@caupulican/pi-adaptative 0.94.1 → 0.95.0

package/dist/bundled-resources/extensions/tmux-agent-manager/launch-profile.d.ts

@@ -0,0 +1,52 @@
+import type { ThinkingLevel } from "@caupulican/pi-agent-core";
+import type { Usage } from "@caupulican/pi-ai";
+export type Provider = "pi" | "codex" | "agy" | "claude" | "opencode" | "custom";
+/** Full host-auditable Pi worker surface after the shared worker ceiling removes agent launchers
+ * and root-owned durable mutation controls. */
+export declare const DEFAULT_MANAGED_WORKER_TOOLS: readonly string[];
+export declare class WorkerLaunchProfileError extends Error {
+    readonly code: "worker_profile_tools_rejected";
+    readonly rejectedTools: readonly string[];
+    constructor(rejectedTools: readonly string[]);
+}
+export interface WorkerLaunchProfileInput {
+    identity: string;
+    inheritedTools?: readonly string[];
+    allowedTools?: readonly string[];
+    resourceProfile?: string;
+    resourceProfileJson?: string;
+    writePaths?: readonly string[];
+    thinkingLevel?: ThinkingLevel;
+    worktreeLane?: string;
+    parentPid?: number;
+    parentSession?: string;
+    taskRef?: string;
+}
+/** Immutable profile compiled once before a managed process is reserved or launched. Empty
+ * `writePaths` means the host-derived machine-root scope; a non-empty list is an explicit narrowing. */
+export interface WorkerLaunchProfile {
+    readonly identity: string;
+    readonly allowedTools: readonly string[];
+    readonly resourceProfile?: string;
+    readonly resourceProfileJson?: string;
+    readonly writePaths: readonly string[];
+    readonly thinkingLevel?: ThinkingLevel;
+    readonly worktreeLane?: string;
+    readonly parentPid?: number;
+    readonly parentSession?: string;
+    readonly taskRef?: string;
+}
+export declare function deriveWorkerLaunchProfile(input: WorkerLaunchProfileInput): WorkerLaunchProfile;
+export interface LaunchProfileFlag {
+    flag: string;
+    value?: string;
+}
+/** Render a Pi child's immutable profile into its own CLI configuration. The manager supplies either
+ * an explicit resource-profile override or a one-shot snapshot of the parent's effective resources;
+ * standalone callers that omit both retain the child's normal resources. */
+export declare function buildLaunchProfileFlags(profile: WorkerLaunchProfile): LaunchProfileFlag[];
+export declare function buildScopedSystemPrompt(profile: WorkerLaunchProfile): string;
+/** Decode an optional cooperative worker usage claim. Malformed numeric fields are zeroed because
+ * the claim is advisory and must never become an authoritative billing record. */
+export declare function decodeTmuxWorkerUsageClaim(raw: unknown): Usage | undefined;
+//# sourceMappingURL=launch-profile.d.ts.map

package/dist/bundled-resources/extensions/tmux-agent-manager/launch-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-profile.d.ts","sourceRoot":"","sources":["../../../../src/bundled-resources/extensions/tmux-agent-manager/launch-profile.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;AAKjF;+CAC+C;AAC/C,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAAkD,CAAC;AAE7G,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,+BAA+B,CAAU;IACzD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,aAAa,EAAE,SAAS,MAAM,EAAE,EAK3C;CACD;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;wGACwG;AACxG,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAWD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAgC9F;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;4EAE4E;AAC5E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,EAAE,CAczF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAiB5E;AAMD;kFACkF;AAClF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAkB1E"}

