feat: split plugins and cleanup

tests/multi-work.test.ts

@@ -143,6 +143,7 @@ function fixture() {
     const toolHooks: ((event: ToolHooks["execute.before"]) => Effect.Effect<void, Tool.Error>)[] =
         [];
     const hooks: ((event: SessionContext) => Effect.Effect<void>)[] = [];
+    let prompt!: (event: Pick<SessionContext, "sessionID">) => Effect.Effect<void>;
     let transform!: (editor: AgentEditor) => void;
     const registration = Effect.succeed({ dispose: Effect.void });
     const editAgents = (): AgentEditor => ({
@@ -214,9 +215,13 @@ function fixture() {
                     }
                     entered.resolve();
                 }),
-            hook: (_name: string, callback: (event: SessionContext) => Effect.Effect<void>) =>
+            hook: (name: string, callback: (event: SessionContext) => Effect.Effect<void>) =>
                 Effect.sync(() => {
-                    hooks.push(callback);
+                    if (name === "context") hooks.push(callback);
+                    if (name === "prompt") {
+                        // SAFETY: The prompt admission hook reads only the native session ID.
+                        prompt = callback as typeof prompt;
+                    }
                 }).pipe(Effect.andThen(registration)),
         },
         tool: {
@@ -256,6 +261,7 @@ function fixture() {
         order,
         entered,
         hooks,
+        prompt: (event: Pick<SessionContext, "sessionID">) => prompt(event),
         toolHooks,
         call,
         progress,
@@ -676,6 +682,45 @@ test("rejects foreign and changed-agent resumes, non-primary multi-work and unbo
     );
 });
 
+test("command-created children require ready owned bindings and cannot bypass placement guards", async () => {
+    const f = fixture();
+    await Effect.runPromise(
+        Effect.scoped(
+            Effect.gen(function* () {
+                yield* f.install;
+                yield* f.invoke();
+                const child = f.sessions.get("ses_child1")!;
+                const binding = bindingSchema.parse(f.storage.get(bindingKey(child.id)));
+                const admit = () => f.prompt({ sessionID: Session.ID.make(child.id) });
+                yield* admit();
+                f.storage.set(bindingKey(child.id), { ...binding, ready: false });
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                f.storage.set(bindingKey(child.id), binding);
+                child.location.directory = "/relocated";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                child.location.directory = binding.directory;
+                child.projectID = "foreign";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                child.projectID = binding.projectID;
+                f.parent.location.directory = "/elsewhere";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                f.parent.location.directory = binding.root.directory;
+                f.parent.agent = "build";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                f.parent.agent = "multi-work";
+                child.agent = "multi-work";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                child.agent = "fast-hi";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                child.agent = "fast-lo";
+                expect((yield* Effect.exit(admit()))._tag).toBe("Failure");
+                child.location.directory = f.parent.location.directory;
+                yield* admit();
+            }),
+        ),
+    );
+});
+
 test("ineligible roots do not register multi-work; multi-work cannot execute shell even with session overrides", async () => {
     const f = fixture();
     f.herdr.eligible = false;