@bermudi/pi-delegate 0.1.0 → 0.1.1

package/README.md

@@ -11,13 +11,32 @@ as a standalone repo (full history preserved).
 
 ## Install
 
-Symlink the **bundled** output into Pi's global extensions dir:
+Install a reviewed Git commit or release tag as a Pi package:
 
 ```bash
-ln -s "$PWD/delegate.bundle.ts" ~/.pi/agent/extensions/delegate.ts
+# Replace this with a reviewed commit or release tag; do not use a moving branch.
+pi install git:github.com/bermudi/pi-delegate@<reviewed-commit-or-tag>
 ```
 
-Then `/reload` in Pi.
+Remove any old `delegate.ts` symlink from `~/.pi/agent/extensions/` before
+starting Pi. Pi loads `delegate.ts` from the isolated Git package checkout; do
+not point a running Pi at this repository or at `.build/delegate.bundle.ts`.
+Start a fresh Pi process after updating the installed ref.
+
+## Usage
+
+Use the built-in `default` profile to run a subagent with the live parent's
+model, thinking level, delegatable native tools, and base system prompt:
+
+```ts
+delegate({
+  tasks: [{ agent: "default", prompt: "Investigate the auth module" }],
+});
+```
+
+Parent extension/MCP tools are not copied, and project instructions are rebuilt
+for the task's `cwd`. Omit `agent` when you want an ad-hoc task using delegate's
+normal inline defaults instead.
 
 ### Token accounting
 
@@ -30,6 +49,25 @@ which has no usage slot. The per-call aggregate (`Nk tokens`) is still shown in
 the delegate header for both modes. Use sync delegation when totals must roll
 into the session.
 
+### Background-work visibility
+
+Async tickets keep running after the parent's turn settles, and pi renders an
+idle session — so delegate adds three signals:
+
+- **Footer status** — while any ticket is active, the footer shows
+  `⏳ 2 subagents · t5042v19`, updated live as subagents start and finish.
+- **Settle warning** — the first time a turn settles with a ticket still
+  active, a warning notification names the ticket and reminds you that
+  quitting aborts it. Once per ticket; the footer carries it from there.
+- **Switch/fork guard** — `/new`, `/resume`, and forking ask for confirmation
+  before killing live subagents (pi lets extensions cancel those paths).
+
+Quitting (Ctrl+C×2 / Ctrl+D / `/quit`) and `/reload` **cannot be intercepted**
+by an extension — pi's `session_shutdown` is advisory. The footer status is
+the mitigation there; on quit, delegate also prints a trace line to the
+terminal naming the aborted tickets and agents, and on `/reload` it shows a
+warning notification.
+
 ### Stall detection and cancellation
 
 `stallTimeoutMs` is an inactivity watchdog, not a hard execution deadline. When
@@ -46,13 +84,15 @@ task result. Set `stallTimeoutMs` to `0` to disable the watchdog.
 
 ```bash
 bun install
-bun run build       # regenerate delegate.bundle.ts
 bun run typecheck
 bun test
+bun run build       # optional disposable bundle smoke test
 ```
 
-The unbundled entry is `delegate.ts`; `extension.ts` holds the tool implementation.
-`delegate.bundle.ts` is generated by `bun run build` — do not edit by hand.
+The package entry point is `delegate.ts`; `extension.ts` holds the tool
+implementation. `.build/delegate.bundle.ts` is generated by `bun run build` and
+is only a verification artifact. Never symlink it into a running Pi or build
+over an installed extension.
 