package/dist/bundled-resources/extensions/tmux-agent-manager/launch-profile.js

@@ -0,0 +1,118 @@
+import { mapToolNamesForPlatform, POLICY_OWNED_RUNTIME_TOOL_NAMES, WORKER_FORBIDDEN_TOOLS, } from "@caupulican/pi-adaptative";
+const MANAGED_WORKER_TOOL_NAMES = POLICY_OWNED_RUNTIME_TOOL_NAMES.filter((tool) => !WORKER_FORBIDDEN_TOOLS.has(tool));
+const MANAGED_WORKER_TOOL_NAME_SET = new Set(MANAGED_WORKER_TOOL_NAMES);
+/** Full host-auditable Pi worker surface after the shared worker ceiling removes agent launchers
+ * and root-owned durable mutation controls. */
+export const DEFAULT_MANAGED_WORKER_TOOLS = Object.freeze([...MANAGED_WORKER_TOOL_NAMES]);
+export class WorkerLaunchProfileError extends Error {
+    constructor(rejectedTools) {
+        const displayNames = rejectedTools.map((tool) => (tool ? `'${tool}'` : "<empty>"));
+        super(`Worker profile requested unavailable or forbidden tools: ${displayNames.join(", ")}.`);
+        this.code = "worker_profile_tools_rejected";
+        this.name = "WorkerLaunchProfileError";
+        this.rejectedTools = Object.freeze([...rejectedTools]);
+    }
+}
+function normalizeToolNames(tools) {
+    return mapToolNamesForPlatform(tools.map((tool) => tool.trim().toLowerCase()));
+}
+function uniqueClassifiedTools(tools) {
+    const selected = new Set(normalizeToolNames(tools).filter((tool) => tool.length > 0));
+    return MANAGED_WORKER_TOOL_NAMES.filter((tool) => selected.has(tool));
+}
+export function deriveWorkerLaunchProfile(input) {
+    if (input.allowedTools !== undefined) {
+        const inheritedToolSet = input.inheritedTools === undefined
+            ? MANAGED_WORKER_TOOL_NAME_SET
+            : new Set(uniqueClassifiedTools(input.inheritedTools));
+        const rejectedTools = [
+            ...new Set(normalizeToolNames(input.allowedTools).filter((tool) => !MANAGED_WORKER_TOOL_NAME_SET.has(tool) || !inheritedToolSet.has(tool))),
+        ];
+        if (rejectedTools.length > 0)
+            throw new WorkerLaunchProfileError(rejectedTools);
+    }
+    const sourceTools = input.allowedTools ?? input.inheritedTools ?? DEFAULT_MANAGED_WORKER_TOOLS;
+    const allowedTools = Object.freeze(uniqueClassifiedTools(sourceTools));
+    const writePaths = Object.freeze([
+        ...new Set(input.writePaths?.map((entry) => entry.trim()).filter((entry) => entry.length > 0) ?? []),
+    ]);
+    return Object.freeze({
+        identity: input.identity,
+        allowedTools,
+        writePaths,
+        ...(input.resourceProfile ? { resourceProfile: input.resourceProfile } : {}),
+        ...(input.resourceProfileJson ? { resourceProfileJson: input.resourceProfileJson } : {}),
+        ...(input.thinkingLevel ? { thinkingLevel: input.thinkingLevel } : {}),
+        ...(input.worktreeLane ? { worktreeLane: input.worktreeLane } : {}),
+        ...(input.parentPid !== undefined ? { parentPid: input.parentPid } : {}),
+        ...(input.parentSession ? { parentSession: input.parentSession } : {}),
+        ...(input.taskRef ? { taskRef: input.taskRef } : {}),
+    });
+}
+/** Render a Pi child's immutable profile into its own CLI configuration. The manager supplies either
+ * an explicit resource-profile override or a one-shot snapshot of the parent's effective resources;
+ * standalone callers that omit both retain the child's normal resources. */
+export function buildLaunchProfileFlags(profile) {
+    const flags = profile.allowedTools.length
+        ? [{ flag: "--tools", value: profile.allowedTools.join(",") }]
+        : [{ flag: "--no-tools" }];
+    if (profile.resourceProfileJson)
+        flags.push({ flag: "--resource-profile-json", value: profile.resourceProfileJson });
+    if (profile.resourceProfile)
+        flags.push({ flag: "--resource-profile", value: profile.resourceProfile });
+    if (profile.thinkingLevel)
+        flags.push({ flag: "--thinking", value: profile.thinkingLevel });
+    if (profile.worktreeLane)
+        flags.push({ flag: "--worktree-lane", value: profile.worktreeLane });
+    if (profile.parentPid !== undefined)
+        flags.push({ flag: "--parent-pid", value: String(profile.parentPid) });
+    if (profile.parentSession)
+        flags.push({ flag: "--parent-session", value: profile.parentSession });
+    if (profile.taskRef)
+        flags.push({ flag: "--task-ref", value: profile.taskRef });
+    flags.push({ flag: "--append-system-prompt", value: buildScopedSystemPrompt(profile) });
+    flags.push({ flag: "--session-mode", value: "worker" });
+    return flags;
+}
+export function buildScopedSystemPrompt(profile) {
+    const scope = profile.writePaths.length
+        ? `Structural filesystem tools are limited to: ${profile.writePaths.join(", ")}. Process tools retain host access and must honor this assigned scope.`
+        : "Filesystem authority inherits the host's full-machine worker scope except private harness paths.";
+    const sentences = [
+        `You are a tmux worker running under immutable profile ${profile.identity}.`,
+        scope,
+        "Work autonomously to completion with the allowed tools; do not ask for routine permission inside the assigned task.",
+        "Do not spawn or delegate to other agents.",
+        "Report BLOCKED only when the objective is genuinely impossible with the assigned profile or missing external information.",
+    ];
+    if (profile.worktreeLane) {
+        sentences.push(`You are bound to worktree-sync lane '${profile.worktreeLane}': work only inside this lane's own worktree, integrate exclusively via worktree_sync land, and never touch main directly.`);
+    }
+    return sentences.join(" ");
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Decode an optional cooperative worker usage claim. Malformed numeric fields are zeroed because
+ * the claim is advisory and must never become an authoritative billing record. */
+export function decodeTmuxWorkerUsageClaim(raw) {
+    if (!isPlainRecord(raw))
+        return undefined;
+    const num = (value) => (typeof value === "number" && Number.isFinite(value) ? value : 0);
+    const cost = isPlainRecord(raw.cost) ? raw.cost : {};
+    return {
+        input: num(raw.input),
+        output: num(raw.output),
+        cacheRead: num(raw.cacheRead),
+        cacheWrite: num(raw.cacheWrite),
+        totalTokens: num(raw.totalTokens),
+        cost: {
+            input: num(cost.input),
+            output: num(cost.output),
+            cacheRead: num(cost.cacheRead),
+            cacheWrite: num(cost.cacheWrite),
+            total: num(cost.total),
+        },
+    };
+}
+//# sourceMappingURL=launch-profile.js.map

