@diegopetrucci/pi-extensions 0.1.76 → 0.1.78

package/README.md

@@ -6,10 +6,10 @@ A collection of [pi](https://pi.dev) agent extensions I made. (Btw, [I am also b
 
 ### Subagents
 
-- [`code-reviewer`](./extensions/code-reviewer): Adds a read-only `code_reviewer` subagent tool that reviews local changes for ticket fit, diff mismatches, correctness, security, simplicity, and validation gaps without implementing fixes, auto-selects a contrarian-style opposite-provider review model when available, and clamps requested thinking to the chosen model's capabilities.
-- [`contrarian`](./extensions/contrarian): Adds a read-only contrarian tool that spins up an isolated subprocess to stress-test plans, designs, assumptions, bug hypotheses, and conclusions by steelmanning the strongest opposing case.
-- [`librarian`](./extensions/librarian): Adds a GitHub research scout with a local repo checkout cache disabled by default under the OS user cache directory, toggleable with `/librarian-cache`, configurable subagent model/thinking defaults via `/librarian-config`, and cached repos expiring after 7 days of non-use.
-- [`oracle`](./extensions/oracle): Adds an Amp-style read-only oracle tool that auto-selects the strongest reasoning model on the current provider/subscription, supports persisted `/oracle` model/thinking defaults, requests xhigh reasoning by default and clamps to model capabilities, and shows live status while running.
+- [`code-reviewer`](./extensions/code-reviewer): Adds a `code_reviewer` subagent tool with read-only built-in tools plus configured MCP tools (run without confirmation, may have side effects, Pi >=1.0.4) that reviews local changes for ticket fit, diff mismatches, correctness, security, simplicity, and validation gaps without implementing fixes, auto-selects a contrarian-style opposite-provider review model when available, and clamps requested thinking to the chosen model's capabilities.
+- [`contrarian`](./extensions/contrarian): Adds a contrarian tool with read-only built-in tools plus configured MCP tools (run without confirmation, may have side effects, Pi >=1.0.4) that spins up an isolated subprocess to stress-test plans, designs, assumptions, bug hypotheses, and conclusions by steelmanning the strongest opposing case.
+- [`librarian`](./extensions/librarian): Adds a GitHub research scout with a local repo checkout cache disabled by default under the OS user cache directory, toggleable with `/librarian-cache`, configurable subagent model/thinking defaults via `/librarian-config`, cached repos expiring after 7 days of non-use, and configured MCP tools (run without confirmation, may have side effects, Pi >=1.0.4).
+- [`oracle`](./extensions/oracle): Adds an Amp-style oracle tool with read-only built-in tools plus configured MCP tools (run without confirmation, may have side effects, Pi >=1.0.4) that auto-selects the strongest reasoning model on the current provider/subscription, supports persisted `/oracle` model/thinking defaults, requests xhigh reasoning by default and clamps to model capabilities, and shows live status while running.
 
 ### Providers
 
@@ -19,19 +19,19 @@ A collection of [pi](https://pi.dev) agent extensions I made. (Btw, [I am also b
 
 - [`git-footer`](./extensions/git-footer): Adds TLH-style git dirty counts, ahead/behind, and optional PR number to pi's built-in footer status area. This package is standalone-only and is not auto-loaded by the `@diegopetrucci/pi-extensions` collection package.
 - [`minimal-footer`](./extensions/minimal-footer): Replaces pi's built-in footer with a minimal configurable two-line layout: branch plus cached git dirty/ahead/PR status and repo on the first line, context/model on the second, optional `DUMB ZONE`, optional `xp` marker, plus OpenAI Codex usage windows labeled from their reported durations.
-- [`quiet-tools`](./extensions/quiet-tools): Renders collapsed built-in tool rows as a one-line invocation plus an expand hint without changing model-visible tool results; toggle temporarily with `/quiet-tools`.
+- [`quiet-tools`](./extensions/quiet-tools): Always renders collapsed built-in tool rows and `mcp__*` rows as a one-line invocation plus an expand hint without changing model-visible tool results; inspect status with `/quiet-tools status`.
 
