From df3d92e34a2d33bfbb939bf4304059c0534a3e38 Mon Sep 17 00:00:00 2001
From: DucNghia <trandoducnghia@gmail.com>
Date: Thu, 10 Sep 2026 07:52:01 +0700
Subject: [PATCH 1/4] feat(tasks): preview sub-agent conversations in realtime

---
 web/src/styles.css                    |   4 +-
 web/src/tasks/TaskTurnBubble.tsx      |  80 ++++++++++++++++--
 web/src/tasks/subagentPresentation.ts |   3 +
 web/src/test/subagentPopup.test.tsx   | 114 ++++++++++++++++++++++++++
 4 files changed, 193 insertions(+), 8 deletions(-)
 create mode 100644 web/src/test/subagentPopup.test.tsx

diff --git a/web/src/styles.css b/web/src/styles.css
index d6bd292e..a2e90230 100644
--- a/web/src/styles.css
+++ b/web/src/styles.css
@@ -197,10 +197,10 @@
 
 .turn-subagents{margin:2px 0 12px;padding:10px;border:1px solid var(--border);border-radius:12px;background:color-mix(in srgb,var(--surface) 78%,transparent)}
 .turn-subagents-heading{display:flex;align-items:center;gap:7px;margin-bottom:8px;color:var(--muted);font-size:.7rem}.turn-subagents-heading svg{width:15px;height:15px}.turn-subagents-heading strong{color:var(--text);font-size:.72rem}.turn-subagents-heading span{display:grid;min-width:20px;height:20px;padding:0 6px;place-items:center;border:1px solid var(--border);border-radius:999px;font-size:.62rem}
-.turn-subagents-list{display:grid;gap:7px}.turn-subagent{display:grid;min-height:48px;padding:8px 10px;grid-template-columns:28px minmax(0,1fr) 18px;align-items:center;gap:9px;color:inherit;text-decoration:none;border:1px solid var(--border);border-radius:10px;background:var(--surface-2);transition:border-color .15s ease,transform .15s ease,background .15s ease}.turn-subagent[href]:hover{transform:translateY(-1px);border-color:var(--accent);background:var(--surface)}
+.turn-subagents-list{display:grid;gap:7px}.turn-subagent{display:grid;min-height:48px;padding:8px 10px;grid-template-columns:28px minmax(0,1fr) 18px;align-items:center;gap:9px;color:inherit;text-decoration:none;border:1px solid var(--border);border-radius:10px;background:var(--surface-2);transition:border-color .15s ease,transform .15s ease,background .15s ease}.turn-subagent[type=button]{width:100%;font:inherit;text-align:left;cursor:pointer}.turn-subagent[type=button]:hover{transform:translateY(-1px);border-color:var(--accent);background:var(--surface)}
 .turn-subagent-state{display:grid;width:28px;height:28px;place-items:center;border-radius:9px;background:var(--surface);color:var(--muted)}.turn-subagent-state svg{width:15px;height:15px}.turn-subagent-state.pending,.turn-subagent-state.running{color:var(--accent)}.turn-subagent-state.completed{color:var(--good)}.turn-subagent-state.failed,.turn-subagent-state.stopped,.turn-subagent-state.timedOut,.turn-subagent-state.interrupted{color:var(--bad)}
 .turn-subagent-copy{display:grid;min-width:0;gap:2px}.turn-subagent-copy strong{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:.72rem}.turn-subagent-copy small{color:var(--muted);font-size:.64rem}.turn-subagent.running .turn-subagent-copy small,.turn-subagent.pending .turn-subagent-copy small{color:var(--accent)}.turn-subagent.completed .turn-subagent-copy small{color:var(--good)}.turn-subagent.failed .turn-subagent-copy small,.turn-subagent.stopped .turn-subagent-copy small,.turn-subagent.timedOut .turn-subagent-copy small,.turn-subagent.interrupted .turn-subagent-copy small{color:var(--bad)}.turn-subagent-open{width:15px;height:15px;color:var(--muted)}
-@media(max-width:520px){.turn-subagents{padding:8px}.turn-subagent{grid-template-columns:26px minmax(0,1fr) 16px;padding-inline:8px}}
+.subagent-preview-modal{width:min(980px,calc(100vw - 32px));max-height:min(88dvh,900px);display:flex;flex-direction:column;overflow:hidden}.subagent-preview-body{min-height:180px;flex:1 1 auto;overflow:auto;padding:0 18px 18px}.subagent-preview-timeline{padding:0}.subagent-preview-state{min-height:180px;display:flex;align-items:center;justify-content:center;gap:9px;padding:24px;color:var(--muted);text-align:center}.subagent-preview-state>svg{width:18px;flex:0 0 auto}.subagent-preview-state.error{color:var(--bad);flex-wrap:wrap}.subagent-preview-actions{flex:0 0 auto;display:flex;justify-content:flex-end;padding:12px 18px 18px;border-top:1px solid var(--border)}.subagent-preview-open{min-height:44px}.subagent-preview-open svg{width:15px;height:15px}@media(max-width:520px){.turn-subagents{padding:8px}.turn-subagent{grid-template-columns:26px minmax(0,1fr) 16px;padding-inline:8px}.subagent-preview-modal{width:calc(100vw - 16px);max-height:92dvh}.subagent-preview-body{padding:0 10px 12px}.subagent-preview-actions{padding:10px 10px 12px}.subagent-preview-open{width:100%}}
 
 /* ChatGPT browser bridge */
 .tasks-header-actions{display:flex;align-items:center;gap:8px}.tasks-new-message{display:inline-flex;min-height:36px;padding:7px 10px;align-items:center;gap:6px;color:var(--text);text-decoration:none;background:var(--surface-2);border:1px solid var(--border);border-radius:9px;font-size:.68rem;font-weight:700;white-space:nowrap}.tasks-new-message:hover{border-color:var(--accent);background:var(--surface-3)}.tasks-new-message svg{width:15px;height:15px;color:var(--accent)}
diff --git a/web/src/tasks/TaskTurnBubble.tsx b/web/src/tasks/TaskTurnBubble.tsx
index 12efe434..d68684fc 100644
--- a/web/src/tasks/TaskTurnBubble.tsx
+++ b/web/src/tasks/TaskTurnBubble.tsx
@@ -2,12 +2,13 @@ import { subagentLabel, subagentTreeRows } from './subagentPresentation';
 import { TurnThinkingSources } from './TurnThinkingSources';
 import { browserThinking, isBrowserEvent } from './chatGptThinking';
 import { BookOpen, Bot, CheckCircle2, ChevronDown, CircleAlert, CircleStop, Clock3, ExternalLink, FileCode2, FilePenLine, GitBranch, LoaderCircle, MessageSquareText, Search, TerminalSquare, Wrench } from 'lucide-react';
-import { lazy, Suspense, useEffect, useLayoutEffect, useRef, useState } from 'react';
+import { lazy, Suspense, useCallback, useEffect, useLayoutEffect, useRef, useState } from 'react';
 import { ChatRichText } from './rich-text/ChatRichText';
 import { api } from '../api';
 import { Modal } from '../components';
 import { appLocale, formatAppNumber, tr } from '../i18n';
-import type { SubagentRun, TaskActivityDetail, TaskTurn, TimelineEvent } from '../types';
+import { useRealtime } from '../realtime';
+import type { SubagentRun, TaskActivityDetail, TaskDetail, TaskTurn, TimelineEvent } from '../types';
 import { ApprovalDecisionActions } from './ApprovalDecisionActions';
 import { CompletionQualityCard } from './CompletionQualityCard';
 import { StopActivityDialog } from './StopActivityDialog';
@@ -21,7 +22,9 @@ import {
   activityOutput,
   activityInputDetails,
   buildProcessBlocks,
+  buildTaskTurns,
   duration,
+  mergeLiveDetail,
   eventText,
   findCompletionSignal,
   findFinalResponse,
@@ -197,6 +200,7 @@ function SubagentList({ agents }: { agents: SubagentRun[] }) {
 }
 
 function SubagentItem({ agent }: { agent: SubagentRun }) {
+  const [previewOpen, setPreviewOpen] = useState(false);
   const pending = agent.status === 'pending';
   const running = agent.status === 'running';
   const failed = agent.status === 'failed';
@@ -207,11 +211,75 @@ function SubagentItem({ agent }: { agent: SubagentRun }) {
   const content = <>
     <span className={`turn-subagent-state ${agent.status}`} aria-hidden="true">{pending ? <Clock3 /> : running ? <LoaderCircle className="spin" /> : stopped ? <CircleStop /> : failed || timedOut || agent.status === 'interrupted' ? <CircleAlert /> : <CheckCircle2 />}</span>
     <span className="turn-subagent-copy"><strong>{agent.name}</strong><small title={agent.terminalReason}>{statusDetail}</small></span>
-    {agent.taskId && <ExternalLink className="turn-subagent-open" aria-hidden="true" />}
+    {agent.taskId && <MessageSquareText className="turn-subagent-open" aria-hidden="true" />}
   </>;
-  return agent.taskId
-    ? <a className={`turn-subagent ${agent.status}`} href={`/tasks/${encodeURIComponent(agent.taskId)}`} target="_blank" rel="noreferrer noopener" aria-label={`${agent.name} - ${statusLabel} - ${tr('Open in new tab')}`}>{content}</a>
-    : <div className={`turn-subagent ${agent.status}`} aria-label={`${agent.name} - ${statusLabel}`}>{content}</div>;
+  if (!agent.taskId) return <div className={`turn-subagent ${agent.status}`} aria-label={`${agent.name} - ${statusLabel}`}>{content}</div>;
+  return <>
+    <button type="button" className={`turn-subagent ${agent.status}`} onClick={() => setPreviewOpen(true)} aria-haspopup="dialog" aria-label={`${agent.name} - ${statusLabel} - ${subagentLabel('preview')}`}>{content}</button>
+    {previewOpen && <SubagentPreviewModal agent={agent} statusDetail={statusDetail} close={() => setPreviewOpen(false)} />}
+  </>;
+}
+
+function SubagentPreviewModal({ agent, statusDetail, close }: { agent: SubagentRun; statusDetail: string; close: () => void }) {
+  const taskId = agent.taskId!;
+  const taskHref = `/tasks/${encodeURIComponent(taskId)}`;
+  const [preview, setPreview] = useState<TaskDetail | null>(null);
+  const [previewLoading, setPreviewLoading] = useState(true);
+  const [previewError, setPreviewError] = useState('');
+  const loadPreview = useCallback((showLoading = false) => {
+    if (showLoading) setPreviewLoading(true);
+    setPreviewError('');
+    return api.task(taskId)
+      .then((next) => setPreview((current) => current ? mergeSubagentPreviewSnapshot(next, current) : next))
+      .catch((reason) => setPreviewError(reason instanceof Error ? reason.message : subagentLabel('previewError')))
+      .finally(() => setPreviewLoading(false));
+  }, [taskId]);
+
+  useEffect(() => { void loadPreview(true); }, [loadPreview]);
+  useRealtime((event) => {
+    if (event.type === 'system.resync_required' || event.type === 'system.connected') { void loadPreview(); return; }
+    if (event.taskId === taskId) {
+      if (event.type.startsWith('subagent.')) { void loadPreview(); return; }
+      setPreview((current) => current ? mergeLiveDetail({ ...current, events: subagentPreviewEvents(current) }, [event]) : current);
+      return;
+    }
+    if (!event.taskId || !preview?.subagents?.some((child) => child.taskId === event.taskId)) return;
+    if (event.type.startsWith('subagent.') || event.type === 'status') void loadPreview();
+  });
+
+  return <Modal className="subagent-preview-modal" title={agent.name} description={statusDetail} close={close}>
+    <div className="subagent-preview-body">
+      {previewLoading && !preview
+        ? <div className="subagent-preview-state" role="status"><LoaderCircle className="spin" aria-hidden="true" /><span>{tr('Loading…')}</span></div>
+        : previewError && !preview
+          ? <div className="subagent-preview-state error" role="alert"><CircleAlert aria-hidden="true" /><span>{previewError}</span><button type="button" className="button secondary compact" onClick={() => void loadPreview(true)}>{tr('Reload')}</button></div>
+          : preview
+            ? <SubagentPreviewBody detail={preview} />
+            : null}
+    </div>
+    <div className="subagent-preview-actions">
+      {previewError && preview && <span className="subagent-preview-live-error" role="status">{previewError}</span>}
+      <a className="button secondary subagent-preview-open" href={taskHref} target="_blank" rel="noreferrer noopener"><span aria-hidden="true">→</span>{subagentLabel('goToConversation')}<ExternalLink aria-hidden="true" /></a>
+    </div>
+  </Modal>;
+}
+
+function subagentPreviewEvents(detail: TaskDetail) {
+  return detail.events?.length ? detail.events : (detail.turns ?? []).flatMap((turn) => turn.events ?? []);
+}
+
+function mergeSubagentPreviewSnapshot(next: TaskDetail, current: TaskDetail) {
+  return mergeLiveDetail({ ...next, events: subagentPreviewEvents(next) }, subagentPreviewEvents(current));
+}
+
+function SubagentPreviewBody({ detail }: { detail: TaskDetail }) {
+  const events = detail.events ?? [];
+  const turns = detail.turns?.length ? detail.turns : buildTaskTurns(events, detail.task);
+  const chatGpt = detail.task.source === 'chatgpt_web';
+  if (!turns.length) return <div className="subagent-preview-state" role="status"><MessageSquareText aria-hidden="true" /><span>{tr('Agent processing, tools, and conclusions will appear here.')}</span></div>;
+  return <section className="task-bubble-timeline turn-timeline subagent-preview-timeline" aria-label={tr('Conversation activity')}>
+    {turns.map((turn) => <TaskTurnBubble turn={turn} taskId={detail.task.id} agentLabel={chatGpt ? 'ChatGPT' : tr('Codex Agent')} subagents={(detail.subagents ?? []).filter((child) => (child.rootTurnId ?? child.parentTurnId) === turn.id)} key={turn.id} />)}
+  </section>;
 }
 
