@bermudi/pi-delegate 0.1.0 → 0.1.2

package/host.ts

@@ -5,8 +5,10 @@
  *
  * `DefaultResourceLoader.reload()` is the one expensive step (~1.2s cold — it
  * scans for skills, prompts, agents.md files, system prompts). It is a
- * read-only cache for the parts we care about: skills, AGENTS.md/context files,
- * and the system prompt. `_buildRuntime` reads `resourceLoader.getExtensions()`
+ * read-only cache for the parts we care about: skills, project AGENTS.md/context
+ * files, and the system prompt. Global context is filtered at this seam so a
+ * child cannot inherit the parent's user-global instructions. `_buildRuntime`
+ * reads `resourceLoader.getExtensions()`
  * and the prompt/skill getters.
  *
  * **Extensions are disabled for subagents by default** (`noExtensions: true`).
@@ -78,7 +80,7 @@ export interface HostDepsOptions {
    * Custom system prompt for a named agent. When set, it overrides the default
    * system prompt the resource loader would otherwise discover. Extension-free
    * host deps are cached per (agentDir + cwd + systemPrompt): the expensive
-   * `reload()` (skills, AGENTS.md discovery) runs once per distinct combo, then
+   * `reload()` (skills, project AGENTS.md discovery) runs once per distinct combo, then
    * is reused across concurrent subagents. Provider-configured or
    * allowlisted-extension tasks always receive fresh host deps. For ad-hoc
    * tasks (no named agent) pass undefined to use the discovered prompt.
@@ -89,6 +91,8 @@ export interface HostDepsOptions {
 const hostDepsCache = new Map<string, HostDeps>();
 /** In-flight builds, so concurrent calls for the same key share one reload(). */
 const hostDepsInflight = new Map<string, Promise<HostDeps>>();
+/** Prevent a pre-invalidation build from repopulating or clearing newer state. */
+let hostDepsCacheGeneration = 0;
 
 function canonicalPath(candidate: string): string {
   try {
@@ -113,6 +117,33 @@ function isPathWithinDirectory(directory: string, candidate: string): boolean {
   );
 }
 
+const CONTEXT_FILE_NAMES = new Set([
+  "agents.override.md",
+  "agents.md",
+  "claude.override.md",
+  "claude.md",
+]);
+
+/**
+ * Delegate workers deliberately do not inherit user-global context files.
+ * Pi's standard global file lives under `agentDir`; `.agents/AGENTS.md` is a
+ * legacy convention used by other coding-agent harnesses. Compare lexical
+ * paths here rather than canonical paths: a user's global file is commonly a
+ * symlink, and the ResourceLoader reports the path it discovered, not its
+ * symlink target.
+ */
+function isExcludedGlobalContextFile(
+  filePath: string,
+  agentDir: string,
+): boolean {
+  const resolvedFilePath = resolve(filePath);
+  const roots = [resolve(agentDir), resolve(homedir(), ".agents")];
+  return roots.some((root) => {
+    const relativePath = relative(root, resolvedFilePath);
+    return CONTEXT_FILE_NAMES.has(relativePath.toLowerCase());
+  });
+}
+
 /**
  * Whether a managed package's canonical target remains in a user install root.
  *
@@ -301,6 +332,7 @@ function getConfiguredGitSource(
     host?: unknown;
     path?: unknown;
     ref?: unknown;
+    pinned?: unknown;
   };
   if (parsedSource.type !== "git") {
     throw new Error(
@@ -324,7 +356,22 @@ function getConfiguredGitSource(
       "A configured provider extension Git identity could not be verified; delegation stopped.",
     );
   }
-  if (parsedSource.ref === undefined) return repository;
+  // `ref` and `pinned` are a security contract from Pi's private parser. If a
+  // host upgrade drops either field, never reinterpret a pinned source as an
+  // unpinned checkout and silently skip commit validation.
+  if (typeof parsedSource.pinned !== "boolean") {
+    throw new Error(
+      "A configured provider extension Git pin state could not be verified; delegation stopped.",
+    );
+  }
+  if (!parsedSource.pinned) {
+    if (parsedSource.ref !== undefined) {
+      throw new Error(
+        "A configured provider extension Git ref could not be verified; delegation stopped.",
+      );
+    }
+    return repository;
+  }
   if (typeof parsedSource.ref !== "string" || parsedSource.ref.length === 0) {
     throw new Error(
       "A configured provider extension Git ref could not be verified; delegation stopped.",
@@ -579,8 +626,10 @@ let testModelRuntimeFactory: (() => Promise<ModelRuntime>) | undefined;
 