 ### / Slash commands
 
-- [`agent-workflow-audit`](./extensions/agent-workflow-audit): Adds `/agent-workflow-audit`, which runs an isolated repo workflow audit subagent and returns only the final distilled report to the main session.
+- [`agent-workflow-audit`](./extensions/agent-workflow-audit): Adds `/agent-workflow-audit`, which runs an isolated repo workflow audit subagent with configured MCP tools (run without confirmation, may have side effects, Pi >=1.0.4) and returns only the final distilled report to the main session.
 - [`annotate-git-diff`](./extensions/annotate-git-diff): Adds `/annotate-git-diff`, a native Glimpse UI where explicit Submit sends structured feedback to the agent and close recovery keeps an unsent draft in the editor.
 - [`annotate-last-message`](./extensions/annotate-last-message): Adds `/annotate-last-message`, a native Glimpse UI for annotating the latest assistant reply and sending planning-oriented feedback directly to the agent.
 - [`review`](./extensions/review): Adds `/review` and `/end-review` for interactive code reviews of local changes, commits, PRs, and selected paths.
-- [`triage-comments`](./extensions/triage-comments): Adds `/triage-comments` and a read-only `triage_comments` subagent tool that can auto-detect the current branch's PR, filter resolved/outdated inline comments, classify selected review comments with evidence, and suggest handling options without implementing changes
+- [`triage-comments`](./extensions/triage-comments): Adds `/triage-comments` and a `triage_comments` subagent tool with read-only built-in tools plus configured MCP tools (run without confirmation, may have side effects, Pi >=1.0.4) that can auto-detect the current branch's PR, filter resolved/outdated inline comments, classify selected review comments with evidence, and suggest handling options without implementing changes
 
 ### Context management
 
-- [`context-cap`](./extensions/context-cap): Caps effective model context windows at 200k tokens by default so pi avoids the `dumb zone`; toggle temporarily with `/context-cap`.
+- [`context-cap`](./extensions/context-cap): Caps effective model context windows at 300k tokens by default so pi avoids the `dumb zone`; toggle temporarily with `/context-cap`.
 - [`context-inspector`](./extensions/context-inspector): Adds `/context`, a local self-contained HTML dashboard that breaks down where the current session context is going, with category overview, top offenders, and drilldown search.
 - [`dynamic-context-pruning`](./extensions/dynamic-context-pruning): Automatically prunes duplicate tool results, stale errored inputs, and superseded file-op outputs from long sessions behind a cache-aware net-benefit gate, with a `/prune` picker and `/context-pruning` status/control commands.
 

package/extensions/agent-workflow-audit/README.md

@@ -60,7 +60,7 @@ Options:
 
 - Runs a child `createAgentSession` with an in-memory session manager.
 - Disables inherited extensions, skills, prompt templates, themes, and context files in the child.
-- Gives the child `read`, `grep`, `find`, `ls`, and guarded `bash` tools.
+- Gives the child `read`, `grep`, `find`, `ls`, and guarded `bash` tools, plus any configured MCP tools (run without confirmation; may have side effects; requires host Pi >=1.0.4; older hosts degrade to no MCP, no error); the global `mcp.json` always applies; a project `.pi/mcp.json` is loaded only when the host session has already trusted the project.
 - Returns a single final `agent-workflow-audit` custom message to the parent session.
 - Includes a short run-boundary footer noting that intermediate command output, errors, retries, and search path stayed in the child session.
 

package/extensions/agent-workflow-audit/index.ts

@@ -1,5 +1,8 @@
 import * as fs from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import type {
   AgentSession,
@@ -15,6 +18,7 @@ import {
   getAgentDir,
   getMarkdownTheme,
 } from "@earendil-works/pi-coding-agent";
+import * as piCodingAgent from "@earendil-works/pi-coding-agent";
 import { Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 
 const CUSTOM_TYPE = "agent-workflow-audit";
@@ -204,11 +208,37 @@ function inspectFinalAssistant(messages: unknown[]): AuditAssistantOutcome {
   return { ok: false, reason: "Agent Workflow Audit subagent produced no assistant message" };
 }
 
