@diegopetrucci/pi-extensions 0.1.76 → 0.1.78

package/extensions/code-reviewer/index.ts

@@ -1,5 +1,8 @@
 import * as fs from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import type { AgentSession, ExtensionAPI, ExtensionFactory } from "@earendil-works/pi-coding-agent";
 import {
@@ -9,6 +12,7 @@ import {
   createAgentSession,
   getAgentDir,
 } from "@earendil-works/pi-coding-agent";
+import * as piCodingAgent from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
 import type { Usage } from "@earendil-works/pi-ai";
@@ -72,6 +76,33 @@ const CODE_REVIEWER_MODEL_PREFERENCES = [
   "grok-4.5",
   "gemini-3.5-flash",
 ];
+const AZURE_MODEL_PREFERENCES = [
+  "gpt-6-astra ",
+  "gpt-6-astra",
+  "gpt-6.1-sol ",
+  "gpt-6-sol ",
+  "gpt-6-sol",
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-6-luna ",
+  "gpt-6-luna",
+  "gpt-5.6-luna",
+  "gpt-5.5-pro",
+  "gpt-5.5",
+  "gpt-5.4-pro",
+  "gpt-5.4",
+  "gpt-5.3-codex",
+  "gpt-5-pro",
+  "gpt-5-chat-latest",
+  "gpt-5.2-pro",
+  "gpt-5.2",
+  "gpt-5.1",
+  "o3-pro",
+  "o1-pro",
+  "gpt-5.4-mini",
+  "gpt-5-mini",
+];
+
 const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "amazon-bedrock": [
     "global.anthropic.claude-opus-5-5 ",
@@ -102,39 +133,12 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "claude-sonnet-4-6",
     "claude-sonnet-4-5",
   ],
-  "azure-openai-responses": [
-    "gpt-6-astra ",
-    "gpt-6-astra",
-    "gpt-6.1-sol ",
-    "gpt-6-sol ",
-    "gpt-6-sol",
-    "gpt-5.6-sol",
-    "gpt-5.6-terra",
-    "gpt-6-luna ",
-    "gpt-6-luna",
-    "gpt-5.6-luna",
-    "gpt-5.5-pro",
-    "gpt-5.5",
-    "gpt-5.4-pro",
-    "gpt-5.4",
-    "gpt-5.3-codex",
-    "gpt-5-pro",
-    "gpt-5-chat-latest",
-    "gpt-5.2-pro",
-    "gpt-5.2",
-    "gpt-5.1",
-    "o3-pro",
-    "o1-pro",
-    "gpt-5.4-mini",
-    "gpt-5-mini",
-  ],
+  azure: AZURE_MODEL_PREFERENCES,
+  // Legacy alias for Pi 1.0.0–1.0.2 hosts (renamed to `azure` in Pi 1.0.3).
+  "azure-openai-responses": AZURE_MODEL_PREFERENCES,
   "cloudflare-ai-gateway": [
     "claude-fable-5",
     "claude-opus-5",
-    "claude-opus-4.8",
-    "claude-opus-4.7",
-    "claude-opus-4.6",
-    "claude-opus-4.5",
     "gpt-6-astra ",
     "gpt-6-astra",
     "gpt-5.5",
@@ -286,6 +290,92 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   ],
 };
 