 /**
  * Lazily build the host deps for a task. Extension-free, provider-independent
- * deps are cached by (agentDir, cwd, systemPrompt); provider registrations and
- * allowlisted extensions get a private dependency graph for every session.
+ * deps are cached by (agentDir, cwd, systemPrompt) within one delegate dispatch;
+ * the extension invalidates the generation before the next dispatch so file
+ * edits become visible. Provider registrations and allowlisted extensions get
+ * a private dependency graph for every session.
  *
  * The first cached call pays the `resourceLoader.reload()` cost (~1.2s). An
  * extension-bearing call intentionally pays that cost again: sharing its
@@ -602,14 +651,13 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
   );
 
   // Resolve provider extensions before deciding whether to use the cache. This
-  // fails closed for missing sources while keeping package lookup's user-only
-  // settings isolated from the project-aware session settings built below.
+  // fails closed for missing sources while keeping both package lookup and child
+  // resource loading isolated from executable project settings.
   let additionalExtensionPaths: string[] = [];
   if (requestedExtensions.length > 0) {
     // Package lookup is a user-scope trust boundary. Pi's legacy npm fallback
     // may execute the configured npmCommand to discover the global npm root,
-    // so project settings must not participate even though the normal resource
-    // loader below remains project-aware.
+    // so project settings must never participate.
     const packageLookupSettingsManager = SettingsManager.create(
       options.cwd,
       agentDir,
@@ -630,6 +678,7 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
   // extension runtime is mutable and session-owned.
   const cacheable =
     providerConfigs.length === 0 && additionalExtensionPaths.length === 0;
+  const cacheGeneration = hostDepsCacheGeneration;
   const key = JSON.stringify({
     agentDir,
     cwd: options.cwd,
@@ -677,6 +726,7 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
     const resolvedSettingsManager = SettingsManager.create(
       options.cwd,
       agentDir,
+      { projectTrusted: false },
     );
     if (testRetryBaseMs !== undefined) {
       installFastRetry(resolvedSettingsManager, testRetryBaseMs);
@@ -689,6 +739,16 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
       // interactive extension inventory. The only paths supplied here are the
       // explicitly allowlisted, user-scoped provider extensions.
       noExtensions: true,
+      // Global AGENTS.md files describe the parent harness, not the delegated
+      // task. Keep cwd/ancestor project context discovery, but remove Pi's
+      // global file and the legacy ~/.agents equivalent. This override also
+      // handles symlinked global files because it compares discovered paths.
+      agentsFilesOverride: ({ agentsFiles }) => ({
+        agentsFiles: agentsFiles.filter(
+          ({ path: contextPath }) =>
+            !isExcludedGlobalContextFile(contextPath, agentDir),
+        ),
+      }),
       ...(additionalExtensionPaths.length ? { additionalExtensionPaths } : {}),
       // When a named agent supplies a custom prompt, it becomes the loader's
       // customPrompt — overriding the default system prompt AgentSession would
@@ -742,16 +802,20 @@ export async function getHostDeps(options: HostDepsOptions): Promise<HostDeps> {
   if (!cacheable) return build();
 
   const promise = build().then((deps) => {
-    hostDepsCache.set(key, deps);
+    if (hostDepsCacheGeneration === cacheGeneration) {
+      hostDepsCache.set(key, deps);
+    }
     return deps;
   });
   hostDepsInflight.set(key, promise);
   try {
     return await promise;
   } finally {
-    // Clear the in-flight marker whether it succeeded or threw; the cache holds
-    // the result on success, and a failure leaves nothing for a retry to reuse.
-    hostDepsInflight.delete(key);
+    // An invalidation can let a newer generation install its own in-flight
+    // build for the same key. Never let the older promise delete that marker.
+    if (hostDepsInflight.get(key) === promise) {
+      hostDepsInflight.delete(key);
+    }
   }
 }
 
