@caupulican/pi-adaptative 0.94.1 → 0.95.0

package/dist/bundled-resources/extensions/tmux-agent-manager/index.js

@@ -4,9 +4,9 @@ import * as fs from "node:fs";
 import { homedir } from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { getProcessWorkRun, PI_ORCHESTRATION_AGENT_ID_ENV, } from "@caupulican/pi-adaptative";
+import { encodeWorkerSessionAllowedPaths, getProcessWorkRun, orchestrationThinkingLevelSchema, PI_ORCHESTRATION_AGENT_ID_ENV, PI_WORKER_ALLOWED_PATHS_ENV, } from "@caupulican/pi-adaptative";
 import { Type } from "typebox";
-import { buildGrant, buildGrantUsageEntry, buildLaunchProfileFlags, buildTombstone, countGrantUsages, DEFAULT_READ_BIASED_TOOLS, decodeTmuxWorkerUsageClaim, describeGrant, GRANT_CUSTOM_TYPE, GRANT_USAGE_CUSTOM_TYPE, grantCovers, isTmuxDispatchGrant, isTmuxDispatchGrantTombstone, launchProfileSourceFromGrant, ONE_SHOT_LAUNCH_PROFILE_SOURCE, } from "./dispatch-grant.js";
+import { buildLaunchProfileFlags, DEFAULT_MANAGED_WORKER_TOOLS, decodeTmuxWorkerUsageClaim, deriveWorkerLaunchProfile, } from "./launch-profile.js";
 export const piConfig = { tools: ["tmux_agent_manager"] };
 function agentLaneId(jobId, agentId) {
     return `tmux:${jobId}:${agentId}`;
@@ -18,36 +18,24 @@ function managedDispatch(job, agent) {
     return {
         sequence,
         instructions,
-        profileId: `tmux:${agent.provider}`,
+        profileId: agent.dispatchProfileId ?? `tmux:${agent.provider}`,
         provider: agent.provider,
         authorizationId,
         authorizationKind: agent.dispatchAuthorizationKind ?? "legacy-recovery",
-        allowedTools: agent.dispatchAllowedTools ?? DEFAULT_READ_BIASED_TOOLS,
+        allowedTools: agent.dispatchAllowedTools ?? DEFAULT_MANAGED_WORKER_TOOLS,
         writePaths: agent.dispatchWritePaths ?? [],
-        ...(agent.dispatchMaxCostUsd !== undefined ? { maxCostUsd: agent.dispatchMaxCostUsd } : {}),
         leaseTtlMs: agent.dispatchLeaseTtlMs ?? job.deadlineSeconds * 1_000,
     };
 }
-function managedAuthorization(grant, fallbackId) {
-    const launchSource = grant ? launchProfileSourceFromGrant(grant) : ONE_SHOT_LAUNCH_PROFILE_SOURCE;
-    return {
-        authorizationId: grant?.grantId ?? fallbackId,
-        authorizationKind: grant ? "standing-grant" : "one-shot-owner-approval",
-        launchSource,
-        allowedTools: [...(launchSource.allowedTools?.length ? launchSource.allowedTools : DEFAULT_READ_BIASED_TOOLS)],
-        writePaths: [...(launchSource.writePaths ?? [])],
-        ...(grant?.budget.maxUsdAdvisory !== undefined ? { maxCostUsd: grant.budget.maxUsdAdvisory } : {}),
-    };
+function applyManagedProfile(agent, profile, args) {
+    agent.dispatchProfileId = profile.identity;
+    agent.dispatchAuthorizationId = profile.identity;
+    agent.dispatchAuthorizationKind = "profile-derived";
+    agent.dispatchAllowedTools = [...profile.allowedTools];
+    agent.dispatchWritePaths = [...profile.writePaths];
+    applyManagedTurn(agent, args);
 }
-function applyManagedAuthorization(agent, authorization, args) {
-    agent.dispatchAuthorizationId = authorization.authorizationId;
-    agent.dispatchAuthorizationKind = authorization.authorizationKind;
-    agent.dispatchAllowedTools = [...authorization.allowedTools];
-    agent.dispatchWritePaths = [...authorization.writePaths];
-    if (authorization.maxCostUsd !== undefined)
-        agent.dispatchMaxCostUsd = authorization.maxCostUsd;
-    else
-        delete agent.dispatchMaxCostUsd;
+function applyManagedTurn(agent, args) {
     agent.dispatchInstructions = args.instructions;
     agent.dispatchGoalId = args.goalId;
     agent.dispatchLeaseTtlMs = args.leaseTtlMs;
@@ -108,13 +96,6 @@ function reportManagedAgentFailure(bridge, jobId, agentId, reasonCode) {
         // Preserve the launch failure; durable leases fence any terminal-report failure.
