@aeondave/pi-persona 1.16.2 → 1.16.3

package/CHANGELOG.md

@@ -6,6 +6,14 @@ used in its [GitHub releases](https://github.com/AeonDave/pi-persona/releases).
 
 ## [Unreleased]
 
+## [1.16.3](https://github.com/AeonDave/pi-persona/releases/tag/v1.16.3) - 2026-10-13
+
+### Fixed
+
+- Reject Pi `+name`/`-name` tool modifiers in agent and per-run allowlists before either engine
+  starts. Those selectors are literal allowlist entries in pi-persona; Pi 1.2 instead applies them
+  to its default tools. Use `deny` or `excludeTools` for denials.
+
 ## [1.16.2](https://github.com/AeonDave/pi-persona/releases/tag/v1.16.2) - 2026-10-08
 
 ### Fixed

package/README.md

@@ -39,9 +39,9 @@ your customizations.
 | Install option | Command |
 |---|---|
 | This project only | `pi install -l npm:@aeondave/pi-persona` |
-| Pin this release | `pi install npm:@aeondave/pi-persona@1.16.2` |
+| Pin this release | `pi install npm:@aeondave/pi-persona@1.16.3` |
 | Update an unpinned install | `pi update npm:@aeondave/pi-persona` |
-| Git alternative | `pi install git:github.com/AeonDave/pi-persona@v1.16.2` |
+| Git alternative | `pi install git:github.com/AeonDave/pi-persona@v1.16.3` |
 
 Restart Pi after updating. For a pinned install, install the new version or tag explicitly.
 If switching from a Git install, remove that source first with

package/docs/REFERENCE.md

@@ -189,9 +189,11 @@ files are seed sources. A fresh install has no installed personas until `/person
 | Preset | `presets/*.preset.json` | reusable council strategy, roster, and parameter bundle |
 
 `tools` accepts an allowlist such as `[read, grep]`, an `allow`/`deny` object, or `[]` for no tools.
-Omit it to inherit the session tool set. `model`, `isolation: worktree`, `mcp: true`, and `purpose`
-are optional agent metadata. The body is the agent prompt. Inline roster members specialise one
-agent with a role, model, or skills without requiring another agent file.
+Entries are plain tool names or `*` patterns; Pi's `+name`/`-name` default-tool modifier
+syntax is not an allowlist and is rejected. Use the `deny` field to remove tools. Omit `tools` to
+inherit the session tool set. `model`, `isolation: worktree`,
+`mcp: true`, and `purpose` are optional agent metadata. The body is the agent prompt. Inline roster
+members specialise one agent with a role, model, or skills without requiring another agent file.
 
 ### Multi-agent quick start
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeondave/pi-persona",
-  "version": "1.16.2",
+  "version": "1.16.3",
   "private": false,
   "type": "module",
   "description": "Supervised multi-agent orchestration for Pi — async workers, live steering, cross-session collaboration, and switchable personas.",
@@ -104,7 +104,7 @@
     "typescript": "^7.0.2"
   },
   "pi": {
-    "image": "https://raw.githubusercontent.com/AeonDave/pi-persona/v1.16.2/assets/banner.png",
+    "image": "https://raw.githubusercontent.com/AeonDave/pi-persona/v1.16.3/assets/banner.png",
     "video": "https://cdn.jsdelivr.net/gh/AeonDave/pi-persona@6655d281ce7965a75303dd704bd29db73db04070/assets/demo1.mp4",
     "extensions": [
       "./src/extension.ts"

package/src/engine/adapter.ts

@@ -18,7 +18,7 @@ import { type ChildEngineOptions, type ChildRunSpec, runChildAgent } from "./chi
 import { looksLikeProviderError } from "./errors.ts";
 import { nextChildHandle } from "./handles.ts";
 import { combineSignals } from "./signals.ts";
-import { unknownAgentFailure, unknownContractFailure } from "./spec-preflight.ts";
+import { toolModifierFailure, unknownAgentFailure, unknownContractFailure } from "./spec-preflight.ts";
 import type { ToolEvent } from "./stream.ts";
 
 /** The engine-side face of the cross-process broker (spec B3/B4/B7) — a child-engine
@@ -113,6 +113,9 @@ export function makeEngine(deps: EngineAdapterDeps): StrategyEngine {
 		): Promise<AgentResult> {
 			const cfg = deps.resolveAgent(spec.agent);
 			if (!cfg) return unknownAgentFailure(spec.agent, deps.listAgents?.() ?? []);
+			const tools = spec.tools ?? cfg.tools;
+			const invalidTools = toolModifierFailure(spec.agent, tools);
+			if (invalidTools) return invalidTools;
 
