@bermudi/pi-delegate 0.1.11 → 0.1.12

package/README.md

@@ -47,6 +47,20 @@ The other built-ins are:
   default. Set `workspace: "shared"` when a reviewer needs a persistent
   `sessionId`.
 
+### Shared-write safety
+
+Before starting work, Delegate resolves each task's real tools and physical Git
+root. If a task could mutate a shared tree that overlaps another task in the
+same call or a still-running sync/async dispatch, the new call is rejected
+before any subagent starts. Unknown tool names are treated as mutating. External
+processes are outside this in-process gate.
+
+Operators can deliberately bypass this check by setting
+`"allowUnsafeSharedWrites": true` in `~/.pi/agent/delegate.json`. This setting
+is intentionally absent from the model-facing tool API. It provides no
+isolation or rollback, and Delegate marks running and final results with a
+visible batch-level warning while it is active.
+
 A same-named Markdown file can override any built-in (first definition wins
 across `.pi/agents/`, `~/.pi/agent/agents/`, `~/.agents/`, `.claude/agents/`,
 `~/.claude/agents/`). A prompt-only override keeps the built-in's tools and
@@ -54,10 +68,20 @@ workspace — `scout` stays read-only and `reviewer` stays scratch unless the
 file explicitly sets `tools` or `workspace`. Fresh built-ins inherit the
 parent's exact model object and thinking level; an explicit `model`/`thinking`
 in the Markdown file replaces that inheritance. Task fields always win, and for
-`scout`/`coder`/`reviewer` settings overrides (`settings.json`
-`delegate.agentOverrides` / `delegate.agentOverridesByParentModel`) win over the
-Markdown file, while `default` ignores settings and uses only an explicit
-Markdown `model`/`thinking` when present.
+`scout`/`coder`/`reviewer` overrides in `~/.pi/agent/delegate.json`
+(`agentOverrides` / `agentOverridesByParentModel`) win over the
+Markdown file, while `default` ignores overrides and uses only an explicit
+Markdown `model`/`thinking` when present. `delegate.json` is the permanent
+config file (user scope, global), and edits apply from the next delegate call.
+
+For the v0.1.12 migration release only, legacy user and nearest-project
+`settings.json` `delegate.agentOverrides` /
+`delegate.agentOverridesByParentModel` still supply `model` and `thinking`
+when a modern value is absent. Modern `delegate.json` wins field-by-field.
+Legacy `tools` is never honored because a project file must not restore shell
+capability. This bridge is removed in v0.1.13. Project-local replacements are
+`.pi/agents/*.md` profiles or explicit task `model`/`thinking` fields; there
+will be no new project-level delegate config file.
 
 ### Disposable scratch workspace
 
@@ -84,6 +108,35 @@ This protects the real project from ordinary relative writes. It is not a
 security sandbox: unrestricted commands and absolute paths can still reach the
 host filesystem.
 
+### Git-native isolated writers
+
+Use `workspace: "isolated"` for synchronous, one-shot coding tasks that should
+run in parallel without sharing a working tree:
+
+```ts
+delegate({
+  tasks: [
+    { prompt: "Implement the parser change", workspace: "isolated" },
+    { prompt: "Update the parser tests", workspace: "isolated" },
+  ],
+});
+```
+
+Delegate snapshots tracked changes, deletions, and non-ignored untracked files
+into a private baseline commit without touching the user's index or branch.
+Each task gets a detached worktree. Successful proposals are captured as
+private refs and full binary patches, then reconciled in task-array order. A
+proposal applies all-or-nothing; conflicts retain the proposal ref, full patch,
+and conflict worktree. Before updating the source, Delegate checks that it
+still matches the baseline.
+
+A clean reconciliation reports `applied_unverified`: textual merging does not
+prove the code builds or tests pass, so the result includes a suggested
+verification call. Isolated mode currently requires Git, rejects async and
+session reuse, disables whole-task retries, and rejects repositories with
+submodules. It is separation, not confinement: absolute-path writes can still
+reach the host.
+
 ### Token accounting
 
 Sync delegate calls report aggregate subagent `Usage` on the tool result, so Pi

package/concurrency.ts

@@ -61,11 +61,7 @@ function acquireGlobal(signal?: AbortSignal): Promise<boolean> {
   });
 }
 
