subagent-wall

README

Darling Data — Claude Code plugins

A Claude Code plugin marketplace from Darling Data.

/plugin marketplace add erikdarlingdata/claude-plugins

Plugins

`sqlserver-query-plans`

Teaches Claude to read a SQL Server execution plan and say what is actually slow, and why.

/plugin install sqlserver-query-plans@erikdarling

Point Claude at a .sqlplan file and ask. The skill is model-invoked — you do not need to call it explicitly.

The hard part of plan analysis is not spotting operators. It is knowing which numbers mean what they appear to mean. This plugin is built mostly out of the conclusions that sound authoritative and are wrong:

Cost percentages are estimates in every plan, including actual plans. Nothing recomputes them after execution. The 97%-cost operator is routinely not the slow one, and an operator shown at 0% can consume the entire runtime.
Row-mode operator times are cumulative. Ranking operators by raw ActualElapsedms ranks them by depth and always crowns the root node. Batch mode reports standalone times. Exchange operators report times that are close to meaningless.
EstimateRows is per-execution; ActualRows is a total. Without dividing by ActualExecutions, the inner side of every nested loop looks catastrophically underestimated when it may have estimated perfectly.
Missing-index requests are hints, not DDL. Equality columns come out in arbitrary order, existing indexes are ignored, and the Impact figure is a percentage of an estimated cost.
A scan is not a defect and a seek is not a virtue. Judge by rows touched and time spent.

It also ships scripts/extract.py, which flattens a .sqlplan into a compact digest. This is not a convenience:

.sqlplan files are UTF-16, so grep silently matches nothing and reports no error. A negative result from grep on a plan file is worthless.
Some plans are UTF-8 bytes that still declare encoding="utf-16", because they were opened and re-saved. Strict XML parsers reject them.
A trivial two-table join is 120 KB. Real plans run to megabytes. Reading one into context wastes the context and still misses things.

The extractor handles the encoding, computes correct self-time attribution (subtracting children in row mode, within a thread rather than across threads in parallel plans, and not at all in batch mode), normalizes cardinality per execution, and recognizes the optimizer's default-guess selectivity fingerprints. --node N drills into a single operator; --sql recovers full statement text.

Requires Python 3 (standard library only). Without it, the skill degrades to a documented grep-based fallback and says plainly what it cannot determine.

GitHub Copilot CLI

This plugin also works in GitHub Copilot CLI, which reads the same SKILL.md and plugin.json format.

copilot plugin marketplace add erikdarlingdata/claude-plugins
copilot plugin install sqlserver-query-plans@erikdarling

Or add just the skill, without the marketplace:

/skills add ./plugins/sqlserver-query-plans/skills/query-plan-analysis

As in Claude Code, the skill is model-invoked: point Copilot at a .sqlplan and ask.

Claude Code mods

Small hook modules for people who run several agents at once. Each one is a plugin of its own. Install only the ones you want, and set their options in /config (or under pluginConfigs in settings.json). They need a Claude Code version that loads plugin hook modules.

`subagent-fence`

Stops the mistakes an unattended agent makes that cannot be taken back.

/plugin install subagent-fence@erikdarling

For the main session and every subagent it refuses four things. A force-push. A push to a protected branch. A git command that skips the repository's hooks. Killing processes by name (pkill, killall, taskkill /IM, Stop-Process -Name), because a name match can kill another session's processes.

Three more guards are off until you set them. One bans folders: nothing reads, writes or enters them. One keeps a subagent from editing a plain git checkout, or running a changing git command there, so it works in its own worktree. One stops a subagent reading a big text file whole instead of by offset and limit.

`model-allowlist`

Checks the model a subagent is spawned with.

/plugin install model-allowlist@erikdarling

A pinned model id goes stale: a dated or versioned name keeps pointing at an old model after the tier moves on. This refuses a spawn that names one and asks for a tier alias (opus, sonnet, haiku) instead. A spawn with no model is always allowed, because the agent file or the parent decides then.

You can add rules of your own. One example: the lane agent runs Sonnet, and Opus only when the brief says design, security or hard debugging. With no rules, every alias is allowed.

A rule applies when the spawn's agent type matches the first pattern and it names that model (* for any model). The brief must then match the brief pattern, or the spawn is refused. Leave the brief pattern empty to refuse the pairing outright. The message is optional and can use {type} and {model}. Patterns are case-insensitive regular expressions. A rule that does not parse is skipped. For example:

^(lane|worker-.*)$ => opus => \b(design|security|hard[- ]debug) => {type} runs sonnet; name the reason in the brief to use opus.

`seat-resume`

Brings interrupted sessions back after a crash, a reboot or a closed terminal.