 export function subagentStatusText(agent: Pick<SubagentRun, 'attempt' | 'terminalReason'>, statusLabel: string) {
diff --git a/web/src/tasks/subagentPresentation.ts b/web/src/tasks/subagentPresentation.ts
index 794957ea..56804cdc 100644
--- a/web/src/tasks/subagentPresentation.ts
+++ b/web/src/tasks/subagentPresentation.ts
@@ -7,6 +7,9 @@ const labels = {
   capacity: ['The limit is shared by the entire Agent tree. A nested Agent works locally when all slots are occupied.', 'Giới hạn áp dụng cho toàn bộ cây Agent. Khi hết chỗ, Agent con xử lý tại chỗ thay vì gọi thêm Agent.'],
   header: ['Conversation header', 'Tiêu đề cuộc trò chuyện'],
   parent: ['Delegated by', 'Được giao bởi'],
+  preview: ['Preview conversation', 'Xem trước cuộc trò chuyện'],
+  previewError: ['Could not load conversation preview.', 'Không thể tải nội dung cuộc trò chuyện.'],
+  goToConversation: ['Go to conversation', 'Tới đoạn trò chuyện'],
 } as const;
 export function subagentLabel(key: keyof typeof labels) {
   return labels[key][getAppLanguage() === 'vi' ? 1 : 0];
diff --git a/web/src/test/subagentPopup.test.tsx b/web/src/test/subagentPopup.test.tsx
new file mode 100644
index 00000000..f3e6d436
--- /dev/null
+++ b/web/src/test/subagentPopup.test.tsx
@@ -0,0 +1,114 @@
+import { act, fireEvent, render, screen, waitFor, within } from '@testing-library/react';
+import { afterEach, beforeEach, expect, it, vi } from 'vitest';
+
+import { api } from '../api';
+import { setAppLanguage } from '../i18n';
+import { TaskTurnBubble } from '../tasks/TaskTurnBubble';
+import type { SubagentRun, TaskDetail, TaskTurn, TimelineEvent } from '../types';
+
+const realtime = vi.hoisted(() => ({ listener: null as ((event: TimelineEvent) => void) | null }));
+vi.mock('../realtime', () => ({ useRealtime: (listener: (event: TimelineEvent) => void) => { realtime.listener = listener; return 'online'; } }));
+
+const startedAt = '2026-09-10T00:00:00Z';
+
+function childAgent(): SubagentRun {
+  return {
+    id: 'subagent-child',
+    parentTurnId: 'root-turn',
+    parentTaskId: 'task-chat-root',
+    rootTurnId: 'root-turn',
+    taskId: 'task-chat-child',
+    name: 'Child reviewer',
+    request: 'Review the child task',
+    status: 'completed',
+    createdAtUtc: startedAt,
+    updatedAtUtc: startedAt,
+    completedAtUtc: startedAt,
+    attempt: 1,
+    maxRuntimeMs: 1_800_000,
+  };
+}
+
+function parentTurn(): TaskTurn {
+  return { id: 'root-turn', status: 'running', startedAtUtc: startedAt, events: [] };
+}
+
+function childDetail(): TaskDetail {
+  return {
+    task: {
+      id: 'task-chat-child',
+      source: 'chatgpt_web',
+      title: 'Child conversation',
+      status: 'running',
+      updatedAtUtc: startedAt,
+      isSubagent: true,
+    },
+    turns: [{
+      id: 'child-turn',
+      status: 'running',
+      startedAtUtc: startedAt,
+      events: [{
+        id: 'child-user-message',
+        type: 'message',
+        taskId: 'task-chat-child',
+        turnId: 'child-turn',
+        occurredAt: startedAt,
+        payload: { role: 'user', content: 'Child body content' },
+      }],
+    }],
+    subagents: [],
+  };
+}
+
+beforeEach(() => {
+  setAppLanguage('en', false);
+  realtime.listener = null;
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+it('opens a body-only subagent preview and keeps the full conversation in a new-tab action', async () => {
+  const taskSpy = vi.spyOn(api, 'task').mockResolvedValue(childDetail());
+  const { container } = render(<TaskTurnBubble turn={parentTurn()} taskId="task-chat-root" subagents={[childAgent()]} />);
+
+  const trigger = screen.getByRole('button', { name: /Child reviewer - Done - Preview conversation/ });
+  expect(trigger).toHaveAttribute('aria-haspopup', 'dialog');
+  fireEvent.click(trigger);
+
+  await waitFor(() => expect(taskSpy).toHaveBeenCalledWith('task-chat-child'));
+  const dialog = await screen.findByRole('dialog');
+  expect(within(dialog).getByText('Child body content')).toBeInTheDocument();
+  expect(dialog.querySelector('.task-detail-topbar')).toBeNull();
+  expect(dialog.querySelector('.task-detail-sidebar')).toBeNull();
+  expect(dialog.querySelector('.task-chat-footer')).toBeNull();
+  expect(dialog.querySelector('.subagent-preview-timeline')).not.toBeNull();
+
+  act(() => realtime.listener?.({
+    id: 'child-progress',
+    type: 'progress',
+    taskId: 'task-chat-child',
+    turnId: 'child-turn',
+    occurredAt: '2026-09-10T00:00:01Z',
+    payload: { message: 'Realtime child update' },
+  }));
+  await waitFor(() => expect(within(dialog).getByText('Realtime child update')).toBeInTheDocument());
+
+  act(() => realtime.listener?.({
+    id: 'grandchild-status',
+    type: 'subagent.status',
+    taskId: 'task-chat-child',
+    turnId: 'child-turn',
+    occurredAt: '2026-09-10T00:00:02Z',
+    payload: { childTaskId: 'task-grandchild', status: 'running' },
+  }));
+  await waitFor(() => expect(taskSpy).toHaveBeenCalledTimes(2));
+  expect(within(dialog).getByText('Realtime child update')).toBeInTheDocument();
+
+  const openConversation = within(dialog).getByRole('link', { name: /Go to conversation/ });
+  expect(openConversation).toHaveAttribute('href', '/tasks/task-chat-child');
+  expect(openConversation).toHaveAttribute('target', '_blank');
+  expect(openConversation).toHaveAttribute('rel', expect.stringContaining('noopener'));
+  expect(container.querySelector('a.turn-subagent')).toBeNull();
+});

From 43e9d71953b7ccda74e531c9ff144d9152802063 Mon Sep 17 00:00:00 2001
From: DucNghia <trandoducnghia@gmail.com>
Date: Thu, 10 Sep 2026 08:30:28 +0700
Subject: [PATCH 2/4] fix: prevent unintended ChatGPT child conversations

---
 crates/chatcmd-mcp/src/server_contract.rs     |  12 +-
 src/runtime_host/dispatch.rs                  |   9 ++
 src/runtime_host/subagent_tests.rs            |  14 ++-
 src/runtime_host/subagents/registration.rs    |   2 +-
 src/runtime_host/user_message.rs              |  54 ++++++++-
 src/runtime_host/user_message_intent.rs       | 105 ++++++++++++++++++
 .../user_message_lifecycle_tests.rs           |  62 ++++++++++-
 .../user_message_project_tests.rs             |   2 +-
 .../tasks/GlobalSubagentFallbackBridge.tsx    |   3 +-
 web/src/test/subagentBridge.test.tsx          |  42 ++++++-
 10 files changed, 295 insertions(+), 10 deletions(-)

diff --git a/crates/chatcmd-mcp/src/server_contract.rs b/crates/chatcmd-mcp/src/server_contract.rs
index 6158b94b..587a042a 100644
--- a/crates/chatcmd-mcp/src/server_contract.rs
+++ b/crates/chatcmd-mcp/src/server_contract.rs
@@ -10,7 +10,7 @@ use super::McpServer;
 
 pub(crate) mod instructions;
 