+const SUBAGENT_MCP_TOOLS = [
+  "mcp__*",
+  "tool_search",
+  "list_mcp_resources",
+  "list_mcp_resource_templates",
+  "read_mcp_resource",
+];
+
+// Derive project-trust for the isolated subagent session from the host tool context.
+// Fails closed: returns false if the host has not trusted the project, or if the subagent
+// runs in a different directory (e.g. a temp workspace), preventing an untrusted project's
+// .pi/mcp.json from being loaded by the MCP extension.
+function resolveSubagentProjectTrusted(
+  ctx: { cwd: string; isProjectTrusted(): boolean },
+  subagentCwd: string,
+): boolean {
+  // Feature-detected for older Pi hosts that may lack isProjectTrusted.
+  const hostTrusted =
+    typeof (ctx as { isProjectTrusted?: unknown }).isProjectTrusted === "function"
+      ? ctx.isProjectTrusted()
+      : false;
+  if (!hostTrusted) return false;
+  try {
+    return realpathSync(subagentCwd) === realpathSync(ctx.cwd);
+  } catch {
+    return false; // fail closed if realpath resolution fails
+  }
+}
+
+function isSubagentMcpTool(toolName: string): boolean {
+  return (
+    toolName.startsWith("mcp__") ||
+    toolName === "tool_search" ||
+    toolName === "list_mcp_resources" ||
+    toolName === "list_mcp_resource_templates" ||
+    toolName === "read_mcp_resource"
+  );
+}
+
+/** Returns true when v is a semver string >=1.0.4 (ignores prerelease; missing/garbage -> false). */
+function isMcpCompatibleVersion(v: string | undefined): boolean {
+  if (!v) return false;
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+  if (!m) return false;
+  const major = Number(m[1]),
+    minor = Number(m[2]),
+    patch = Number(m[3]);
+  if (major !== 1) return major > 1;
+  if (minor !== 0) return minor > 0;
+  return patch >= 4;
+}
+
+// Gated on VERSION >=1.0.4: on older hosts mcp__* allowlist entries are exact-name
+// matches that resolve nothing, so spawning MCP servers provides no benefit.
+function createMcpSubagentFactories(): ExtensionFactory[] {
+  const ns = piCodingAgent as Record<string, unknown>;
+  if (!isMcpCompatibleVersion(ns["VERSION"] as string | undefined)) return [];
+  const factories: ExtensionFactory[] = [];
+  const mcp = ns["createMcpExtension"];
+  const toolSearch = ns["createToolSearchExtension"];
+  if (typeof mcp === "function") factories.push((mcp as () => ExtensionFactory)());
+  if (typeof toolSearch === "function") factories.push((toolSearch as () => ExtensionFactory)());
+  return factories;
+}
+
+// Emit session_shutdown before dispose so MCP closes server connections (no leaked child processes).
+async function disposeSubagentSession(session: AgentSession | undefined): Promise<void> {
+  if (!session) return;
+  try {
+    const runner = (
+      session as unknown as {
+        extensionRunner?: {
+          hasHandlers(n: string): boolean;
+          emit(e: { type: string; reason: string }): Promise<unknown>;
+        };
+      }
+    ).extensionRunner;
+    if (runner?.hasHandlers("session_shutdown")) {
+      await runner.emit({ type: "session_shutdown", reason: "quit" });
+    }
+  } catch {
+    // Shutdown errors must not prevent dispose.
+  }
+  session.dispose();
+}
+
 const READ_ONLY_TOOL_NAMES = new Set(["read", "grep", "find", "ls", "bash"]);
 const READ_ONLY_BASH_COMMANDS = new Set(["gh", "git", "pwd"]);
 const READ_ONLY_GIT_SUBCOMMANDS = new Set([
@@ -321,7 +411,12 @@ const SAFE_GIT_BRANCH_FLAGS = new Set([
   "--no-merged",
 ]);
 const SAFE_GIT_GLOBAL_FLAGS = new Set(["--no-pager", "--no-optional-locks"]);
-const SAFE_GIT_CONFIG_OVERRIDES = ["core.pager=cat", "core.fsmonitor=false", "diff.external="];
+const SAFE_GIT_CONFIG_OVERRIDES = [
+  "core.pager=cat",
+  "core.fsmonitor=false",
+  "diff.external=",
+  "log.showSignature=false",
+];
 const GIT_SUBCOMMAND_SAFE_FLAGS: Partial<Record<string, string[]>> = {
   blame: ["--no-textconv"],
   diff: ["--no-ext-diff", "--no-textconv"],
@@ -330,12 +425,6 @@ const GIT_SUBCOMMAND_SAFE_FLAGS: Partial<Record<string, string[]>> = {
   whatchanged: ["--no-ext-diff", "--no-textconv"],
 };
 const GIT_OPTIONS_REQUIRING_LOCAL_FILE = [
-  {
-    flag: "--contents",
-    blockedPrefixes: ["--con"],
-    reason:
-      "Code Reviewer bash blocks git --contents because it can read local files outside built-in path guards.",
-  },
   {
     flag: "--pathspec-from-file",
     blockedPrefixes: ["--pathspec"],
@@ -353,6 +442,15 @@ const GIT_SUBCOMMAND_OPTIONS_REQUIRING_LOCAL_FILE: Partial<
   Record<string, Array<{ reason: string; matches: (token: string) => boolean }>>
 > = {
   blame: [
+    {
+      reason:
+        "Code Reviewer bash blocks git blame --contents because it can read local files outside built-in path guards.",
+      matches: (token) => {
+        if (!token.startsWith("--")) return false;
+        const option = token.split("=", 1)[0]?.toLowerCase() ?? "";
+        return option === "--contents" || option.startsWith("--con");
+      },
+    },
     {
       reason:
         "Code Reviewer bash blocks git blame -S because it can read local revs files outside built-in path guards.",
@@ -859,6 +957,82 @@ function isInside(parent: string, child: string): boolean {
   );
 }
 
