# NousResearch/hermes-agent · Delegate cascade deleting parent session bug fix

## Open now

- Nothing open on GitHub.

A critical bug in \`_collect_delegate_child_ids\` lacks a guard for \`parent_ids\`, causing delegate session cleanup to cascade and delete the parent session. The members describe the problem and a corresponding fix.

## TL;DR

- 3 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 1 PR(s) closed without merging.
- A fix was merged to main in PR #50329. Verify it addresses your case.
- **Recommended:** read PR #50329 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.67`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #49148: \[Critical Bug\] \`_collect_delegate_child_ids\` missing \`parent_ids\` guard causes parent session cascade deletion and permanent data loss

## Prior & competing PRs

- **#50329: fix(agent): stop delegate cascade from deleting the parent session**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `hermes_state.py`, `tests/test_delegate_cascade_49148.py`
  - fix hunks:
  - `hermes_state.py`

    ```diff
    @@ -75,8 +75,16 @@ def _collect_delegate_child_ids(conn, parent_ids: List[str]) -> List[str]:
         orchestrator subagent's own delegate children go too (FK safety).
         """
         df = _delegate_from_json()
    -    found: set[str] = set()
    -    frontier = [sid for sid in parent_ids if sid]
    +    seeds = {sid for sid in parent_ids if sid}
    +    # Seed the visited set with the parents themselves. A delegation marker
    +    # chain can loop back onto a parent — a cycle, or a parent that is also
    +    # another parent's delegate child when several ids are deleted at once —
    +    # and without this guard that parent would be collected as one of its own
    +    # descendants and cascade-deleted along with all of its messages. Callers
    +    # delete the parents separately, so parents must never appear in the
    +    # returned child set. (#49148)
    +    found: set[str] = set(seeds)
    +    frontier = list(seeds)
         while frontier:
             ph = ",".join("?" * len(frontier))
             cursor = conn.execute(
    ```

    ```diff
    @@ -86,7 +94,8 @@ def _collect_delegate_child_ids(conn, parent_ids: List[str]) -> List[str]:
             )
             frontier = [row["id"] for row in cursor.fetchall() if row["id"] not in found]
             found.update(frontier)
    -    return list(found)
    +    # Return only the discovered children — never the parents themselves.
    +    return [sid for sid in found if sid not in seeds]
     
     
     def _delete_delegate_children(conn, parent_ids: List[str]) -> List[str]:
    ```
  - `tests/test_delegate_cascade_49148.py`

    ```diff
    @@ -0,0 +1,103 @@
    +"""Regression tests for delegate-child cascade collection (#49148).
    +
    +`_collect_delegate_child_ids` walks the ``_delegate_from`` marker chain to
    +find delegate subagents that should be cascade-deleted with their parent.
    +The parents themselves are deleted separately by the callers, so they must
    +never appear in the collected child set. A delegation cycle (or a parent
    +that is also another parent's delegate child) used to leak the parent into
    +the deletion set, permanently deleting the parent session and its messages.
    +"""
    +
    +import json
    +import sqlite3
    +
    +from hermes_state import _collect_delegate_child_ids, _delete_delegate_children
    +
    +
    +def _make_conn():
    +    conn = sqlite3.connect(":memory:")
    +    conn.row_factory = sqlite3.Row
    +    conn.execute(
    +        "CREATE TABLE sessions ("
    +        " id TEXT PRIMARY KEY,"
    +        " parent_session_id TEXT,"
    +        " model_config TEXT)"
    +    )
    +    conn.execute("CREATE TABLE messages (session_id TEXT)")
    +    return conn
    +
    +
    +def _add_session(conn, sid, *, delegate_from=None, parent_session_id=None, messages=0):
    +    model_config = json.dumps({"_delegate_from": delegate_from}) if delegate_from else None
    +    conn.execute(
    +        "INSERT INTO sessions (id, parent_session_id, model_config) VALUES (?, ?, ?)",
    +        (sid, parent_session_id, model_config),
    +    )
    +    for _ in range(messages):
    +        conn.execute("INSERT INTO messages (session_id) VALUES (?)", (sid,))
    +
    +
    +class TestCollectDelegateChildIds:
    +    def test_collects_delegate_child_excludes_parent(self):
    +        conn = _make_conn()
    +        _add_session(conn, "P")
    +        _add_session(conn, "C", delegate_from="P")
    +
    +        result = _collect_delegate_child_ids(conn, ["P"])
    +
    +        assert "C" in result
    +        assert "P" not in result
    +
    +    def test_multilevel_chain_collects_all_descendants(self):
    +        conn = _make_conn()
    +        _add_session(conn, "O")
    +        _add_session(conn, "A", delegate_from="O")
    +        _add_session(conn, "B", delegate_from="A")
    +
    +        result = set(_collect_delegate_child_ids(conn, ["O"]))
    +
    +        assert result == {"A", "B"}  # parent O excluded, both descendants in
    +
    +    def test_parent_session_id_branch_with_marker_collected(self):
    +        # Second OR clause: parent_session_id match AND _delegate_from present.
    +        conn = _make_conn()
    +        _add_session(conn, "P")
    +        _add_session(conn, "C", parent_session_id="P", delegate_from="something")
    +
    +        assert _collect_delegate_child_ids(conn, ["P"]) == ["C"]
    +
    +    def test_untagged_child_not_collected(self):
    +        # No _delegate_from marker -> orphan-don't-delete contract.
    +        conn = _make_conn()
    +        _add_session(conn, "P")
    +        _add_session(conn, "C", parent_session_id="P")
    +
    +        assert _collect_delegate_child_ids(conn, ["P"]) == []
    +
    +    def test_cycle_terminates_and_excludes_parent(self):
    +        # The #49148 bug: A and B reference each other via _delegate_from.
    +        # Collection must terminate and never return the seed parent A.
    +        conn = _make_conn()
    +        _add_session(conn, "A", delegate_from="B")
    +        _add_session(conn, "B", delegate_from="A")
    +
    +        result = _collect_delegate_child_ids(conn, ["A"])
    +
    +        assert "A" not in result  # parent never collected as its own child
    +        assert result == ["B"]
    +
    +
    +class TestDeleteDelegateChildrenPreservesParent:
    +    def test_cycle_does_not_delete_parent_or_its_messages(self):
    +        conn = _make_conn()
    +        _add_session(conn, "A", delegate_from="B", messages=3)
    +        _add_session(conn, "B", delegate_from="A", messages=2)
    +
    +        removed = _delete_delegate_children(conn, ["A"])
    +
    +        assert "A" not in removed
    +        # Parent A and its messages survive; only delegate child B is gone.
    +        assert conn.execute("SELECT COUNT(*) FROM sessions WHERE id='A'").fetchone()[0] == 1
    +        assert conn.execute("SELECT COUNT(*) FROM messages WHERE session_id='A'").fetchone()[0] == 3
    +        assert conn.execute("SELECT COUNT(*) FROM sessions WHERE id='B'").fetchone()[0] == 0
    +        assert conn.execute("SELECT COUNT(*) FROM messages WHERE session_id='B'").fetchone()[0] == 0
    ```
- **#49178: fix(agent): stop delegate cascade from deleting the parent session**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `#50329`, `#49148`

## Fix status

- Merged to main in PR #50329 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-06-21`.
- Subsystem: `agent`