package/dist/bundled-resources/extensions/tmux-agent-manager/launch-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-profile.js","sourceRoot":"","sources":["../../../../src/bundled-resources/extensions/tmux-agent-manager/launch-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EACvB,+BAA+B,EAC/B,sBAAsB,GACtB,MAAM,2BAA2B,CAAC;AAMnC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACtH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAE7F;+CAC+C;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC,CAAC;AAE7G,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAIlD,YAAY,aAAgC;QAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACnF,KAAK,CAAC,4DAA4D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QALtF,SAAI,GAAG,+BAAwC,CAAC;QAMxD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC;CACD;AA+BD,SAAS,kBAAkB,CAAC,KAAwB;IACnD,OAAO,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAwB;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACxE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,gBAAgB,GACrB,KAAK,CAAC,cAAc,KAAK,SAAS;YACjC,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG;YACrB,GAAG,IAAI,GAAG,CACT,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAChF,CACD;SACD,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,aAAa,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,cAAc,IAAI,4BAA4B,CAAC;IAC/F,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;KACpG,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY;QACZ,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;AACJ,CAAC;AAOD;;4EAE4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,OAA4B;IACnE,MAAM,KAAK,GAAwB,OAAO,CAAC,YAAY,CAAC,MAAM;QAC7D,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,mBAAmB;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACrH,IAAI,OAAO,CAAC,eAAe;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA4B;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM;QACtC,CAAC,CAAC,+CAA+C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,wEAAwE;QACtJ,CAAC,CAAC,kGAAkG,CAAC;IACtG,MAAM,SAAS,GAAG;QACjB,yDAAyD,OAAO,CAAC,QAAQ,GAAG;QAC5E,KAAK;QACL,qHAAqH;QACrH,2CAA2C;QAC3C,2HAA2H;KAC3H,CAAC;IACF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,SAAS,CAAC,IAAI,CACb,wCAAwC,OAAO,CAAC,YAAY,4HAA4H,CACxL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACtD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO;QACN,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;QACjC,IAAI,EAAE;YACL,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YACtB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB;KACD,CAAC;AACH,CAAC","sourcesContent":["import {\n\tmapToolNamesForPlatform,\n\tPOLICY_OWNED_RUNTIME_TOOL_NAMES,\n\tWORKER_FORBIDDEN_TOOLS,\n} from \"@caupulican/pi-adaptative\";\nimport type { ThinkingLevel } from \"@caupulican/pi-agent-core\";\nimport type { Usage } from \"@caupulican/pi-ai\";\n\nexport type Provider = \"pi\" | \"codex\" | \"agy\" | \"claude\" | \"opencode\" | \"custom\";\n\nconst MANAGED_WORKER_TOOL_NAMES = POLICY_OWNED_RUNTIME_TOOL_NAMES.filter((tool) => !WORKER_FORBIDDEN_TOOLS.has(tool));\nconst MANAGED_WORKER_TOOL_NAME_SET: ReadonlySet<string> = new Set(MANAGED_WORKER_TOOL_NAMES);\n\n/** Full host-auditable Pi worker surface after the shared worker ceiling removes agent launchers\n * and root-owned durable mutation controls. */\nexport const DEFAULT_MANAGED_WORKER_TOOLS: readonly string[] = Object.freeze([...MANAGED_WORKER_TOOL_NAMES]);\n\nexport class WorkerLaunchProfileError extends Error {\n\treadonly code = \"worker_profile_tools_rejected\" as const;\n\treadonly rejectedTools: readonly string[];\n\n\tconstructor(rejectedTools: readonly string[]) {\n\t\tconst displayNames = rejectedTools.map((tool) => (tool ? `'${tool}'` : \"<empty>\"));\n\t\tsuper(`Worker profile requested unavailable or forbidden tools: ${displayNames.join(\", \")}.`);\n\t\tthis.name = \"WorkerLaunchProfileError\";\n\t\tthis.rejectedTools = Object.freeze([...rejectedTools]);\n\t}\n}\n\nexport interface WorkerLaunchProfileInput {\n\tidentity: string;\n\tinheritedTools?: readonly string[];\n\tallowedTools?: readonly string[];\n\tresourceProfile?: string;\n\tresourceProfileJson?: string;\n\twritePaths?: readonly string[];\n\tthinkingLevel?: ThinkingLevel;\n\tworktreeLane?: string;\n\tparentPid?: number;\n\tparentSession?: string;\n\ttaskRef?: string;\n}\n\n/** Immutable profile compiled once before a managed process is reserved or launched. Empty\n * `writePaths` means the host-derived machine-root scope; a non-empty list is an explicit narrowing. */\nexport interface WorkerLaunchProfile {\n\treadonly identity: string;\n\treadonly allowedTools: readonly string[];\n\treadonly resourceProfile?: string;\n\treadonly resourceProfileJson?: string;\n\treadonly writePaths: readonly string[];\n\treadonly thinkingLevel?: ThinkingLevel;\n\treadonly worktreeLane?: string;\n\treadonly parentPid?: number;\n\treadonly parentSession?: string;\n\treadonly taskRef?: string;\n}\n\nfunction normalizeToolNames(tools: readonly string[]): string[] {\n\treturn mapToolNamesForPlatform(tools.map((tool) => tool.trim().toLowerCase()));\n}\n\nfunction uniqueClassifiedTools(tools: readonly string[]): string[] {\n\tconst selected = new Set(normalizeToolNames(tools).filter((tool) => tool.length > 0));\n\treturn MANAGED_WORKER_TOOL_NAMES.filter((tool) => selected.has(tool));\n}\n\nexport function deriveWorkerLaunchProfile(input: WorkerLaunchProfileInput): WorkerLaunchProfile {\n\tif (input.allowedTools !