-function isAbortLikeError(error: unknown): boolean {
-  if (error && typeof error === "object" && (error as { name?: unknown }).name === "AbortError")
-    return true;
-  const message = error instanceof Error ? error.message : String(error);
-  return /aborted|cancelled|canceled/i.test(message);
+function classifyRunFailure(
+  error: unknown,
+  callerAborted: boolean,
+): { status: "aborted" | "error"; message: string; error?: string } {
+  const message = callerAborted
+    ? "Aborted"
+    : error instanceof Error
+      ? error.message
+      : String(error);
+  return {
+    status: callerAborted ? "aborted" : "error",
+    message,
+    error: callerAborted ? undefined : message,
+  };
+}
+
+function createAuditAbortController(abortChild: () => void, onCallerAbort: () => void) {
+  let callerAborted = false;
+  return {
+    get callerAborted() {
+      return callerAborted;
+    },
+    abortForCleanup() {
+      abortChild();
+    },
+    abortFromCaller() {
+      callerAborted = true;
+      onCallerAbort();
+      abortChild();
+    },
+  };
 }
 
 function renderCollapsedReport(report: string, lineLimit = COLLAPSED_REPORT_LINES): string {
@@ -267,6 +297,82 @@ async function gitStatusShort(
   return result.stdout.trim();
 }
 
+const UNICODE_SPACES_PATTERN = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
+/**
+ * Mirrors normalizeWindowsShellPath from dist/utils/paths.js. No-op on
+ * non-win32 paths.
+ */
+function normalizeWindowsShellPathLocal(filePath: string): string {
+  if (!filePath.startsWith("/") || filePath.startsWith("//") || filePath.includes("\\"))
+    return filePath;
+  const match = filePath.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+  if (!match) return filePath;
+  const suffix = match[2]?.replaceAll("/", "\\");
+  return `${match[1].toUpperCase()}:\\${suffix ?? ""}`;
+}
+
+/**
+ * Mirrors Pi's normalizePath (dist/utils/paths.js). On win32, Git Bash / WSL
+ * drive-path normalisation always runs; only tilde expansion is gated by
+ * expandTilde.
+ */
+function normalizePath(
+  input: string,
+  opts: { normalizeUnicodeSpaces?: boolean; stripAtPrefix?: boolean; expandTilde?: boolean } = {},
+): string {
+  const { normalizeUnicodeSpaces = false, stripAtPrefix = false, expandTilde = true } = opts;
+  let p = input;
+  if (normalizeUnicodeSpaces) p = p.replace(UNICODE_SPACES_PATTERN, " ");
+  if (stripAtPrefix && p.startsWith("@")) p = p.slice(1);
+  if (process.platform === "win32") p = normalizeWindowsShellPathLocal(p);
+  if (expandTilde) {
+    const home = os.homedir();
+    if (p === "~") p = home;
+    else if (p.startsWith("~/") || (process.platform === "win32" && p.startsWith("~\\")))
+      p = path.join(home, p.slice(2));
+  }
+  if (/^file:\/\//.test(p)) p = fileURLToPath(p);
+  return p;
+}
+
+/**
+ * Mirrors Pi's resolveToCwd (dist/core/tools/path-utils.js). Exposed via
+ * __test__ for parity tests; not imported by other extensions.
+ */
+function resolveToCwd(rawPath: string, cwd: string): string {
+  const normalized = normalizePath(rawPath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });
+  const base = normalizePath(cwd);
+  return path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(base, normalized);
+}
+