+const UNICODE_SPACES_PATTERN = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
+/**
+ * Mirrors normalizeWindowsShellPath from dist/utils/paths.js. No-op on
+ * non-win32 paths.
+ */
+function normalizeWindowsShellPathLocal(filePath: string): string {
+  if (!filePath.startsWith("/") || filePath.startsWith("//") || filePath.includes("\\"))
+    return filePath;
+  const match = filePath.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+  if (!match) return filePath;
+  const suffix = match[2]?.replaceAll("/", "\\");
+  return `${match[1].toUpperCase()}:\\${suffix ?? ""}`;
+}
+
+/**
+ * Mirrors Pi's normalizePath (dist/utils/paths.js). On win32, Git Bash / WSL
+ * drive-path normalisation always runs; only tilde expansion is gated by
+ * expandTilde.
+ */
+function normalizePath(
+  input: string,
+  opts: { normalizeUnicodeSpaces?: boolean; stripAtPrefix?: boolean; expandTilde?: boolean } = {},
+): string {
+  const { normalizeUnicodeSpaces = false, stripAtPrefix = false, expandTilde = true } = opts;
+  let p = input;
+  if (normalizeUnicodeSpaces) p = p.replace(UNICODE_SPACES_PATTERN, " ");
+  if (stripAtPrefix && p.startsWith("@")) p = p.slice(1);
+  if (process.platform === "win32") p = normalizeWindowsShellPathLocal(p);
+  if (expandTilde) {
+    const home = os.homedir();
+    if (p === "~") p = home;
+    else if (p.startsWith("~/") || (process.platform === "win32" && p.startsWith("~\\")))
+      p = path.join(home, p.slice(2));
+  }
+  if (/^file:\/\//.test(p)) p = fileURLToPath(p);
+  return p;
+}
+
+/**
+ * Mirrors Pi's resolveToCwd (dist/core/tools/path-utils.js). Exposed via
+ * __test__ for parity tests; not imported by other extensions.
+ */
+function resolveToCwd(rawPath: string, cwd: string): string {
+  const normalized = normalizePath(rawPath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });
+  const base = normalizePath(cwd);
+  return path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(base, normalized);
+}
+
+/** Mirrors tryMacOSScreenshotPath from dist/core/tools/path-utils.js */
+function tryMacOSScreenshotPathVariant(filePath: string): string {
+  return filePath.replace(/ (AM|PM)\./gi, "\u202F$1.");
+}
+/** Mirrors tryNFDVariant from dist/core/tools/path-utils.js */
+function tryNFDPathVariant(filePath: string): string {
+  return filePath.normalize("NFD");
+}
+/** Mirrors tryCurlyQuoteVariant from dist/core/tools/path-utils.js */
+function tryCurlyQuotePathVariant(filePath: string): string {
+  return filePath.replace(/'/g, "\u2019");
+}
+/**
+ * Returns all read path candidates including Pi's resolveReadPathAsync fallback
+ * variants. Used only for the read tool guard; grep/find/ls use resolveToCwd only.
+ */
+function getReadPathCandidates(resolved: string): string[] {
+  const nfd = tryNFDPathVariant(resolved);
+  return [
+    resolved,
+    tryMacOSScreenshotPathVariant(resolved),
+    nfd,
+    tryCurlyQuotePathVariant(resolved),
+    tryCurlyQuotePathVariant(nfd),
+  ];
+}
+
 function resolveToolPath(cwd: string, rawPath: string | undefined): string {
   const input = rawPath?.trim() || ".";
   const normalized = input.startsWith("@") ? input.slice(1) : input;
@@ -880,10 +1054,33 @@ async function assertToolPathInsideCwd(
       return `${toolName} path must not traverse outside the local checkout.`;
     }
   }
+  // A path is allowed if it resolves inside EITHER the realpath'd root (root) OR
+  // the lexical cwd (lexicalCwd). This handles missing files in symlinked workspaces
+  // where realpath fails and the lexical fallback starts with the alias prefix.
   const root = await fs.realpath(cwd).catch(() => path.resolve(cwd));
+  const lexicalCwd = path.resolve(cwd);
   const resolved = resolveToolPath(cwd, rawPath);
   const realPath = await fs.realpath(resolved).catch(() => resolved);
-  if (!isInside(root, realPath)) return `${toolName} is limited to the local checkout: ${realPath}`;
+  if (!isInside(root, realPath) && !isInside(lexicalCwd, realPath))
+    return `${toolName} is limited to the local checkout: ${realPath}`;
+  // Pi-effective path check (monotonic: block if either resolution is outside).
+  // For the read tool, also check Pi's resolveReadPathAsync fallback variants so
+  // a missing file whose variant resolves outside is not silently allowed.
+  try {
+    const piResolved = resolveToCwd(typeof rawPath === "string" ? rawPath : ".", cwd);
+    const candidates = toolName === "read" ? getReadPathCandidates(piResolved) : [piResolved];
+    // Deliberate policy: all candidates are checked regardless of existence (not
+    // Pi's existence-ordered selection) so the guard cannot be raced by creating
+    // a variant between the hook and the read. Trade-off: a read is blocked when
+    // an escaping variant symlink sits next to a safe primary file.
+    for (const candidate of candidates) {
+      const candidateRealPath = await fs.realpath(candidate).catch(() => candidate);
+      if (!isInside(root, candidateRealPath) && !isInside(lexicalCwd, candidateRealPath))
+        return `${toolName} is limited to the local checkout: ${candidateRealPath}`;
+    }
+  } catch {
+    return `${toolName} path could not be resolved safely.`;
+  }
   return undefined;
 }
 