     }
 }
-function sameStringValues(left, right) {
-    if (left.length !== right.length)
-        return false;
-    const sortedLeft = [...left].sort();
-    const sortedRight = [...right].sort();
-    return sortedLeft.every((value, index) => value === sortedRight[index]);
-}
 const EXTENSION_ROOT = path.dirname(fileURLToPath(import.meta.url));
 export function getTmuxAgentManagerDataRoot() {
     const agentDir = process.env.PI_ADAPTATIVE_CODING_AGENT_DIR ||
@@ -167,7 +148,7 @@ const TEAM_TEMPLATES = [
         ],
         notes: [
             "Use only when model-token/auth validation is intended.",
-            "The manager opens each CLI in tmux, injects the prompt, captures pane output, and watches DONE/BLOCKED markers.",
+            "The manager arms pane capture, starts each CLI with its task, and watches DONE/BLOCKED markers.",
         ],
     },
     {
@@ -196,7 +177,7 @@ const TEAM_TEMPLATES = [
             { provider: "pi", name: "coordinator" },
         ],
         notes: [
-            "Use for owner-approved implementation/QA batches; never claim complete until result files and validation evidence are inspected.",
+            "Use for implementation/QA batches; never claim complete until result files and validation evidence are inspected.",
         ],
     },
 ];
@@ -335,7 +316,7 @@ function formatDetection(d) {
 }
 function setupHelp(d) {
     if (d.cliAvailable)
-        return `tmux CLI available: ${d.tmuxBin || "tmux"}\nUse native delegate for ordinary subagents. Use tmux_agent_manager only for an owner-requested persistent interactive pane; set dryRun=true only when a preview is useful.`;
+        return `tmux CLI available: ${d.tmuxBin || "tmux"}\nUse native delegate for ordinary subagents. Use tmux_agent_manager when a persistent interactive provider pane benefits the task; set dryRun=true only when a preview is useful.`;
     return [
         "tmux CLI not found.",
         "Ordinary subagents remain available through native delegate; do not abort delegation.",
@@ -358,10 +339,10 @@ async function guardTmux(_ctx, detection, purpose) {
 }
 function tmuxManagerInstructions(toolName, detection) {
     return [
-        `tmux is available (${detection.version || detection.tmuxBin || "tmux"}). Native delegate remains the standard subagent route. Use tmux_agent_manager for managed ${toolName} panes only when the owner explicitly requested persistent interactive provider processes.`,
+        `tmux is available (${detection.version || detection.tmuxBin || "tmux"}). Native delegate remains the standard subagent route. Use tmux_agent_manager when managed ${toolName} panes need persistent interactive provider processes.`,
         "Suggested next call:",
         'tmux_agent_manager({ action: "fire_task", teamTemplate: "builder-validator", task: "<objective>" })',
-        "The launch returns immediately after panes, event watchers, and prompt handoffs are armed.",
+        "The launch returns after pane capture is armed and each provider command receives its initial task.",
         "Managed mode creates panes, prompt files, result files, event-driven terminal handoffs, tmux display-message notifications, @pi_* status options, shared variables, and one-shot deadlines.",
     ].join("\n");
 }
@@ -464,12 +445,25 @@ function normalizeAgents(params) {
         if (!Object.hasOwn(PROVIDER_COMMANDS, provider))
             throw new Error(`unsupported provider: ${provider}`);
         const name = firstString(agent.name, provider === "custom" ? `custom-${index + 1}` : provider) || `agent-${index + 1}`;
-        const baseCommand = firstString(agent.command, PROVIDER_COMMANDS[provider]);
-        if (!baseCommand)
+        const command = firstString(agent.command, PROVIDER_COMMANDS[provider]);
+        if (!command)
             throw new Error(`agent ${name} needs command when provider=custom`);
         const tools = Array.isArray(agent.tools) && agent.tools.length > 0 ? agent.tools : undefined;
-        const command = tools ? `${baseCommand} --tools ${tools.join(",")}` : baseCommand;
-        return { provider, name, command, cwd: agent.cwd, tools, worktreeLane: agent.worktreeLane };
+        const resourceProfile = firstString(agent.resourceProfile);
+        if (provider !== "pi" && (tools || resourceProfile || agent.thinkingLevel || agent.worktreeLane)) {
+            throw new Error(`agent ${name}: tools, resourceProfile, thinkingLevel, and worktreeLane overrides are Pi-only; configure ${provider}'s native CLI in command instead`);
+        }
+        return {
+            provider,
+            name,
+            command,
+            path: firstString(agent.path),
+            cwd: agent.cwd,
+            tools,
+            resourceProfile,
+            thinkingLevel: agent.thinkingLevel,
+            worktreeLane: agent.worktreeLane,
+        };
     });
 }
 function defaultProviderInvocation(provider) {
@@ -491,6 +485,13 @@ function defaultProviderInvocation(provider) {
 function interactivePromptText(prompt) {
     return prompt.replace(/\r?\n/g, "\\n");
 }
+function initialPromptInvocation(command, provider, promptPath) {
+    const promptArgument = `"$(cat ${quoteShell(promptPath)})"`;
+    if (provider === "agy" && !/(?:^|\s)(?:-i|--prompt-interactive)(?:\s|$)/.test(command)) {
+        return `${command} --prompt-interactive ${promptArgument}`;
+    }
+    return `${command} ${promptArgument}`;
+}
 function spellMarker(marker) {
     return marker.split("").join(" ");
 }
@@ -506,7 +507,7 @@ function managedPrompt(task, jobId, agent, doneMarker, blockedMarker, varsPath)
         "Rules:",
         "- Work autonomously until honest PASS or BLOCKED.",
         "- Verify important claims before PASS; include concise evidence.",
-        "- If user input, credentials, destructive approval, publishing, or unavailable dependency blocks you, report BLOCKED instead of waiting silently.",
+        "- Use the assigned profile without asking for routine permission. Report BLOCKED only when missing external information or an unavailable dependency makes the objective impossible.",
         "- Never print secrets/tokens. Prompts, commands, and logs persist under ~/.pi/agent/work/background/tmux-agent-manager/state/jobs.",
         "- If a task names an external decision variable, read it only at the decision point; never loop or poll the shared JSON file.",
         "",
@@ -521,7 +522,7 @@ function buildWorkspacePlan(ctx, params) {
     const cwd = resolveCwd(ctx, params.cwd);
     const agents = normalizeAgents(params).map((agent, index) => ({
         ...agent,
