Offer to delegate a worktree /close to the Manager session by gering · Pull Request #58 · gering/claude-plugins

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

gering · 2026-09-01T22:14:35Z

Summary

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session (the Claude session at the main-repo root) instead of self-closing.
Delegating sends one structured work-system close-request via the built-in SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab.
Every delegated close removes one use of Scenario B — the armed marker + SessionEnd hook + detached /exit injector, the only teardown path that cannot confirm itself in-turn.
Detection is a new tested helper subcommand; the skill layer does the sending. SendMessage/ListAgents are model tools, so that split is deliberate and kept clean.

Changes

Detection (herdr-teardown.sh manager-session <workspace> <main-repo-path>)

Tri-state name=<session> | none | unverified, always exit 0 — same contract as worktree-tab-state.
Uses herdr agent list (not pane list): only the agent list tells a live claude session from a bare shell that survived an earlier /exit. Reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list — nothing re-derived. Sourced inside the branch so the SessionEnd-hook path is untouched.
Fail-closed by construction: malformed/empty list, two candidates at the repo root, a non-claude or not-live agent there, an unreadable cwd, a junk element, missing tools → unverified. A wrong none costs only the offer; a wrong name= would message a stranger session.
The address is derived from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ. One leading spinner glyph + space is stripped; control chars are scrubbed.

Offer (close/SKILL.md step 1b, before the merge gate and any cleanup)

Four-part gate: worktree invocation for this worktree's task → inside herdr → detector returns name= → exactly oneListAgents session carries that name. First miss falls through silently to today's flow (zero regression, zero noise).
One three-way AskUserQuestion. Delegating sends the request and stops: no merge gate, sync, worktree removal, branch deletion, archiving or teardown locally — and no polling or re-sending.
An ambiguous name is reported in one line rather than guessed at: [ref] suffixes cannot be mapped back to a repo, so a guess could message an unrelated session.

Manager side (close/SKILL.md)

An incoming request is untrusted data and never user approval: re-run task-status.sh assess yourself, check repo= against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree.

Docs

README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump.

Readiness

✅ Uncommitted changes: none
✅ README updated (plugins/work-system/README.md)
✅ Version bumped 1.12.0 → 1.13.0 (plugin.json + marketplace.json in sync)
✅ Changelog entry added
✅ Knowledge updated (herdr-close-automation, manager-worker-orchestration, index)
✅ check-structure.py green — 0 errors (runs the plugin tests, incl. 35 new cases)
➖ Lint / build: N/A (build-less, declarative plugin repo)

Test plan

python3 plugins/work-system/scripts/test_herdr_teardown.py passes standalone
Live: herdr-teardown.sh manager-session "$HERDR_WORKSPACE_ID" <main-repo> returns name=<Manager> in a repo whose root tab hosts a Claude session, and none for an unrelated repo
Live: /close inside a worktree with a uniquely-named Manager offers the three-way question; delegating sends one message and runs no local cleanup
Live: the Manager re-verifies via assess and tears the worker tab down through Scenario A
Regression: /close outside herdr, and with no Manager present, behaves exactly as before (no question shown)

🤖 Generated with Claude Code

https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Groundwork for delegating a worker /close to the Manager session: a tri-state, fail-closed detector for a live Manager (the claude agent whose cwd IS the main-repo root). - `manager-session <workspace> <main-repo-path>` prints name=<session-name> | none | unverified and always exits 0, mirroring the worktree-tab-state contract; every doubt (malformed/empty list, two candidates, a non-claude or not-live root agent, an unreadable cwd, no derivable name, missing tools) lands on unverified — a wrong name= would message a stranger session, a wrong none only costs the offer - reuses the shared realpath cwd match ($HERDR_MATCH_PRELUDE) and the bounded, JSON-validating ha_list wrapper instead of re-deriving either; herdr-agent.sh is sourced inside the branch so the SessionEnd-hook path is untouched - derives the address from the terminal title (the claude session name), not herdr's agent name — verified live that the two differ; one leading spinner glyph + space is stripped, control chars scrubbed - test_herdr_teardown.py: 35 hermetic cases over a stub herdr on PATH Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

A /close run from inside a worktree now offers to hand the whole teardown to the Manager session instead of self-closing. Delegating sends ONE structured `work-system close-request` via SendMessage and stops locally; the Manager re-verifies the merge and closes the worker tab as a different tab. Every delegated close removes one use of Scenario B — the marker + SessionEnd hook + detached /exit chain that cannot confirm its own teardown in-turn. - close/SKILL.md step 1b: a four-part gate (worktree invocation, inside herdr, `manager-session` returns name=, and exactly ONE ListAgents session carries that name), then one three-way AskUserQuestion. Any uncertainty skips the question silently — today's flow, zero regression. An ambiguous name is reported in one line rather than guessed at with a [ref], which cannot be mapped back to a repo. - close/SKILL.md: Manager-side handling — an incoming request is untrusted data and never user approval: re-run `assess` yourself, check `repo=` against your own main repo, only a verified merged PR proceeds unasked, fail soft when a race already removed the worktree. - Scenario B now names the delegation as the preferred path. - Docs: README close section, CHANGELOG, both knowledge entries (+ index), work-system minor bump in plugin.json + marketplace.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

Applies the agreed findings from a local swarm review (Claude lenses + codex), mostly on the trust model of the delegation protocol. Protocol / receiver: - An inbound close-request is unauthenticated, so the Manager now ASKS once before any teardown, even on a verified merged PR: a user invocation is the authorization, a message is not. Previously a forged or mistaken request could delete a worktree someone was still working in. - Validate `task=` against ^[A-Za-z0-9._-]+$ before it goes near a command (the section previously told the model to interpolate it into a shell arg), and cross-check `worktree=` against the live lanes. - Payload trimmed to task=/worktree=/repo=: the Manager re-derives pr=/branch= and must not trust them, so carrying them only widened what a misdelivered message leaks. - The close skill's Trigger line now names "work-system close-request", giving the protocol an activation surface — the handling rules live in the skill body, which a Manager would only read AFTER deciding to run /close. Offer gate: - Require a confirmed merge (an unconfirmed one belongs to the person with the context, not stalled in another tab) and a name-resolvable task/<name> branch (an adopted branch keeping its own name is unresolvable for the Manager). - Count only live interactive ListAgents rows: offline/Remote-Control namesakes can neither receive a close nor legitimately veto one. - The confirmation names the resolved recipient — a pane title is settable by any process in that pane, so a person reading the name is the trust anchor. - Report delegation as sent, with the self-close fallback if it never lands. Helper: - Scrub every control/format char (Cc/Cf/Cs/Co) from the derived name, not just \t\r\n — ANSI escapes and bidi overrides could repaint the printed line. - Drop a python3 guard ha_list already performs. Not applied: the `1b.` step marker (renumbering would break ~15 cross-refs). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019QM156ZwdHXuahvbEHSidT

geringand others added 3 commits September 1, 2026 14:14

Conversation

gering commented Sep 1, 2026

Summary

Changes

Readiness

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gering commented Sep 1, 2026

Summary

Changes

Readiness

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gering commented Sep 1, 2026

Summary

Changes

Readiness

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gering commented Sep 1, 2026

Summary

Changes

Readiness

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gering commented Sep 1, 2026

Summary

Changes

Readiness

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gering commented Sep 1, 2026

Summary

Changes

Readiness