+/** Mirrors tryMacOSScreenshotPath from dist/core/tools/path-utils.js */
+function tryMacOSScreenshotPathVariant(filePath: string): string {
+  return filePath.replace(/ (AM|PM)\./gi, " $1.");
+}
+/** Mirrors tryNFDVariant from dist/core/tools/path-utils.js */
+function tryNFDPathVariant(filePath: string): string {
+  return filePath.normalize("NFD");
+}
+/** Mirrors tryCurlyQuoteVariant from dist/core/tools/path-utils.js */
+function tryCurlyQuotePathVariant(filePath: string): string {
+  return filePath.replace(/'/g, "’");
+}
+/**
+ * Returns all read path candidates including Pi's resolveReadPathAsync fallback
+ * variants. Used only for the read tool guard; grep/find/ls use resolveToCwd only.
+ */
+function getReadPathCandidates(resolved: string): string[] {
+  const nfd = tryNFDPathVariant(resolved);
+  return [
+    resolved,
+    tryMacOSScreenshotPathVariant(resolved),
+    nfd,
+    tryCurlyQuotePathVariant(resolved),
+    tryCurlyQuotePathVariant(nfd),
+  ];
+}
+
 function resolveToolPath(cwd: string, rawPath: unknown): string {
   const input = typeof rawPath === "string" && rawPath.trim() ? rawPath.trim() : ".";
   const normalized = input.startsWith("@") ? input.slice(1) : input;
@@ -288,11 +394,33 @@ async function assertToolPathInsideCwd(
 ): Promise<string | undefined> {
   if (rawPath !== undefined && typeof rawPath !== "string")
     return `${toolName} path must be a string.`;
+  // A path is allowed if it resolves inside EITHER the realpath'd root (root) OR
+  // the lexical cwd (lexicalCwd). This handles missing files in symlinked workspaces
+  // where realpath fails and the lexical fallback starts with the alias prefix.
   const root = await fs.realpath(cwd).catch(() => path.resolve(cwd));
+  const lexicalCwd = path.resolve(cwd);
   const resolved = resolveToolPath(cwd, rawPath);
   const realPath = await fs.realpath(resolved).catch(() => resolved);
-  if (!isInside(root, realPath))
+  if (!isInside(root, realPath) && !isInside(lexicalCwd, realPath))
     return `${toolName} is limited to the audited checkout: ${realPath}`;
+  // Pi-effective path check (monotonic: block if either resolution is outside).
+  // For the read tool, also check Pi's resolveReadPathAsync fallback variants so
+  // a missing file whose variant resolves outside is not silently allowed.
+  try {
+    const piResolved = resolveToCwd(typeof rawPath === "string" ? rawPath : ".", cwd);
+    const candidates = toolName === "read" ? getReadPathCandidates(piResolved) : [piResolved];
+    // Deliberate policy: all candidates are checked regardless of existence (not
+    // Pi's existence-ordered selection) so the guard cannot be raced by creating
+    // a variant between the hook and the read. Trade-off: a read is blocked when
+    // an escaping variant symlink sits next to a safe primary file.
+    for (const candidate of candidates) {
+      const candidateRealPath = await fs.realpath(candidate).catch(() => candidate);
+      if (!isInside(root, candidateRealPath) && !isInside(lexicalCwd, candidateRealPath))
+        return `${toolName} is limited to the audited checkout: ${candidateRealPath}`;
+    }
+  } catch {
+    return `${toolName} path could not be resolved safely.`;
+  }
   return undefined;
 }
 