-        cwd: resolveCwd(ctx, agent.cwd || cwd),
+        cwd: resolveCwd(ctx, agent.path || agent.cwd || cwd),
         id: `${safeName(agent.name || agent.provider || "agent")}-${index + 1}`,
     }));
     const workspaceName = firstString(params.workspaceName, `pi-agents-${Date.now().toString(36)}`) || "pi-agents";
@@ -599,7 +600,12 @@ export function makePaneWatcherScript(job) {
         "  sleep_pid=$!",
         '  wait "$sleep_pid" 2>/dev/null || exit 0',
         "  sleep_pid=",
-        '  if [ -e "$stop_request_path" ]; then finish stopped stop-requested-event; else finish timeout deadline-event; fi',
+        '  if [ -e "$stop_request_path" ]; then',
+        "    finish stopped stop-requested-event",
+        "  else",
+        "    finish timeout deadline-event",
+        '    [ -z "$pane_id" ] || tmux kill-pane -t "$pane_id" >/dev/null 2>&1 || true',
+        "  fi",
         '  kill -TERM "$parent_pid" 2>/dev/null || true',
         ") &",
         "timer_pid=$!",
@@ -644,15 +650,16 @@ function buildFireTaskPlan(ctx, params) {
     if (!task)
         throw new Error("fire_task requires task (or body) with the worker objective");
     const cwd = resolveCwd(ctx, params.cwd);
-    const id = firstString(params.jobId) || makeJobId();
+    const id = firstString(params.launchKey) || makeJobId();
     if (!/^[a-zA-Z0-9_.:-]{4,80}$/.test(id))
-        throw new Error("jobId must be 4-80 chars: letters, numbers, _, ., :, or -");
+        throw new Error("launchKey must be 4-80 chars: letters, numbers, _, ., :, or -");
     const jobDir = path.join(jobsRoot(), id);
     const workspaceName = firstString(params.workspaceName, `Pi job ${id}`) || `Pi job ${id}`;
     const sessionName = safeName(workspaceName, id);
     const rawAgents = normalizeAgents(params);
     const agents = rawAgents.map((agent, index) => {
         const provider = agent.provider || "custom";
+        const agentCwd = resolveCwd(ctx, agent.path || agent.cwd || cwd);
         const slug = `${safeName(agent.name || provider)}-${index + 1}`;
         const markerBase = `TMUX_${crypto.createHash("sha1").update(`${id}:${slug}`).digest("hex").slice(0, 10).toUpperCase()}`;
         const doneMarker = `${markerBase}_DONE`;
@@ -662,14 +669,17 @@ function buildFireTaskPlan(ctx, params) {
             name: firstString(agent.name, provider) || slug,
             provider,
             command: firstString(agent.command, PROVIDER_COMMANDS[provider]),
-            cwd: resolveCwd(ctx, agent.cwd || cwd),
-            // tools already baked into command by normalizeAgents
+            cwd: agentCwd,
+            dispatchAllowedTools: agent.tools ? [...agent.tools] : undefined,
+            dispatchWritePaths: agent.path ? [agentCwd] : undefined,
             doneMarker,
             blockedMarker,
             promptPath: path.join(jobDir, `${slug}.prompt.md`),
             logPath: path.join(jobDir, `${slug}.log`),
             resultPath: path.join(jobDir, `${slug}.result.json`),
             worktreeLane: agent.worktreeLane,
+            resourceProfile: agent.resourceProfile,
+            thinkingLevel: agent.thinkingLevel,
         };
     });
     const job = {
@@ -689,7 +699,7 @@ function buildFireTaskPlan(ctx, params) {
         agents,
         launchCommands: [],
     };
-    job.launchCommands = agents.map((agent) => `${agent.command || defaultProviderInvocation(agent.provider)} then inject ${path.basename(agent.promptPath)}`);
+    job.launchCommands = agents.map((agent) => `${agent.command || defaultProviderInvocation(agent.provider)} with initial task from ${path.basename(agent.promptPath)}`);
     return job;
 }
 function archiveExistingJobDir(jobDir) {
@@ -703,7 +713,7 @@ function prepareJobDirForLaunch(job, force) {
     if (!fs.existsSync(job.jobDir))
         return undefined;
     if (!force)
-        throw new Error(`tmux job already exists: ${job.id}. Use a new jobId, or pass force:true to archive the old job before launching.`);
+        throw new Error(`tmux job already exists: ${job.id}. Use a new launchKey, or pass force:true to archive the old job before launching.`);
     return archiveExistingJobDir(job.jobDir);
 }
 function writeFireTaskFiles(job) {
@@ -811,7 +821,7 @@ function sendCommandToPane(paneId, command) {
     requireTmuxRun(runTmux(["send-keys", "-t", paneId, "-l", command]), `tmux command injection for ${paneId}`);
     requireTmuxRun(runTmux(["send-keys", "-t", paneId, "Enter"]), `tmux command submit for ${paneId}`);
 }
-function launchTmuxSession(sessionName, cwd, panes) {
+function launchTmuxSession(sessionName, cwd, panes, options = {}) {
     if (tmuxSessionExists(sessionName))
         throw new Error(`tmux session already exists: ${sessionName}. Use stop_session/stop_job first or choose a different workspaceName.`);
     const runs = [];
@@ -824,7 +834,8 @@ function launchTmuxSession(sessionName, cwd, panes) {
     try {
         const firstPane = create.stdout.trim();
         paneIds.push(firstPane);
-        sendCommandToPane(firstPane, first.command);
+        if (!options.deferCommands)
+            sendCommandToPane(firstPane, first.command);
         for (const pane of panes.slice(1)) {
             const split = runTmux(["split-window", "-d", "-P", "-F", "#{pane_id}", "-t", `${sessionName}:0`, "-c", pane.cwd || cwd], 5_000);
             runs.push(split);
@@ -832,7 +843,8 @@ function launchTmuxSession(sessionName, cwd, panes) {
                 throw new Error(`tmux split-window failed: ${split.error || split.stderr || `exit ${split.status}`}`);
             const paneId = split.stdout.trim();
             paneIds.push(paneId);
-            sendCommandToPane(paneId, pane.command);
+            if (!options.deferCommands)
+                sendCommandToPane(paneId, pane.command);
         }
         runs.push(runTmux(["select-layout", "-t", `${sessionName}:0`, "tiled"], 3_000));
         return { runs, paneIds };
@@ -1125,98 +1137,53 @@ function setVariable(jobId, name, value) {
     fs.writeFileSync(job.varsPath, `${JSON.stringify(current, null, 2)}\n`, { mode: 0o600 });
     return { varsPath: job.varsPath, variables: current.variables, updatedAt: current.updatedAt };
 }
-// ---------------------------------------------------------------------------
-// STANDING GRANT — approval-gated tmux dispatch. The pure decode/decision logic lives in
-// dispatch-grant.ts; the functions below are the session-access GLUE: read the latest grant custom
-// entry (skipping past malformed payloads, but stopping DEAD on a tombstone — never resurrecting an
-// older grant beneath a revocation), count spend, and gate a real launch.