-const SERVER_INSTRUCTIONS: &str = "IDENTITY: one ChatGPT chat equals one ChatCMD task; one user message equals one turn. Generate one unique turnId for each user message and reuse it unchanged for every ChatCMD call in that message. FIRST TOOL RULE: before calling any other ChatCMD tool in a user turn, call agent_user_message with the exact current user message text as content and that turnId. Do not summarize, rewrite, or omit the user's text. Reuse the newest taskId returned in this ChatGPT chat; omit taskId only when this chat has never returned one. ChatCMD validates the private ChatGPT conversation identity server-side; a stale taskId from another chat must not merge two chats. The server rejects other tools until the current turn's user message has been synchronized. Call agent_user_message exactly once per user turn. Never use agent_user_message for progress, reflections, findings, or commentary after tool results; use agent_progress for those updates. TOOL DISCOVERY RECOVERY RULE: ChatCMD exposes a broad, stable tool catalog and the host may lazy-load only a subset of tool schemas in a turn. A schema that is not currently visible is not evidence that the MCP server lost that tool. If a ChatCMD tool required to complete the user's request or any rule below is not currently visible or loaded, use the host's connector/resource discovery mechanism to discover and load that tool in the same turn, then continue the work. On ChatGPT connector hosts, use the connector discovery entrypoint available to the model (for example api_tool.list_resources) on the current connector with a focused query such as fs_, shell_, git_, skill, task, or agent. Before replying that a tool is unavailable, missing, not loaded, or cannot be used in the current turn, you MUST attempt discovery at least once for the needed capability in that same turn. Do not stop, defer implementation, or ask the user to send another message merely because a needed tool schema has not been loaded yet. SKILL RULE: after agent_user_message and before repository inspection, design decisions, code changes, or other non-trivial project work, call skills_list once to discover available .agents and .codex skills. Compare the returned skill descriptions with the current user request and intended work. If any skill matches, call skill_read for every relevant matching skill before doing the matching work, then follow those skill instructions. A directly matching skill is mandatory, not optional; do not infer its instructions from the skill name or description alone. For example, UI/color/layout/accessibility work must read a matching UI/UX skill when present, and Rust implementation/review work must read a matching Rust skill when present. Skip skill discovery only for trivial conversational turns or turns that do not require project work. INITIAL ACK RULE: for every non-trivial user request, immediately after agent_user_message and before skills_list or any other substantive tool call, call agent_progress once with a concise summary of what the user asked for and what you are going to do next. This first acknowledgement is mandatory even when the task seems obvious; do not postpone it until after repository inspection or tool results. PLAN MODE RULE: inspect planMode returned by agent_user_message. When planMode=true, the user explicitly asked for planning (for example 'Lên kế hoạch', 'Lập kế hoạch', or #plan) and you MUST build a detailed plan rather than treating the request as an ordinary execution request. First analyze all information already supplied and use relevant read-only/project inspection when it can answer uncertainties without bothering the user. Ask only missing information that materially changes the plan. Ask each clarification with agent_plan_question, exactly one question at a time with exactly two distinct options; that tool waits inside the SAME current turn for up to 120 seconds and the user may also provide a custom answer in the UI. A plan question is not a new user turn: never call agent_user_message again for its answer and never stop merely to ask the user to send another chat message. When agent_plan_question returns a user answer, before any further reasoning or tool call immediately call agent_progress with the exact agentProgressMessage returned by that tool. If it returns timedOut=true, choose one of its two options yourself, immediately report the question plus your chosen answer through agent_progress, and continue. Repeat only while genuinely plan-changing information is still missing. For programming, file-editing, deployment, command execution, or any other request whose planned work you can perform, after all other clarifications and before any modifying/execution action, ask one final agent_plan_question: 'Bạn có muốn mình thực hiện luôn công việc trong kế hoạch này không?' with options ['Có', 'Không']. Read-only inspection needed to understand the work is allowed before this consent; modifying files, running mutating commands, deployments, commits, or other planned side effects are not. If the answer is 'Không', return the detailed plan without executing it. If the answer is 'Có', form the detailed plan first and then execute that plan in the same turn, still following normal safety/approval/progress rules. Do not ask the execution-consent question for advice-only plans that have no action you can perform. Never finalize while an agent_plan_question call is pending. PROGRESS CADENCE RULE: for every non-trivial project turn, agent_progress is mandatory throughout the entire turn, not only near the beginning. After the initial acknowledgement, aim for a progress checkpoint after roughly 2-4 substantive operations or at the end of one coherent batch of tightly related low-level calls; prefer meaningful milestones over mechanical per-tool updates so progress reporting does not materially slow execution. A substantive call includes repository/file inspection, search, edit/create/delete, shell/process work, Git work, build/test/lint, deployment, or another operation that advances the task. POST-ACTION REFLECTION RULE: after finishing a meaningful file read/code inspection or a coherent batch of tightly related reads/searches, call agent_progress with the concrete understanding or finding you just gained before moving into a new substantive phase. Immediately after successfully editing or creating a file, call agent_progress with what changed and the relevant effect before continuing. Immediately after a build, test, lint, search, Git operation, command, deployment, or other verification step returns a meaningful result, call agent_progress with that concrete result before starting the next substantive operation. SHELL PENDING RULE: when shell_wait or shell_read shows a long-running command is still pending and more polling is needed, send agent_progress with what command/process is running, the current known stage/output, and what result you are waiting for or will check next. Do not repeat an identical progress update for rapid consecutive polls; one update may cover a short polling loop until the state/output changes materially or a noticeable wait has elapsed. ERROR RECOVERY RULE: whenever any tool, command, build, test, lint, Git operation, deployment, or verification step returns an error, non-zero exit code, rejection, or other task-relevant failure, call agent_progress before retrying, changing approach, or invoking a fallback. The progress message must identify the failed operation, summarize the observable error, state whether a likely cause is known, and say what recovery or alternative approach you will try next; if no safe alternative is available, say so. Never silently retry after an error. STRONG PROGRESS HABIT: treat progress updates as an AI execution discipline rather than a server-side gate. Prefer calling agent_progress after fs_find/fs_search/fs_read_text and other meaningful filesystem results before moving to the next substantive read/search/edit, after pending shell polling, and before retrying a failed operation. Do not let progress messaging block or materially slow the actual task; when several tightly related low-level operations form one coherent step, group them and report the meaningful checkpoint rather than adding unnecessary round trips. These progress messages must summarize observable results and decisions, not private chain-of-thought. Do not emit progress for tiny mechanical no-ops or duplicate pagination chunks unless a dedicated rule above requires it. MIRROR RULE: whenever you are about to emit a user-visible commentary/progress/update message about current work, findings, next steps, phase changes, long-running operations, or completion status before the final answer, first call agent_progress with a concise message carrying the same substantive information. Do not emit multiple user-visible progress/commentary updates in a row without mirroring each distinct milestone through agent_progress. If a commentary update contains only conversational filler and no substantive project status, omit the commentary instead of sending an unmirrored status. This mirror requirement applies only to user-visible progress summaries, never to private chain-of-thought, hidden reasoning, or internal scratch work. Progress messages must be concise, concrete, user-visible summaries of the current work or confirmed findings; do not expose private chain-of-thought and do not send generic filler such as 'Working on it' or 'Please wait'. Never call agent_progress after agent_turn_complete. TOOL ARGUMENT RULE: treat each tool's generated JSON schema as the canonical contract. Use the canonical field names shown by the schema and never invent a field name from an output object or from another tool. Compatibility aliases may be accepted by the server, but do not prefer them over the schema. PATH RULE: an existing absolute filesystem path explicitly present in any user message of the current ChatCMD task is a task-scoped access grant for that exact file or directory subtree, even when it is outside configured workspace roots. Use it directly when relevant, including in later turns such as when the user says to continue. Never widen that grant to a parent, sibling, different drive, or another path the user did not write; a path from another task/chat is not granted. PROJECT CONTEXT RULE: project/workspace context belongs to the current task/conversation, never to the Agent. Before filesystem, Git, repository, codebase, or project shell work, if the current task does not already have a project folder and the user has not supplied an explicit absolute work path, do not guess or infer a folder from the Agent, workspace_roots, current process directory, another task, or a previously used project. Ask the user to provide the project folder or absolute work path first, and do not call filesystem, Git, or project shell tools until that context is available. PATH DISCOVERY RULE: never guess a relative project path. If the exact relative path was not supplied by the user or returned by a prior ChatCMD filesystem/path result in this task, call fs_find from path '.' first and use the returned path. Use '.' rather than an empty string for the workspace root. EDIT RULE: for targeted text changes, obtain a version token with fs_stat or fs_read_text_v2, then use fs_apply_edits; use fs_write_text for whole-file creation or replacement. Prefer byte ranges for exact streaming edits and lineColumn with 1-based utf8CodePoint positions for human-oriented edits. Use fs_replace_text only as a legacy adapter for small files; copy oldText exactly from the latest current file content and read the target range again if it may have changed. Do not create or run Python, PowerShell, Node, or shell scripts merely to edit text when native filesystem tools can perform the change; use shell only when the native tools cannot express the required edit. NEW CHAT RULE: only when agent_user_message returns isFirstMessage=true, the exact first user message participates in the Rust task ID seed and agent_turn_complete must include a concise suggestedTitle for that conversation; never rename it from later turns. When any ChatCMD tool is used in a user turn, agent_turn_complete MUST be called exactly once immediately before replying to the user. Use the same taskId and turnId as that turn's tools, pass the exact final user-facing response text as content, finish all other tool calls first, and do not call another tool afterward. SUB-AGENT RULE: the parent ChatGPT may delegate when the user explicitly asks to split work across agents or when the parent independently judges delegation useful for parallel or specialized work. EXPLICIT MULTI-AGENT INTENT RULE: if agent_user_message.content clearly asks to split work across agents, for example phrases equivalent to 'chia agent', 'chia ra N agent', 'dùng nhiều agent', 'split into agents', or 'use multiple agents', the parent MUST attempt host-native delegation/subagent execution before doing the delegated work itself. Prefer the ChatGPT host's native delegation capability when available, and register/synchronize each delegated child with ChatCMD via agent_subagent_start so the parent/child task relationship remains visible to ChatCMD. Do not substitute a local Codex fallback for this explicit multi-agent request. When delegating, call agent_subagent_start once for each delegated child with a concise AI-chosen name and request. The result keeps taskId as the parent coordinator task and exposes childTaskId as the child conversation/task; never replace the parent taskId with childTaskId in later parent calls. Registration is idempotent within one parent turn by name plus delegated request, so a retry returns the same subagentId/childTaskId with duplicate=true instead of creating another child. Inspect dispatchMode: samplingTools or samplingText means ChatCMD is running the child through MCP sampling; extensionFallback means MCP sampling was unavailable and ChatCMD queued the reserved child task for the browser extension to open a separate ChatGPT conversation. When extensionFallback is returned, the child remains pending: the parent MUST NOT duplicate the delegated work and MUST use agent_subagent_wait until that child completes, fails, or exhausts fallback retries. The browser fallback keeps the same subagentId/childTaskId relationship and may claim MCP later through its CMDGPT_SUBAGENT_ID marker. If startup fails before the extension fallback can be queued, handle the structured failure without blindly creating a duplicate child. existing means the same child was already registered/claimed and must not be spawned again. If startup fails after registration, agent_subagent_start returns a normal structured result with status=failed and startupError rather than a tool-level error; do not blindly retry it. Do not create a duplicate host-native child. Before agent_turn_complete in the parent turn, call agent_subagent_wait while allFinished=false. ChatCMD rejects parent finalization while any child remains pending or running.";
