@bacnh85/pi-subagent 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.15.1 (2026-08-17)
+
+### Improvements
+
+- Project-local agent approval is now a single select — **Allow once / Trust for this session / Deny** — instead of a yes/no confirm repeated on every delegation. "Trust for this session" remembers the project agents dir for the session (cleared on `session_start`); dismissed dialogs and Deny cancel the delegation. Headless sessions still fail closed.
+- New test coverage for the approval gate (Deny / dismissed / headless / trust-remembering / session_start clearing).
+
 ## 0.15.0 (2026-08-09)
 
 ### Packaging

package/README.md

@@ -91,7 +91,7 @@ Threads are session-memory only and are cleared when Pi replaces or reloads the
 Agent files under `.pi/agents/` are controlled by the current repository. A project agent's system prompt may instruct a child to execute shell commands or modify files.
 
 - **Project-agent approval cannot be disabled by the model.** The `confirmProjectAgents` parameter is not exposed in the tool schema. Confirmation policy comes from trusted user configuration only.
-- **Interactive sessions** prompt the user before executing project agents.
+- **Interactive sessions** prompt the user before executing project agents (**Allow once / Trust for this session / Deny**); "Trust for this session" remembers the project agents dir until the session ends. Dismissed dialogs and Deny cancel the delegation.
 - **Headless sessions fail closed.** Project agents are not executed without UI confirmation unless the trusted setting `allowUnconfirmedProjectAgents` is enabled (via `PI_SUBAGENT_ALLOW_UNCONFIRMED_PROJECT_AGENTS=true` environment variable or pi settings).
 - **The extension service path** (`pi-subagent:run` event) follows the same policy.
 

package/agents/planner.md

@@ -3,7 +3,7 @@ name: planner
 description: Read-only planning and architecture specialist. Use for consequential design, tradeoff analysis, and implementation plans.
 tools: read, grep, find, ls
 models:
-  - zai-coding-cn/glm-5.2
+  - zai-coding-cn/glm-5.3
   - openrouter/nvidia/nemotron-3-ultra-550b-a55b:free
   - opencode-go/deepseek-v4-pro
 thinking: high

package/agents/reviewer.md

@@ -3,7 +3,7 @@ name: reviewer
 description: Code review specialist. Use for correctness, security, regression, and meaningful test-gap review.
 tools: read, grep, find, ls
 models:
-  - zai-coding-cn/glm-5.2
+  - zai-coding-cn/glm-5.3
   - openrouter/nvidia/nemotron-3-ultra-550b-a55b:free
   - opencode-go/deepseek-v4-pro
 thinking: high

package/extensions/index.ts

@@ -95,6 +95,9 @@ function getTrustedConfig(ctx: ExtensionContext): { allowUnconfirmedProjectAgent
   };
 }
 
+/** Session-scoped approvals for project-local agents ("Trust for this session"). */
+const trustedProjectAgentDirs = new Set<string>();
+
 
 // ---------------------------------------------------------------------------
 // Tool parameter schema
@@ -186,6 +189,7 @@ export default function (pi: ExtensionAPI) {
     currentCtx = ctx;
     if (event.reason === "reload") invalidateAgentCache();
     threadStore.clear();
+    trustedProjectAgentDirs.clear();
     // Clear any widget from a prior session.
     widget.clearWidgetIfIdle();
     // Mark prior-session running tasks as interrupted (we can't resume them).
@@ -591,19 +595,22 @@ export default function (pi: ExtensionAPI) {
 
         if (projectAgentsRequested.length > 0) {
           if (confirmProjectAgents) {
-            if (ctx.hasUI) {
+            const dir = discovery.projectAgentsDir ?? "(unknown)";
+            if (trustedProjectAgentDirs.has(dir)) {
+              // Previously approved "Trust for this session" for this agents dir.
+            } else if (ctx.hasUI) {
               const names = projectAgentsRequested.map((a) => a.name).join(", ");
-              const dir = discovery.projectAgentsDir ?? "(unknown)";
-              const ok = await ctx.ui.confirm(
-                "Run project-local agents?",
-                `Agents: ${names}\nSource: ${dir}\n\nProject agents are repo-controlled. Only continue for trusted repositories.`,
+              const choice = await ctx.ui.select(
+                `Run project-local agents?\n\nAgents: ${names}\nSource: ${dir}\n\nProject agents are repo-controlled. Only continue for trusted repositories.`,
+                ["Allow once", "Trust for this session", "Deny"],
               );
-              if (!ok) {
+              if (choice !== "Allow once" && choice !== "Trust for this session") {
                 return {
                   content: [{ type: "text", text: "Canceled: project-local agents not approved." }],
                   details: makeDetails(hasChain ? "chain" : hasTasks ? "parallel" : "single")([]),
                 };
               }
+              if (choice === "Trust for this session") trustedProjectAgentDirs.add(dir);
             } else {
               // Fail closed in headless sessions.
               return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-subagent",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "In-process subagents for Pi with isolated SDK sessions, parallel and chained delegation, and inspectable threads.",
   "type": "module",
   "license": "MIT",