@@ -764,12 +828,25 @@ function installFastRetry(sm: SettingsManager, baseDelayMs: number): void {
   })) as never;
 }
 
-/** Test-only: clear the cache so a fresh (cwd, prompt) gets re-built. */
-export function _resetHostDepsCacheForTesting(): void {
+/**
+ * Invalidate cached host dependencies before a new delegate dispatch.
+ *
+ * A dispatch may still share one expensive resource reload across its parallel
+ * tasks, but the next dispatch observes auth, model, settings, and context-file
+ * edits made while Pi remains open. Existing sessions retain their already-built
+ * dependencies; clearing the maps never mutates live AgentSessions.
+ */
+export function invalidateHostDepsCache(): void {
+  hostDepsCacheGeneration++;
   hostDepsCache.clear();
   hostDepsInflight.clear();
 }
 
+/** Test-only alias retained for existing test setup. */
+export function _resetHostDepsCacheForTesting(): void {
+  invalidateHostDepsCache();
+}
+
 /**
  * Test-only: substitute the ModelRuntime factory. Pass a factory returning a
  * pre-authenticated runtime (e.g. the parent session's `modelRuntime`) so

package/leaf.ts

@@ -0,0 +1,48 @@
+/**
+ * Session-tree leaf affinity for async tickets.
+ *
+ * An async ticket outlives the turn that spawned it. `/tree` navigation moves
+ * the session to a different leaf **within the same session file**: no
+ * `session_shutdown` fires, the extension runtime stays live, and the ticket
+ * keeps running. When it finishes, `deliverTicketResults` wakes the agent at
+ * whatever leaf is active *now* — which may be a branch that knows nothing
+ * about the task. See GitHub issue #30.
+ *
+ * pi exposes no "what leaf am I on?" query, so the current leaf has to be
+ * tracked from the `session_tree` event (`newLeafId`). That event also fires
+ * for extension-driven `ctx.navigateTree`, so this tracking covers navigation
+ * that never passed the `session_before_tree` confirm guard.
+ *
+ * State is runtime-scoped: `resetLeafTracking()` on session shutdown, since a
+ * replacement session starts on its own (unknown) leaf.
+ */
+import type { AsyncTicket } from "./types.ts";
+
+/** Leaf the session is currently on. `undefined` means no navigation has been
+ *  observed by this runtime — i.e. the leaf the session opened on. */
+let currentLeafId: string | null | undefined;
+
+/** Record a completed `/tree` navigation. */
+export function recordTreeNavigation(newLeafId: string | null): void {
+  currentLeafId = newLeafId;
+}
+
+/** Leaf id to stamp on a ticket at spawn time. */
+export function getCurrentLeafId(): string | null | undefined {
+  return currentLeafId;
+}
+
+export function resetLeafTracking(): void {
+  currentLeafId = undefined;
+}
+
+/** True when the session has navigated away from the leaf that spawned this
+ *  ticket, so delivering its result would wake the agent on a foreign branch.
+ *
+ *  Navigating away and back to the spawn leaf yields a fresh leaf id and is
+ *  therefore reported as cross-leaf. That false positive is deliberate: the
+ *  cross-leaf path only downgrades delivery to non-waking, and reconstructing
+ *  true leaf identity across a round trip is not worth the complexity. */
+export function isCrossLeafTicket(ticket: AsyncTicket): boolean {
+  return ticket.spawnLeafId !== currentLeafId;
+}