+const SERVER_INSTRUCTIONS: &str = "IDENTITY: one ChatGPT chat equals one ChatCMD task; one user message equals one turn. Generate one unique turnId for each user message and reuse it unchanged for every ChatCMD call in that message. FIRST TOOL RULE: before calling any other ChatCMD tool in a user turn, call agent_user_message with the exact current user message text as content and that turnId. Do not summarize, rewrite, or omit the user's text. Reuse the newest taskId returned in this ChatGPT chat; omit taskId only when this chat has never returned one. ChatCMD validates the private ChatGPT conversation identity server-side; a stale taskId from another chat must not merge two chats. The server rejects other tools until the current turn's user message has been synchronized. Call agent_user_message exactly once per user turn. Never use agent_user_message for progress, reflections, findings, or commentary after tool results; use agent_progress for those updates. TOOL DISCOVERY RECOVERY RULE: ChatCMD exposes a broad, stable tool catalog and the host may lazy-load only a subset of tool schemas in a turn. A schema that is not currently visible is not evidence that the MCP server lost that tool. If a ChatCMD tool required to complete the user's request or any rule below is not currently visible or loaded, use the host's connector/resource discovery mechanism to discover and load that tool in the same turn, then continue the work. On ChatGPT connector hosts, use the connector discovery entrypoint available to the model (for example api_tool.list_resources) on the current connector with a focused query such as fs_, shell_, git_, skill, task, or agent. Before replying that a tool is unavailable, missing, not loaded, or cannot be used in the current turn, you MUST attempt discovery at least once for the needed capability in that same turn. Do not stop, defer implementation, or ask the user to send another message merely because a needed tool schema has not been loaded yet. SKILL RULE: after agent_user_message and before repository inspection, design decisions, code changes, or other non-trivial project work, call skills_list once to discover available .agents and .codex skills. Compare the returned skill descriptions with the current user request and intended work. If any skill matches, call skill_read for every relevant matching skill before doing the matching work, then follow those skill instructions. A directly matching skill is mandatory, not optional; do not infer its instructions from the skill name or description alone. For example, UI/color/layout/accessibility work must read a matching UI/UX skill when present, and Rust implementation/review work must read a matching Rust skill when present. Skip skill discovery only for trivial conversational turns or turns that do not require project work. INITIAL ACK RULE: for every non-trivial user request, immediately after agent_user_message and before skills_list or any other substantive tool call, call agent_progress once with a concise summary of what the user asked for and what you are going to do next. This first acknowledgement is mandatory even when the task seems obvious; do not postpone it until after repository inspection or tool results. PLAN MODE RULE: inspect planMode returned by agent_user_message. When planMode=true, the user explicitly asked for planning (for example 'Lên kế hoạch', 'Lập kế hoạch', or #plan) and you MUST build a detailed plan rather than treating the request as an ordinary execution request. First analyze all information already supplied and use relevant read-only/project inspection when it can answer uncertainties without bothering the user. Ask only missing information that materially changes the plan. Ask each clarification with agent_plan_question, exactly one question at a time with exactly two distinct options; that tool waits inside the SAME current turn for up to 120 seconds and the user may also provide a custom answer in the UI. A plan question is not a new user turn: never call agent_user_message again for its answer and never stop merely to ask the user to send another chat message. When agent_plan_question returns a user answer, before any further reasoning or tool call immediately call agent_progress with the exact agentProgressMessage returned by that tool. If it returns timedOut=true, choose one of its two options yourself, immediately report the question plus your chosen answer through agent_progress, and continue. Repeat only while genuinely plan-changing information is still missing. For programming, file-editing, deployment, command execution, or any other request whose planned work you can perform, after all other clarifications and before any modifying/execution action, ask one final agent_plan_question: 'Bạn có muốn mình thực hiện luôn công việc trong kế hoạch này không?' with options ['Có', 'Không']. Read-only inspection needed to understand the work is allowed before this consent; modifying files, running mutating commands, deployments, commits, or other planned side effects are not. If the answer is 'Không', return the detailed plan without executing it. If the answer is 'Có', form the detailed plan first and then execute that plan in the same turn, still following normal safety/approval/progress rules. Do not ask the execution-consent question for advice-only plans that have no action you can perform. Never finalize while an agent_plan_question call is pending. PROGRESS CADENCE RULE: for every non-trivial project turn, agent_progress is mandatory throughout the entire turn, not only near the beginning. After the initial acknowledgement, aim for a progress checkpoint after roughly 2-4 substantive operations or at the end of one coherent batch of tightly related low-level calls; prefer meaningful milestones over mechanical per-tool updates so progress reporting does not materially slow execution. A substantive call includes repository/file inspection, search, edit/create/delete, shell/process work, Git work, build/test/lint, deployment, or another operation that advances the task. POST-ACTION REFLECTION RULE: after finishing a meaningful file read/code inspection or a coherent batch of tightly related reads/searches, call agent_progress with the concrete understanding or finding you just gained before moving into a new substantive phase. Immediately after successfully editing or creating a file, call agent_progress with what changed and the relevant effect before continuing. Immediately after a build, test, lint, search, Git operation, command, deployment, or other verification step returns a meaningful result, call agent_progress with that concrete result before starting the next substantive operation. SHELL PENDING RULE: when shell_wait or shell_read shows a long-running command is still pending and more polling is needed, send agent_progress with what command/process is running, the current known stage/output, and what result you are waiting for or will check next. Do not repeat an identical progress update for rapid consecutive polls; one update may cover a short polling loop until the state/output changes materially or a noticeable wait has elapsed. ERROR RECOVERY RULE: whenever any tool, command, build, test, lint, Git operation, deployment, or verification step returns an error, non-zero exit code, rejection, or other task-relevant failure, call agent_progress before retrying, changing approach, or invoking a fallback. The progress message must identify the failed operation, summarize the observable error, state whether a likely cause is known, and say what recovery or alternative approach you will try next; if no safe alternative is available, say so. Never silently retry after an error. STRONG PROGRESS HABIT: treat progress updates as an AI execution discipline rather than a server-side gate. Prefer calling agent_progress after fs_find/fs_search/fs_read_text and other meaningful filesystem results before moving to the next substantive read/search/edit, after pending shell polling, and before retrying a failed operation. Do not let progress messaging block or materially slow the actual task; when several tightly related low-level operations form one coherent step, group them and report the meaningful checkpoint rather than adding unnecessary round trips. These progress messages must summarize observable results and decisions, not private chain-of-thought. Do not emit progress for tiny mechanical no-ops or duplicate pagination chunks unless a dedicated rule above requires it. MIRROR RULE: whenever you are about to emit a user-visible commentary/progress/update message about current work, findings, next steps, phase changes, long-running operations, or completion status before the final answer, first call agent_progress with a concise message carrying the same substantive information. Do not emit multiple user-visible progress/commentary updates in a row without mirroring each distinct milestone through agent_progress. If a commentary update contains only conversational filler and no substantive project status, omit the commentary instead of sending an unmirrored status. This mirror requirement applies only to user-visible progress summaries, never to private chain-of-thought, hidden reasoning, or internal scratch work. Progress messages must be concise, concrete, user-visible summaries of the current work or confirmed findings; do not expose private chain-of-thought and do not send generic filler such as 'Working on it' or 'Please wait'. Never call agent_progress after agent_turn_complete. TOOL ARGUMENT RULE: treat each tool's generated JSON schema as the canonical contract. Use the canonical field names shown by the schema and never invent a field name from an output object or from another tool. Compatibility aliases may be accepted by the server, but do not prefer them over the schema. PATH RULE: an existing absolute filesystem path explicitly present in any user message of the current ChatCMD task is a task-scoped access grant for that exact file or directory subtree, even when it is outside configured workspace roots. Use it directly when relevant, including in later turns such as when the user says to continue. Never widen that grant to a parent, sibling, different drive, or another path the user did not write; a path from another task/chat is not granted. PROJECT CONTEXT RULE: project/workspace context belongs to the current task/conversation, never to the Agent. Before filesystem, Git, repository, codebase, or project shell work, if the current task does not already have a project folder and the user has not supplied an explicit absolute work path, do not guess or infer a folder from the Agent, workspace_roots, current process directory, another task, or a previously used project. Ask the user to provide the project folder or absolute work path first, and do not call filesystem, Git, or project shell tools until that context is available. PATH DISCOVERY RULE: never guess a relative project path. If the exact relative path was not supplied by the user or returned by a prior ChatCMD filesystem/path result in this task, call fs_find from path '.' first and use the returned path. Use '.' rather than an empty string for the workspace root. EDIT RULE: for targeted text changes, obtain a version token with fs_stat or fs_read_text_v2, then use fs_apply_edits; use fs_write_text for whole-file creation or replacement. Prefer byte ranges for exact streaming edits and lineColumn with 1-based utf8CodePoint positions for human-oriented edits. Use fs_replace_text only as a legacy adapter for small files; copy oldText exactly from the latest current file content and read the target range again if it may have changed. Do not create or run Python, PowerShell, Node, or shell scripts merely to edit text when native filesystem tools can perform the change; use shell only when the native tools cannot express the required edit. NEW CHAT RULE: only when agent_user_message returns isFirstMessage=true, the exact first user message participates in the Rust task ID seed and agent_turn_complete must include a concise suggestedTitle for that conversation; never rename it from later turns. When any ChatCMD tool is used in a user turn, agent_turn_complete MUST be called exactly once immediately before replying to the user. Use the same taskId and turnId as that turn's tools, pass the exact final user-facing response text as content, finish all other tool calls first, and do not call another tool afterward. SUB-AGENT RULE: create or register a child agent only when the exact current root user message explicitly asks to split work across agents or use multiple agents. Never delegate merely because parallel or specialized work seems useful; continue in the current conversation instead. EXPLICIT MULTI-AGENT INTENT RULE: if agent_user_message.content clearly asks to split work across agents, for example phrases equivalent to 'chia agent', 'chia ra N agent', 'dùng nhiều agent', 'split into agents', or 'use multiple agents', the parent MUST attempt host-native delegation/subagent execution before doing the delegated work itself. Prefer the ChatGPT host's native delegation capability when available, and register/synchronize each delegated child with ChatCMD via agent_subagent_start so the parent/child task relationship remains visible to ChatCMD. Do not substitute a local Codex fallback for this explicit multi-agent request. When delegating, call agent_subagent_start once for each delegated child with a concise AI-chosen name and request. The result keeps taskId as the parent coordinator task and exposes childTaskId as the child conversation/task; never replace the parent taskId with childTaskId in later parent calls. Registration is idempotent within one parent turn by name plus delegated request, so a retry returns the same subagentId/childTaskId with duplicate=true instead of creating another child. Inspect dispatchMode: samplingTools or samplingText means ChatCMD is running the child through MCP sampling; extensionFallback means MCP sampling was unavailable and ChatCMD queued the reserved child task for the browser extension to open a separate ChatGPT conversation. When extensionFallback is returned, the child remains pending: the parent MUST NOT duplicate the delegated work and MUST use agent_subagent_wait until that child completes, fails, or exhausts fallback retries. The browser fallback keeps the same subagentId/childTaskId relationship and may claim MCP later through its CMDGPT_SUBAGENT_ID marker. If startup fails before the extension fallback can be queued, handle the structured failure without blindly creating a duplicate child. existing means the same child was already registered/claimed and must not be spawned again. If startup fails after registration, agent_subagent_start returns a normal structured result with status=failed and startupError rather than a tool-level error; do not blindly retry it. Do not create a duplicate host-native child. Before agent_turn_complete in the parent turn, call agent_subagent_wait while allFinished=false. ChatCMD rejects parent finalization while any child remains pending or running.";
 