/plugin install seat-resume@erikdarling

The plugin writes one small file per interactive session: its id, name, folder, permission mode and last activity. It marks the file when the session ends. /resume-sessions lists the sessions that died or were interrupted in the last 72 hours, with the command that reopens each. The script's -Launch switch reopens all of them in terminal tabs. Sessions you left with /exit, Ctrl+C or /clear stay closed. The plugin name still says "seat", but everything you see says "session".

This one is Windows only. The bundled script (scripts/resume-sessions.ps1) is PowerShell. It compares Windows process start times to tell a live session from a reused process id. It reopens tabs in WezTerm or Windows Terminal. Nobody has tried the plugin on macOS or Linux.

The Claude config folder is CLAUDE_CONFIG_DIR when that is set, otherwise .claude in your home folder.

`open-asks`

Keeps the questions Claude asks you from scrolling away. Every time a reply asks you something or leaves a decision to you, Claude records it. The question stays in a band above your prompt, with Claude's recommended answer, until you answer, decline or drop it. Claude gets ask_add, ask_resolve and ask_list tools. You get /asks (done <ids>, clear, hide, show). Open asks are saved per session, so a resumed session still has them.

/plugin install open-asks@erikdarling

Option	Default	What it does
`maxBandAsks`	6	Most asks the band draws. The rest stay in `/asks`.
`maxQuestionChars`	400	Longest question or recommendation shown before it is cut.
`keepDays`	30	Saved asks from other sessions are removed after this many days. 0 keeps them.

`subagent-band`

A live view of your subagents. The band above the prompt has one row per running subagent: type, model, effort, steps, context size, advisor calls and estimated cost. /fleet opens a pane with every subagent of the session, finished ones included. /subagent-cost totals the estimated cost by agent type and by issue number in the description, with the main session's own cost. /steer <id> <text> sends a running subagent a message. Claude gets a cheap subagent_vitals tool, so it does not have to read output files to check progress. Costs are list-price estimates, not your bill.

/plugin install subagent-band@erikdarling

Option	Default	What it does
`priceTable`	`opus:4:20, sonnet:2:10, haiku:1:5, fable:10:50`	Input and output USD per million tokens for each model family. A model id is matched by containing the family name.
`cacheWriteMultiplier`	1.25	Cache write price as a multiple of the input price.
`cacheReadMultiplier`	0.1	Cache read price as a multiple of the input price.

`usage-budget`

Watches the account's 5-hour and 7-day usage windows. A toast tells you each time a window crosses a percent. Past a higher percent, Claude also gets a one-time note so it can stop starting optional work and write its handoff. Past the last one, new subagents are refused until the window resets.

/plugin install usage-budget@erikdarling

Option	Default	What it does
`warnPercents`	`70, 85, 95`	Percents that raise a toast, once each per window.
`tellModelAtPercent`	85	From here the model is told as well. 0 never tells it.
`spawnGatePercent`	95	A new subagent is refused when either window is at or past this. 0 turns the refusal off.

`subagent-wall`

A wall-clock limit for subagents. After a warning time, a subagent is told to finish up. After the limit, it can only run git and gh commands and write .md or .txt files. It commits, reports and ends instead of running on. It also nudges a code-changing subagent that has a lot of context but no edited file to stop exploring and make the change. The main session is never limited.

/plugin install subagent-wall@erikdarling

Option	Default	What it does
`warnMinutes`	45	Minutes before a subagent is told to finish up. 0 turns the warning off.
`limitMinutes`	60	Minutes before it is held to `git`, `gh` and note writes. 0 turns the limit off.
`noEditNudgeK`	100	Thousands of context tokens before the no-edit nudge. 0 turns it off.
`codeAgentTypes`	`general-purpose`	Comma-separated subagent types that get the no-edit nudge.

pi

This repository is also a pi package: the root package.json declares every plugins/*/skills and plugins/*/extensions directory, and pi reads the same SKILL.md format the other two harnesses do. Install straight from git — no marketplace step:

pi install git:github.com/erikdarlingdata/claude-plugins

As everywhere else, the skill is model-invoked: point pi at a .sqlplan and ask.

`pi-session-resume` (pi only)

Your machine restarts for updates with a dozen pi sessions open; this brings them all back with one command, as terminal tabs, in their original directories, with full history:

pi-resume-sessions

An extension (auto-loaded by the install above) records every open interactive session; the pi-resume-sessions script reopens the interrupted ones — Ghostty tabs on macOS, tmux anywhere. Sessions you quit deliberately (Ctrl+D, /quit) stay closed; sessions killed by a reboot, a closed window, or a crash come back. Idle-time filters keep abandoned sessions from resurrecting.

The script needs a one-time symlink onto your PATH, and macOS needs a one-time Automation permission — see plugins/pi-session-resume/README.md for both, plus the design notes. This one is pi-only: Claude Code and Copilot CLI don't load pi extensions.