@@ -1428,10 +1625,10 @@ function createCodeReviewerRuntimeGuardExtension(options: {
     });
 
     pi.on("tool_call", async (event) => {
-      if (!READ_ONLY_TOOL_NAMES.has(event.toolName)) {
+      if (!READ_ONLY_TOOL_NAMES.has(event.toolName) && !isSubagentMcpTool(event.toolName)) {
         return {
           block: true,
-          reason: `code_reviewer exposes read-only tools only; ${event.toolName} is not allowed.`,
+          reason: `code_reviewer exposes read-only built-in tools and MCP tools; ${event.toolName} is not allowed.`,
         };
       }
 
@@ -1505,7 +1702,7 @@ function buildSystemPrompt(options: {
   maxTurns: number;
   maxRunSeconds: number;
 }): string {
-  return `You are Code Reviewer, an isolated read-only review agent running inside the code-reviewer package. Review the proposed change against the stated task and the local checkout, then return a concise evidence-based review report.\n\nWorking directory: ${options.cwd}\nTurn budget: ${options.maxTurns} turns total, including your final answer.\nWall-clock budget: ${options.maxRunSeconds} seconds.\n\nAvailable tools are intended to be read-only: read, grep, find, ls, and bash. Use the built-in read, grep, find, and ls tools for local file inspection. Use bash only for a single read-only git, gh, or pwd invocation, such as git status/diff/show/log/blame, gh pr view/diff/list/status/checks, gh api GET calls, or pwd. A runtime guard blocks write/edit tools, shell pipelines/control operators, redirection, mutating git/gh commands, npm/publish commands, path traversal outside the checkout, and other filesystem mutation.\n\nReview priorities, in order:\n1. Ticket fit: does the change actually satisfy the requested task and stay in scope?\n2. Diff accuracy: do the files and edits match what the task claims changed?\n3. Correctness: could the change fail, regress behavior, mishandle errors, or break edge cases?\n4. Security and safety: look for unsafe command use, path handling issues, secret exposure, injection risks, destructive behavior, and policy violations.\n5. Simplicity and maintainability: call out unnecessary complexity, unclear behavior, or avoidable duplication.\n6. Tests and validation: check whether meaningful verification exists and whether gaps matter for this task.\n\nNon-negotiable constraints:\n- Never implement changes. Never edit, write, move, delete, format, install, commit, checkout, reset, clean, push, publish, or mutate GitHub.\n- Treat the supplied task and diff/context as claims to verify, not as facts. Cite file paths, line ranges, git diff/status output, or supplied diff excerpts as evidence.\n- Prefer the built-in file tools over bash when local file inspection is enough.\n- If evidence is missing, stale, or contradictory, say so plainly.\n- Keep the final review concise and actionable. Report the most important findings first; do not pad with non-findings.\n\nOutput format, exact order:\n## Verdict\nOne short paragraph with the overall review outcome.\n\n## Findings\nUse bullets ordered by severity. For each finding include: severity ('blocker', 'major', or 'minor'), a short title, evidence, and why it matters. If there are no findings, write '- none'.\n\n## Validation\nList the read-only checks you performed, including key files inspected, notable git/gh commands, and any uncertainty that limited the review, or '- none'.\n\n## Scope check\nState whether the change appears to match the requested task and note any missing or extra scope.`;
