fix(announce): use deterministic idempotency keys to prevent duplicate subagent announces

Fixes #17122

Problem

When a subagent completes while the main session is busy, the completion announcement is delivered twice:

1. The application-level announce queue (subagent-announce-queue.ts) drains and calls sendAnnounce → callGateway({ method: "agent" })
2. If the main session is still busy, the gateway-level message queue also captures this callGateway call
3. Both queues eventually deliver → duplicate announcement

Root Cause

Both sendAnnounce (queue drain path) and the direct announce path in runSubagentAnnounceFlow use crypto.randomUUID() as the idempotency key:

// Before fix:
idempotencyKey: crypto.randomUUID(),  // unique per call → dedup never matches

The gateway's dedup cache (context.dedupe.get(\agent:${idem}`)`) can never detect the duplicate because each delivery attempt has a different key.

Fix

Replace random idempotency keys with deterministic ones derived from stable identifiers:

// Queue drain path:
idempotencyKey: \`announce:${item.sessionKey}:${item.enqueuedAt}\`

// Direct announce path:
idempotencyKey: \`announce:${params.childSessionKey}:${params.childRunId}\`

This allows the gateway dedup cache to recognize the second delivery attempt and return the cached response instead of processing it again.

Changed Files

Testing

• All 79 agent tests pass
• All 101 cron tests pass
• Lint + format pass (oxlint + oxfmt)

Related

• fix(cron): prevent duplicate delivery for isolated jobs with announce mode #15739 (cron duplicate delivery — same pattern, different subsystem)

Greptile Summary

Replaced random UUIDs with deterministic idempotency keys derived from stable identifiers to prevent duplicate subagent announcements when both the application-level announce queue and gateway-level message queue deliver the same announcement.

Key changes:

• Queue drain path in sendAnnounce: uses template with session key and enqueue timestamp instead of random UUID
• Direct announce path in runSubagentAnnounceFlow: uses template with child session key and run ID instead of random UUID
• Removed unused crypto import

The fix allows the gateway's deduplication cache to properly recognize and reject duplicate delivery attempts by using the same idempotency key for both delivery paths.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix correctly addresses the root cause of duplicate announcements by replacing non-deterministic random UUIDs with stable, deterministic idempotency keys. The values used (sessionKey, enqueuedAt, childRunId) are all stable identifiers that remain constant across duplicate delivery attempts. The change is minimal, well-tested (79 agent tests + 101 cron tests passing), and follows the same pattern used for cron duplicate delivery in fix(cron): prevent duplicate delivery for isolated jobs with announce mode #15739.
• No files require special attention

_{Last reviewed commit: 8f695c3}

_{(5/5) You can turn off certain types of comments like style here!}