== undefined) {\n\t\tconst inheritedToolSet =\n\t\t\tinput.inheritedTools === undefined\n\t\t\t\t? MANAGED_WORKER_TOOL_NAME_SET\n\t\t\t\t: new Set(uniqueClassifiedTools(input.inheritedTools));\n\t\tconst rejectedTools = [\n\t\t\t...new Set(\n\t\t\t\tnormalizeToolNames(input.allowedTools).filter(\n\t\t\t\t\t(tool) => !MANAGED_WORKER_TOOL_NAME_SET.has(tool) || !inheritedToolSet.has(tool),\n\t\t\t\t),\n\t\t\t),\n\t\t];\n\t\tif (rejectedTools.length > 0) throw new WorkerLaunchProfileError(rejectedTools);\n\t}\n\tconst sourceTools = input.allowedTools ?? input.inheritedTools ?? DEFAULT_MANAGED_WORKER_TOOLS;\n\tconst allowedTools = Object.freeze(uniqueClassifiedTools(sourceTools));\n\tconst writePaths = Object.freeze([\n\t\t...new Set(input.writePaths?.map((entry) => entry.trim()).filter((entry) => entry.length > 0) ?? []),\n\t]);\n\treturn Object.freeze({\n\t\tidentity: input.identity,\n\t\tallowedTools,\n\t\twritePaths,\n\t\t...(input.resourceProfile ? { resourceProfile: input.resourceProfile } : {}),\n\t\t...(input.resourceProfileJson ? { resourceProfileJson: input.resourceProfileJson } : {}),\n\t\t...(input.thinkingLevel ? { thinkingLevel: input.thinkingLevel } : {}),\n\t\t...(input.worktreeLane ? { worktreeLane: input.worktreeLane } : {}),\n\t\t...(input.parentPid !== undefined ? { parentPid: input.parentPid } : {}),\n\t\t...(input.parentSession ? { parentSession: input.parentSession } : {}),\n\t\t...(input.taskRef ? { taskRef: input.taskRef } : {}),\n\t});\n}\n\nexport interface LaunchProfileFlag {\n\tflag: string;\n\tvalue?: string;\n}\n\n/** Render a Pi child's immutable profile into its own CLI configuration. The manager supplies either\n * an explicit resource-profile override or a one-shot snapshot of the parent's effective resources;\n * standalone callers that omit both retain the child's normal resources. */\nexport function buildLaunchProfileFlags(profile: WorkerLaunchProfile): LaunchProfileFlag[] {\n\tconst flags: LaunchProfileFlag[] = profile.allowedTools.length\n\t\t? [{ flag: \"--tools\", value: profile.allowedTools.join(\",\") }]\n\t\t: [{ flag: \"--no-tools\" }];\n\tif (profile.resourceProfileJson) flags.push({ flag: \"--resource-profile-json\", value: profile.resourceProfileJson });\n\tif (profile.resourceProfile) flags.push({ flag: \"--resource-profile\", value: profile.resourceProfile });\n\tif (profile.thinkingLevel) flags.push({ flag: \"--thinking\", value: profile.thinkingLevel });\n\tif (profile.worktreeLane) flags.push({ flag: \"--worktree-lane\", value: profile.worktreeLane });\n\tif (profile.parentPid !== undefined) flags.push({ flag: \"--parent-pid\", value: String(profile.parentPid) });\n\tif (profile.parentSession) flags.push({ flag: \"--parent-session\", value: profile.parentSession });\n\tif (profile.taskRef) flags.push({ flag: \"--task-ref\", value: profile.taskRef });\n\tflags.push({ flag: \"--append-system-prompt\", value: buildScopedSystemPrompt(profile) });\n\tflags.push({ flag: \"--session-mode\", value: \"worker\" });\n\treturn flags;\n}\n\nexport function buildScopedSystemPrompt(profile: WorkerLaunchProfile): string {\n\tconst scope = profile.writePaths.length\n\t\t? `Structural filesystem tools are limited to: ${profile.writePaths.join(\", \")}. Process tools retain host access and must honor this assigned scope.`\n\t\t: \"Filesystem authority inherits the host's full-machine worker scope except private harness paths.\";\n\tconst sentences = [\n\t\t`You are a tmux worker running under immutable profile ${profile.identity}.`,\n\t\tscope,\n\t\t\"Work autonomously to completion with the allowed tools; do not ask for routine permission inside the assigned task.\",\n\t\t\"Do not spawn or delegate to other agents.\",\n\t\t\"Report BLOCKED only when the objective is genuinely impossible with the assigned profile or missing external information.\",\n\t];\n\tif (profile.worktreeLane) {\n\t\tsentences.push(\n\t\t\t`You are bound to worktree-sync lane '${profile.worktreeLane}': work only inside this lane's own worktree, integrate exclusively via worktree_sync land, and never touch main directly.`,\n\t\t);\n\t}\n\treturn sentences.join(\" \");\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Decode an optional cooperative worker usage claim. Malformed numeric fields are zeroed because\n * the claim is advisory and must never become an authoritative billing record. */\nexport function decodeTmuxWorkerUsageClaim(raw: unknown): Usage | undefined {\n\tif (!isPlainRecord(raw)) return undefined;\n\tconst num = (value: unknown): number => (typeof value === \"number\" && Number.isFinite(value) ? value : 0);\n\tconst cost = isPlainRecord(raw.cost) ? raw.cost : {};\n\treturn {\n\t\tinput: num(raw.input),\n\t\toutput: num(raw.output),\n\t\tcacheRead: num(raw.cacheRead),\n\t\tcacheWrite: num(raw.cacheWrite),\n\t\ttotalTokens: num(raw.totalTokens),\n\t\tcost: {\n\t\t\tinput: num(cost.input),\n\t\t\toutput: num(cost.output),\n\t\t\tcacheRead: num(cost.cacheRead),\n\t\t\tcacheWrite: num(cost.cacheWrite),\n\t\t\ttotal: num(cost.total),\n\t\t},\n\t};\n}\n"]}