+  return `You are Code Reviewer, an isolated read-only review agent running inside the code-reviewer package. Review the proposed change against the stated task and the local checkout, then return a concise evidence-based review report.\n\nWorking directory: ${options.cwd}\nTurn budget: ${options.maxTurns} turns total, including your final answer.\nWall-clock budget: ${options.maxRunSeconds} seconds.\n\nAvailable tools are intended to be read-only: read, grep, find, ls, and bash. Use the built-in read, grep, find, and ls tools for local file inspection. Use bash only for a single read-only git, gh, or pwd invocation, such as git status/diff/show/log/blame, gh pr view/diff/list/status/checks, gh api GET calls, or pwd. A runtime guard blocks write/edit tools, shell pipelines/control operators, redirection, mutating git/gh commands, npm/publish commands, path traversal outside the checkout, and other filesystem mutation. Configured MCP tools are also available and run without confirmation; use them only to gather evidence or context, not for state-changing actions unless the task explicitly requires it. MCP access requires host Pi >=1.0.4; on older hosts MCP tools are absent with no error.\n\nReview priorities, in order:\n1. Ticket fit: does the change actually satisfy the requested task and stay in scope?\n2. Diff accuracy: do the files and edits match what the task claims changed?\n3. Correctness: could the change fail, regress behavior, mishandle errors, or break edge cases?\n4. Security and safety: look for unsafe command use, path handling issues, secret exposure, injection risks, destructive behavior, and policy violations.\n5. Simplicity and maintainability: call out unnecessary complexity, unclear behavior, or avoidable duplication.\n6. Tests and validation: check whether meaningful verification exists and whether gaps matter for this task.\n\nNon-negotiable constraints:\n- Never implement changes. Never edit, write, move, delete, format, install, commit, checkout, reset, clean, push, publish, or mutate GitHub.\n- Treat the supplied task and diff/context as claims to verify, not as facts. Cite file paths, line ranges, git diff/status output, or supplied diff excerpts as evidence.\n- Prefer the built-in file tools over bash when local file inspection is enough.\n- If evidence is missing, stale, or contradictory, say so plainly.\n- Keep the final review concise and actionable. Report the most important findings first; do not pad with non-findings.\n\nOutput format, exact order:\n## Verdict\nOne short paragraph with the overall review outcome.\n\n## Findings\nUse bullets ordered by severity. For each finding include: severity ('blocker', 'major', or 'minor'), a short title, evidence, and why it matters. If there are no findings, write '- none'.\n\n## Validation\nList the read-only checks you performed, including key files inspected, notable git/gh commands, and any uncertainty that limited the review, or '- none'.\n\n## Scope check\nState whether the change appears to match the requested task and note any missing or extra scope.`;
 }
 
 function buildUserPrompt(
@@ -1564,17 +1761,20 @@ function appendRunDetails(report: string, details: ReviewDetails): string {
     : "thinking unknown";
   const suffix = `\n\n---\nRun details: ${modelSummary}; ${thinkingSummary}; ${details.turns} turn(s); ${details.toolCalls.length} tool call(s); duration ${duration}; cwd ${details.cwd}; tools ${toolSummary}.`;
   if (!trimmed)
-    return `## Verdict\nNo review output was produced.\n\n## Findings\n- major — Missing review output. Evidence: the isolated code_reviewer session returned no assistant text. Why it matters: the review could not be completed.\n\n## Validation\n- none\n\n## Scope check\nReview could not be completed.\n\n## Run details\n- ${suffix.trim()}`;
+    return `## Verdict\nNo review output was produced.\n\n## Findings\n- major — Missing review output. Evidence: the isolated code_reviewer session returned no assistant text. Why it matters: the review could not be completed.\n\n## Validation\n- none\n\n## Scope check\nReview could not be completed.${suffix}`;
   return `${trimmed}${suffix}`;
 }
 