-// ---------------------------------------------------------------------------
-/** Most recent VALID `tmux-dispatch-grant` entry on the active branch, or undefined when there is
- * none, it was revoked (a tombstone is a hard stop — never skipped to find an older grant), or every
- * entry found fails to decode. Mirrors the branch-walk idiom used by goal/task session state. */
-function resolveLatestGrantEntry(ctx) {
-    let fromId;
-    for (;;) {
-        const entry = ctx.sessionManager.getLatestCustomEntryOnBranch(GRANT_CUSTOM_TYPE, fromId);
-        if (!entry)
-            return undefined;
-        if (isTmuxDispatchGrantTombstone(entry.data))
-            return undefined;
-        if (isTmuxDispatchGrant(entry.data))
-            return entry.data;
-        if (!entry.parentId)
-            return undefined;
-        fromId = entry.parentId;
-    }
-}
-/** Decoded `data` payloads of every custom entry of `customType` on the active branch (root→leaf
- * order), for spend-counting — a single `getLatestCustomEntryOnBranch` call only ever returns ONE
- * entry, but budget spend requires ALL of them. */
-function collectCustomEntryData(ctx, customType) {
-    const result = [];
-    for (const entry of ctx.sessionManager.getBranch()) {
-        const loose = entry;
-        if (loose.type === "custom" && loose.customType === customType)
-            result.push(loose.data);
-    }
-    return result;
-}
-/** Gate a REAL tmux dispatch (fire_task non-dryRun, send_followup) per the standing-grant doctrine:
- * a valid covering grant dispatches UNATTENDED (spending one usage); absent that, an
- * interactive host may approve a ONE-SHOT launch; absent BOTH, this REFUSES — never a silent launch.
- * Returns the covering grant when one authorized this launch (so the caller can derive launch-profile
- * flags from its envelope), or `{}` for a one-shot approval (no envelope to derive from — the caller
- * falls back to the conservative default profile). */
-async function authorizeLaunch(bridge, ctx, request) {
-    if (request.agents.length === 0)
-        throw new Error("tmux dispatch refused: launch has no agents");
-    const grant = resolveLatestGrantEntry(ctx);
-    // A standing grant names one provider. It must cover every child and spend one unit for every
-    // child process; a matching first pane must never authorize an unrestricted mixed team.
-    if (grant && request.agents.every((agent) => grantCovers(grant, { agent, goalId: request.goalId }))) {
-        const used = countGrantUsages(grant.grantId, collectCustomEntryData(ctx, GRANT_USAGE_CUSTOM_TYPE));
-        if (grant.budget.maxLaunches - used >= request.agents.length) {
-            if (!bridge.appendEntry)
-                throw new Error("this host does not support session custom entries; cannot spend the tmux dispatch grant.");
-            for (let index = 0; index < request.agents.length; index++) {
-                bridge.appendEntry(GRANT_USAGE_CUSTOM_TYPE, buildGrantUsageEntry(grant.grantId, `${request.jobId}:${index}`));
-            }
-            return { grant };
-        }
-    }
-    if (ctx.hasUI) {
-        const approved = await ctx.ui.confirm("tmux dispatch approval", [
-            `No standing grant currently authorizes every child of: ${request.description}.`,
-            `Agents: ${request.agents.join(", ")}${request.goalId ? `, goal: ${request.goalId}` : ""}.`,
-            "Approve this ONE-SHOT launch? Run tmux_agent_manager action=grant_dispatch to authorize future launches without this prompt.",
-        ].join("\n"));
-        if (!approved)
-            throw new Error(`tmux dispatch declined by the owner: ${request.description}`);
-        return {};
-    }
-    throw new Error(`no standing grant for tmux dispatch; run grant_dispatch first: every child must be covered. ${request.description}. Refusing to launch without a grant or interactive approval.`);
-}
-/** Render grant/one-shot-derived launch-profile flags into a pi child's start command. Values
- * are shell-quoted; flags are not (they're fixed literals, never user input). */
+/** Render a host-derived launch profile into a Pi child's start command. Values are shell-quoted;
+ * flags are fixed literals. */
 function appendLaunchProfileFlags(command, flags) {
     const rendered = flags.map((flag) => flag.value !== undefined ? `${flag.flag} ${quoteShell(flag.value)}` : flag.flag);
     return [command, ...rendered].join(" ");
 }
-/** Apply the launch profile to every provider="pi" agent in the job (fire_task only — send_followup
- * reuses an already-launched pane, so there is no new child command to configure). Non-pi agents are
- * bounded by the grant only at the launch layer (agent/budget/count); their internal tool-loop
- * enforcement is the target CLI's own responsibility (documented limitation, not a hidden gap). */
-function applyLaunchProfile(job, source) {
-    for (const agent of job.agents) {
-        if (agent.provider !== "pi")
-            continue;
-        // Per-agent flags: `worktreeLane` is a per-agent property (only a lane-first goal->tmux
-        // dispatch sets it), so the shared `source` envelope is extended with it just for this agent's
-        // flag build -- every other agent in a multi-agent team keeps the plain grant-derived profile.
-        const flags = buildLaunchProfileFlags(agent.worktreeLane ? { ...source, worktreeLane: agent.worktreeLane } : source);
-        const profiledCommand = appendLaunchProfileFlags(agent.command || defaultProviderInvocation(agent.provider), flags);
-        agent.command = `env ${PI_ORCHESTRATION_AGENT_ID_ENV}=${quoteShell(agentLaneId(job.id, agent.id))} ${profiledCommand}`;
+function deriveLaunchProfile(bridge, ctx, job, agent, goalId) {
+    if (agent.provider !== "pi") {
+        return deriveWorkerLaunchProfile({
+            identity: `tmux-profile:${job.id}:${agent.id}`,
+            // External interactive CLIs expose their own native, unrestricted tool surfaces. Model the
+            // managed boundary honestly as one host-trusted process instead of projecting Pi tool names.