 ## Glossary
 
@@ -61,6 +101,9 @@ The unbundled entry is `delegate.ts`; `extension.ts` holds the tool implementati
   `systemPrompt`, `thinking`, `cwd`, `context`, `sessionId`, or `resumeFrom`.
   `model` is also accepted but should be rare — subagents inherit the parent
   model by default.
+- **Default subagent** — The reserved built-in `agent: "default"` profile. It
+  mirrors the live parent's model, thinking level, delegatable native tools, and
+  base system prompt while preserving delegate's extension/context isolation.
 - **Custom agent** — A subagent profile defined by the parent, either inline in
   a delegate task (`systemPrompt`, `tools`, and `thinking`) or persisted as a
   Markdown file. The subagent inherits the parent model by default; `model` is a
@@ -88,5 +131,6 @@ The unbundled entry is `delegate.ts`; `extension.ts` holds the tool implementati
 - **Skill** — A `SKILL.md` instruction bundle injected into the subagent system
   prompt. Skills are text instructions only; they do not unlock additional
   tools.
-- **AGENTS.md context** — Project and global guidance files automatically
-  appended to subagent system prompts, separate from named agent definitions.
+- **AGENTS.md context** — Project and ancestor guidance files are automatically
+  appended to subagent system prompts. User-global AGENTS.md files are excluded;
+  they describe the parent harness, not the delegated task.

package/agents.ts

@@ -6,7 +6,11 @@ import type {
   ThinkingLevel,
 } from "@earendil-works/pi-agent-core";
 import { parseFrontmatter as parsePiFrontmatter } from "@earendil-works/pi-coding-agent";
-import { DEFAULT_TOOLS, VALID_THINKING } from "./constants.ts";
+import {
+  DEFAULT_AGENT_NAME,
+  DEFAULT_TOOLS,
+  VALID_THINKING,
+} from "./constants.ts";
 import { resolveToolGroups } from "./tools.ts";
 import type { AgentConfig } from "./types.ts";
 
@@ -294,7 +298,14 @@ export function discoverAgents(cwd: string): Map<string, AgentConfig> {
     }
     for (const e of entries) {
       if (!e.name.endsWith(".md") || e.name.endsWith(".chain.md")) continue;
-      const cfg = loader(path.join(dir, e.name));
+      const filePath = path.join(dir, e.name);
+      const cfg = loader(filePath);
+      if (cfg?.name === DEFAULT_AGENT_NAME) {
+        console.warn(
+          `[delegate] ignoring agent profile '${DEFAULT_AGENT_NAME}' from ${filePath}: the name is reserved for the built-in parent-mirroring profile.`,
+        );
+        continue;
+      }
       if (cfg && !agents.has(cfg.name)) {
         cfg.scope = scope;
         agents.set(cfg.name, cfg);

package/constants.ts

@@ -1,3 +1,6 @@
+/** Reserved built-in profile that mirrors the live parent configuration. */
+export const DEFAULT_AGENT_NAME = "default";
+
 /** Full-capability agent set. Inline-task default and the `*` shorthand.
  *  Bash subsumes search, so the dedicated grep/find/ls tools are excluded. */
 export const DEFAULT_TOOLS = ["read", "write", "edit", "bash"];

package/delegate.ts

@@ -14,12 +14,14 @@ export type {
   TaskResult,
   TaskFailureKind,
   ReuseIntent,
+  ParentAgentDefaults,
   AgentRunConfig,
   TaskRunEnv,
 } from "./types.ts";
 export type { DelegateConfig } from "./config.ts";
 
 export {
+  DEFAULT_AGENT_NAME,
   DEFAULT_TOOLS,
   READONLY_TOOLS,
   MAX_CONCURRENCY,
@@ -66,7 +68,17 @@ export {
   formatCompletedTicket,
 } from "./tickets.ts";
 export { runAgentSession } from "./runner.ts";
-export { getHostDeps } from "./host.ts";
+export {
+  activeTicketSummary,
+  buildStatusText,
+  clearDelegateStatusContext,
+  describeActiveTickets,
+  syncDelegateStatus,
+  notifyActiveTicketsOnSettled,
+  guardSessionReplacement,
+} from "./status.ts";
+export type { ActiveTicketSummary } from "./status.ts";
+export { getHostDeps, invalidateHostDepsCache } from "./host.ts";
 export type { HostDeps, HostDepsOptions } from "./host.ts";
 export {
   emptyUsage,