package/dist/bundled-resources/extensions/tmux-agent-manager/launch-profile.ts

@@ -0,0 +1,169 @@
+import {
+	mapToolNamesForPlatform,
+	POLICY_OWNED_RUNTIME_TOOL_NAMES,
+	WORKER_FORBIDDEN_TOOLS,
+} from "@caupulican/pi-adaptative";
+import type { ThinkingLevel } from "@caupulican/pi-agent-core";
+import type { Usage } from "@caupulican/pi-ai";
+
+export type Provider = "pi" | "codex" | "agy" | "claude" | "opencode" | "custom";
+
+const MANAGED_WORKER_TOOL_NAMES = POLICY_OWNED_RUNTIME_TOOL_NAMES.filter((tool) => !WORKER_FORBIDDEN_TOOLS.has(tool));
+const MANAGED_WORKER_TOOL_NAME_SET: ReadonlySet<string> = new Set(MANAGED_WORKER_TOOL_NAMES);
+
+/** Full host-auditable Pi worker surface after the shared worker ceiling removes agent launchers
+ * and root-owned durable mutation controls. */
+export const DEFAULT_MANAGED_WORKER_TOOLS: readonly string[] = Object.freeze([...MANAGED_WORKER_TOOL_NAMES]);
+
+export class WorkerLaunchProfileError extends Error {
+	readonly code = "worker_profile_tools_rejected" as const;
+	readonly rejectedTools: readonly string[];
+
+	constructor(rejectedTools: readonly string[]) {
+		const displayNames = rejectedTools.map((tool) => (tool ? `'${tool}'` : "<empty>"));
+		super(`Worker profile requested unavailable or forbidden tools: ${displayNames.join(", ")}.`);
+		this.name = "WorkerLaunchProfileError";
+		this.rejectedTools = Object.freeze([...rejectedTools]);
+	}
+}
+
+export interface WorkerLaunchProfileInput {
+	identity: string;
+	inheritedTools?: readonly string[];
+	allowedTools?: readonly string[];
+	resourceProfile?: string;
+	resourceProfileJson?: string;
+	writePaths?: readonly string[];
+	thinkingLevel?: ThinkingLevel;
+	worktreeLane?: string;
+	parentPid?: number;
+	parentSession?: string;
+	taskRef?: string;
+}
+
+/** Immutable profile compiled once before a managed process is reserved or launched. Empty
+ * `writePaths` means the host-derived machine-root scope; a non-empty list is an explicit narrowing. */
+export interface WorkerLaunchProfile {
+	readonly identity: string;
+	readonly allowedTools: readonly string[];
+	readonly resourceProfile?: string;
+	readonly resourceProfileJson?: string;
+	readonly writePaths: readonly string[];
+	readonly thinkingLevel?: ThinkingLevel;
+	readonly worktreeLane?: string;
+	readonly parentPid?: number;
+	readonly parentSession?: string;
+	readonly taskRef?: string;
+}
+
+function normalizeToolNames(tools: readonly string[]): string[] {
+	return mapToolNamesForPlatform(tools.map((tool) => tool.trim().toLowerCase()));
+}
+
+function uniqueClassifiedTools(tools: readonly string[]): string[] {
+	const selected = new Set(normalizeToolNames(tools).filter((tool) => tool.length > 0));
+	return MANAGED_WORKER_TOOL_NAMES.filter((tool) => selected.has(tool));
+}
+
+export function deriveWorkerLaunchProfile(input: WorkerLaunchProfileInput): WorkerLaunchProfile {
+	if (input.allowedTools !== undefined) {
+		const inheritedToolSet =
+			input.inheritedTools === undefined
+				? MANAGED_WORKER_TOOL_NAME_SET
+				: new Set(uniqueClassifiedTools(input.inheritedTools));
+		const rejectedTools = [
+			...new Set(
+				normalizeToolNames(input.allowedTools).filter(
+					(tool) => !MANAGED_WORKER_TOOL_NAME_SET.has(tool) || !inheritedToolSet.has(tool),
+				),
+			),
+		];
+		if (rejectedTools.length > 0) throw new WorkerLaunchProfileError(rejectedTools);
+	}
+	const sourceTools = input.allowedTools ?? input.inheritedTools ?? DEFAULT_MANAGED_WORKER_TOOLS;
+	const allowedTools = Object.freeze(uniqueClassifiedTools(sourceTools));
+	const writePaths = Object.freeze([
+		...new Set(input.writePaths?.map((entry) => entry.trim()).filter((entry) => entry.length > 0) ?? []),
+	]);
+	return Object.freeze({
+		identity: input.identity,
+		allowedTools,
+		writePaths,
+		...(input.resourceProfile ? { resourceProfile: input.resourceProfile } : {}),
+		...(input.resourceProfileJson ? { resourceProfileJson: input.resourceProfileJson } : {}),
+		...(input.thinkingLevel ? { thinkingLevel: input.thinkingLevel } : {}),
+		...(input.worktreeLane ? { worktreeLane: input.worktreeLane } : {}),
+		...(input.parentPid !== undefined ? { parentPid: input.parentPid } : {}),
+		...(input.parentSession ? { parentSession: input.parentSession } : {}),
+		...(input.taskRef ? { taskRef: input.taskRef } : {}),
+	});
+}
+
+export interface LaunchProfileFlag {
+	flag: string;
+	value?: string;
+}
+
+/** Render a Pi child's immutable profile into its own CLI configuration. The manager supplies either
+ * an explicit resource-profile override or a one-shot snapshot of the parent's effective resources;
+ * standalone callers that omit both retain the child's normal resources. */
+export function buildLaunchProfileFlags(profile: WorkerLaunchProfile): LaunchProfileFlag[] {
+	const flags: LaunchProfileFlag[] = profile.allowedTools.length
+		? [{ flag: "--tools", value: profile.allowedTools.join(",") }]
+		: [{ flag: "--no-tools" }];
+	if (profile.resourceProfileJson) flags.push({ flag: "--resource-profile-json", value: profile.resourceProfileJson });
+	if (profile.resourceProfile) flags.push({ flag: "--resource-profile", value: profile.resourceProfile });
+	if (profile.thinkingLevel) flags.push({ flag: "--thinking", value: profile.thinkingLevel });
+	if (profile.worktreeLane) flags.push({ flag: "--worktree-lane", value: profile.worktreeLane });
+	if (profile.parentPid !== undefined) flags.push({ flag: "--parent-pid", value: String(profile.parentPid) });
+	if (profile.parentSession) flags.push({ flag: "--parent-session", value: profile.parentSession });
+	if (profile.taskRef) flags.push({ flag: "--task-ref", value: profile.taskRef });
+	flags.push({ flag: "--append-system-prompt", value: buildScopedSystemPrompt(profile) });
+	flags.push({ flag: "--session-mode", value: "worker" });
+	return flags;
+}
+
+export function buildScopedSystemPrompt(profile: WorkerLaunchProfile): string {
+	const scope = profile.writePaths.length
+		? `Structural filesystem tools are limited to: ${profile.writePaths.join(", ")}. Process tools retain host access and must honor this assigned scope.`
+		: "Filesystem authority inherits the host's full-machine worker scope except private harness paths.";
+	const sentences = [
+		`You are a tmux worker running under immutable profile ${profile.identity}.`,
+		scope,
+		"Work autonomously to completion with the allowed tools; do not ask for routine permission inside the assigned task.",
+		"Do not spawn or delegate to other agents.",
+		"Report BLOCKED only when the objective is genuinely impossible with the assigned profile or missing external information.",
+	];
+	if (profile.worktreeLane) {
+		sentences.push(
+			`You are bound to worktree-sync lane '${profile.worktreeLane}': work only inside this lane's own worktree, integrate exclusively via worktree_sync land, and never touch main directly.`,
+		);
+	}
+	return sentences.join(" ");
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Decode an optional cooperative worker usage claim. Malformed numeric fields are zeroed because
+ * the claim is advisory and must never become an authoritative billing record. */
+export function decodeTmuxWorkerUsageClaim(raw: unknown): Usage | undefined {
+	if (!isPlainRecord(raw)) return undefined;
+	const num = (value: unknown): number => (typeof value === "number" && Number.isFinite(value) ? value : 0);
+	const cost = isPlainRecord(raw.cost) ? raw.cost : {};
+	return {
+		input: num(raw.input),
+		output: num(raw.output),
+		cacheRead: num(raw.cacheRead),
+		cacheWrite: num(raw.cacheWrite),
+		totalTokens: num(raw.totalTokens),
+		cost: {
+			input: num(cost.input),
+			output: num(cost.output),
+			cacheRead: num(cost.cacheRead),
+			cacheWrite: num(cost.cacheWrite),
+			total: num(cost.total),
+		},
+	};
+}