 const TASK_WORKSPACE_INSTRUCTIONS: &str = "TASK WORKSPACE RESULT RULE: treat projectFolder returned by agent_user_message as the authoritative workspace for the current task. workspace_roots is task-scoped: when the task has a project folder it returns that folder, never the Agent folder or process-wide server root. Do not reject an explicit task project folder because it differs from a previous workspace_roots result from another task or connection.";
 
@@ -262,6 +262,16 @@ mod tests {
 
     #[test]
     fn server_instructions_require_explicit_multi_agent_intent_to_try_native_delegation() {
+        assert!(
+            SERVER_INSTRUCTIONS
+                .contains("only when the exact current root user message explicitly asks")
+        );
+        assert!(
+            SERVER_INSTRUCTIONS.contains(
+                "Never delegate merely because parallel or specialized work seems useful"
+            )
+        );
+        assert!(!SERVER_INSTRUCTIONS.contains("parent independently judges delegation useful"));
         assert!(SERVER_INSTRUCTIONS.contains("EXPLICIT MULTI-AGENT INTENT RULE"));
         assert!(SERVER_INSTRUCTIONS.contains("'chia agent'"));
         assert!(SERVER_INSTRUCTIONS.contains("'chia ra N agent'"));
diff --git a/src/runtime_host/dispatch.rs b/src/runtime_host/dispatch.rs
index 135a9184..4697e879 100644
--- a/src/runtime_host/dispatch.rs
+++ b/src/runtime_host/dispatch.rs
@@ -462,6 +462,15 @@ impl RuntimeHost {
                 .await
             }
             "agent_subagent_start" => {
+                if !self
+                    .subagent_delegation_explicitly_requested(&context)
+                    .await?
+                {
+                    return Err(RuntimeError::new(
+                        "subagent_explicit_user_intent_required",
+                        "The current root user turn did not explicitly request multi-agent delegation. Continue in the current conversation instead of opening a child.",
+                    ));
+                }
                 let input: SubagentStartInput = parse(arguments)?;
                 super::subagent_contract::validate_delegation_contract(&input)?;
                 self.register_subagent(
diff --git a/src/runtime_host/subagent_tests.rs b/src/runtime_host/subagent_tests.rs
index 10e11515..25b0e5af 100644
--- a/src/runtime_host/subagent_tests.rs
+++ b/src/runtime_host/subagent_tests.rs
@@ -1,5 +1,5 @@
 use chatcmd_mcp::catalog_hash;
-use chatcmd_runtime::OperationContext;
+use chatcmd_runtime::{OperationContext, ShellCreateRequest};
 use serde_json::{Value, json};
 use sqlx::Row as _;
 use tempfile::TempDir;
@@ -26,6 +26,18 @@ async fn parent_fixture() -> (RuntimeHost, OperationContext, TempDir) {
         .execute(host.repository.pool())
         .await
         .expect("insert parent task");
+    sqlx::query(
+        "INSERT INTO timeline_events(event_id,task_id,turn_id,session_id,actor,kind,idempotency_key,payload_json,metadata_json,created_at_ms) VALUES(?,?,?,NULL,'user','message',?,?,NULL,?)",
+    )
+    .bind("event-subagent-parent-user")
+    .bind(PARENT_TASK_ID)
+    .bind(PARENT_TURN_ID)
+    .bind("subagent-parent-user-message")
+    .bind(json!({"role":"user","content":"Chia agent để chạy delegated test fixture"}).to_string())
+    .bind(now)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert explicit parent user message");
 
     let mut context =
         OperationContext::new("subagent-parent-request", &agent_id, "agent_subagent_start");
diff --git a/src/runtime_host/subagents/registration.rs b/src/runtime_host/subagents/registration.rs
index 86587806..045474cb 100644
--- a/src/runtime_host/subagents/registration.rs
+++ b/src/runtime_host/subagents/registration.rs
@@ -133,7 +133,7 @@ impl RuntimeHost {
             ));
         }
 
-        sqlx::query("INSERT INTO tasks(id,agent_id,device_id,conversation_scope_hash,title,source,project_folder,status,active_session_id,generation,stopped_at_ms,created_at_ms,updated_at_ms) SELECT ?,agent_id,device_id,NULL,?,'mcp',project_folder,'pending',NULL,1,NULL,?,? FROM tasks WHERE id=? ON CONFLICT(id) DO NOTHING")
+        sqlx::query("INSERT INTO tasks(id,agent_id,device_id,conversation_scope_hash,title,source,project_folder,allow_execute,status,active_session_id,generation,stopped_at_ms,created_at_ms,updated_at_ms) SELECT ?,agent_id,device_id,NULL,?,'mcp',project_folder,allow_execute,'pending',NULL,1,NULL,?,? FROM tasks WHERE id=? ON CONFLICT(id) DO NOTHING")
             .bind(&deterministic_task_id)
             .bind(name)
             .bind(now)
diff --git a/src/runtime_host/user_message.rs b/src/runtime_host/user_message.rs
index 1d8579c1..0f92ad35 100644
--- a/src/runtime_host/user_message.rs
+++ b/src/runtime_host/user_message.rs
@@ -13,7 +13,7 @@ use super::{RuntimeHost, invalid, now_ms, storage_error};
 mod intent;
 #[path = "user_message_paths.rs"]
 mod paths;
-use intent::{intent_hint, is_plan_mode_request};
+use intent::{intent_hint, is_explicit_multi_agent_request, is_plan_mode_request};
 use paths::extract_explicit_absolute_paths;
 
 impl RuntimeHost {
@@ -41,6 +41,48 @@ impl RuntimeHost {
         }
     }
 
+    pub(super) async fn subagent_delegation_explicitly_requested(
+        &self,
+        context: &OperationContext,
+    ) -> RuntimeResult<bool> {
+        let task_id = required_task_id(context)?;
+        let turn_id = required_turn_id(context)?;
+        let root = sqlx::query_as::<_, (String, String)>(
+            r#"WITH RECURSIVE ancestors(parent_task_id,parent_turn_id,child_task_id,depth) AS (
+                SELECT parent_task_id,parent_turn_id,child_task_id,1 FROM subagent_runs WHERE child_task_id=?
+                UNION ALL
+                SELECT r.parent_task_id,r.parent_turn_id,r.child_task_id,ancestors.depth+1
+                FROM subagent_runs r JOIN ancestors ON r.child_task_id=ancestors.parent_task_id
+                WHERE ancestors.depth<32
+            )
+            SELECT parent_task_id,parent_turn_id FROM ancestors ORDER BY depth DESC LIMIT 1"#,
+        )
+        .bind(task_id.as_str())
+        .fetch_optional(self.repository.pool())
+        .await
+        .map_err(|_| RuntimeError::new("storage_error", "sub-agent root intent lookup failed"))?;
+        let (root_task_id, root_turn_id) =
+            root.unwrap_or_else(|| (task_id.as_str().to_owned(), turn_id.as_str().to_owned()));
+        let payload = sqlx::query_scalar::<_, String>(
+            "SELECT payload_json FROM timeline_events WHERE task_id=? AND turn_id=? AND actor='user' AND kind='message' ORDER BY created_at_ms,event_id LIMIT 1",
+        )
+        .bind(&root_task_id)
+        .bind(&root_turn_id)
+        .fetch_optional(self.repository.pool())
+        .await
+        .map_err(|_| RuntimeError::new("storage_error", "sub-agent root user message unavailable"))?;
+        let content = payload
+            .and_then(|payload| serde_json::from_str::<Value>(&payload).ok())
+            .and_then(|payload| {
+                payload
+                    .get("content")
+                    .and_then(Value::as_str)
+                    .map(str::to_owned)
+            })
+            .unwrap_or_default();
+        Ok(is_explicit_multi_agent_request(&content))
+    }
+
     pub(super) async fn task_user_path_scopes(
         &self,
         context: &OperationContext,
@@ -263,6 +305,7 @@ impl RuntimeHost {
             Value::Null
         };
         let subagent_limit = self.subagent_concurrency_limit().await?;
+        let explicit_subagent_intent = is_explicit_multi_agent_request(content);
         let intent_hint = intent_hint(content);
         Ok(json!({
             "accepted": true,
@@ -277,7 +320,14 @@ impl RuntimeHost {
                 },
                 "enabled": subagent_limit > 0,
                 "maxConcurrent": subagent_limit,
-                "instruction": if subagent_limit == 0 { "Sub-agents are disabled by the user. Do not call agent_subagent_start or delegate to any child; perform the work in this conversation." } else { "Use registered children within the global limit. All descendants remain attached to the root turn. If a nested child cannot acquire a slot, continue locally rather than waiting for another child." }
+                "explicitUserIntent": explicit_subagent_intent,
+                "instruction": if subagent_limit == 0 {
+                    "Sub-agents are disabled by the user. Do not call agent_subagent_start or delegate to any child; perform the work in this conversation."
+                } else if explicit_subagent_intent {
+                    "The current root user turn explicitly requested multi-agent work. Use registered children only for that requested delegation scope; all descendants remain attached to the root turn."
+                } else {
+                    "The current root user turn did not explicitly request multi-agent delegation. Do not call agent_subagent_start or open a child conversation; continue in this conversation."
+                }
             },
             "planMode": is_plan_mode_request(content),
             "intentHint": intent_hint,
diff --git a/src/runtime_host/user_message_intent.rs b/src/runtime_host/user_message_intent.rs
index 5193b103..c634dfa6 100644
--- a/src/runtime_host/user_message_intent.rs
+++ b/src/runtime_host/user_message_intent.rs
@@ -25,6 +25,71 @@ pub(super) fn is_plan_mode_request(content: &str) -> bool {
             || normalized.split_whitespace().any(|word| word == "#plan"))
 }
 