package/dispatch.ts

@@ -15,6 +15,7 @@ import { sumUsage } from "./usage.ts";
 import { runResolvedTask, updateProgressFromRun } from "./lifecycle.ts";
 import { fmtDuration, formatCompletedTask, trunc } from "./format.ts";
 import { validateDelegateOperation } from "./schema.ts";
+import { syncDelegateStatus } from "./status.ts";
 import { validateTasks, resolveTasks } from "./task-resolution.ts";
 import type {
   AgentConfig,
@@ -23,6 +24,7 @@ import type {
   DelegateDetails,
   DelegateToolCtx,
   DelegateToolResult,
+  ParentAgentDefaults,
   ResolvedTask,
   TaskDef,
   TaskProgress,
@@ -123,6 +125,7 @@ export interface DelegateDispatchInput {
   ctx: DelegateToolCtx;
   agents: Map<string, AgentConfig>;
   parentModelId: string | undefined;
+  parentDefaults: ParentAgentDefaults;
   signal: AbortSignal | undefined;
   onUpdate: AgentToolUpdateCallback<DelegateDetails> | undefined;
 }
@@ -131,13 +134,22 @@ export interface DelegateDispatchInput {
 export async function dispatchDelegate(
   input: DelegateDispatchInput,
 ): Promise<DelegateToolResult> {
-  const { pi, params, ctx, agents, parentModelId, signal, onUpdate } = input;
+  const {
+    pi,
+    params,
+    ctx,
+    agents,
+    parentModelId,
+    parentDefaults,
+    signal,
+    onUpdate,
+  } = input;
   const tasks = params.tasks ?? [];
 
   const validationError = validateTasks(tasks, agents, parentModelId);
   if (validationError) return validationError;
 
-  const resolved = resolveTasks(tasks, ctx, agents);
+  const resolved = resolveTasks(tasks, ctx, agents, parentDefaults);
   const progress = initProgress(resolved);
   const fire = makeFireUpdater(
     onUpdate,
@@ -206,6 +218,10 @@ export function dispatchAsync(input: AsyncDispatchInput): DelegateToolResult {
     parentModelId,
   };
   ticketRegistry.set(ticketId, ticket);
+  // Footer visibility for the new background work (see status.ts). Uses the
+  // ctx cached from the dispatch path in extension.ts — DelegateToolCtx is
+  // the intentionally narrowed surface and does not carry `ui`.
+  syncDelegateStatus();
 
   // Capture values for the closure — do NOT use `signal` from execute()
   // The parent turn's signal dies when execute() returns.
@@ -221,9 +237,13 @@ export function dispatchAsync(input: AsyncDispatchInput): DelegateToolResult {
     onProgress: (p, u) => {
       updateProgressFromRun(p, u);
       notifyWaiters(ticket);
+      // Live subagent counts in the footer. Deduped by text, so only
+      // running/pending count transitions trigger a render.
+      syncDelegateStatus();
     },
     onStatusChange: () => {
       notifyWaiters(ticket);
+      syncDelegateStatus();
     },
   };
 
@@ -243,6 +263,12 @@ export function dispatchAsync(input: AsyncDispatchInput): DelegateToolResult {
     ticketSignal,
   )
     .then(() => {
+      // A ticket that is already terminally "cancelled" at this point was
+      // finalized by cancelTicketForShutdown (user cancels pass through
+      // "cancelling" first): the extension runtime is being torn down, the
+      // captured `pi` is stale or about to be, and a follow-up message has
+      // no live session to land in. Skip delivery entirely.
+      if (ticket.status === "cancelled") return;
       // All tasks settled — determine final ticket status.
       // Use progress (set by runResolvedTask) for settled-ness so the
       // status reflects work completion, not just result-array density.
@@ -262,10 +288,13 @@ export function dispatchAsync(input: AsyncDispatchInput): DelegateToolResult {
         ticket.completedAt = Date.now();
         syncTicketBusyIndex(ticket);
       }
+      syncDelegateStatus();
       deliverTicketResults(pi, ticket);
     })
     .catch((err) => {
-      // Defense-in-depth — should not happen if individual tasks catch properly
+      // Defense-in-depth — should not happen if individual tasks catch properly.
+      // Same shutdown guard as the .then path above.
+      if (ticket.status === "cancelled") return;
       if (ticket.status === "cancelling") {
         ticket.status = "cancelled";
       } else if (ticket.status === "running") {
@@ -274,6 +303,7 @@ export function dispatchAsync(input: AsyncDispatchInput): DelegateToolResult {
       ticket.error = err instanceof Error ? err.message : String(err);
       ticket.completedAt = Date.now();
       syncTicketBusyIndex(ticket);
+      syncDelegateStatus();
       deliverTicketResults(pi, ticket);
     });
 

