Cursor Subagent Delegation Workflow

A cost-aware subagent delegation workflow for Cursor: keep architecture, risk decisions and final acceptance with the main conversation, then dispatch bounded work to the cheapest model that can safely do it — enforced by a fail-closed pre-dispatch hook.

一套面向 Cursor 的子代理委派工作流:主对话持有架构、风险决策与最终验收, 执行腿活下放给能安全完成它的最便宜模型;由 fail-closed 的派单前 hook 强制执行。

Note: the rule/skill bodies are written in Chinese. The workflow itself is language-agnostic — an agent reading Chinese rules follows them just as well — but if you want an English version, the files are small enough to machine-translate.

What it enforces

Concern	Policy
Model routing	Every Task dispatch (including resume) must pass an explicit model; a preToolUse hook denies otherwise
Cost control	Default to a cheap model for all delegable work; premium models require the user's real, auditable confirmation via AskQuestion
Confirmation integrity	Premium dispatch requires a provenance marker in the prompt; bare markers are rejected; all decisions are logged for cross-checking against the transcript
Task ownership	Red-line tasks (core business rework, cross-project ports, long state chains) keep decisions/integration/acceptance in the main conversation, while read-only research and mechanical edits still fan out
Quality	Quality comes from process, not model strength: pre-dispatch decomposition, machine-checkable acceptance, and mandatory L1 re-runs by the main conversation (never trust self-reports)
Safety	High-risk dispatches must carry a scope-stop clause: stop and report on anything outside the listed scope
Observability	Every dispatch is auto-logged locally (~/.cursor/delegation-log.log); premium attempts go to a local audit log; session summaries on close

The delegation decision tree (short form)

1. Red-line task? → main conversation owns decisions + integration + acceptance; fan out read-only research and frozen-interface mechanical edits to cheap subagents.
2. Single irreducible reasoning step? → try a cheap draft first if machine-checkable; otherwise go through the premium-upgrade confirmation gate.
3. Truly trivial (one tool call)? → just do it inline.
4. Independent parallel items? → parallel fan-out (skill).
5. Dependent multi-hop chain? → serial pipeline with handoff files (skill).
6. Complex but coherent? → one coherent worker, or orchestrate (rule).
7. Everything else → one cheap subagent, closed loop.

Full tree with all the edge cases: rules/subagent-inherit-model.mdc.

Repository layout

rules/    5 Cursor rules (.mdc) — decision tree, async preference, task
          ownership red lines, orchestrate-first, scope-stop clause
skills/   3 skills — dispatch QA protocol (+ dispatch template + format
          checker), parallel fan-out levers, serial pipeline levers
hooks/    preToolUse gate (require-task-model.sh), sessionEnd audit
          summary, example hooks.json wiring
agents/   dev-lead-orchestrator subagent definition
install.sh

Quick start

Requirements: Cursor with hooks support, Bash, jq (the gate fails closed without it — dispatches are denied rather than silently allowed), Python 3 for the optional skill-format checker.

git clone https://github.com/liuhl152/cursor-subagent-delegation.git
cd cursor-subagent-delegation
./install.sh --dry-run
./install.sh

The installer is non-destructive: it refuses to overwrite existing files.

Configure your models (required)

The hook ships with a placeholder allowlist. Nothing premium is hard-coded; you decide what counts as "cheap" for your account.

1. Edit ~/.cursor/hooks/require-task-model.sh:

   • FREE_MODELS: model slugs that dispatch without confirmation (your cheap default).
   • BLOCKED_MODELS: slugs to deny even with confirmation (optional).

   Tip for Cursor Ultra plan users: Ultra typically includes a grok-family model that does not consume premium API quota. Put that slug in FREE_MODELS as your cheap default — use the Task tool's current model list, do not hard-code a slug here. 若你用的是 Cursor Ultra 计划,把当前不占高级额度的 grok 系 slug 填进 FREE_MODELS 作为廉价默认(以 Task 当次清单为准,此处不写死 slug)。

2. Replace the <默认廉价模型> / <高级模型> placeholders in rules/ and skills/ with your actual slugs if you want the rules to name them, or leave the placeholders — agents resolve them against FREE_MODELS anyway.

3. Wire the hooks into ~/.cursor/hooks.json (see hooks/hooks.example.json).

How the premium gate works

flowchart LR
  T[Task dispatch] --> M{explicit model?}
  M -->|no| D[deny: add model]
  M -->|yes| F{in FREE_MODELS?}
  F -->|yes| A[allow + log]
  F -->|no| C{prompt has AskQuestion-backed
confirmation marker?}
  C -->|no| D2[deny: confirm with user first]
  C -->|yes| A2[allow + audit log]

Loading

The confirmation marker must carry provenance (which option the user actually selected in AskQuestion), so an agent cannot fabricate approval — the audit log can be reconciled against the conversation transcript.

Privacy

• No account credentials, personal paths, or company-specific policy in this repository; model slugs are placeholders you fill in locally.
• All logs produced by the hooks (delegation-log.log, model-upgrade-audit.log) stay local and are never uploaded. Do not commit them.

License

MIT