 export const __test__ = {
-  assertToolPathInsideCwd,
-  buildSystemPrompt,
-  buildUserPrompt,
+  SUBAGENT_MCP_TOOLS,
+  isMcpCompatibleVersion,
+  resolveSubagentProjectTrusted,
+  createMcpSubagentFactories,
+  disposeSubagentSession,
   createCodeReviewerRuntimeGuardExtension,
+  assertToolPathInsideCwd,
+  resolveToCwd,
   buildSafeGitCommand,
-  formatToolCall,
   getBlockedBashReason,
   isModelAvailabilityError,
   normalizeThinkingLevel,
@@ -1599,11 +1799,11 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
     name: "code_reviewer",
     label: "Code reviewer",
     description:
-      "Read-only isolated reviewer that checks a proposed change for ticket fit, diff accuracy, correctness, security, simplicity, and validation gaps without implementing anything.",
+      "Isolated reviewer with read-only built-in tools and configured MCP tools that checks a proposed change for ticket fit, diff accuracy, correctness, security, simplicity, and validation gaps without implementing anything.",
     promptSnippet:
-      "Run an isolated read-only code review against the local checkout and optional diff; returns concise findings with evidence and run details.",
+      "Run an isolated code review against the local checkout and optional diff using read-only built-in tools plus any configured MCP tools; returns concise findings with evidence and run details.",
     promptGuidelines: [
-      "Use code_reviewer when you want an independent read-only review of a proposed change or task implementation.",
+      "Use code_reviewer when you want an independent review of a proposed change or task implementation; it uses read-only built-in tools and any configured MCP tools.",
       "Provide the requested task and any relevant diff/context. Do not use code_reviewer to implement or edit files.",
     ],
     parameters: CodeReviewerParams,
@@ -1661,7 +1861,8 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
       try {
         emit();
 
-        const isolatedSettingsManager = SettingsManager.inMemory({});
+        const projectTrusted = resolveSubagentProjectTrusted(ctx, cwd);
+        const isolatedSettingsManager = SettingsManager.inMemory({}, { projectTrusted });
         const resourceLoader = new DefaultResourceLoader({
           cwd,
           agentDir: getAgentDir(),
@@ -1673,6 +1874,7 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
           noContextFiles: true,
           extensionFactories: [
             createCodeReviewerRuntimeGuardExtension({ cwd, maxTurns: MAX_TURNS }),
+            ...createMcpSubagentFactories(),
           ],
           systemPromptOverride: () =>
             buildSystemPrompt({
@@ -1712,10 +1914,12 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
               sessionManager: SessionManager.inMemory(cwd),
               model: candidate as CreateAgentSessionModel,
               thinkingLevel: thinking.effective,
-              tools: ["read", "grep", "find", "ls", "bash"],
+              tools: ["read", "grep", "find", "ls", "bash", ...SUBAGENT_MCP_TOOLS],
             });
             attemptSession = created.session;
             session = attemptSession;
+            // Connect extensions (MCP servers) before prompting. Feature-detected: Pi >=0.99.0.
+            await (created.session as any).bindExtensions?.({ mode: "json" });
             attemptUnsubscribe = attemptSession.subscribe((event) => {
               addSessionEventUsage(usage, event);
               switch (event.type) {
@@ -1797,7 +2001,7 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
             if (attemptSession && !succeeded) {
               attemptUnsubscribe?.();
               if (unsubscribe === attemptUnsubscribe) unsubscribe = undefined;
-              attemptSession.dispose();
+              await disposeSubagentSession(attemptSession);
               if (session === attemptSession) session = undefined;
             }
           }
@@ -1828,7 +2032,7 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
         details.error = failure.error;
         details.endedAt = Date.now();
         lastContent = appendRunDetails(
-          `## Verdict\nReview failed.\n\n## Findings\n- major — Review execution failed. Evidence: ${message}. Why it matters: the requested read-only review did not complete.\n\n## Validation\n- none\n\n## Scope check\nReview could not be completed.\n\n## Run details\n- failure: ${message}`,
+          `## Verdict\nReview failed.\n\n## Findings\n- major — Review execution failed. Evidence: ${message}. Why it matters: the requested read-only review did not complete.\n\n## Validation\n- none\n\n## Scope check\nReview could not be completed.`,
           details,
         );
         emit();
@@ -1837,7 +2041,7 @@ export default function codeReviewerExtension(pi: ExtensionAPI) {
         if (runTimeout) clearTimeout(runTimeout);
         if (signal && abortListenerAdded) signal.removeEventListener("abort", abortFromCaller);
         unsubscribe?.();
-        session?.dispose();
+        await disposeSubagentSession(session);
       }
     },
   });