package/extension.ts

@@ -18,7 +18,16 @@ import {
 } from "./dispatch.ts";
 import { renderDelegateCall, renderDelegateResult } from "./render-result.ts";
 import { hostCompatError } from "./host-compat.ts";
+import { invalidateHostDepsCache } from "./host.ts";
 import { closeAllPooledAgents } from "./pool.ts";
+import {
+  activeTicketSummary,
+  clearDelegateStatusContext,
+  describeActiveTickets,
+  guardSessionReplacement,
+  notifyActiveTicketsOnSettled,
+  syncDelegateStatus,
+} from "./status.ts";
 import type { DelegateArguments } from "./types.ts";
 
 /** Register the delegate tool and clean up its parent-session resources. */
@@ -55,7 +64,11 @@ export default function delegateExtension(pi: ExtensionAPI): void {
 
       // ── Cancel action ─────────────────────────────────────────────────
       if (params.action === "cancel") {
-        return handleCancel(params);
+        const result = handleCancel(params);
+        // A forced cancel flips the ticket to "cancelling" — keep the
+        // footer status in step (deduped; the preview path is a no-op).
+        syncDelegateStatus(ctx);
+        return result;
       }
 
       // ── Wait action ────────────────────────────────────────────────────
@@ -83,12 +96,26 @@ export default function delegateExtension(pi: ExtensionAPI): void {
         };
       }
 
+      // Cache the full ExtensionContext for the footer-status module before
+      // dispatch narrows it to DelegateToolCtx (which has no `ui`). The
+      // status push itself is a deduped no-op here; dispatchAsync re-syncs
+      // after registering its ticket.
+      syncDelegateStatus(ctx);
+
+      // Keep expensive host deps shared within this dispatch, not indefinitely
+      // across dispatches: edits to auth/models/settings/context files must be
+      // visible without restarting Pi.
+      invalidateHostDepsCache();
       return dispatchDelegate({
         pi,
         params,
         ctx,
         agents,
         parentModelId,
+        parentDefaults: {
+          thinking: pi.getThinkingLevel(),
+          tools: pi.getActiveTools(),
+        },
         signal,
         onUpdate,
       });
@@ -98,11 +125,48 @@ export default function delegateExtension(pi: ExtensionAPI): void {
     renderResult: renderDelegateResult,
   });
 
+  // ── Background-work visibility (see status.ts) ──────────────────────────
+  // The turn settling with live tickets is the "looks idle but isn't" moment:
+  // warn once per ticket. The footer status carries it from there.
+  pi.on("agent_settled", (_event, ctx) => {
+    notifyActiveTicketsOnSettled(ctx);
+  });
+
+  // Session replacements are cancellable — confirm before killing live work.
+  pi.on("session_before_switch", (_event, ctx) =>
+    guardSessionReplacement(ctx, "switch"),
+  );
+  pi.on("session_before_fork", (_event, ctx) =>
+    guardSessionReplacement(ctx, "fork"),
+  );
+
   // ── Session shutdown: abort tickets and dispose live pooled sessions ──
-  pi.on("session_shutdown", async () => {
+  pi.on("session_shutdown", async (event, ctx) => {
+    // Quit and /reload kill background work with no cancellable hook, so
+    // leave a trace. For quit the TUI is already stopped — stderr lands in
+    // the scrollback. For reload the TUI survives — warn in place. Switch
+    // and fork already passed the confirm guard above.
+    const active = activeTicketSummary();
+    if (active.tickets.length) {
+      if (event.reason === "quit") {
+        console.error(
+          `[delegate] pi exited with ${describeActiveTickets(active)} — aborted.`,
+        );
+      } else if (event.reason === "reload") {
+        ctx.ui.notify(
+          `[delegate] reload aborted ${describeActiveTickets(active)}`,
+          "warning",
+        );
+      }
+    }
     for (const ticket of ticketRegistry.values()) {
       cancelTicketForShutdown(ticket);
     }
+    syncDelegateStatus(ctx);
+    // The runtime is invalidated right after this handler returns; aborted
+    // tickets keep unwinding asynchronously and must find no cached ctx (or
+    // captured pi) to touch. See the "cancelled"-at-entry guard in dispatch.
+    clearDelegateStatusContext();
     // Do NOT clear the ticket registry here — completed tickets are retained
     // until their TTL cleanup. Pooled AgentSessions, however, own listeners
     // and must be disposed before the parent session exits.