@@ -330,6 +458,93 @@ const SAFE_DIRECT_COMMANDS = new Set([
   "yarn",
 ]);
 
+const SUBAGENT_MCP_TOOLS = [
+  "mcp__*",
+  "tool_search",
+  "list_mcp_resources",
+  "list_mcp_resource_templates",
+  "read_mcp_resource",
+];
+
+// Derive project-trust for the isolated subagent session from the host tool context.
+// Fails closed: returns false if the host has not trusted the project, or if the subagent
+// runs in a different directory, preventing an untrusted project's .pi/mcp.json from
+// being loaded by the MCP extension.
+function resolveSubagentProjectTrusted(
+  ctx: { cwd: string; isProjectTrusted(): boolean },
+  subagentCwd: string,
+): boolean {
+  // Feature-detected for older Pi hosts that may lack isProjectTrusted.
+  const hostTrusted =
+    typeof (ctx as { isProjectTrusted?: unknown }).isProjectTrusted === "function"
+      ? ctx.isProjectTrusted()
+      : false;
+  if (!hostTrusted) return false;
+  try {
+    return realpathSync(subagentCwd) === realpathSync(ctx.cwd);
+  } catch {
+    return false; // fail closed if realpath resolution fails
+  }
+}
+
+/** Returns true when v is a semver string >=1.0.4 (ignores prerelease; missing/garbage -> false). */
+function isMcpCompatibleVersion(v: string | undefined): boolean {
+  if (!v) return false;
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+  if (!m) return false;
+  const major = Number(m[1]),
+    minor = Number(m[2]),
+    patch = Number(m[3]);
+  if (major !== 1) return major > 1;
+  if (minor !== 0) return minor > 0;
+  return patch >= 4;
+}
+
+// Safe runtime access to MCP/tool-search factories — feature-detected for Pi >=0.99.0 hosts.
+// Additionally gated on VERSION >=1.0.4: on older hosts mcp__* allowlist entries are exact-name
+// matches that resolve nothing, so spawning MCP servers provides no benefit.
+function createMcpSubagentFactories(): ExtensionFactory[] {
+  const ns = piCodingAgent as Record<string, unknown>;
+  if (!isMcpCompatibleVersion(ns["VERSION"] as string | undefined)) return [];
+  const factories: ExtensionFactory[] = [];
+  const mcp = ns["createMcpExtension"];
+  const toolSearch = ns["createToolSearchExtension"];
+  if (typeof mcp === "function") factories.push((mcp as () => ExtensionFactory)());
+  if (typeof toolSearch === "function") factories.push((toolSearch as () => ExtensionFactory)());
+  return factories;
+}
+
+// Emit session_shutdown before dispose so MCP closes server connections (no leaked child processes).
+async function disposeSubagentSession(session: AgentSession | undefined): Promise<void> {
+  if (!session) return;
+  try {
+    const runner = (
+      session as unknown as {
+        extensionRunner?: {
+          hasHandlers(n: string): boolean;
+          emit(e: { type: string; reason: string }): Promise<unknown>;
+        };
+      }
+    ).extensionRunner;
+    if (runner?.hasHandlers("session_shutdown")) {
+      await runner.emit({ type: "session_shutdown", reason: "quit" });
+    }
+  } catch {
+    // Shutdown errors must not prevent dispose.
+  }
+  session.dispose();
+}
+
+function isSubagentMcpTool(toolName: string): boolean {
+  return (
+    toolName.startsWith("mcp__") ||
+    toolName === "tool_search" ||
+    toolName === "list_mcp_resources" ||
+    toolName === "list_mcp_resource_templates" ||
+    toolName === "read_mcp_resource"
+  );
+}
+
 const READ_ONLY_GIT_SUBCOMMANDS = new Set([
   "blame",
   "branch",
@@ -677,9 +892,7 @@ function getBlockedPackageManagerReason(commandName: string, tokens: string[]):
       index += 1;
     }
   }
-  const runnerIndex = lowerTokens.findIndex((token) =>
-    ["node", "python", "python3", "ruby", "php"].includes(token),
-  );
+  const runnerIndex = lowerTokens.findIndex((token) => ["node", "ruby", "php"].includes(token));
   if (runnerIndex >= 0) {
     const runnerReason = getBlockedInterpreterReason(
       lowerTokens[runnerIndex],
@@ -961,9 +1174,6 @@ function getBlockedInterpreterReason(commandName: string, tokens: string[]): str
   ) {
     return `Agent Workflow Audit blocks inline/preload ${commandName} execution; run documented project scripts instead.`;
   }
-  if (["python", "python3"].includes(commandName) && hasInlineFlag(lowerTokens, ["-c"])) {
-    return "Agent Workflow Audit blocks inline Python execution; run documented project scripts instead.";
-  }
   if (["ruby", "php"].includes(commandName) && hasInlineFlag(lowerTokens, ["-e", "-r"])) {
     return `Agent Workflow Audit blocks inline/preload ${commandName} execution; run documented project scripts instead.`;
   }
@@ -1137,10 +1347,13 @@ function createAuditRuntimeGuardExtension(options: {
     });
 
     pi.on("tool_call", async (event) => {
-      if (!["read", "grep", "find", "ls", "bash"].includes(event.toolName)) {
+      if (
+        !["read", "grep", "find", "ls", "bash"].includes(event.toolName) &&
+        !isSubagentMcpTool(event.toolName)
+      ) {
         return {
           block: true,
-          reason: `agent-workflow-audit exposes only read, grep, find, ls, and guarded bash; ${event.toolName} is not allowed.`,
+          reason: `agent-workflow-audit exposes only read, grep, find, ls, guarded bash, and MCP tools; ${event.toolName} is not allowed.`,
         };
       }
 
@@ -1212,7 +1425,7 @@ function buildSystemPrompt(options: {
     ? "Plan-only mode is active. Do not run project commands with bash. Read instructions and manifests, infer the likely workflow, and report what would be tried plus remaining uncertainty."
     : "Execution mode is active. Try documented setup, build, lint, test, run, and other obvious project commands when they are safe and relevant. A runtime guard blocks deploy/publish/VCS-mutating/destructive commands; if a command is blocked, report it as a workflow/safety finding instead of trying to bypass it.";
 
-  return `You are Agent Workflow Audit, an isolated subagent running inside The Last Harness. Your job is to stress-test how efficiently an agent can operate in the current repository and return a concise final audit report to the parent session.
+  return `You are Agent Workflow Audit, an isolated subagent. Your job is to stress-test how efficiently an agent can operate in the current repository and return a concise final audit report to the parent session.
 
