Repository navigation
State the Session-Tree Bound and the Orphan Stop in Requirement 9 #2598
Description
Summary
The Claude kit's fix for #1903 goes beyond what requirement 9 of host-setup/agent-safety/README.md states. That spec file was outside the fix's file claim, so the spec still describes the earlier behavior.
What Changed in the Claude Implementation
- A tree-wide ceiling. Every tool-call scope joins a slice named for the root session of a chain of nested
claudesessions. That slice carries a total task and memory ceiling, while each scope keeps its own. Requirement 9 names a group per command and says nothing about a tree. - A stop judged by the recorded agent. The SessionEnd sweep now also stops scopes in its tree that belong to other, nested sessions, when the agent recorded on each scope is no longer running. Requirement 9 says the session-end stop "needs none of requirement 8's judgment about what a process is, since the group's name proves which session started it". The new stop is still bounded by the tree's slice and never judges a scope's own processes, but it is no longer bounded by the session's own name alone.
Proposed
- Amend requirement 9 to cover the tree: a command started by a bounded command stays under a total bound for the whole tree, without being run inside its parent's group, which Contain Each Bash Tool Call in a Task- and Memory-Capped Scope #1900 rejected.
- State when a group named for another session may be stopped: it is in this session's tree, and the agent it records has ended.
- Check whether the Codex and opencode implementations need the same tree bound.
Open Question, Unverified
At a nested session's SessionEnd, does Claude Code set CLAUDE_CODE_SESSION_ID in the hook's environment to the nested session's own id, or leave the id it inherited from the parent? If it leaves the inherited one, the existing first phase of the sweep, which predates #1903, would stop the parent's scopes from the nested session's sweep. A nested claude -p run that prints its hook environment would settle it.
Activity
Bound Nested Claude Sessions' Tool-Call Scopes as One Tree and Reap T…
ptr727 commentedon Nov 1, 2026
Decision needed (decision triage, 2026-11-01)
Question: Should requirement 9 of host-setup/agent-safety/README.md be amended to state what the Claude kit has done since #2599 (a total bound for a whole tree of nested sessions, and a scope named for another session stopped only when it is in this session's tree and its recorded agent has ended), and should Codex/opencode also get the tree bound?
Options, recommended first:
claude -prun whether a nested session inherits the parent'sCLAUDE_CODE_SESSION_ID, since the sweep would then stop the parent's scopes. No work in flight.Evidence: README.md:72-93 (requirement 9) unchanged since a1efe40 (#2599). stray-process-sweep.py:674-677 builds session ids from both the hook payload's
session_idandCLAUDE_CODE_SESSION_ID. codex/README.md and opencode/README.md: "No hook implements ... yet. Tracked at issue #781."Blocks: none (its Codex/opencode half depends on #781)
ptr727 commentedon Nov 1, 2026
Maintainer answer (decision triage, 2026-11-01): Option 1: approved. Amend requirement 9 in host-setup/agent-safety/README.md to state the whole-tree bound and the in-tree, agent-ended stop. First verify with a nested claude -p run whether a nested session inherits the parent's CLAUDE_CODE_SESSION_ID. The Codex/opencode tree bound moves to #781, which stays deferred. This agent-safety edit is approved for implementation.