package/host-compat.ts

@@ -8,16 +8,27 @@ import type { DelegateToolResult } from "./types.ts";
  * Keep this list in sync with the actual import sites (host.ts, sessions.ts,
  * lifecycle.ts, agents.ts).
  */
-const REQUIRED_SYMBOLS = [
-  "ModelRuntime",
-  "SettingsManager",
-  "SessionManager",
-  "DefaultResourceLoader",
-  "DefaultPackageManager",
-  "createAgentSession",
-  "getAgentDir",
-  "parseFrontmatter",
-] as const;
+type ExportCheck = {
+  name: string;
+  requiredMember?: string;
+};
+
+/**
+ * Host symbols actually dereferenced by delegate. Static members are listed by
+ * `<symbol>.<member>` so we fail fast when a constructor is present but no longer
+ * exposes the required factory methods.
+ */
+const REQUIRED_EXPORTS: ExportCheck[] = [
+  { name: "ModelRuntime", requiredMember: "create" },
+  { name: "SettingsManager", requiredMember: "create" },
+  { name: "SessionManager", requiredMember: "create" },
+  { name: "SessionManager", requiredMember: "open" },
+  { name: "DefaultResourceLoader" },
+  { name: "DefaultPackageManager" },
+  { name: "createAgentSession" },
+  { name: "getAgentDir" },
+  { name: "parseFrontmatter" },
+];
 
 /**
  * Build a tool result describing any required symbols missing from a pi
@@ -27,9 +38,33 @@ const REQUIRED_SYMBOLS = [
 export function hostCompatResult(
   ns: Record<string, unknown>,
 ): DelegateToolResult | null {
-  const missing = REQUIRED_SYMBOLS.filter((name) => ns[name] === undefined);
+  const missing: string[] = [];
+  for (const entry of REQUIRED_EXPORTS) {
+    const value = ns[entry.name];
+    if (value === undefined) {
+      missing.push(`'${entry.name}'`);
+      continue;
+    }
+
+    if (typeof value !== "function") {
+      missing.push(`'${entry.name}'`);
+      continue;
+    }
+
+    if (entry.requiredMember) {
+      const symbolValue = value as unknown as { [key: string]: unknown };
+      if (!(entry.requiredMember in symbolValue)) {
+        missing.push(`'${entry.name}.${entry.requiredMember}'`);
+        continue;
+      }
+      if (typeof symbolValue[entry.requiredMember] !== "function") {
+        missing.push(`'${entry.name}.${entry.requiredMember}'`);
+      }
+    }
+  }
+
   if (missing.length === 0) return null;
-  const listed = missing.map((m) => `'${m}'`).join(", ");
+  const listed = missing.join(", ");
   return {
     content: [
       {

package/host.ts

@@ -5,8 +5,10 @@
  *
  * `DefaultResourceLoader.reload()` is the one expensive step (~1.2s cold — it
  * scans for skills, prompts, agents.md files, system prompts). It is a
- * read-only cache for the parts we care about: skills, AGENTS.md/context files,
- * and the system prompt. `_buildRuntime` reads `resourceLoader.getExtensions()`
+ * read-only cache for the parts we care about: skills, project AGENTS.md/context
+ * files, and the system prompt. Global context is filtered at this seam so a
+ * child cannot inherit the parent's user-global instructions. `_buildRuntime`
+ * reads `resourceLoader.getExtensions()`
  * and the prompt/skill getters.
  *
  * **Extensions are disabled for subagents by default** (`noExtensions: true`).
@@ -78,7 +80,7 @@ export interface HostDepsOptions {
    * Custom system prompt for a named agent. When set, it overrides the default
    * system prompt the resource loader would otherwise discover. Extension-free
    * host deps are cached per (agentDir + cwd + systemPrompt): the expensive
-   * `reload()` (skills, AGENTS.md discovery) runs once per distinct combo, then
+   * `reload()` (skills, project AGENTS.md discovery) runs once per distinct combo, then
    * is reused across concurrent subagents. Provider-configured or
    * allowlisted-extension tasks always receive fresh host deps. For ad-hoc
    * tasks (no named agent) pass undefined to use the discovered prompt.
@@ -89,6 +91,8 @@ export interface HostDepsOptions {
 const hostDepsCache = new Map<string, HostDeps>();
 /** In-flight builds, so concurrent calls for the same key share one reload(). */
 const hostDepsInflight = new Map<string, Promise<HostDeps>>();
+/** Prevent a pre-invalidation build from repopulating or clearing newer state. */
+let hostDepsCacheGeneration = 0;
 