 Working directory: ${options.cwd}
 Turn budget: ${options.maxTurns} turns total, including your final answer.
@@ -1233,7 +1446,7 @@ Workflow:
 
 Constraints:
 - Do not fix application code or failing tests. Do not edit, write, move, delete, commit, checkout, reset, clean, push, publish, deploy, or mutate GitHub.
-- Use built-in read/grep/find/ls for file inspection. Use bash only for safe documented project commands or read-only local inspection.
+- Use built-in read/grep/find/ls for file inspection. Use bash only for safe documented project commands or read-only local inspection. Configured MCP tools are also available and run without confirmation; use them only to gather evidence or context, not for state-changing actions unless the task explicitly requires it. MCP access requires host Pi >=1.0.4; on older hosts MCP tools are absent with no error.
 - Do not paste raw full logs. Summarize command output and include short excerpts only when needed to prove a finding.
 - Never present a command as successful unless tool output showed success.
 - Mark inferred steps as assumptions.
@@ -1354,27 +1567,31 @@ async function runAudit(
   let unsubscribe: (() => void) | undefined;
   let runTimeout: NodeJS.Timeout | undefined;
   let abortListenerAdded = false;
-  let aborted = Boolean(ctx.signal?.aborted);
 
   const emit = () => updateAuditUi(ctx, details, lastContent);
-  const abort = () => {
-    aborted = true;
-    details.status = "aborted";
-    details.endedAt = Date.now();
-    lastContent = "Aborted";
-    emit();
-    void session?.abort();
-  };
+  const abortController = createAuditAbortController(
+    () => {
+      void session?.abort();
+    },
+    () => {
+      details.status = "aborted";
+      details.endedAt = Date.now();
+      lastContent = "Aborted";
+      emit();
+    },
+  );
+  const abortFromCaller = () => abortController.abortFromCaller();
 
-  if (ctx.signal?.aborted) abort();
+  if (ctx.signal?.aborted) abortFromCaller();
   if (ctx.signal && !ctx.signal.aborted) {
-    ctx.signal.addEventListener("abort", abort);
+    ctx.signal.addEventListener("abort", abortFromCaller);
     abortListenerAdded = true;
   }
 
   try {
     emit();
-    const isolatedSettingsManager = SettingsManager.inMemory({});
+    const projectTrusted = resolveSubagentProjectTrusted(ctx, cwd);
+    const isolatedSettingsManager = SettingsManager.inMemory({}, { projectTrusted });
     const resourceLoader = new DefaultResourceLoader({
       cwd,
       agentDir: getAgentDir(),
@@ -1386,6 +1603,7 @@ async function runAudit(
       noContextFiles: true,
       extensionFactories: [
         createAuditRuntimeGuardExtension({ cwd, maxTurns: MAX_TURNS, planOnly: options.planOnly }),
+        ...createMcpSubagentFactories(),
       ],
       systemPromptOverride: () =>
         buildSystemPrompt({
@@ -1404,8 +1622,8 @@ async function runAudit(
     await resourceLoader.reload();
 
     const tools = options.planOnly
-      ? ["read", "grep", "find", "ls"]
-      : ["read", "grep", "find", "ls", "bash"];
+      ? ["read", "grep", "find", "ls", ...SUBAGENT_MCP_TOOLS]
+      : ["read", "grep", "find", "ls", "bash", ...SUBAGENT_MCP_TOOLS];
     const created = await createAgentSession({
       cwd,
       ...getModelRuntimeOption(ctx),
@@ -1417,9 +1635,17 @@ async function runAudit(
       tools,
     });
 
+    // Assign session BEFORE bindExtensions so the finally block can dispose it
+    // even if binding fails partway through (e.g. a server starts then an
+    // extension's session_start throws).
     session = created.session;
+    // Connect extensions (MCP servers) before prompting. Feature-detected: Pi >=0.99.0.
+    await (created.session as any).bindExtensions?.({ mode: "json" });
     unsubscribe = session.subscribe((event) => {
       switch (event.type) {
+        case "message_start":
+          if (event.message.role === "assistant") lastContent = "";
+          break;
         case "message_update":
           if (event.assistantMessageEvent?.type === "text_delta") {
             lastContent += event.assistantMessageEvent.delta ?? "";
@@ -1454,7 +1680,7 @@ async function runAudit(
       }
     });
 