package/dist/bundled-resources/extensions/tmux-agent-manager/templates/builder-validator.json

@@ -9,6 +9,6 @@
     { "provider": "pi", "name": "coordinator" }
   ],
   "notes": [
-    "Use for owner-approved implementation/QA batches; never claim complete until result files and validation evidence are inspected."
+    "Use for implementation/QA batches; never claim complete until result files and validation evidence are inspected."
   ]
 }

package/dist/bundled-resources/extensions/tmux-agent-manager/templates/provider-prompt-smoke.json

@@ -9,6 +9,6 @@
   ],
   "notes": [
     "Use only when model-token/auth validation is intended.",
-    "The manager opens each CLI in tmux, injects the prompt, captures pane output, and watches DONE/BLOCKED markers."
+    "The manager arms pane capture, starts each CLI with its initial prompt, and watches DONE/BLOCKED markers."
   ]
 }

package/dist/bundled-resources/skills/pi-harness-learning/SKILL.md

@@ -98,22 +98,28 @@ history. This is not single-session summarization.
 5. Pick the smallest useful layer: Automata memory, skill, prompt template,
    role agent, extension/tool, then core source only when lower layers cannot
    solve it.
-6. When `autoLearn.enabled` is true, long sessions may autonomously launch a
-   background learner with the selected active/in-use model. Learners must share
-   the Auto Learn state file, use per-session tenant leases, renew/complete
-   their lease, and avoid colliding with learners from other sessions.
-7. Auto Learn learners must look for memory. If Automata/user memory is enabled
+6. Automatic reflection is root-only: at most one durable cue is pending for
+   the orchestrator and projected transiently into its next ordinary provider
+   request. Accepting that request consumes the cue. Disabling reflection
+   dismisses it; re-enabling cannot resurrect its evidence. Reflection never
+   launches a second, background, or isolated model request. Workers do not
+   reflect or mutate durable memory; they return evidence to the orchestrator.
+7. An explicit `/auto-learn run` may launch one bounded background learner with
+   the selected active/in-use model. Learners must share the Auto Learn state
+   file, use per-session tenant leases, renew/complete their lease, and avoid
+   colliding with learners from other sessions.
+8. Auto Learn learners must look for memory. If Automata/user memory is enabled
    and contains rules, preferences, corrections, or project facts, query it
    before judging candidates and use it to polish proposals, avoid duplicates,
    and improve behavioral/tooling accuracy.
-8. Apply policy gates: memory may be auto-applied only after overlap checks;
+9. Apply policy gates: memory may be auto-applied only after overlap checks;
    safe low-risk user-level skill/prompt changes may be applied when the current
    request or standing grant authorizes self-improvement. A direct request to
    fix or improve the harness is authorization for scoped source changes; do
    not ask for duplicate approval at each layer transition. Settings,
    credentials, destructive actions, executable authority expansion,
    publishing, pushing, tagging, and releases still require specific approval.
-9. Leave an audit artifact with evidence sources, recurrence count, chosen
+10. Leave an audit artifact with evidence sources, recurrence count, chosen
    layer, action/approval need, expected benefit, risk, and validation.
 
 ## After-action learning workflow

package/dist/bundled-resources/skills/worker-profile-writer/SKILL.md

@@ -9,7 +9,7 @@ description: "Use only when you need a reusable session-scoped worker preset (pr
 
 Use this skill only to create a session-scoped task preset. Do not load it to start workers.
 
-Native `delegate start` does not need an owner-authored base. Omit `profileId` and set `authority` (role `explorer` or `implementer`, model/reasoning, and tools). Empty `profile_inspect` bases are not a start block. Never add a budget: host settings and owner-authored profiles own ceilings.
+Native `delegate start` does not need an owner-authored base. Omit `profileId` to inherit the foreground model, live reasoning level, compatible tools, and machine scope. Use only the optional top-level `model`, `thinkingLevel`, `path`, and `toolNames` fields to narrow or focus that inheritance. Empty `profile_inspect` bases are not a start block. Never add a budget or authority object: the host compiles grants and owns ceilings. Every generated profile inherits the base budget unchanged.
 
 Freedom Dial: high freedom for describing and composing the bounded task; low freedom for authority, persistence, model availability, and budget checks. Pi's core engineering and evidence rules remain mandatory.
 