 function canonicalPath(candidate: string): string {
   try {
@@ -113,6 +117,33 @@ function isPathWithinDirectory(directory: string, candidate: string): boolean {
   );
 }
 
+const CONTEXT_FILE_NAMES = new Set([
+  "agents.override.md",
+  "agents.md",
+  "claude.override.md",
+  "claude.md",
+]);
+
+/**
+ * Delegate workers deliberately do not inherit user-global context files.
+ * Pi's standard global file lives under `agentDir`; `.agents/AGENTS.md` is a
+ * legacy convention used by other coding-agent harnesses. Compare lexical
+ * paths here rather than canonical paths: a user's global file is commonly a
+ * symlink, and the ResourceLoader reports the path it discovered, not its
+ * symlink target.
+ */
+function isExcludedGlobalContextFile(
+  filePath: string,
+  agentDir: string,
+): boolean {
+  const resolvedFilePath = resolve(filePath);
+  const roots = [resolve(agentDir), resolve(homedir(), ".agents")];
+  return roots.some((root) => {
+    const relativePath = relative(root, resolvedFilePath);
+    return CONTEXT_FILE_NAMES.has(relativePath.toLowerCase());
+  });
+}
+
 /**
  * Whether a managed package's canonical target remains in a user install root.
  *
@@ -301,6 +332,7 @@ function getConfiguredGitSource(
     host?: unknown;
     path?: unknown;
     ref?: unknown;
+    pinned?: unknown;
   };
   if (parsedSource.type !== "git") {
     throw new Error(
@@ -324,7 +356,22 @@ function getConfiguredGitSource(
       "A configured provider extension Git identity could not be verified; delegation stopped.",
     );
   }
-  if (parsedSource.ref === undefined) return repository;
+  // `ref` and `pinned` are a security contract from Pi's private parser. If a
+  // host upgrade drops either field, never reinterpret a pinned source as an
+  // unpinned checkout and silently skip commit validation.
+  if (typeof parsedSource.pinned !== "boolean") {
+    throw new Error(
+      "A configured provider extension Git pin state could not be verified; delegation stopped.",
+    );
+  }
+  if (!parsedSource.pinned) {
+    if (parsedSource.ref !== undefined) {
+      throw new Error(
+        "A configured provider extension Git ref could not be verified; delegation stopped.",
+      );
+    }
+    return repository;
+  }
   if (typeof parsedSource.ref !== "string" || parsedSource.ref.length === 0) {
     throw new Error(
       "A configured provider extension Git ref could not be verified; delegation stopped.",
@@ -579,8 +626,10 @@ let testModelRuntimeFactory: (() => Promise<ModelRuntime>) | undefined;
 
 /**
  * Lazily build the host deps for a task. Extension-free, provider-independent
- * deps are cached by (agentDir, cwd, systemPrompt); provider registrations and
- * allowlisted extensions get a private dependency graph for every session.
+ * deps are cached by (agentDir, cwd, systemPrompt) within one delegate dispatch;
+ * the extension invalidates the generation before the next dispatch so file
+ * edits become visible. Provider registrations and allowlisted extensions get
+ * a private dependency graph for every session.
  *
  * The first cached call pays the `resourceLoader.reload()` cost (~1.2s). An
  * extension-bearing call intentionally pays that cost again: sharing its
@@ -602,14 +651,13 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
   );
 
