feat(mcp): pilot/co-pilot control handoff for coordinated tasks

Adds explicit control handoff between the orchestrating agent and the
human user, modelled on a pilot/co-pilot system where control is always
unambiguously held by one party.

Each sub-task created by a coordinator has a new runtime field
`controlledBy: 'orchestrator' | 'human'`. The task panel shows a
persistent banner so the user always knows who has the stick:

- Orchestrator driving: subtle bar + "Take Control" button
- Human in control: amber warning banner "You have control —
  orchestrator is paused" + "Return to Orchestrator" button

When the human holds control, the orchestrator's MCP tools are blocked:
- `send_prompt` throws immediately so the coordinator agent knows it
  cannot proceed and must wait or work on other tasks
- `wait_for_idle` resolves immediately so the coordinator is not left
  hanging; the status signals human control

Control returns to the orchestrator only via explicit user action —
never automatically. Returning control also fires any queued
`waitForIdle` resolvers so the coordinator can resume.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: brooksc

electron/ipc/channels.ts

@@ -141,4 +141,5 @@ export enum IPC {
   MCP_TaskCreated = 'mcp_task_created',
   MCP_TaskClosed = 'mcp_task_closed',
   MCP_TaskStateSync = 'mcp_task_state_sync',
+  MCP_ControlChanged = 'mcp_control_changed',
 }

electron/ipc/register.ts

@@ -997,6 +997,13 @@ export function registerAllHandlers(win: BrowserWindow): void {
     },
   );
 
+  ipcMain.handle(
+    IPC.MCP_ControlChanged,
+    (_e, args: { taskId: string; controlledBy: 'orchestrator' | 'human' }) => {
+      orchestrator.setTaskControl(args.taskId, args.controlledBy);
+    },
+  );
+
   ipcMain.handle(IPC.StopMCPServer, async () => {
     // The MCP server process is spawned by Claude Code (via --mcp-config),
     // not by us. This handler is a no-op but kept for API completeness.

electron/mcp/orchestrator.ts

@@ -28,6 +28,7 @@ export class Orchestrator {
   private idleResolvers = new Map<string, Array<() => void>>();
   private subscribers = new Map<string, (encoded: string) => void>();
   private decoders = new Map<string, TextDecoder>();
+  private controlMap = new Map<string, 'orchestrator' | 'human'>();
   private win: BrowserWindow | null = null;
   private projectRoot: string | null = null;
   private projectId: string | null = null;
@@ -54,6 +55,18 @@ export class Orchestrator {
     });
   }
 
+  setTaskControl(taskId: string, who: 'orchestrator' | 'human'): void {
+    this.controlMap.set(taskId, who);
+    // If returning to orchestrator and there are idle resolvers queued, fire them
+    if (who === 'orchestrator') {
+      const resolvers = this.idleResolvers.get(taskId);
+      if (resolvers?.length) {
+        for (const resolve of resolvers) resolve();
+        this.idleResolvers.delete(taskId);
+      }
+    }
+  }
+
   setWindow(win: BrowserWindow): void {
     this.win = win;
   }
@@ -223,6 +236,11 @@ export class Orchestrator {
   async sendPrompt(taskId: string, prompt: string): Promise<void> {
     const task = this.tasks.get(taskId);
     if (!task) throw new Error(`Task not found: ${taskId}`);
+    if (this.controlMap.get(taskId) === 'human') {
+      throw new Error(
+        'Task is under human control. Return control to orchestrator before sending prompts.',
+      );
+    }
 
     // Send text then Enter separately (like the frontend does)
     writeToAgent(task.agentId, prompt);
@@ -239,6 +257,9 @@ export class Orchestrator {
   private waitForIdleInternal(taskId: string, timeoutMs: number): Promise<void> {
     const task = this.tasks.get(taskId);
     if (!task) return Promise.reject(new Error(`Task not found: ${taskId}`));
+    if (this.controlMap.get(taskId) === 'human') {
+      return Promise.resolve(); // resolve immediately — caller gets control-change event instead
+    }
     if (task.status === 'idle' || task.status === 'exited') return Promise.resolve();
 
     return new Promise((resolve, reject) => {