+pub(super) fn is_explicit_multi_agent_request(content: &str) -> bool {
+    let normalized = intent_prose(content)
+        .to_lowercase()
+        .split_whitespace()
+        .collect::<Vec<_>>()
+        .join(" ");
+    let negated = [
+        "không chia agent",
+        "không cần chia agent",
+        "đừng chia agent",
+        "không thử chia agent",
+        "không cần thử chia agent",
+        "đừng thử chia agent",
+        "không muốn chia agent",
+        "không dùng nhiều agent",
+        "không sử dụng nhiều agent",
+        "do not split into agents",
+        "do not try to split into agents",
+        "don't try to split into agents",
+        "don't split into agents",
+        "do not use multiple agents",
+        "don't use multiple agents",
+        "without subagents",
+        "no subagents",
+    ]
+    .iter()
+    .any(|phrase| normalized.contains(phrase));
+    if negated {
+        return false;
+    }
+
+    let starts_with_command = |command: &str| {
+        normalized.strip_prefix(command).is_some_and(|rest| {
+            rest.is_empty()
+                || rest.starts_with(' ')
+                || rest.starts_with(':')
+                || rest.starts_with('-')
+        })
+    };
+
+    starts_with_command("chia agent")
+        || ((starts_with_command("chia ra") || starts_with_command("tách ra"))
+            && normalized.contains(" agent"))
+        || starts_with_command("dùng nhiều agent")
+        || starts_with_command("sử dụng nhiều agent")
+        || starts_with_command("use multiple agents")
+        || starts_with_command("use several agents")
+        || starts_with_command("split into agents")
+        || starts_with_command("split across agents")
+        || [
+            "hãy chia agent",
+            "vui lòng chia agent",
+            "thử chia agent",
+            "giúp tôi chia agent",
+            "giúp t chia agent",
+            "hãy dùng nhiều agent",
+            "vui lòng dùng nhiều agent",
+            "hãy sử dụng nhiều agent",
+            "please use multiple agents",
+            "please split into agents",
+        ]
+        .iter()
+        .any(|phrase| normalized.contains(phrase))
+}
+
 pub(super) fn intent_hint(content: &str) -> Value {
     let normalized = intent_prose(content).to_lowercase();
     let workflow_kind = if is_plan_mode_request(content) {
@@ -111,6 +176,46 @@ mod tests {
         assert!(!is_plan_mode_request("Review chuỗi \"lên kế hoạch\""));
     }
 
+    #[test]
+    fn multi_agent_intent_requires_an_explicit_user_request() {
+        assert!(is_explicit_multi_agent_request(
+            "Chia agent đọc file giúp tôi"
+        ));
+        assert!(is_explicit_multi_agent_request(
+            "Chia agent: create delegated reviewer"
+        ));
+        assert!(is_explicit_multi_agent_request(
+            "Thử chia agent đọc các file chưa commit"
+        ));
+        assert!(is_explicit_multi_agent_request(
+            "Chia ra 3 agent để audit song song"
+        ));
+        assert!(is_explicit_multi_agent_request(
+            "Use multiple agents to review this repo"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Rà soát toàn bộ source code, sub agent, để tìm lỗi"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Kiểm tra logic chia agent hiện tại"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Kiểm tra logic dùng nhiều agent hiện tại"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Không chia agent, làm trong cuộc trò chuyện hiện tại"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Review chuỗi `chia agent` trong source"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Đừng thử chia agent; làm trong cuộc trò chuyện hiện tại"
+        ));
+        assert!(!is_explicit_multi_agent_request(
+            "Review nhãn \"thử chia agent\" trong UI"
+        ));
+    }
+
     #[test]
     fn intent_hint_never_grants_execution_permission() {
         let review = intent_hint("Chỉ review, đừng sửa");
diff --git a/src/runtime_host/user_message_lifecycle_tests.rs b/src/runtime_host/user_message_lifecycle_tests.rs
index ae7f5422..4c254049 100644
--- a/src/runtime_host/user_message_lifecycle_tests.rs
+++ b/src/runtime_host/user_message_lifecycle_tests.rs
@@ -218,6 +218,58 @@ async fn first_message_seeds_task_id_and_only_first_final_can_name_chat() {
     assert_eq!(final_title, "Sửa lỗi Git diff stat");
 }
 
+#[tokio::test]
+async fn ordinary_user_turn_cannot_start_subagent_or_create_child() {
+    let (host, agent_id, _directory) = test_host().await;
+    sqlx::query(
+        "INSERT INTO settings(key,value_json,updated_at_ms) VALUES('ui_subagentConcurrency','1',0)",
+    )
+    .execute(host.repository.pool())
+    .await
+    .expect("enable one child slot");
+    let scope = "conversation-subagent-explicit-intent";
+    let turn = "turn-subagent-explicit-intent";
+    let parent = host
+        .call_persisted(
+            "agent_user_message",
+            turn_context(
+                "parent-user-no-delegation",
+                &agent_id,
+                "agent_user_message",
+                turn,
+                scope,
+            ),
+            json!({"content":"Rà soát toàn bộ source code và sub agent để tìm lỗi"}),
+        )
+        .await
+        .expect("sync ordinary parent turn");
+    assert_eq!(parent["subagentPolicy"]["explicitUserIntent"], false);
+    let parent_task = parent["taskId"].as_str().expect("parent task");
+    let mut start = OperationContext::new(
+        "unexpected-subagent-start",
+        &agent_id,
+        "agent_subagent_start",
+    );
+    start.task_id = Some(parent_task.to_owned());
+    start.turn_id = Some(turn.to_owned());
+    let error = host
+        .call_persisted(
+            "agent_subagent_start",
+            start,
+            json!({"name":"Unexpected child","request":"Read one file"}),
+        )
+        .await
+        .expect_err("ordinary user turns must not create child conversations");
+    assert_eq!(error.code, "subagent_explicit_user_intent_required");
+    let count: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM subagent_runs WHERE parent_task_id=?")
+            .bind(parent_task)
+            .fetch_one(host.repository.pool())
+            .await
+            .expect("count unexpected children");
+    assert_eq!(count, 0);
+}
+
 #[tokio::test]
 async fn repeated_subagent_registration_is_idempotent_with_new_request_id() {
     let (host, agent_id, _directory) = test_host().await;
@@ -239,7 +291,7 @@ async fn repeated_subagent_registration_is_idempotent_with_new_request_id() {
                 turn,
                 scope,
             ),
-            json!({"content":"Create delegated reviewer"}),
+            json!({"content":"Chia agent: create delegated reviewer"}),
         )
         .await
         .expect("sync parent");
@@ -259,6 +311,14 @@ async fn repeated_subagent_registration_is_idempotent_with_new_request_id() {
         )
         .await
         .expect("first registration");
+    assert_eq!(parent["subagentPolicy"]["explicitUserIntent"], true);
+    let child_task = first["childTaskId"].as_str().expect("child task");
+    let child_allow_execute: i64 = sqlx::query_scalar("SELECT allow_execute FROM tasks WHERE id=?")
+        .bind(child_task)
+        .fetch_one(host.repository.pool())
+        .await
+        .expect("read delegated child approval");
+    assert_eq!(child_allow_execute, 1);
     let retry = host
         .call_persisted(
             "agent_subagent_start",
diff --git a/src/runtime_host/user_message_project_tests.rs b/src/runtime_host/user_message_project_tests.rs
index 1df3b114..68d86351 100644
--- a/src/runtime_host/user_message_project_tests.rs
+++ b/src/runtime_host/user_message_project_tests.rs
@@ -172,7 +172,7 @@ async fn delegated_child_inherits_project_folder_and_keeps_internal_user_message
                 parent_turn,
                 parent_scope,
             ),
-            json!({"content":format!("Create one delegated child for `{}`", project.display())}),
+            json!({"content":format!("Chia agent: create one delegated child for `{}`", project.display())}),
         )
         .await
         .expect("sync parent user message");
diff --git a/web/src/tasks/GlobalSubagentFallbackBridge.tsx b/web/src/tasks/GlobalSubagentFallbackBridge.tsx
index d8a5f8c9..a8eaabe1 100644
--- a/web/src/tasks/GlobalSubagentFallbackBridge.tsx
+++ b/web/src/tasks/GlobalSubagentFallbackBridge.tsx
@@ -47,7 +47,8 @@ export function GlobalSubagentFallbackBridge() {
   const recoverPending = useCallback(async () => {
     try {
       const pending = await api.pendingSubagentFallbacks();
-      await Promise.all(pending.map(dispatchFallback));
+      const resumable = pending.filter((fallback) => Boolean(fallback.conversationUrl?.trim()));
+      await Promise.all(resumable.map(dispatchFallback));
     } catch {
       // A later realtime reconnect will try recovery again.
     }
diff --git a/web/src/test/subagentBridge.test.tsx b/web/src/test/subagentBridge.test.tsx
index adf9a8be..1ccee6bf 100644
--- a/web/src/test/subagentBridge.test.tsx
+++ b/web/src/test/subagentBridge.test.tsx
@@ -1,14 +1,52 @@
 import { act, render, waitFor } from '@testing-library/react';
-import { expect, it, vi } from 'vitest';
+import { beforeEach, expect, it, vi } from 'vitest';
 import type { TimelineEvent } from '../types';
+import { api } from '../api';
 import { GlobalSubagentFallbackBridge } from '../tasks/GlobalSubagentFallbackBridge';
-import { closeSubagentFallbackTab } from '../chatgptBridge';
+import { closeSubagentFallbackTab, dispatchSubagentFallback } from '../chatgptBridge';
 
 const events = vi.hoisted(() => ({ listener: null as ((event: TimelineEvent) => void) | null }));
 vi.mock('../realtime', () => ({ useRealtime: (callback: (event: TimelineEvent) => void) => { events.listener = callback; return 'online'; } }));
 vi.mock('../api', () => ({ api: { pendingSubagentFallbacks: vi.fn(async () => []) } }));
 vi.mock('../chatgptBridge', () => ({ closeSubagentFallbackTab: vi.fn(async () => undefined), dispatchSubagentFallback: vi.fn() }));
 
+beforeEach(() => {
+  vi.clearAllMocks();
+  vi.mocked(api.pendingSubagentFallbacks).mockResolvedValue([]);
+});
+
+it('does not auto-open a brand-new browser child while recovering stale pending fallback', async () => {
+  vi.mocked(api.pendingSubagentFallbacks).mockResolvedValueOnce([{
+    subagentId: 'stale-child',
+    childTaskId: 'task-stale-child',
+    name: 'Stale child',
+    submittedContent: 'Read one file',
+    attempt: 1,
+    maxAttempts: 3,
+    conversationUrl: null,
+  }]);
+  render(<GlobalSubagentFallbackBridge />);
+  await waitFor(() => expect(api.pendingSubagentFallbacks).toHaveBeenCalled());
+  expect(dispatchSubagentFallback).not.toHaveBeenCalled();
+});
+
+it('resumes recovery when the browser child already has a conversation URL', async () => {
+  vi.mocked(api.pendingSubagentFallbacks).mockResolvedValueOnce([{
+    subagentId: 'existing-child',
+    childTaskId: 'task-existing-child',
+    name: 'Existing child',
+    submittedContent: 'Read one file',
+    attempt: 1,
+    maxAttempts: 3,
+    conversationUrl: 'https://chatgpt.com/c/existing-child',
+  }]);
+  render(<GlobalSubagentFallbackBridge />);
+  await waitFor(() => expect(dispatchSubagentFallback).toHaveBeenCalledWith(expect.objectContaining({
+    subagentId: 'existing-child',
+    conversationUrl: 'https://chatgpt.com/c/existing-child',
+  })));
+});
+
 it('keeps a claimed/completed MCP child tab alive until its browser final answer, but closes failed work', async () => {
   render(<GlobalSubagentFallbackBridge />);
   const event = (type: string, status?: string): TimelineEvent => ({ id: type, type, occurredAt: '2026-09-06T00:00:00Z', payload: { subagentId: 'child', status } });