`pi-subagent-watchdog` (pi only)

Background subagents only report back when they finish — nothing wakes the orchestrator while one wedges on a giant grep or balloons from 200k to 2M tokens. This extension (auto-loaded by the install above) polls every running subagent's live vitals — tokens, cost, context %, tool uses, turns, wall clock, compactions — and batches nearby threshold crossings into one compact orchestrator check-in. Full structured records persist outside LLM context; per-agent and fleet-wide rate limits keep the watchdog from becoming its own token amplifier. Two orchestrator postures: guide (assess with judgment) and strict (thresholds are budgets — wrap up by default, one evidence-cited extension max). Optional automatic hard stop handles the truly wedged, with the outcome reported from the RPC reply rather than assumed. An optional exact model invariant hard-stops any top-level child that bypasses the manager's pre-spawn model policy. Optional per-agent cost signal and hard stop, plus session and daily USD budget warnings. The CLI surfaces also identify each child's effective model and thinking level.

Humans get a /watchdog panel (vitals, manual check-ins, steering, hard stop) plus /watchdog help | status | config | reload — config edits apply live, no session restart. See plugins/pi-subagent-watchdog/README.md for signals, modes, and design notes. Requires the pi-subagents extension; pi-only for the same reason as above.

`pi-subagent-guardrails` (pi only)

Token-budget guardrails for multi-agent setups, built after an overnight orchestration burned through its usage limit (95% of the spend came at more than 150k context). It has three pieces:

guardrails.md: the written rules for fan-out caps, model tiers, context discipline, session length and ranking.
A context-wall extension, loaded only into subagents through their agent files. It tells the child its own size at 150k and 200k. At 250k it refuses everything but git/gh and markdown writes, so the agent commits and reports instead of being aborted with its work lost.
A lane agent type for code-editing lanes: Sonnet, its own worktree, draft PRs, no fan-out tools.

The wall is deliberately not auto-loaded, because it would wall off your interactive session too. See plugins/pi-subagent-guardrails/README.md for install and the recommended watchdog and pi-subagents settings.

Not a plugin: the pi setup guide

pi-setup-guide.md — a distilled ~15-minute setup for pi written for Claude Code ex-pats: install, model/thinking defaults, the trust model, a Claude-to-pi habit translation table, a tested-together extension stack, full source for a few small quality-of-life extensions (refusal fallback, tab-title status, ! command wake-ups + autocomplete), how to point pi at years of accumulated Claude Code memory instead of migrating it, and a troubleshooting section of the gotchas that actually happened. The plugins in this repo (§11–§13 of the guide) slot into that stack.

About

Built by Erik Darling at Darling Data. SQL Server consulting, training, and free tools: <https://erikdarling.com>