@@ -22,13 +22,13 @@ Create the smallest immutable profile that can complete one explicit task, then
 ### 1. Establish the contract
 
 1. State the worker's single outcome, required evidence, intended files, and completion boundary.
-2. Call `delegate` with `action: "profile_inspect"` only when you are about to `profile_create` and the reusable bases or configured model/thinking combinations are unknown.
-3. If inspect lists no owner-authored explorer/implementer base, do not ask the user to authorize one just to start work. Start with `delegate start` and `authority`. Ask the user only if they explicitly want a durable reusable base for future `profile_create`.
-4. When creating a preset, choose an owner-authored base whose role and authority already cover the task. Never derive from another generated task profile.
+2. Call `delegate` with `action: "profile_inspect"` only when you are about to `profile_create` and reusable owner bases or configured model/thinking combinations are unknown. Inspection is optional.
+3. If no owner-authored base is selected, `profile_create` derives its base directly from the foreground inheritance. Do not ask the user to authorize a base just to start work or create a preset.
+4. When an owner-authored base is useful, choose one whose authority already covers the task. Never derive from another generated task profile.
 5. Prefer the fastest model with demonstrated ability to satisfy the task contract. Configuration and authentication prove availability, not fitness; use existing fitness evidence or `model_fitness` when the risk justifies its token cost.
-6. Request only the tools and resource profiles the task needs. Omitted fields inherit the base; supplied fields must be exact subsets. The generated profile inherits the base budget unchanged because `profile_create` has no budget field.
+6. Request only the model, thinking level, one workspace path, and exact tool subset the task needs. Omitted fields inherit the base. Resources and budget always remain host-owned and inherited.
 
-Human edge: if `profile_create` is required and the task needs an unlisted base, unavailable credentials, broader tools/resources, or a different budget, stop and ask the user to authorize a durable owner-profile change. Do not route around a rejection. Do not treat that as a ban on `delegate start`.
+Human edge: if an explicitly requested reusable preset needs unavailable credentials, tools outside its inherited surface, or a different budget, report the exact rejection and ask for an owner-profile change. Do not route around a rejection. Ordinary inherited `delegate start` remains available unless the host reports a real admission block.
 
 ### 2. Execute and verify
 
@@ -43,15 +43,15 @@ Human edge: if `profile_create` is required and the task needs an unlisted base,
 - Blocking `delegate start` because `profile_inspect` listed no bases.
 - Writing one-off profile JSON, settings, reports, or dependencies into the repository.
 - Selecting a model or thinking level that `inspect` did not report as available.
-- Giving a worker extra tools "just in case" or attempting to author a per-dispatch budget.
+- Giving a worker extra tools "just in case", authoring resource/capability arrays, or attempting a per-dispatch budget.
 - Inventing, guessing, editing, or reusing a generated profile ID across sessions or branches.
 - Treating a fast model as fit without task-shaped evidence.
 
 ## Examples
 
-Positive: inspect, derive from a read/write implementer, select an authenticated fast model at `low`, narrow tools to `read`, `grep`, and `edit`, inherit the base budget unchanged, then delegate with the returned `task-...` ID.
+Positive: omit inspect and base, derive from foreground inheritance, select an authenticated fast model at `low`, narrow tools to `read`, `grep`, and `edit`, inherit host resources and budget unchanged, then delegate with the returned `task-...` ID.
 
-Positive: inspect returns no bases; start two workers with `authority.role` `explorer` and `implementer` and no `profileId`.
+Positive: start two workers with self-contained instructions and no `profileId`; omit overrides when both should inherit the foreground model, reasoning, tools, and machine scope.
 
 Negative: a base exposes only `read` and `grep`, but the task requires `edit`. Do not request `edit` from `profile_create`; select an authorized write-capable base or ask the user for an owner-profile change. Starting without a profile remains allowed.
 
@@ -62,9 +62,9 @@ Negative: telling the user workers are blocked until they authorize explorer/imp
 - Ordinary start omitted `profileId` unless a returned `task-...` ID is in hand.
 - Empty inspect bases did not stop start.
 - The task has one bounded outcome and explicit acceptance evidence.
-- The base, if used, is owner-authored and authorized for this orchestrator.
+- The base is foreground inheritance or an owner-authored profile authorized for this orchestrator.
 - Model and thinking level were reported available or otherwise resolved by the harness.
-- Tools/resources are subsets and the owner-authored base budget is unchanged.
+- Tools are an exact subset; resources and budget remain inherited and host-owned.
 - The returned ID is passed unchanged; no project/user profile file was created.
 
