fix(quickjs): isolate forked subagent runtimes

[Hunter Lovell (hntrl)]

Forked subagents now use private QuickJS slots, so finishing a child cannot close the parent or a sibling's REPL.

---

Forked subagents inherit the parent checkpoint thread_id and middleware stack. The task tool now stamps each invocation with an opaque private runtime identity; QuickJS uses it only for its in-process registry key, leaving checkpoint identity unchanged. Child cleanup therefore evicts only the child slot.

Tests: make test TEST_FILE=tests/unit_tests/test_repl_middleware.py (78 passed); make test TEST_FILE=tests/unit_tests/test_subagents.py (38 passed, 1 expected failure); make lint in libs/deepagents and libs/partners/quickjs.

Made by Open SWE

[github-actions]

⛔ This PR title scope does not match the package directory it changes.

Title scope(s): quickjs

Touched package dir(s) not covered by those scopes:

• package label deepagents from libs/deepagents/

This check is blocking because the PR title declares one package scope while the changed files live in a different package directory.

Release-please consequence: release-please attributes commits by file path, not title scope. A bump-worthy title (feat/fix/etc.) that touches multiple managed packages opens a separate release PR per package. Bypassing this gate does not stop that fan-out.

To resolve

Edit the PR title scope so it covers the changed package directory (for example, use fix(code): ... for libs/code/**), or move the files so they match the declared scope.

If this is a feature plus incidental cross-package dependency/lock churn, split into:

1. One feature/fix PR scoped to the single package that owns the user-facing change.
2. One chore(deps): ... PR for the cross-package dependency / lockfile churn (chore is hidden and does not open release PRs).

If intentional

Apply the allow-scope-mismatch label. The check re-runs and passes with an informational note — confirm you still want a release PR for every managed component the diff touches.

📖 Multi-component fan-out

[github-actions]

⛔ This bump-worthy PR touches real files in more than one release-please component.

Components with non-lockfile edits: deepagents, langchain-quickjs

Because the PR title is bump-worthy, release-please will open a separate release PR for each of these components (and any lockfile-only packages above). This check is blocking.

To resolve

Split into:

1. One feature/fix PR scoped to the single package that owns the user-facing change (feat(code): ... / fix(cli): ...).
2. One chore(deps): ... PR for the cross-package dependency / lockfile churn (chore is hidden and does not open release PRs).

If intentional

Apply the allow-lockfile-release label to acknowledge the fan-out. The check re-runs and passes — but that still ships a release PR per touched component.

📖 Multi-component fan-out
📖 Lockfile churn fan-out