-    if (!aborted) {
+    if (!abortController.callerAborted) {
       const promptPromise = session.prompt(
         buildUserPrompt({
           cwd,
@@ -1466,12 +1692,11 @@ async function runAudit(
       );
       const timeoutPromise = new Promise<never>((_resolve, reject) => {
         runTimeout = setTimeout(() => {
-          abort();
-          reject(
-            new Error(
-              `/agent-workflow-audit timed out after ${Math.round(MAX_RUN_MS / 1000)} seconds.`,
-            ),
+          const timeoutError = new Error(
+            `/agent-workflow-audit timed out after ${Math.round(MAX_RUN_MS / 1000)} seconds.`,
           );
+          reject(timeoutError);
+          abortController.abortForCleanup();
         }, MAX_RUN_MS);
       });
       await Promise.race([promptPromise, timeoutPromise]);
@@ -1486,7 +1711,7 @@ async function runAudit(
     if (outcome.ok) {
       lastContent = outcome.answer;
       details.status = "done";
-    } else if (aborted) {
+    } else if (abortController.callerAborted) {
       lastContent = "Aborted";
       details.status = "aborted";
     } else {
@@ -1497,10 +1722,10 @@ async function runAudit(
     emit();
     return { report: lastContent, details };
   } catch (error) {
-    const wasAbort = aborted || isAbortLikeError(error);
-    const message = wasAbort ? "Aborted" : error instanceof Error ? error.message : String(error);
-    details.status = wasAbort ? "aborted" : "error";
-    details.error = wasAbort ? undefined : message;
+    const failure = classifyRunFailure(error, abortController.callerAborted);
+    const { message } = failure;
+    details.status = failure.status;
+    details.error = failure.error;
     details.endedAt = Date.now();
     lastContent = message;
     details.reportLength = lastContent.length;
@@ -1508,18 +1733,26 @@ async function runAudit(
     return { report: `## Agent Workflow Audit failed\n\n${message}`, details };
   } finally {
     if (runTimeout) clearTimeout(runTimeout);
-    if (ctx.signal && abortListenerAdded) ctx.signal.removeEventListener("abort", abort);
+    if (ctx.signal && abortListenerAdded) ctx.signal.removeEventListener("abort", abortFromCaller);
     unsubscribe?.();
-    session?.dispose();
+    await disposeSubagentSession(session);
   }
 }
 
 export const __test__ = {
+  SUBAGENT_MCP_TOOLS,
+  isMcpCompatibleVersion,
+  resolveSubagentProjectTrusted,
+  createMcpSubagentFactories,
+  disposeSubagentSession,
+  classifyRunFailure,
+  createAuditAbortController,
+  createAuditRuntimeGuardExtension,
   appendRunBoundary,
   assertToolPathInsideCwd,
+  resolveToCwd,
   buildSystemPrompt,
   buildUserPrompt,
-  createAuditRuntimeGuardExtension,
   inspectFinalAssistant,
   formatToolCall,
   getBlockedBashReason,

package/extensions/agent-workflow-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-agent-workflow-audit",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "A pi extension that runs an isolated repo workflow audit and returns only the final report to the main session.",
   "keywords": [
     "pi-package",

package/extensions/annotate-git-diff/git.ts

@@ -381,20 +381,14 @@ const binaryExtensions = new Set([
   ".7z",
   ".a",
   ".avi",
-  ".avif",
   ".bin",
-  ".bmp",
   ".class",
   ".dll",
   ".dylib",
   ".eot",
   ".exe",
-  ".gif",
   ".gz",
-  ".ico",
   ".jar",
-  ".jpeg",
-  ".jpg",
   ".lockb",
   ".map",
   ".mov",
@@ -403,7 +397,6 @@ const binaryExtensions = new Set([
   ".o",
   ".otf",
   ".pdf",
-  ".png",
   ".pyc",
   ".so",
   ".svgz",
@@ -411,7 +404,6 @@ const binaryExtensions = new Set([
   ".ttf",
   ".wasm",
   ".webm",
-  ".webp",
   ".woff",
   ".woff2",
   ".zip",