package/extensions/code-reviewer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-code-reviewer",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "A standalone pi extension that adds a read-only code_reviewer subagent tool for isolated code reviews.",
   "keywords": [
     "pi-package",

package/extensions/confirm-destructive/index.ts

@@ -12,20 +12,14 @@ import type {
 } from "@earendil-works/pi-coding-agent";
 
 function hasUnsavedUserWork(entries: SessionEntry[]): boolean {
-  let sawAssistant = false;
-
   for (let index = entries.length - 1; index >= 0; index -= 1) {
     const entry = entries[index];
     if (entry.type !== "message") continue;
-    if (entry.message.role === "assistant") {
-      sawAssistant = true;
-      break;
-    }
+    if (entry.message.role === "assistant") return false;
     if (entry.message.role === "user") return true;
   }
 
-  if (sawAssistant) return false;
-  return entries.some((entry) => entry.type === "message" && entry.message.role === "user");
+  return false;
 }
 
 export default function (pi: ExtensionAPI) {

package/extensions/confirm-destructive/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-confirm-destructive",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "A pi extension that confirms destructive session actions.",
   "keywords": [
     "pi-package",

package/extensions/context-cap/README.md

@@ -1,6 +1,6 @@
 # context-cap
 
-A pi extension that treats large-context models as having an effective 200k-token context window, so pi's built-in auto-compaction starts earlier, and avoids the dumb zone.
+A pi extension that treats large-context models as having an effective 300k-token context window, so pi's built-in auto-compaction starts earlier, and avoids the dumb zone.
 
 By default, pi auto-compacts when:
 
@@ -11,10 +11,10 @@ contextTokens > model.contextWindow - reserveTokens
 This extension changes the active model's in-memory `contextWindow` to:
 
 ```text
-min(originalContextWindow, 200000)
+min(originalContextWindow, 300000)
 ```
 
-With pi's default `reserveTokens` of 16,384, models larger than 200k will proactively compact around 183,616 tokens.
+With pi's default `reserveTokens` of 16,384, models larger than 300k will proactively compact around 283,616 tokens.
 
 ## Commands
 
@@ -65,21 +65,21 @@ Then reload pi:
 
 ### Settings guard and alternative
 
-- On Pi hosts exposing `getSettings()`, the extension resolves `reserveTokens` using Pi's precedence: `compaction.modelOverrides["provider/model-id"].reserveTokens`, then `compaction.reserveTokens`, then the default `16,384`. It skips the cap when the resolved value is at least `200,000` (which would make the threshold zero or negative), or when any explicit entry exists for that model. Hosts without `getSettings()` use the older cap behavior without this guard.
-- Pi's provider request path also derives an output-token budget from the effective window (`contextWindow - contextTokens - 4096`, with any provider-specific clamp applied afterward). The cap can therefore reduce response or thinking-token budgets near the limit, in addition to causing earlier compaction; Pi's overflow handling may also treat a request above 200k as overflow and retry after compaction. Use `/context-cap off` when you need the full model window temporarily.
-- As a session-scoped alternative, configure Pi's own `compaction.modelOverrides` instead of this extension. The exact key is `provider/model-id`; to match this extension's default 200k threshold for a model with original window `W`, let `R` be the configured `reserveTokens` value (default `16,384`) and use:
+- On Pi hosts exposing `getSettings()`, the extension skips the cap whenever `compaction.modelOverrides` contains the active model's key (`provider/model-id`), whatever fields that entry sets; it does not read `reserveTokens` from the override. Otherwise it uses `compaction.reserveTokens`, then the default `16,384`, and skips the cap when that value is at least `300,000` (which would make the threshold zero or negative). Hosts without `getSettings()` use the older cap behavior without this guard.
+- Pi's provider request path also derives an output-token budget from the effective window (`contextWindow - contextTokens - 4096`, with any provider-specific clamp applied afterward). The cap can therefore reduce response or thinking-token budgets near the limit, in addition to causing earlier compaction; Pi's overflow handling may also treat a request above 300k as overflow and retry after compaction. Use `/context-cap off` when you need the full model window temporarily.
+- As a session-scoped alternative, configure Pi's own `compaction.modelOverrides` instead of this extension. The exact key is `provider/model-id`; to match this extension's default 300k threshold for a model with original window `W`, let `R` be the configured `reserveTokens` value (default `16,384`) and use:
 