-function releaseGlobal(): void {
-  globalConcurrencyRunning--;
-  // Never hand a slot to a waiter whose signal already aborted. The abort
-  // listener normally removes it synchronously during abort() dispatch; this
-  // drain is defensive for any ordering edge.
+function removeAbortedWaiters(): void {
   while (
     globalConcurrencyWaiters.length > 0 &&
     globalConcurrencyWaiters[0]!.signal?.aborted
@@ -74,34 +70,77 @@ function releaseGlobal(): void {
     w.signal?.removeEventListener("abort", w.onAbort);
     w.resolve(false);
   }
-  if (globalConcurrencyWaiters.length > 0) {
-    globalConcurrencyRunning++;
-    const w = globalConcurrencyWaiters.shift()!;
-    w.signal?.removeEventListener("abort", w.onAbort);
-    w.resolve(true);
+}
+
+/** Wake the next eligible waiter if capacity allows. Returns true if a slot was
+ *  handed out (and `globalConcurrencyRunning` already incremented). */
+function wakeNextWaiter(): boolean {
+  removeAbortedWaiters();
+  if (
+    globalConcurrencyWaiters.length === 0 ||
+    globalConcurrencyRunning >= globalConcurrencyLimit
+  ) {
+    return false;
+  }
+  const w = globalConcurrencyWaiters.shift()!;
+  globalConcurrencyRunning++;
+  w.signal?.removeEventListener("abort", w.onAbort);
+  w.resolve(true);
+  return true;
+}
+
+function releaseGlobal(): void {
+  globalConcurrencyRunning--;
+  wakeNextWaiter();
+}
+
+/** Safely change the global concurrency cap at runtime.
+ *
+ *  Newly queued tasks observe the new limit immediately; already-running tasks
+ *  keep their slots. If the limit was raised, this wakes as many eligible
+ *  queued waiters as the new cap allows. Malformed limits fall back to 1. */
+export function reconfigureGlobalConcurrency(limit: number): void {
+  const safe =
+    typeof limit === "number" && Number.isFinite(limit) && limit > 0
+      ? limit
+      : 1;
+  globalConcurrencyLimit = Math.max(1, safe);
+  while (wakeNextWaiter()) {
+    // Wake up to the new limit.
   }
 }
 
 /** Test-only hook: override the global concurrency cap. */
 export function _setGlobalConcurrencyLimitForTesting(limit: number): void {
-  globalConcurrencyLimit = Math.max(1, limit);
+  reconfigureGlobalConcurrency(limit);
 }
 
-/** Test-only hook: reset the global semaphore to the configured cap. */
+/** Test-only hook: reset the global semaphore to the configured cap.
+ *  Counters and waiters are cleared *before* reconfiguring so the wake loop
+ *  inside reconfigureGlobalConcurrency cannot hand out slots against stale
+ *  bookkeeping (only to have them zeroed) or resolve waiters that the clears
+ *  then abandon. Called when the semaphore should be idle; clearing semantics
+ *  are unchanged — only the ordering is safe now. */
 export function _resetGlobalConcurrencyForTesting(): void {
-  globalConcurrencyLimit = Math.max(1, getMaxConcurrent());
   globalConcurrencyRunning = 0;
   globalConcurrencyWaiters.length = 0;
+  reconfigureGlobalConcurrency(getMaxConcurrent());
 }
 
-async function mapConcurrent<T, R>(
-  items: T[],
+export async function mapConcurrent<T, R>(
+  items: readonly T[],
   concurrency: number,
   fn: (item: T, index: number) => Promise<R>,
   signal?: AbortSignal,
 ): Promise<R[]> {
   if (items.length === 0) return [];
-  const limit = Math.max(1, Math.min(concurrency, items.length));
+  const safeConcurrency =
+    typeof concurrency === "number" &&
+    Number.isFinite(concurrency) &&
+    concurrency > 0
+      ? concurrency
+      : 1;
+  const limit = Math.max(1, Math.min(safeConcurrency, items.length));
   const results: R[] = new Array(items.length);
   let next = 0;
   const worker = async () => {