From 2f75632898e0995b7a02f08b13b9c33d384e7daa Mon Sep 17 00:00:00 2001
From: DucNghia <trandoducnghia@gmail.com>
Date: Thu, 10 Sep 2026 08:36:58 +0700
Subject: [PATCH 3/4] fix(settings): persist interface font across reloads

---
 web/src/pages/SettingsPage.tsx   | 23 +++++++++++++++++++++--
 web/src/test/subagentUi.test.tsx |  9 +++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/web/src/pages/SettingsPage.tsx b/web/src/pages/SettingsPage.tsx
index 78952e73..1e45f7b9 100644
--- a/web/src/pages/SettingsPage.tsx
+++ b/web/src/pages/SettingsPage.tsx
@@ -43,7 +43,7 @@ export function SettingsPage() {
 
   useEffect(() => {
     if (!result.data) return;
-    setValue({ ...result.data, language: getAppLanguage() });
+    setValue({ ...result.data, fontFamily: storedFontFamily(result.data.fontFamily), language: getAppLanguage() });
   }, [result.data]);
 
   const submit = (event: FormEvent) => {
@@ -78,7 +78,7 @@ export function SettingsPage() {
 
   const update = <K extends keyof LocalSettings>(key: K, next: LocalSettings[K]) => setValue({ ...value, [key]: next });
   const updateLanguage = (language: LocalSettings['language']) => { update('language', language); setAppLanguage(language, true); };
-  const updateFont = (fontFamily: string) => { const next = normalizeFontFamily(fontFamily); update('fontFamily', next); applyAppFont(next); };
+  const updateFont = (fontFamily: string) => { const next = normalizeFontFamily(fontFamily); update('fontFamily', next); persistFontFamily(next); applyAppFont(next); };
   const updateTaskFontScale = (fontScale: number) => { const next = normalizeTaskFontScale(fontScale); update('taskFontScale', next); applyTaskFontScale(next); };
   const activeMeta = SETTINGS_TABS.find((tab) => tab.id === activeTab) ?? SETTINGS_TABS[0];
   const ActiveIcon = activeMeta.icon;
@@ -190,3 +190,22 @@ function sectionDescription(tab: SettingsTab) {
 function isSettingsTab(value: string | null): value is SettingsTab {
   return SETTINGS_TABS.some((tab) => tab.id === value);
 }
+
+function storedFontFamily(fallback: string) {
+  try {
+    const preferences = JSON.parse(localStorage.getItem('chatcmd.preferences') ?? '{}') as { fontFamily?: unknown };
+    return typeof preferences.fontFamily === 'string' ? normalizeFontFamily(preferences.fontFamily) : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+function persistFontFamily(fontFamily: string) {
+  let preferences: Record<string, unknown> = {};
+  try {
+    preferences = JSON.parse(localStorage.getItem('chatcmd.preferences') ?? '{}') as Record<string, unknown>;
+  } catch {
+    // Replace malformed browser preferences with a valid object containing the selected font.
+  }
+  localStorage.setItem('chatcmd.preferences', JSON.stringify({ ...preferences, fontFamily }));
+}
diff --git a/web/src/test/subagentUi.test.tsx b/web/src/test/subagentUi.test.tsx
index 676bf54b..6a51ad44 100644
--- a/web/src/test/subagentUi.test.tsx
+++ b/web/src/test/subagentUi.test.tsx
@@ -75,4 +75,13 @@ describe('subagent tree and chat layout', () => {
     fireEvent.submit(select.closest('form')!);
     await waitFor(() => expect(save).toHaveBeenCalledWith(expect.objectContaining({ subagentConcurrency: 0 })));
   });
+  it('persists the selected interface font immediately and restores the browser preference', async () => {
+    scene.data = { bindAddress: '127.0.0.1', port: 8080, mcpEndpoint: '', databasePath: '', executionMode: 'approval', approveNewConversations: false, terminalExecutable: 'pwsh', taskConcurrency: 2, sessionConcurrency: 2, subagentConcurrency: 0, theme: 'dark', fontFamily: 'Inter', taskFontScale: 100, language: 'en', newAgentSound: false, finishedTaskSound: false, dataRetention: 'off' };
+    localStorage.setItem('chatcmd.preferences', JSON.stringify({ theme: 'dark', fontFamily: 'Roboto' }));
+    render(<MemoryRouter initialEntries={['/settings?tab=display']}><SettingsPage /></MemoryRouter>);
+    const font = await screen.findByDisplayValue('Roboto');
+    expect(font).toHaveAttribute('list', 'chatcmd-google-fonts');
+    fireEvent.change(font, { target: { value: 'Manrope' } });
+    expect(JSON.parse(localStorage.getItem('chatcmd.preferences') ?? '{}')).toMatchObject({ theme: 'dark', fontFamily: 'Manrope' });
+  });
 });

From 5b4f44184feae4ccc75794181002403c1b50f996 Mon Sep 17 00:00:00 2001
From: DucNghia <trandoducnghia@gmail.com>
Date: Thu, 10 Sep 2026 08:56:56 +0700
Subject: [PATCH 4/4] fix: prevent ghost conversation approval tasks

---
 src/runtime_host/identity.rs                |  39 ++-
 src/runtime_host/user_message_path_tests.rs | 308 ++++++++++++++++++++
 2 files changed, 342 insertions(+), 5 deletions(-)