+            allowedTools: ["bash"],
+            writePaths: [],
+            parentPid: process.pid,
+            parentSession: ctx.sessionManager.getSessionId?.() ?? ctx.sessionManager.getSessionFile(),
+            taskRef: goalId,
+        });
     }
+    const effectiveResources = agent.resourceProfile ? undefined : bridge.getEffectiveResourceProfile?.();
+    const serializedResources = effectiveResources && Object.keys(effectiveResources).length > 0 ? JSON.stringify(effectiveResources) : undefined;
+    const inheritedResourceProfile = serializedResources
+        ? `tmux-inherited-${crypto.createHash("sha256").update(serializedResources).digest("hex").slice(0, 12)}`
+        : undefined;
+    return deriveWorkerLaunchProfile({
+        identity: `tmux-profile:${job.id}:${agent.id}`,
+        inheritedTools: bridge.getActiveTools?.(),
+        allowedTools: agent.dispatchAllowedTools,
+        resourceProfile: agent.resourceProfile ?? inheritedResourceProfile,
+        resourceProfileJson: inheritedResourceProfile && effectiveResources
+            ? JSON.stringify({ [inheritedResourceProfile]: effectiveResources })
+            : undefined,
+        writePaths: agent.dispatchWritePaths ?? (agent.worktreeLane ? [agent.cwd] : []),
+        thinkingLevel: agent.thinkingLevel ?? bridge.getThinkingLevel?.(),
+        worktreeLane: agent.worktreeLane,
+        parentPid: process.pid,
+        parentSession: ctx.sessionManager.getSessionId?.() ?? ctx.sessionManager.getSessionFile(),
+        taskRef: goalId,
+    });
+}
+/** Apply the already-compiled immutable profile to a Pi child. Other provider CLIs retain their own
+ * native tool surface; the profile remains the host's durable audit contract for every provider. */
+function applyLaunchProfile(job, agent, profile) {
+    if (agent.provider !== "pi")
+        return;
+    const profiledCommand = appendLaunchProfileFlags(agent.command || defaultProviderInvocation(agent.provider), buildLaunchProfileFlags(profile));
+    agent.command = `env ${PI_ORCHESTRATION_AGENT_ID_ENV}=${quoteShell(agentLaneId(job.id, agent.id))} ${PI_WORKER_ALLOWED_PATHS_ENV}=${quoteShell(encodeWorkerSessionAllowedPaths(profile.writePaths))} ${profiledCommand}`;
 }
 /** Read an OPTIONAL, cooperative worker-reported usage claim for the turn that just went terminal (a
  * sibling `<result-path>.usage.json` file next to the watcher's own result file). Absent file ⇒ no
@@ -1286,62 +1253,6 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
             details: { action, jobId: params.jobId, variableName: params.variableName, result },
         };
     }
-    if (action === "grant_dispatch") {
-        if (!params.agent)
-            throw new Error("grant_dispatch requires agent");
-        if (!Object.hasOwn(PROVIDER_COMMANDS, params.agent))
-            throw new Error(`grant_dispatch: unsupported agent: ${params.agent}`);
-        const grantParams = {
-            agent: params.agent,
-            goalId: params.goalId,
-            allowedTools: params.allowedTools,
-            resourceProfile: params.resourceProfile,
-            writePaths: params.writePaths,
-            maxLaunches: typeof params.maxLaunches === "number" ? params.maxLaunches : Number.NaN,
-            expiresInMinutes: params.expiresInMinutes,
-            maxUsdAdvisory: params.maxUsdAdvisory,
-        };
-        const grant = buildGrant(grantParams);
-        const summary = describeGrant(grant);
-        // OWNER-AUTHORIZED, NEVER SILENT: an interactive host must explicitly confirm the exact
-        // grant details; a non-interactive host (print/rpc, or the unattended goal loop) has no confirm
-        // surface, so it needs an explicit opt-in flag instead — absent either, refuse to create the grant.
-        if (ctx.hasUI) {
-            const approved = await ctx.ui.confirm("Authorize tmux dispatch grant", summary);
-            if (!approved)
-                throw new Error("grant_dispatch was declined by the owner.");
-        }
-        else if (bridge.getFlag?.("allow-tmux-dispatch") !== true) {
-            throw new Error("grant_dispatch requires interactive approval; no UI is available in this mode. Pass --allow-tmux-dispatch to authorize grant creation non-interactively.");
-        }
-        if (!bridge.appendEntry)
-            throw new Error("this host does not support session custom entries; cannot persist a tmux dispatch grant.");
-        bridge.appendEntry(GRANT_CUSTOM_TYPE, grant);
-        return {
-            content: [{ type: "text", text: `Created tmux dispatch grant ${grant.grantId}.\n${summary}` }],
-            details: { action, grant },
-        };
-    }
-    if (action === "revoke_grant") {
-        const activeGrant = resolveLatestGrantEntry(ctx);
-        const targetGrantId = firstString(params.grantId) || activeGrant?.grantId;
-        if (!targetGrantId)
-            throw new Error("revoke_grant: no active tmux dispatch grant to revoke.");
-        if (activeGrant && activeGrant.grantId !== targetGrantId)
-            throw new Error(`revoke_grant: grantId ${targetGrantId} is not the active grant (active: ${activeGrant.grantId}).`);
-        if (!bridge.appendEntry)
-            throw new Error("this host does not support session custom entries; cannot revoke a tmux dispatch grant.");
-        bridge.appendEntry(GRANT_CUSTOM_TYPE, buildTombstone(targetGrantId));
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `Revoked tmux dispatch grant ${targetGrantId}. Future launches need a new grant_dispatch or interactive/opt-in approval.`,
-                },
-            ],
-            details: { action, grantId: targetGrantId },
-        };
-    }
     const guard = await guardTmux(ctx, detection, `tmux ${action}`);
     if (!guard.allowed)
         return { content: [{ type: "text", text: guard.text }], details: { action, detection, guard, skipped: true } };
@@ -1406,33 +1317,19 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
             };
         if (tmuxSessionExists(job.sessionName))
             throw new Error(`tmux session already exists: ${job.sessionName}. Use stop_job/stop_session first or choose a different workspaceName.`);
-        // APPROVAL-GATED LAUNCH: resolved before any tmux/FS side effect. A standing grant must
-        // authorize every child provider and spend its budget per child process.