   // Resolve provider extensions before deciding whether to use the cache. This
-  // fails closed for missing sources while keeping package lookup's user-only
-  // settings isolated from the project-aware session settings built below.
+  // fails closed for missing sources while keeping both package lookup and child
+  // resource loading isolated from executable project settings.
   let additionalExtensionPaths: string[] = [];
   if (requestedExtensions.length > 0) {
     // Package lookup is a user-scope trust boundary. Pi's legacy npm fallback
     // may execute the configured npmCommand to discover the global npm root,
-    // so project settings must not participate even though the normal resource
-    // loader below remains project-aware.
+    // so project settings must never participate.
     const packageLookupSettingsManager = SettingsManager.create(
       options.cwd,
       agentDir,
@@ -630,6 +678,7 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
   // extension runtime is mutable and session-owned.
   const cacheable =
     providerConfigs.length === 0 && additionalExtensionPaths.length === 0;
+  const cacheGeneration = hostDepsCacheGeneration;
   const key = JSON.stringify({
     agentDir,
     cwd: options.cwd,
@@ -677,6 +726,7 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
     const resolvedSettingsManager = SettingsManager.create(
       options.cwd,
       agentDir,
+      { projectTrusted: false },
     );
     if (testRetryBaseMs !== undefined) {
       installFastRetry(resolvedSettingsManager, testRetryBaseMs);
@@ -689,6 +739,16 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
       // interactive extension inventory. The only paths supplied here are the
       // explicitly allowlisted, user-scoped provider extensions.
       noExtensions: true,
+      // Global AGENTS.md files describe the parent harness, not the delegated
+      // task. Keep cwd/ancestor project context discovery, but remove Pi's
+      // global file and the legacy ~/.agents equivalent. This override also
+      // handles symlinked global files because it compares discovered paths.
+      agentsFilesOverride: ({ agentsFiles }) => ({
+        agentsFiles: agentsFiles.filter(
+          ({ path: contextPath }) =>
+            !isExcludedGlobalContextFile(contextPath, agentDir),
+        ),
+      }),
       ...(additionalExtensionPaths.length ? { additionalExtensionPaths } : {}),
       // When a named agent supplies a custom prompt, it becomes the loader's
       // customPrompt — overriding the default system prompt AgentSession would
@@ -742,16 +802,20 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
   if (!cacheable) return build();
 
   const promise = build().then((deps) => {
-    hostDepsCache.set(key, deps);
+    if (hostDepsCacheGeneration === cacheGeneration) {
+      hostDepsCache.set(key, deps);
+    }
     return deps;
   });
   hostDepsInflight.set(key, promise);
   try {
     return await promise;
   } finally {
-    // Clear the in-flight marker whether it succeeded or threw; the cache holds
-    // the result on success, and a failure leaves nothing for a retry to reuse.
-    hostDepsInflight.delete(key);
+    // An invalidation can let a newer generation install its own in-flight
+    // build for the same key. Never let the older promise delete that marker.
+    if (hostDepsInflight.get(key) === promise) {
+      hostDepsInflight.delete(key);
+    }
   }
 }
 
@@ -764,12 +828,25 @@ function installFastRetry(sm: SettingsManager, baseDelayMs: number): void {
   })) as never;
 }
 
-/** Test-only: clear the cache so a fresh (cwd, prompt) gets re-built. */
-export function _resetHostDepsCacheForTesting(): void {
+/**
+ * Invalidate cached host dependencies before a new delegate dispatch.
+ *
+ * A dispatch may still share one expensive resource reload across its parallel
+ * tasks, but the next dispatch observes auth, model, settings, and context-file
+ * edits made while Pi remains open. Existing sessions retain their already-built
+ * dependencies; clearing the maps never mutates live AgentSessions.
+ */
+export function invalidateHostDepsCache(): void {
+  hostDepsCacheGeneration++;
   hostDepsCache.clear();
   hostDepsInflight.clear();
 }
 
+/** Test-only alias retained for existing test setup. */
+export function _resetHostDepsCacheForTesting(): void {
+  invalidateHostDepsCache();
+}
+
 /**
  * Test-only: substitute the ModelRuntime factory. Pass a factory returning a
  * pre-authenticated runtime (e.g. the parent session's `modelRuntime`) so