diff --git a/src/runtime_host/identity.rs b/src/runtime_host/identity.rs
index 0ee96d00..5b18dab2 100644
--- a/src/runtime_host/identity.rs
+++ b/src/runtime_host/identity.rs
@@ -82,6 +82,22 @@ impl RuntimeHost {
         } else {
             None
         };
+        let unresolved_openai_tool_call = first_user_message.is_none()
+            && explicit_task.is_none()
+            && bound_task.is_none()
+            && delegated_task.is_none()
+            && chatgpt_bridge_task.is_none()
+            && mapped_scope_task.is_none()
+            && pending_chatgpt_bridge_task.is_none()
+            && conversation_scope
+                .as_deref()
+                .is_some_and(|scope| scope.starts_with("openai:"));
+        if unresolved_openai_tool_call {
+            return Err(RuntimeError::new(
+                "conversation_identity_unbound",
+                "this ChatGPT tool call is not bound to an existing local conversation. Call agent_user_message first and reuse its taskId/turnId instead of creating a new conversation",
+            ));
+        }
         let task = explicit_task.unwrap_or_else(|| {
             delegated_task.unwrap_or_else(|| {
                 chatgpt_bridge_task.unwrap_or_else(|| {
@@ -304,7 +320,18 @@ impl RuntimeHost {
         conversation_scope: &str,
     ) -> RuntimeResult<Option<String>> {
         sqlx::query_scalar::<_, String>(
-            "SELECT id FROM tasks WHERE agent_id=? AND conversation_scope_hash=? ORDER BY created_at_ms,id LIMIT 1",
+            r#"SELECT t.id
+               FROM tasks t
+               WHERE t.agent_id=? AND t.conversation_scope_hash=?
+                 AND (
+                   t.source='chatgpt_web'
+                   OR EXISTS(
+                     SELECT 1 FROM timeline_events e
+                     WHERE e.task_id=t.id AND e.actor='user' AND e.kind='message'
+                   )
+                 )
+               ORDER BY t.created_at_ms,t.id
+               LIMIT 1"#,
         )
         .bind(agent_id)
         .bind(conversation_scope)
@@ -354,12 +381,14 @@ impl RuntimeHost {
             r#"SELECT r.task_id
                FROM chatgpt_bridge_requests r
                JOIN tasks t ON t.id=r.task_id
+               LEFT JOIN chatgpt_conversations c ON c.task_id=r.task_id
                WHERE r.task_id IS NOT NULL
-                 AND t.agent_id=? AND t.source='chatgpt_web'
+                 AND t.agent_id=? AND t.source='chatgpt_web' AND t.status='running'
                  AND r.status IN ('queued','running','stop_requested')
-                 AND r.updated_at_ms>=?
+                 AND (c.active_request_id=r.id OR r.updated_at_ms>=?)
                GROUP BY r.task_id
-               ORDER BY MAX(r.updated_at_ms) DESC
+               ORDER BY MAX(CASE WHEN c.active_request_id=r.id THEN 1 ELSE 0 END) DESC,
+                        MAX(r.updated_at_ms) DESC
                LIMIT 2"#,
         )
         .bind(agent_id)
@@ -367,7 +396,7 @@ impl RuntimeHost {
         .fetch_all(self.repository.pool())
         .await
         .map_err(|_| {
-            RuntimeError::new("storage_error", "pending ChatGPT bridge task lookup failed")
+            RuntimeError::new("storage_error", "active ChatGPT bridge task lookup failed")
         })?;
         Ok((rows.len() == 1).then(|| rows[0].clone()))
     }
diff --git a/src/runtime_host/user_message_path_tests.rs b/src/runtime_host/user_message_path_tests.rs
index f02c1fdb..75b2a677 100644
--- a/src/runtime_host/user_message_path_tests.rs
+++ b/src/runtime_host/user_message_path_tests.rs
@@ -531,3 +531,311 @@ async fn chatgpt_bridge_claims_unbound_request_before_bridge_started() {
         "claiming must not create an approval ghost task"
     );
 }
+
+#[tokio::test]
+async fn long_running_active_chatgpt_bridge_remains_the_unique_tool_identity() {
+    let (host, agent_id, _directory) = test_host().await;
+    let task_id = "task-chatgpt-long-running-active";
+    let request_id = "chatgpt-request-long-running-active";
+    let old = now_ms().saturating_sub(5 * 60 * 1000);
+
+    sqlx::query(
+        "INSERT INTO tasks(id,agent_id,device_id,conversation_scope_hash,title,source,allow_execute,status,active_session_id,generation,stopped_at_ms,created_at_ms,updated_at_ms) VALUES(?,?,?,?,?,'chatgpt_web',1,'running',NULL,1,NULL,?,?)",
+    )
+    .bind(task_id)
+    .bind(&agent_id)
+    .bind(host.device.id.as_str())
+    .bind("openai:browser-conversation-scope")
+    .bind("Long running ChatGPT task")
+    .bind(old)
+    .bind(old)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert long running task");
+
+    sqlx::query(
+        "INSERT INTO chatgpt_bridge_requests(id,task_id,turn_id,agent_id,model,user_content,submitted_content,status,conversation_id,conversation_url,assistant_content,error_message,created_at_ms,updated_at_ms,completed_at_ms) VALUES(?,?,?,?,?,?,?,'running',?,?,NULL,NULL,?,?,NULL)",
+    )
+    .bind(request_id)
+    .bind(task_id)
+    .bind("chatgpt-turn-long-running")
+    .bind(&agent_id)
+    .bind("Auto")
+    .bind("Long running")
+    .bind("Long running")
+    .bind("conversation-long-running")
+    .bind("https://chatgpt.com/c/conversation-long-running")
+    .bind(old)
+    .bind(old)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert long running request");
+
+    sqlx::query(
+        "INSERT INTO chatgpt_conversations(task_id,conversation_id,conversation_url,model,active_request_id,created_at_ms,updated_at_ms) VALUES(?,?,?,?,?,?,?)",
+    )
+    .bind(task_id)
+    .bind("conversation-long-running")
+    .bind("https://chatgpt.com/c/conversation-long-running")
+    .bind("Auto")
+    .bind(request_id)
+    .bind(old)
+    .bind(old)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert long running conversation");
+
+    let mut context = turn_context(
+        "late-tool-call",
+        &agent_id,
+        "workspace_roots",
+        "turn-from-rotated-openai-session",
+        "openai:rotated-host-session-scope",
+    );
+    host.ensure_call_identity(&mut context, None)
+        .await
+        .expect("canonical active browser request must survive a long model turn");
+
+    assert_eq!(context.task_id.as_deref(), Some(task_id));
+    let task_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM tasks WHERE agent_id=?")
+        .bind(&agent_id)
+        .fetch_one(host.repository.pool())
+        .await
+        .expect("count tasks");
+    assert_eq!(
+        task_count, 1,
+        "a rotated OpenAI session must not create a second local task"
+    );
+}
+
+#[tokio::test]
+async fn ambiguous_openai_tool_call_fails_closed_without_creating_approval_task() {
+    let (host, agent_id, _directory) = test_host().await;
+    let now = now_ms();
+
+    for suffix in ["a", "b"] {
+        let task_id = format!("task-chatgpt-ambiguous-{suffix}");
+        let request_id = format!("chatgpt-request-ambiguous-{suffix}");
+        let conversation_id = format!("conversation-ambiguous-{suffix}");
+        let conversation_url = format!("https://chatgpt.com/c/{conversation_id}");
+
+        sqlx::query(
+            "INSERT INTO tasks(id,agent_id,device_id,conversation_scope_hash,title,source,allow_execute,status,active_session_id,generation,stopped_at_ms,created_at_ms,updated_at_ms) VALUES(?,?,?,?,?,'chatgpt_web',1,'running',NULL,1,NULL,?,?)",
+        )
+        .bind(&task_id)
+        .bind(&agent_id)
+        .bind(host.device.id.as_str())
+        .bind(format!("openai:browser-scope-{suffix}"))
+        .bind(format!("Ambiguous {suffix}"))
+        .bind(now)
+        .bind(now)
+        .execute(host.repository.pool())
+        .await
+        .expect("insert ambiguous task");
+
+        sqlx::query(
+            "INSERT INTO chatgpt_bridge_requests(id,task_id,turn_id,agent_id,model,user_content,submitted_content,status,conversation_id,conversation_url,assistant_content,error_message,created_at_ms,updated_at_ms,completed_at_ms) VALUES(?,?,?,?,?,?,?,'running',?,?,NULL,NULL,?,?,NULL)",
+        )
+        .bind(&request_id)
+        .bind(&task_id)
+        .bind(format!("chatgpt-turn-ambiguous-{suffix}"))
+        .bind(&agent_id)
+        .bind("Auto")
+        .bind(format!("Ambiguous {suffix}"))
+        .bind(format!("Ambiguous {suffix}"))
+        .bind(&conversation_id)
+        .bind(&conversation_url)
+        .bind(now)
+        .bind(now)
+        .execute(host.repository.pool())
+        .await
+        .expect("insert ambiguous request");
+
+        sqlx::query(
+            "INSERT INTO chatgpt_conversations(task_id,conversation_id,conversation_url,model,active_request_id,created_at_ms,updated_at_ms) VALUES(?,?,?,?,?,?,?)",
+        )
+        .bind(&task_id)
+        .bind(&conversation_id)
+        .bind(&conversation_url)
+        .bind("Auto")
+        .bind(&request_id)
+        .bind(now)
+        .bind(now)
+        .execute(host.repository.pool())
+        .await
+        .expect("insert ambiguous conversation");
+    }
+
+    let mut context = turn_context(
+        "ambiguous-tool-call",
+        &agent_id,
+        "workspace_roots",
+        "turn-without-local-binding",
+        "openai:rotated-or-ambiguous-session",
+    );
+    let error = host
+        .ensure_call_identity(&mut context, None)
+        .await
+        .expect_err("ambiguous tool call must not mint an approval task");
+    assert_eq!(error.code, "conversation_identity_unbound");
+
+    let task_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM tasks WHERE agent_id=?")
+        .bind(&agent_id)
+        .fetch_one(host.repository.pool())
+        .await
+        .expect("count tasks");
+    assert_eq!(task_count, 2, "must not create a third ghost task");
+    let mcp_task_count: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM tasks WHERE agent_id=? AND source='mcp'")
+            .bind(&agent_id)
+            .fetch_one(host.repository.pool())
+            .await
+            .expect("count generic MCP tasks");
+    assert_eq!(
+        mcp_task_count, 0,
+        "must not create an approval-only MCP task"
+    );
+}
+
+#[tokio::test]
+async fn approved_ghost_scope_without_user_message_cannot_hijack_browser_tool_calls() {
+    let (host, agent_id, _directory) = test_host().await;
+    let browser_task = "task-chatgpt-browser-after-ghost";
+    let request_id = "chatgpt-request-browser-after-ghost";
+    let ghost_task = "task-chatgpt-approved-ghost";
+    let rotated_scope = "openai:approved-ghost-session";
+    let now = now_ms();
+
+    sqlx::query(
+        "INSERT INTO tasks(id,agent_id,device_id,conversation_scope_hash,title,source,allow_execute,status,active_session_id,generation,stopped_at_ms,created_at_ms,updated_at_ms) VALUES(?,?,?,?,?,'chatgpt_web',1,'running',NULL,1,NULL,?,?)",
+    )
+    .bind(browser_task)
+    .bind(&agent_id)
+    .bind(host.device.id.as_str())
+    .bind("openai:real-browser-scope")
+    .bind("Browser task")
+    .bind(now)
+    .bind(now)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert browser task");
+
+    sqlx::query(
+        "INSERT INTO chatgpt_bridge_requests(id,task_id,turn_id,agent_id,model,user_content,submitted_content,status,conversation_id,conversation_url,assistant_content,error_message,created_at_ms,updated_at_ms,completed_at_ms) VALUES(?,?,?,?,?,?,?,'running',?,?,NULL,NULL,?,?,NULL)",
+    )
+    .bind(request_id)
+    .bind(browser_task)
+    .bind("chatgpt-turn-browser-after-ghost")
+    .bind(&agent_id)
+    .bind("Auto")
+    .bind("Continue browser task")
+    .bind("Continue browser task")
+    .bind("conversation-browser-after-ghost")
+    .bind("https://chatgpt.com/c/conversation-browser-after-ghost")
+    .bind(now)
+    .bind(now)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert browser request");
+
+    sqlx::query(
+        "INSERT INTO chatgpt_conversations(task_id,conversation_id,conversation_url,model,active_request_id,created_at_ms,updated_at_ms) VALUES(?,?,?,?,?,?,?)",
+    )
+    .bind(browser_task)
+    .bind("conversation-browser-after-ghost")
+    .bind("https://chatgpt.com/c/conversation-browser-after-ghost")
+    .bind("Auto")
+    .bind(request_id)
+    .bind(now)
+    .bind(now)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert browser conversation");
+
+    sqlx::query(
+        "INSERT INTO tasks(id,agent_id,device_id,conversation_scope_hash,title,source,allow_execute,status,active_session_id,generation,stopped_at_ms,created_at_ms,updated_at_ms) VALUES(?,?,?,?,NULL,'mcp',1,'running',NULL,1,NULL,?,?)",
+    )
+    .bind(ghost_task)
+    .bind(&agent_id)
+    .bind(host.device.id.as_str())
+    .bind(rotated_scope)
+    .bind(now)
+    .bind(now)
+    .execute(host.repository.pool())
+    .await
+    .expect("insert approval-only ghost task");
+
+    let mut context = turn_context(
+        "tool-after-approved-ghost",
+        &agent_id,
+        "workspace_roots",
+        "turn-after-approved-ghost",
+        rotated_scope,
+    );
+    host.ensure_call_identity(&mut context, None)
+        .await
+        .expect("approved ghost scope must be ignored in favor of the active browser task");
+
+    assert_eq!(context.task_id.as_deref(), Some(browser_task));
+    let ghost_user_messages: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM timeline_events WHERE task_id=? AND actor='user' AND kind='message'",
+    )
+    .bind(ghost_task)
+    .fetch_one(host.repository.pool())
+    .await
+    .expect("count ghost user messages");
+    assert_eq!(ghost_user_messages, 0);
+    let task_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM tasks WHERE agent_id=?")
+        .bind(&agent_id)
+        .fetch_one(host.repository.pool())
+        .await
+        .expect("count tasks after ghost recovery");
+    assert_eq!(task_count, 2, "must not create another approval task");
+}
+
+#[tokio::test]
+async fn established_native_mcp_conversation_scope_still_reuses_its_task() {
+    let (host, agent_id, _directory) = test_host().await;
+    let scope = "openai:established-native-mcp-scope";
+    let accepted = host
+        .call_persisted(
+            "agent_user_message",
+            turn_context(
+                "native-mcp-user",
+                &agent_id,
+                "agent_user_message",
+                "native-mcp-user-turn",
+                scope,
+            ),
+            json!({"content":"Normal ChatGPT MCP conversation"}),
+        )
+        .await
+        .expect("establish native MCP conversation");
+    let task_id = accepted["taskId"].as_str().expect("task id").to_owned();
+
+    let source: String = sqlx::query_scalar("SELECT source FROM tasks WHERE id=?")
+        .bind(&task_id)
+        .fetch_one(host.repository.pool())
+        .await
+        .expect("read native MCP task source");
+    assert_eq!(source, "mcp");
+
+    let mut context = turn_context(
+        "native-mcp-follow-up-tool",
+        &agent_id,
+        "workspace_roots",
+        "native-mcp-follow-up-turn",
+        scope,
+    );
+    host.ensure_call_identity(&mut context, None)
+        .await
+        .expect("established native MCP conversation must remain reusable by scope");
+    assert_eq!(context.task_id.as_deref(), Some(task_id.as_str()));
+
+    let task_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM tasks WHERE agent_id=?")
+        .bind(&agent_id)
+        .fetch_one(host.repository.pool())
+        .await
+        .expect("count native MCP tasks");
+    assert_eq!(task_count, 1);
+}