 ## Known Gaps

package/dist/core/agent-session.d.ts

@@ -20,7 +20,7 @@ import type { MemoryRetrievalReport } from "./context/memory-retrieval.ts";
 import type { ContextGcReport } from "./context-gc.ts";
 import type { SessionCostSummary } from "./cost/cost-summary.ts";
 import type { DailyUsageTotals } from "./cost/daily-usage.ts";
-import { type CostGuardDecision } from "./cost-guard.ts";
+import type { CostGuardDecision, CostGuardSettings } from "./cost-guard.ts";
 import type { WorkerDelegationRequest } from "./delegation/worker-delegation-request.ts";
 import type { CompactOptions, ContextUsage, ExtensionRunner, ReplacedSessionContext, ToolDefinition, ToolInfo } from "./extensions/index.ts";
 import { type ChannelProvider, GatewayRegistry, type JobSchedulerProvider } from "./gateways/channel-provider.ts";
@@ -41,7 +41,7 @@ import { type PromptTemplate } from "./prompt-templates.ts";
 import type { ModelFitnessReport } from "./research/model-fitness.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
 import type { CredentialManager } from "./secrets/credential-manager.ts";
-import type { SettingsManager } from "./settings-manager.ts";
+import type { SettingsManager, SettingsScope } from "./settings-manager.ts";
 import { type TaskStepsState } from "./tasks/task-state.ts";
 import { type ToolProbeReport } from "./tool-protocol-controller.ts";
 import type { BashOperations } from "./tools/bash.ts";
@@ -62,6 +62,7 @@ export declare class AgentSession {
     capabilityEnvelope?: CapabilityEnvelope;
     private _scopedModels;
     private _unsubscribeAgent?;
+    private _unsubscribeSettingsChanges?;
     private _eventListeners;
     private _extensionsChangedListeners;
     private _steeringMessages;
@@ -94,9 +95,8 @@ export declare class AgentSession {
     private _agentDir;
     private _collectWorkspaceSources;
     private readonly _localRuntimeController;
+    private readonly _localPrefixWarm;
     private readonly _toolProtocol;
-    private _prefixWarmer;
-    private readonly _completedPrefixWarms;
     /** Assembles the session's base system prompt from live session state (see
      * system-prompt-builder.ts); owns the paired _baseSystemPromptOptions. */
     private readonly _systemPromptBuilder;
@@ -136,14 +136,7 @@ export declare class AgentSession {
      * owns the spawned-usage and daily-usage memo caches. */
     private readonly _analytics;
     private readonly _treeNavigator;
-    private _lastCostGuardDecision?;
-    /**
-     * `getSpawnedUsage().cost` snapshotted at the start of the CURRENT foreground prompt cycle (see
-     * `_promptUnserialized`), so the cost guard can attribute only background/spawned spend since THIS
-     * turn began, not the session's entire lifetime spend. Reset on every new user prompt; every
-     * round-trip within the same turn (tool-call iterations) shares this one baseline.
-     */
-    private _costGuardTurnBaselineUsd;
+    private readonly _costGuard;
     /** Per-turn model-router subsystem (see model-router-controller.ts); owns the transient route/intent,
      * the cheap-turn session buffer, the escalation/retry flags, and the sticky last-decision/skip-reason
      * used by the status report. Its parallel routed drive path delegates every turn back to
@@ -161,8 +154,7 @@ export declare class AgentSession {
     private _disposed;
     private _disposeCompletion;
     private readonly _reflectionAbort;
-    /** Native reflection engine + learning-apply/rollback path (see reflection-controller.ts); owns no
-     * session state, applies durable writes through the bundled memory tool and the session log. */
+    /** Root current-turn reflection cue + explicit learning-apply/rollback compatibility path. */
     private readonly _reflection;
     /** Durable goal lifecycle, accounting, and raw continuation loop. */
     private readonly _goals;
@@ -188,10 +180,6 @@ export declare class AgentSession {
     constructor(config: AgentSessionConfig);
     /** Model registry for API key resolution and model discovery */
     get modelRegistry(): ModelRegistry;
-    private _scheduleLocalPrefixWarm;
-    private _cancelPrefixWarm;
-    private _runLocalPrefixWarm;
-    private _isWarmableLocalModel;
     /**
      * True when the session's stream fn is the raw `streamSimple` provider entry (directly, or as the
      * base wrapped by the idle watchdog at construction). Callers use this to decide whether request
@@ -210,25 +198,10 @@ export declare class AgentSession {
     private _describeCompactionSummarizer;
     private _getLastCompactionSelectionReason;
     private _resolveCompactionThinkingLevel;
-    /**
-     * Resolve the foreground request's cost policy after routing/context conversion, when the actual
-     * model, full system prompt, converted messages, and tool schemas are known. The guard is a
-     * projection threshold rather than a hard output cap: warning mode never reduces capability, while
-     * opt-in downgrade changes only this request's reasoning effort. Best-effort: never throws.
-     *
-     * The ceiling is turn-cumulative: the next foreground call's projection is folded together with
-     * background/research/worker/reflection spend recorded SINCE THIS TURN BEGAN — {@link getSpawnedUsage}'s
-     * already-recorded rollup (the same read-side-deduped total the footer's SUBAGENTS line uses) minus the
-     * baseline snapshotted before a new turn enters routing in `_promptUnserialized`
-     * ({@link _costGuardTurnBaselineUsd}) — so a
-     * turn that is cheap in the foreground but has spent heavily via background lanes THIS turn still trips
-     * the warning, while a prior turn's background spend does not keep every later turn's guard stuck
-     * "over". A background lane that finishes mid-turn is attributed to whichever turn it completes in.
-     * Per-lane dollar caps (research/worker `maxUsd`) are separate and untouched by this guard.
-     */
-    private _resolveCostGuardRequestReasoning;
     /** Latest cost-guard decision (for the host footer/UI to surface a warning). Undefined if disabled. */
     getLastCostGuardDecision(): CostGuardDecision | undefined;
+    /** Apply an explicit guard choice and invalidate all prior decision/envelope projections immediately. */
+    setCostGuardSettings(settings: CostGuardSettings, scope?: SettingsScope): void;
     private get _skillCurator();
     /**
      * Skill curator (#32): PROPOSE (never auto-apply) archival of stale reflection-promoted skills and
@@ -960,14 +933,11 @@ export declare class AgentSession {
      * call `this._goals.continueLoop` directly from here — that bypasses the guard.
      */
     continueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;
-    /**
-     * Run a one-shot LLM completion fully ISOLATED from the main session — the load-bearing primitive
-     * for native reflection (see reflection-controller.ts for the isolation invariants).
-     */
+    /** Run one explicit isolated completion for bounded host-owned consumers. */
     runIsolatedCompletion(opts: IsolatedCompletionOptions): Promise<IsolatedCompletionResult>;
     /**
-     * Native end-of-loop reflection pass. Delegates to {@link ReflectionController}; returns null
-     * when the demand gate skips or in a child session.
+     * Explicit compatibility/application reflection pass. Automatic reflection never calls this
+     * method; it returns null when the demand gate skips or in a child session.
      */
     runReflectionPass(input: {
         signals: DemandSignals;