package/extensions/annotate-git-diff/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-annotate-git-diff",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "A standalone pi extension that adds /annotate-git-diff, a native Glimpse UI for annotating git diffs and sending explicit feedback directly to the agent; close recovery keeps unsent drafts in the editor.",
   "keywords": [
     "pi-package",

package/extensions/annotate-last-message/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-annotate-last-message",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "A standalone pi extension that adds /annotate-last-message, a native Glimpse UI for annotating the latest assistant reply.",
   "keywords": [
     "pi-package",

package/extensions/annotate-last-message/web/index.html

@@ -10,8 +10,8 @@
    * overrides semantic and Markdown colours from ctx.ui.theme. When Pi's theme
    * cannot provide a token, the matching dark/light fallback remains readable.
    *
-   * The --md* fallback values below are kept in sync with the FALLBACK
-   * object in theme.ts so this template renders correctly when the injected
+   * The --md* fallback values below are kept in sync with DARK_FALLBACK
+   * in theme.ts so this template renders correctly when the injected
    * theme block is absent (e.g. opened standalone in a browser for debugging).
    */
   :root {
@@ -31,7 +31,7 @@
     --error: #ffb3b3;
     --warning: #f4c95d;
 
-    /* Markdown token colours — kept in sync with FALLBACK in theme.ts */
+    /* Markdown token colours — kept in sync with DARK_FALLBACK in theme.ts */
     --mdHeading: #f4c95d;
     --mdLink: #7dd3fc;
     --mdLinkUrl: #8a8a8a;

package/extensions/code-reviewer/README.md

@@ -1,10 +1,8 @@
 # code-reviewer
 
-Adds a read-only `code_reviewer` subagent tool that adapts The Last Harness [`code-reviewer`](https://github.com/diegopetrucci/the-last-harness/blob/main/agents/subagents/code-reviewer.md) prompt into a standalone pi extension.
+Adds a `code_reviewer` subagent tool that adapts The Last Harness [`code-reviewer`](https://github.com/diegopetrucci/the-last-harness/blob/main/agents/subagents/code-reviewer.md) prompt into a standalone pi extension.
 
-Use it when you want an isolated second-pass review of a proposed change against the local checkout. The tool stays read-only, checks ticket fit and scope first, then looks for diff mismatches, correctness bugs, security/safety issues, unnecessary complexity, and missing validation.
-
-This package is adapted from the TLH code-reviewer workflow for use as a standalone pi extension.
+Use it when you want an isolated second-pass review of a proposed change against the local checkout. The subagent uses read-only built-in tools plus any configured MCP tools, checks ticket fit and scope first, then looks for diff mismatches, correctness bugs, security/safety issues, unnecessary complexity, and missing validation.
 
 ## Install
 
@@ -46,7 +44,8 @@ When called, it launches an isolated in-memory child agent with:
 - an auto-selected review model that prefers contrarian-style opposite-provider and opposite-family candidates before same-provider fallbacks;
 - automatic model candidates constrained to the current Pi session's model scope when that scope is non-empty;
 - requested thinking taken from the active session when available, otherwise defaulting to `high` for reasoning models and `off` for non-reasoning models, then clamped to the selected model's supported level;
-- read-only tools only: `read`, `grep`, `find`, `ls`, and guarded `bash`;
+- read-only built-in tools: `read`, `grep`, `find`, `ls`, and guarded `bash`;
+- configured MCP tools (run without confirmation in the subagent; may have side effects; use for evidence gathering only; requires host Pi >=1.0.4; older hosts degrade to no MCP, no error); the global `mcp.json` always applies; a project `.pi/mcp.json` is loaded only when the host session has already trusted the project;
 - a local-checkout path guard for file inspection;
 - a bash guard that allows only direct read-only `git`, `gh`, or `pwd` invocations.
 
@@ -65,6 +64,7 @@ The model report is concise and includes a verdict, findings, validation notes,
 
 - The subagent is explicitly instructed not to implement changes.
 - Runtime guards block write/edit tools, shell control operators, pipelines, redirection, path traversal outside the checkout, mutating `git`/`gh` commands, `npm`/publish commands, and other filesystem mutation.
+- Runtime guards apply to built-in tools only; configured MCP tools pass the guard, run without confirmation, and are limited only by prompt guidance.
 - Built-in file-inspection tools are preferred over shell commands for local files.
 
 ## Example