-        const authorization = await authorizeLaunch(bridge, ctx, {
-            agents: job.agents.map((agent) => agent.provider),
-            goalId: params.goalId,
-            jobId: job.id,
-            description: `fire_task launch of job ${job.id} (${job.agents.length} child process${job.agents.length === 1 ? "" : "es"}: ${job.agents.map((agent) => `${agent.name}/${agent.provider}`).join(", ")})`,
-        });
-        const managedAuthority = managedAuthorization(authorization.grant, `one-shot:${job.id}:turn:1`);
+        // Compile each immutable worker profile from the parent surface plus per-agent overrides before
+        // any durable reservation, filesystem artifact, pane, watcher, or prompt side effect.
         for (const agent of job.agents) {
+            const profile = deriveLaunchProfile(bridge, ctx, job, agent, params.goalId);
             agent.currentTurn = 1;
-            applyManagedAuthorization(agent, managedAuthority, {
+            applyManagedProfile(agent, profile, {
                 instructions: job.task,
                 goalId: params.goalId,
                 leaseTtlMs: job.deadlineSeconds * 1_000,
             });
+            applyLaunchProfile(job, agent, profile);
         }
-        applyLaunchProfile(job, {
-            ...managedAuthority.launchSource,
-            ...(params.goalId ? { taskRef: params.goalId } : {}),
-            // Process-matrix parent identity: the dispatched child self-registers as a worker of THIS
-            // session and winds down gracefully if this session disappears (see dispatch-grant.ts's
-            // `LaunchProfileSource.parentPid`/`parentSession` doc).
-            parentPid: process.pid,
-            parentSession: ctx.sessionManager.getSessionId?.() ?? ctx.sessionManager.getSessionFile(),
-        });
-        // The host commits the full execution grant and starts the durable lease before any child
+        // The host commits the full execution profile and starts the durable lease before any child
         // process, job artifact, watcher, or prompt side effect occurs.
         reportManagedDispatchReservations(bridge, job, job.agents);
         let sessionCreated = false;
@@ -1443,7 +1340,9 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
                 cwd: agent.cwd,
                 command: agent.command || defaultProviderInvocation(agent.provider),
             }));
-            const launch = launchTmuxSession(job.sessionName, job.cwd, panes);
+            // Create idle panes first. The initial provider task is part of the provider command, but no
+            // command starts until its output watcher owns the pane stream.
+            const launch = launchTmuxSession(job.sessionName, job.cwd, panes, { deferCommands: true });
             sessionCreated = true;
             job.agents.forEach((agent, index) => {
                 agent.paneId = launch.paneIds[index];
@@ -1453,7 +1352,7 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
             for (const agent of job.agents) {
                 if (!agent.paneId)
                     continue;
-                injectPromptToPane(agent.paneId, fs.readFileSync(agent.promptPath, "utf8"), agent.provider);
+                sendCommandToPane(agent.paneId, initialPromptInvocation(agent.command || defaultProviderInvocation(agent.provider), agent.provider, agent.promptPath));
             }
             return {
                 content: [
@@ -1524,22 +1423,8 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
             throw new Error(`tmux session is gone: ${job.sessionName}. The worker pane cannot receive a follow-up; use fire_task to relaunch.`);
         if (!tmuxPaneExists(job.sessionName, targetAgent.paneId))
             throw new Error(`tmux pane ${targetAgent.paneId} for ${targetAgent.name} is gone. The worker cannot receive a follow-up; use fire_task to relaunch.`);
-        // APPROVAL-GATED LAUNCH (doctrine-regression mandatory): a follow-up dispatches a fresh
-        // turn into an already-running child, so there is no new child command to profile — only the
-        // grant/one-shot authorization is resolved here (no applyLaunchProfile call).
-        const authorization = await authorizeLaunch(bridge, ctx, {
-            agents: [targetAgent.provider],
-            goalId: params.goalId,
-            jobId: `${job.id}:turn:${turn}`,
-            description: `send_followup turn ${turn} to ${targetAgent.name} in job ${job.id}`,
-        });
-        const managedAuthority = managedAuthorization(authorization.grant, `one-shot:${job.id}:turn:${turn}`);
-        const launchAllowedTools = targetAgent.dispatchAllowedTools ?? [...DEFAULT_READ_BIASED_TOOLS];
-        const launchWritePaths = targetAgent.dispatchWritePaths ?? [];
-        if (!sameStringValues(launchAllowedTools, managedAuthority.allowedTools) ||
-            !sameStringValues(launchWritePaths, managedAuthority.writePaths)) {
-            throw new Error(`send_followup refused: authorization scope differs from the already-running process for ${targetAgent.name}; relaunch the worker to apply a new tool or write-path scope.`);
-        }
+        // The live process keeps the immutable profile persisted at birth. A follow-up only advances
+        // instructions and its fenced sequence; it cannot widen or replace the process profile.
         // Reserve before watcher/prompt side effects. Reconcile re-arms a reserved turn but never
         // re-injects it, so crash recovery cannot duplicate a provider prompt.
         const reserved = persistJobPatch(job.id, (current) => {
@@ -1549,9 +1434,9 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
             agent.currentTurn = turn;
             agent.pendingTurn = turn;
             agent.result = undefined;
-            applyManagedAuthorization(agent, managedAuthority, {
+            applyManagedTurn(agent, {
                 instructions: followupTask,
-                goalId: params.goalId,
+                goalId: params.goalId ?? agent.dispatchGoalId,
                 leaseTtlMs: job.deadlineSeconds * 1_000,
             });
             current.currentTurn = turn;
@@ -1608,6 +1493,13 @@ async function executeTool(_toolCallId, params, _signal, _onUpdate, ctx, bridge)
                 content: [{ type: "text", text: `tmux job ${job.id} was already dismissed.` }],
                 details: { action, jobId: job.id, alreadyDismissed: true },
             };
+        if (tmuxSessionExists(job.sessionName)) {
+            for (const agent of job.agents) {
+                if (!agent.paneId || !tmuxPaneExists(job.sessionName, agent.paneId))
+                    continue;
+                requireTmuxRun(runTmux(["pipe-pane", "-t", agent.paneId]), `tmux completion watcher detach for ${agent.paneId}`);
+            }
+        }
         persistJobPatch(job.id, (current) => {
             current.dismissedAt = new Date().toISOString();
             return current;
@@ -1705,6 +1597,15 @@ function formatFireTaskHandoff(job) {
         "This event woke the parent; do not poll. Continue safe scoped work from the bounded handoff and inspect terminal artifacts only if needed for a material claim.",
     ].join("\n");
 }
+function compactTmuxAgentStatus(status) {
+    if (status === "done" || status === "succeeded" || status === "completed")
+        return "succeeded";
+    if (status === "blocked" || status === "partial")
+        return "partial";
+    if (status === "canceled" || status === "cancelled" || status === "stopped")
+        return "canceled";
+    return "failed";
+}
 /** Diff live tmux sessions against this session's job records. Mirrors the invariant behind
  * `LocalRuntimeController.reconcile` (local-runtime-controller.ts): reconcile only ever OBSERVES —
  * it never kills a session it did not provably start. A job whose tmux session is gone is marked
@@ -1766,12 +1667,6 @@ export default function tmuxAgentManagerExtension(pi) {
     let handoffTail = Promise.resolve();
     const jobWatchers = new Map();
     const bridge = pi;
-    // Non-interactive opt-in for grant_dispatch: optional-chained so a lightweight test double
-    // that doesn't implement registerFlag still loads the extension; a real host always has it.
