
 
@@ -157,6 +173,13 @@ def cmd_new(args) -> int:
     # KIND can be derived from whether a worktree is being created.
     project, branch, machine_id = parse_session_name(name)
 
+    # A wrong --created-by fails here, before any worktree/session exists
+    # (#1261). Remote spawns are exempt: the parent can't be verified from here.
+    if not machine_id:
+        parent_err = created_by_error(getattr(args, 'created_by', None))
+        if parent_err:
+            return _output_result(False, json_mode, parent_err)
+
     # --- Role resolution (two distinct phases) -----------------------------
     # Phase 1 — resolve. The session's ROLE is derived from the spawn verb:
     # cmd_worktree passes an explicit kind (default "worker"); for `new` we
@@ -529,7 +552,12 @@ def cmd_new(args) -> int:
     if created_by is None and getattr(args, 'kind', None) == 'orchestrator':
         created_by = ''
     elif created_by is None:
-        created_by = resolve_default_created_by(caller, session_path)
+        created_by = resolve_default_created_by(
+            caller, session_path, delegated=bool(first_message))
+    orphan_warning = unparented_delegation_warning(
+        session_name, caller, created_by, first_message)
+    if orphan_warning and not json_mode:
+        print(f"WARNING: {orphan_warning}", file=sys.stderr)
 
     # Build agent command
     model_override = getattr(args, 'model', None)
@@ -717,6 +745,8 @@ def cmd_new(args) -> int:
             "branch": branch,
             "machine": None,
         }
+        if orphan_warning:
+            result["warning"] = orphan_warning
         if first_message:
             result["first_message_delivered"] = bool(first_message_delivered)
             # Present whenever the straight verified paste didn't carry the
@@ -1068,6 +1098,10 @@ def cmd_worktree(args) -> int:
     if not name:
         return _output_result(False, json_mode, "Usage: agentwire worktree <name> (or --list / --remove <name> / --prune)")
 
+    parent_err = created_by_error(getattr(args, 'created_by', None))
+    if parent_err:
+        return _output_result(False, json_mode, parent_err)
+
     if not _check_tmux_installed():
         return _output_result(False, json_mode, "tmux is required but not installed")
 

{agentwire_dev-1.77.2 → agentwire_dev-1.77.3}/agentwire/system_cli.py

@@ -42,15 +42,15 @@ UV_CACHE_CLEAN_TIMEOUT = 20.0
 
 
 def _clean_uv_cache_for_agentwire() -> None:
-    """Drop only agentwire-dev's and damage-control-dev's entries from the uv cache.
+    """Drop only agentwire-dev's entry from the uv cache.
 
     The uv cache (~/.cache/uv) is shared by every uv tool and project on the
     machine — never rmtree it wholesale. `uv cache clean <package>` evicts just
     that package's wheels/sdists so the next install rebuilds from source.
-    damage-control-dev is the workspace sibling the hooks run from, so a stale
-    cached wheel of it would ship old rules just as a stale agentwire wheel would.
+    damage-control-dev is a published, versioned wheel resolved from PyPI (#1209 M8),
+    so there is no stale local build of it to evict.
     """
-    for package in ("agentwire-dev", "damage-control-dev"):
+    for package in ("agentwire-dev",):
         try:
             result = subprocess.run(
                 ["uv", "cache", "clean", package],
@@ -570,9 +570,8 @@ def cmd_rebuild(args) -> int:
             print(f"  {line}" if line else "", file=sys.stderr)
         return 1
 
-    # ...and the same question for each package it installs (#1209 M6): the damage-control
-    # engine is a second distribution, so a missing or worktree-resident sibling is the
-    # #936 hazard on the package that actually runs on every tool call.
+    # ...and the same question for the package it installs: one that resolves into a linked
+    # worktree (a symlinked package dir) is the #936 hazard from a primary-looking checkout.
     package_refusal = prov.rebuild_package_refusal_lines(project_root)
     if package_refusal and not getattr(args, "allow_foreign_source", False):
         for line in package_refusal: