feat(atlas): allow Atlas to spawn Hephaestus as subagent for complex tasks

[teneburu]

Summary

Implements the hybrid Atlas/Hephaestus workflow from #1980 (Option B: orchestrator allowlist).

• Orchestrator allowlist in subagent-resolver.ts: Only Atlas can spawn Hephaestus via task(subagent_type="hephaestus"). Other agents get a clear error message. Self-recursion is explicitly blocked.
• Hephaestus agent config: Mode changed from "primary" to "all", permission updated to task: "deny" (recursion guard - OMC's createDelegateTask() bypasses OpenCode permission checks, but this signals intent).
• Atlas prompt update: Added complexity-based routing table so Atlas knows when to pick Hephaestus (complex, unclear scope, multi-step) vs category-based Sisyphus-Junior (single file, known pattern).

Key Design Decisions

1. Why mode: "all" + explicit guard instead of keeping mode: "primary"? The isTaskCallableAgentMode() filter runs after the agent API call. Adding orchestrator awareness there would require threading parent context through every caller. Instead, a dedicated pre-filter check at the top of resolveSubagentExecution() catches it early with a clear error message.

2. Why task: "deny" instead of call_omo_agent: "deny"? Hephaestus needs explore/librarian for codebase research. Denying task prevents recursion while preserving its autonomous research capability. Note: OMC's createDelegateTask() replaces OpenCode's built-in task tool and doesn't check the caller's permission ruleset, so this is a defense-in-depth signal, not the primary guard.

3. Status signaling deferred: Hephaestus runs in sync mode (run_in_background=false) with existing idle detection + stability polling. The <progress> section in Hephaestus's prompt already instructs phase-transition updates. No additional signaling mechanism needed for v1.

PR Checklist

• Code follows project conventions
• bun run typecheck passes
• bun run build succeeds
• 551 tests pass (agents + delegate-task suites)
• No version changes in package.json
• 5 new tests covering: Atlas->Hephaestus spawn, self-recursion block, non-orchestrator block, case-insensitive matching, undefined parent block

Closes #1980

---

Summary by cubic

Enable Atlas to delegate complex, multi-step work to Hephaestus as a subagent with an orchestrator allowlist and recursion guards. Also fixes UI display names by removing hidden ZWSP prefixes. Implements Option B from #1980.

• New Features

  • Subagent resolver: add ORCHESTRATOR_ALLOWLIST and ORCHESTRATOR_CALLABLE_PRIMARY_AGENTS; only atlas can call task(subagent_type="hephaestus"); Hephaestus self-recursion blocked with clear errors.
  • Hephaestus config: set mode: "all" and permission task: "deny" as a recursion guard.
  • Atlas prompt: add a simple complexity routing table for when to use Hephaestus vs category-based tasks.
  • Tests: cover Atlas→Hephaestus spawn, recursion guard, non-orchestrator block, case-insensitive parent, and undefined parent.

• Bug Fixes

  • Remove ZWSP from agent display names in UI/API by using getAgentDisplayName in agent-key-remapper.ts, agent-priority-order.ts, command-config-handler.ts, and start-work/start-work-hook.ts.

^{Written for commit 091376d. Summary will update on new commits.}

[github-actions]

All contributors have signed the CLA. Thank you! ✅
_{Posted by the CLA Assistant Lite bot.}

[cubic-dev-ai]

This review could not be run because your cubic account has exceeded the monthly review limit. If you need help restoring access, please contact contact@cubic.dev.

[teneburu]

I have read the CLA Document and I hereby sign the CLA