-    bridge.registerFlag?.("allow-tmux-dispatch", {
-        type: "boolean",
-        description: "Authorize tmux_agent_manager grant_dispatch to create a standing tmux dispatch grant without interactive approval (print/rpc/non-interactive mode only).",
-    });
     const closeJobWatchers = () => {
         for (const watcher of jobWatchers.values())
             watcher.close();
@@ -1810,16 +1705,13 @@ export default function tmuxAgentManagerExtension(pi) {
             // message remains only for lightweight/standalone hosts that omit that bridge entirely.
             if (!bridge.reportManagedLane) {
                 pi.sendMessage({
-                    customType: "tmux-background-completion",
+                    customType: "background-worker-completion",
                     content: formatFireTaskHandoff(job),
                     display: true,
                     details: {
-                        jobId: job.id,
-                        sessionName: job.sessionName,
-                        agents: job.agents.map((agent) => ({
-                            id: agent.id,
-                            name: agent.name,
-                            status: agent.result?.status,
+                        records: job.agents.map((agent) => ({
+                            laneId: agentLaneId(job.id, agent.id),
+                            status: compactTmuxAgentStatus(agent.result?.status),
                         })),
                     },
                 }, { triggerTurn: true, deliverAs: "followUp" });
@@ -1834,8 +1726,6 @@ export default function tmuxAgentManagerExtension(pi) {
                 }
                 return current;
             });
-            if (ctx.hasUI)
-                ctx.ui.notify(`tmux background task ${job.id} completed.`, "info");
         }
         const activeIds = new Set(jobs.filter((job) => !isFireTaskTerminal(job)).map((job) => job.id));
         for (const [jobId, watcher] of jobWatchers) {
@@ -1892,22 +1782,21 @@ export default function tmuxAgentManagerExtension(pi) {
     pi.registerTool({
         name: "tmux_agent_manager",
         label: "tmux Agent Manager",
-        description: "Specialized tmux-backed interactive provider/workspace manager. Native delegate is the standard cross-platform subagent path. Use this tool only when the owner explicitly requests persistent interactive CLI panes and tmux is available.",
-        promptSnippet: "tmux interactive panes only by owner request after guard; ordinary agents use native delegate.",
+        description: "Tmux-backed persistent interactive provider/workspace manager. Native delegate remains the standard cross-platform route; use this when a task benefits from persistent CLI panes.",
+        promptSnippet: "Persistent tmux workers with inherited, immutable launch profiles; ordinary agents use native delegate.",
         promptGuidelines: [
-            "Ordinary agents: delegate. tmux only owner-requested panes after guard; never native Windows.",
-            "WSL tmux only if installed/requested. Never edit profiles during dispatch; native resolver owns them.",
-            "fire_task starts batch, returns after watcher armed; never wait/poll/peek.",
+            "Ordinary agents: delegate. Tmux availability detection is automatic; guard is diagnostic only. Never use native Windows tmux.",
+            "fire_task derives one immutable profile per agent; omitted fields inherit parent tools, thinking, and machine scope.",
+            "tools, thinkingLevel, resourceProfile, and worktreeLane are Pi-only; configure external CLIs in command.",
+            "Pi path narrows structured file tools; external path sets cwd only and is audited as a machine-wide host process.",
+            "fire_task arms capture before atomically starting each CLI with its task; never wait/poll/peek.",
             "Teams: list/show_template, teamTemplate. Layout: workspace_plan, then launch_workspace.",
             "send_followup prompts live pane/re-arms watcher; no relaunch. dismiss stops tracking, not session.",
             "Cleanup: stop_job/stop_session dryRun, then confirm=yes-tmux-stop.",
             "No secrets in task/command; all persist: ~/.pi/agent/work/background/tmux-agent-manager/state/jobs.",
             "Display/status metadata only; verify result/log before completion claim.",
-            "Real fire_task/send_followup needs grant or one-shot UI approval. No grant/UI: refused; run grant_dispatch.",
-            "grant_dispatch: agent,maxLaunches; optional goalId,allowedTools,resourceProfile,writePaths,expiresInMinutes.",
-            "Grant needs UI confirmation, or --allow-tmux-dispatch without UI; revoke_grant ends it.",
-            "Pi child: restricted tools/resource profile or no extensions/skills, scoped hard-stop prompt; launch config holds grant.",
-            "Non-pi CLI grant applies at launch only; tool loop is CLI-owned.",
+            "Workers continue autonomously inside the assigned profile; no separate approval handshake exists.",
+            "Non-Pi process behavior is CLI-owned; never represent Pi-only profile controls as enforced for an external CLI.",
         ],
         parameters: Type.Object({
             action: Type.Optional(Type.Union([
@@ -1930,10 +1819,8 @@ export default function tmuxAgentManagerExtension(pi) {
                 Type.Literal("show_template"),
                 Type.Literal("stop_job"),
                 Type.Literal("stop_session"),
-                Type.Literal("grant_dispatch"),
-                Type.Literal("revoke_grant"),
             ], {
-                description: "status, setup_help, guard, notify, set_status, clear_status, workspace_plan, launch_workspace, fire_task, send_followup, dismiss, job_status, list_jobs, set_variable, list_variables, list_templates, show_template, stop_job, stop_session, grant_dispatch, or revoke_grant. Default status.",
+                description: "status, setup_help, guard, notify, set_status, clear_status, workspace_plan, launch_workspace, fire_task, send_followup, dismiss, job_status, list_jobs, set_variable, list_variables, list_templates, show_template, stop_job, or stop_session. Default status.",
             })),
             title: Type.Optional(Type.String({ description: "Notification title or workspace title context." })),
             body: Type.Optional(Type.String({ description: "Notification body/status text, or fallback task text for fire_task." })),
@@ -1957,7 +1844,10 @@ export default function tmuxAgentManagerExtension(pi) {
                 description: "Fire-and-forget worker objective. Required for fire_task unless body is provided. Also used as the follow-up objective for send_followup.",
             })),
             jobId: Type.Optional(Type.String({
-                description: "Job id for fire_task (optional), job_status/list_variables/set_variable/send_followup/dismiss (required).",
+                description: "Existing job id for job_status/list_variables/set_variable/send_followup/dismiss. Never creates a fresh fire_task job.",
+            })),
+            launchKey: Type.Optional(Type.String({
+                description: "Optional fresh fire_task identity. Use only for intentional stable naming; omitted creates a unique key. Never auto-retained from results.",
             })),
             agentId: Type.Optional(Type.String({
                 description: "Target agent id for send_followup. Defaults to the job's first (primary) agent. Multi-agent-per-turn follow-up is not supported; only one agent's pane receives each follow-up.",
@@ -1967,7 +1857,7 @@ export default function tmuxAgentManagerExtension(pi) {
             })),
             variableValue: Type.Optional(Type.String({ description: "For set_variable: value to write. body/status can also supply the value." })),
             deadlineSeconds: Type.Optional(Type.Number({
-                description: "For fire_task: seconds before each event-driven pane watcher records a timeout. Default 1200.",
+                description: "For fire_task: seconds before each event-driven watcher records timeout and terminates its owned pane. Default 1200.",
                 minimum: 5,
                 maximum: MAX_DEADLINE_SECONDS,
             })),
@@ -1975,43 +1865,33 @@ export default function tmuxAgentManagerExtension(pi) {
                 provider: Type.Optional(providerSchema()),
                 name: Type.Optional(Type.String({ description: "Pane/worker name." })),
                 command: Type.Optional(Type.String({
-                    description: "Interactive CLI start command for this pane, e.g. claude, agy, pi, or a custom wrapper CLI. The manager injects the prompt after launch and captures pane output.",
+                    description: "Interactive CLI start command. Capture is armed first, then the initial prompt file is passed as the final CLI argument; Agy also gets --prompt-interactive.",
+                })),
+                cwd: Type.Optional(Type.String({
+                    description: "Legacy per-agent working directory; does not narrow filesystem scope.",
+                })),
+                path: Type.Optional(Type.String({
+                    description: "Optional workspace cwd. For Pi it narrows structured file tools; external CLIs remain machine-wide host-trusted processes.",
+                })),
+                tools: Type.Optional(Type.Array(Type.String(), {
+                    description: "Pi-only policy-owned tool override. Omitted inherits the parent's eligible worker tools; parent-only controls are removed.",
+                    minItems: 1,
                 })),
-                cwd: Type.Optional(Type.String({ description: "Optional per-agent cwd." })),
+                resourceProfile: Type.Optional(Type.String({
+                    description: "Pi-only resource-profile override. Omitted inherits the parent's effective resources.",
+                })),
+                thinkingLevel: Type.Optional(orchestrationThinkingLevelSchema("Pi-only thinking override. Omitted inherits the orchestrator's current level.")),
+                worktreeLane: Type.Optional(Type.String({ description: "Pi-only worktree-sync lane binding for this worker." })),
             }), { description: "Agents/providers to lay out in tmux. Default: pi, agy, codex." })),
             dryRun: Type.Optional(Type.Boolean({
                 description: "Preview only when true. Launch actions run by default; stop actions remain previews by default.",
             })),
             force: Type.Optional(Type.Boolean({
-                description: "For fire_task only: archive an existing job directory with the same jobId before launch. Existing tmux sessions are still refused; stop them first.",
+                description: "For fire_task only: archive an existing job directory with the same launchKey before launch. Existing tmux sessions are still refused; stop them first.",
             })),
             confirm: Type.Optional(Type.String({ description: "Required for real stop_job/stop_session: yes-tmux-stop." })),
             goalId: Type.Optional(Type.String({
-                description: "Goal this dispatch/grant is scoped to. For grant_dispatch: an unscoped grant (omitted) covers any goal; a scoped grant covers only launches naming the same goalId. For fire_task/send_followup: tags the request for grant-coverage matching.",
-            })),
-            agent: Type.Optional(providerSchema("grant_dispatch: the provider this standing grant authorizes.")),
-            allowedTools: Type.Optional(Type.Array(Type.String(), {
-                description: "grant_dispatch: tool allowlist pushed into the child pi's own --tools flag. Defaults to a read-biased safe set (read, grep, find, ls) when omitted.",
-            })),
-            resourceProfile: Type.Optional(Type.String({
-                description: "grant_dispatch: resource profile name pushed into the child pi's own --resource-profile flag. When omitted, the child launches with --no-extensions --no-skills instead.",
-            })),
-            writePaths: Type.Optional(Type.Array(Type.String(), {
-                description: "grant_dispatch: write paths named in the child's scoped --append-system-prompt role text.",
-            })),
-            maxLaunches: Type.Optional(Type.Number({
-                description: "grant_dispatch: number of real fire_task/send_followup dispatches this grant authorizes.",
-                minimum: 1,
-            })),
-            expiresInMinutes: Type.Optional(Type.Number({
-                description: "grant_dispatch: grant validity window from creation. Omit for a grant that never expires (until revoke_grant).",
-                minimum: 1,
-            })),
-            maxUsdAdvisory: Type.Optional(Type.Number({
-                description: "grant_dispatch: advisory USD ceiling. Never enforced across the process boundary (the child bills under its own auth) — a claim to review only.",
-            })),
-            grantId: Type.Optional(Type.String({
-                description: "revoke_grant: grant id to revoke. Omit to revoke whichever grant is currently active.",
+                description: "Goal this fire_task/send_followup belongs to for durable lane ownership and recovery.",
             })),
         }),
         async execute(toolCallId, params, signal, onUpdate, ctx) {