 			// Resolved (and pinned) up front: the SAME def both instructs the member and
 			// validates its output — an instruction/validation drift is impossible. A named
@@ -132,7 +135,6 @@ export function makeEngine(deps: EngineAdapterDeps): StrategyEngine {
 			// a child without it defaults to "adaptive", which some models reject.
 			if (model && deps.childThinking && !model.includes(":")) model = `${model}:${deps.childThinking}`;
 			if (model) childSpec.model = model;
-			const tools = spec.tools ?? cfg.tools;
 			if (tools !== undefined) childSpec.tools = tools;
 			if (cfg.excludeTools && cfg.excludeTools.length > 0) childSpec.excludeTools = cfg.excludeTools;
 			// The shared behavioral layer (docs/SPINE.md) + the agent's own persona + any

package/src/engine/inproc.ts

@@ -35,7 +35,7 @@ import type { AgentResult } from "../orchestration/types.ts";
 import { looksLikeProviderError } from "./errors.ts";
 import { nextChildHandle } from "./handles.ts";
 import { combineSignals } from "./signals.ts";
-import { unknownAgentFailure, unknownContractFailure } from "./spec-preflight.ts";
+import { toolModifierFailure, unknownAgentFailure, unknownContractFailure } from "./spec-preflight.ts";
 import { applyEvent, createStreamState, emptyUsage, type ProgressSnapshot, snapshot } from "./stream.ts";
 
 /** The minimal slice of Pi's AgentSession the engine drives — also the test seam. */
@@ -315,6 +315,9 @@ export function makeInProcessEngine(deps: InProcessDeps): StrategyEngine {
 		async run(spec: AgentRunSpec, onProgress?, callSignal?, onSteerable?): Promise<AgentResult> {
 			const cfg = deps.resolveAgent(spec.agent);
 			if (!cfg) return unknownAgentFailure(spec.agent, deps.listAgents?.() ?? []);
+			const tools = spec.tools ?? cfg.tools;
+			const invalidTools = toolModifierFailure(spec.agent, tools);
+			if (invalidTools) return invalidTools;
 			// A requested contract is a runtime guard, not merely prompt decoration. Resolve it
 			// before model/session construction so a missing name can never run unconstrained.
 			const requestedContract = spec.outputContract?.trim();
@@ -346,7 +349,6 @@ export function makeInProcessEngine(deps: InProcessDeps): StrategyEngine {
 			const rm = model as { provider?: string; id?: string };
 			const resolvedRef = rm.provider && rm.id ? `${rm.provider}/${rm.id}` : ref;
 			const thinkingLevel = isThinkingLevel(deps.childThinking) ? deps.childThinking : undefined;
-			const tools = spec.tools ?? cfg.tools;
 			const excludeTools = cfg.excludeTools;
 
 			// Diagnostic tag: which agent + which model ref + whether it was dynamically

package/src/engine/spec-preflight.ts

@@ -31,3 +31,16 @@ export function unknownAgentFailure(agent: string, installed: string[]): AgentRe
 export function unknownContractFailure(agent: string, requested: string, installed: string[]): AgentResult {
 	return failure(agent, `[${agent}] output contract "${requested}" not found${installedHint("contracts", installed)}`, "contract");
 }
+
+/** Pi's SDK treats leading `+`/`-` entries in `tools` as default-tool modifiers, not as
+ *  literal allowlist entries. AgentRunSpec.tools and agent frontmatter use this field as an
+ *  allowlist, so reject that syntax before either engine reaches Pi. Use excludeTools for denies. */
+export function toolModifierFailure(agent: string, tools: readonly string[] | undefined): AgentResult | undefined {
+	const modifier = tools?.find((selector) => /^[+-]/.test(selector.trim()));
+	if (modifier === undefined) return undefined;
+	return failure(
+		agent,
+		`[${agent}] unsupported tool modifier "${modifier.trim()}" in tools allowlist; use plain tool names/patterns or excludeTools for denials`,
+		"contract",
+	);
+}

package/src/telemetry/contract.ts

@@ -4,7 +4,7 @@ export const TELEMETRY_EVENT_NAME = "pi:telemetry" as const;
 export const LEGACY_TELEMETRY_EVENT_NAME = "pi-persona:telemetry" as const;
 export const LEGACY_TELEMETRY_VERSION = 1 as const;
 export const TELEMETRY_PRODUCER_ID = "pi-persona" as const;
-export const TELEMETRY_PRODUCER_VERSION = "1.16.2" as const;
+export const TELEMETRY_PRODUCER_VERSION = "1.16.3" as const;
 
 export type InstanceStatus = "active" | "idle" | "stopped" | "stale" | (string & {});
 export type AgentKind = "subagent" | "delegate" | "council" | "flow" | "phase" | (string & {});