License

MIT

Source 2 files

hooks/register.ts 125 lines

1import { atom, read, update } from 'claude-code'
2import type { EngineInterface, Register } from 'claude-code'
3
4import type { Tracked } from '../types'
5
6const agents = atom({ plugin: 'subagent-wall', key: 'agents' } as const, {} as Record<string, Tracked>)
7
8const EDIT_TOOLS = new Set(['Edit', 'Write', 'NotebookEdit'])
9
10// What stays allowed past the limit: git and gh commands, and note writes.
11const GIT_GH = /^(git|gh)(\s|$)/
12const isNote = (path: unknown) => /\.(md|txt)$/.test(String(path ?? '').trim().toLowerCase())
13
14function patch($: EngineInterface, id: string, fn: (t: Tracked) => Tracked) {
15  return update($, agents, all => (all[id] ? { ...all, [id]: fn(all[id]) } : all))
16}
17
18export const register: Register = (on, options) => {
19  const warnMs = Number(options.warnMinutes ?? 45) * 60000
20  const limitMs = Number(options.limitMinutes ?? 60) * 60000
21  const nudgeTokens = Number(options.noEditNudgeK ?? 100) * 1000
22  // The agent types that change code; only they get the no-edit nudge.
23  const codeTypes = new Set(
24    String(options.codeAgentTypes ?? 'general-purpose')
25      .split(/[\s,]+/)
26      .filter(Boolean),
27  )
28
29  on('agent.spawn', async ($, e, next) => {
30    const spawned = await next(e)
31    const id = spawned.agentId
32    if (id) {
33      const startedAt = await $.clock.now()
34      await update($, agents, all => ({
35        ...all,
36        [id]: { type: e.subagentType, startedAt, edits: 0, context: 0, hasTimeWarning: false, hasEditNudge: false },
37      }))
38    }
39
40    return spawned
41  }).catch(($, e, next) => next(e))
42
43  on('turn.step', async function* ($, e, next) {
44    const response = yield* next(e)
45    const usage = response.usage
46    if (e.agentId && usage) {
47      const context = usage.input_tokens + usage.cache_read_input_tokens + usage.cache_creation_input_tokens
48      await patch($, e.agentId, t => ({ ...t, context }))
49    }
50
51    return response
52  })
53
54  on('turn.complete', async ($, e, next) => {
55    const id = e.agentId
56    if (id) {
57      await update($, agents, all => {
58        const { [id]: _, ...rest } = all
59
60        return rest
61      })
62    }
63
64    return next(e)
65  })
66
67  on('tool.call', async ($, e, next) => {
68    const id = e.agentId
69    const tracked = id ? (await read($, agents))[id] : undefined
70    if (!id || !tracked) {
71      return next(e)
72    }
73
74    const elapsed = (await $.clock.now()) - tracked.startedAt
75    const minutes = Math.floor(elapsed / 60000)
76
77    if (limitMs > 0 && elapsed >= limitMs) {
78      const isAllowed =
79        e.tool === 'Bash' || e.tool === 'PowerShell'
80          ? GIT_GH.test(String(e.command ?? '').trim())
81          : e.tool === 'Write' || e.tool === 'Edit'
82            ? isNote(e.file_path)
83            : false
84      if (!isAllowed) {
85        return {
86          deny:
87            `subagent-wall: ${minutes} minutes, at or past the ${limitMs / 60000}-minute limit. ` +
88            'From here only git/gh commands and .md/.txt writes are allowed. Commit, push, put your report ' +
89            'in the PR body or your final message, and end your turn.',
90        }
91      }
92    }
93
94    const ran = await next(e)
95    if (ran.deny !== undefined) {
96      return ran
97    }
98
99    const notes: string[] = []
100    const isEdit = EDIT_TOOLS.has(e.tool) && ran.isError !== true
101    if (isEdit) {
102      await patch($, id, t => ({ ...t, edits: t.edits + 1 }))
103    }
104
105    if (warnMs > 0 && elapsed >= warnMs && !tracked.hasTimeWarning) {
106      await patch($, id, t => ({ ...t, hasTimeWarning: true }))
107      notes.push(
108        `subagent-wall: ${minutes} minutes in. At ${limitMs / 60000} minutes only git, gh and .md/.txt writes ` +
109        'will be allowed. Start no new item: finish the one in hand, commit, push, and report.',
110      )
111    }
112
113    if (nudgeTokens > 0 && codeTypes.has(tracked.type) && tracked.edits === 0 && !isEdit &&
114        tracked.context >= nudgeTokens && !tracked.hasEditNudge) {
115      await patch($, id, t => ({ ...t, hasEditNudge: true }))
116      notes.push(
117        `subagent-wall: about ${Math.round(tracked.context / 1000)}k tokens of context and no file edited yet. ` +
118        'Stop exploring: make the change now from what you know, or report what blocks you.',
119      )
120    }
121
122    return notes.length > 0 ? { ...ran, context: [...(ran.context ?? []), ...notes] } : ran
123  }).catch(($, e, next) => next(e)) // if the wall itself fails, the call goes ahead (replayed if it already ran)
124}
125

types/index.d.ts 15 lines

1export type Tracked = {
2  type: string
3  startedAt: number
4  edits: number
5  context: number
6  hasTimeWarning: boolean
7  hasEditNudge: boolean
8}
9
10declare module 'claude-code' {
11  interface PluginState {
12    'subagent-wall': { agents: Record<string, Tracked> }
13  }
14}
15

Install

$claude plugin marketplace add erikdarlingdata/claude-plugins

$claude plugin install subagent-wall@erikdarling

Entry name may differ; see the README.

$claude plugin marketplace add https://www.slopshopper.com/community/marketplace.json

$claude plugin install subagent-wall@slopshopper-community

Points at the author's repo. Nothing re-hosted.

$git clone https://github.com/erikdarlingdata/claude-plugins

$claude --plugin-dir ./claude-plugins/plugins/subagent-wall

One session, nothing installed.

In the preview

Nothing visible. Works behind the scenes, or needs what the sandbox lacks.

Hooks

agent.spawnturn.stepturn.completetool.call

Reaches

$.clock.now$.state.get$.state.set

Options

warnMinutes: Warn a subagent at (minutes) = 45
limitMinutes: Limit a subagent at (minutes) = 60
noEditNudgeK: Nudge a subagent with no edits at (thousand tokens of context) = 100
codeAgentTypes: Code-changing agent types (comma separated) = "general-purpose"

Checks

validate: passed

Tests ✓ · State contract ✓ · first seen 2026-10-07

Darling Data — Claude Code plugins

Plugins

sqlserver-query-plans

GitHub Copilot CLI

Claude Code mods

subagent-fence

model-allowlist

seat-resume

open-asks

subagent-band

usage-budget