   ```text
-  reserveTokens = W - 200000 + R
+  reserveTokens = W - 300000 + R
   ```
 
-  For example, with the default `R`, a 1,000,000-token model uses `816384`, yielding the same `183616` threshold as `200000 - 16384`:
+  For example, with the default `R`, a 1,000,000-token model uses `716384`, yielding the same `283616` threshold as `300000 - 16384`:
 
   ```json
   {
     "compaction": {
       "modelOverrides": {
-        "provider/model-id": { "reserveTokens": 816384 }
+        "provider/model-id": { "reserveTokens": 716384 }
       }
     }
   }

package/extensions/context-cap/index.ts

@@ -1,7 +1,7 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { Model, Api } from "@earendil-works/pi-ai";
 
-const DEFAULT_MAX_CONTEXT_WINDOW = 200_000;
+const DEFAULT_MAX_CONTEXT_WINDOW = 300_000;
 const DEFAULT_RESERVE_TOKENS = 16_384;
 const PROCESS_STATE_KEY = Symbol.for("pi-extensions.context-cap.model-holds.v1");
 type AnyModel = Model<Api> | Model<any>;
@@ -224,7 +224,7 @@ function unavailableReason(result: ApplyResult | undefined): string | undefined
     return "physical model has no compatible context-window limit";
   }
   if (result?.reason === "reserve") {
-    return `compaction reserveTokens (${formatTokens(result.reserveTokens ?? DEFAULT_MAX_CONTEXT_WINDOW)}) is at least 200k; the auto-compaction threshold would be zero or negative`;
+    return `compaction reserveTokens (${formatTokens(result.reserveTokens ?? DEFAULT_MAX_CONTEXT_WINDOW)}) is at least 300k; the auto-compaction threshold would be zero or negative`;
   }
   if (result?.reason === "modelOverride") {
     return `compaction.modelOverrides[\"${result.key}\"] is configured; leaving the model window unchanged`;
@@ -317,7 +317,7 @@ export default function contextCapExtension(pi: ExtensionAPI) {
   }
 
   pi.registerCommand("context-cap", {
-    description: "Toggle the 200k effective context-window cap for auto-compaction",
+    description: "Toggle the 300k effective context-window cap for auto-compaction",
     getArgumentCompletions: (prefix) => {
       const commands = ["on", "off", "toggle", "status"];
       const matches = commands.filter((command) => command.startsWith(prefix.trim()));

package/extensions/context-cap/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@diegopetrucci/pi-context-cap",
-  "version": "0.1.13",
-  "description": "A pi extension that caps effective model context windows at 200k tokens for earlier auto-compaction.",
+  "version": "0.1.15",
+  "description": "A pi extension that caps effective model context windows at 300k tokens for earlier auto-compaction.",
   "keywords": [
     "pi-package",
     "pi",

package/extensions/contrarian/README.md

@@ -1,6 +1,6 @@
 # contrarian
 
-A read-only contrarian subagent for [pi](https://github.com/earendil-works/pi).
+A contrarian subagent with read-only built-in tools and configured MCP tools for [pi](https://github.com/earendil-works/pi).
 
 It adds a `contrarian` tool that spins up a separate pi subprocess to stress-test plans, designs, assumptions, bug hypotheses, review conclusions, and product directions by steelmanning the strongest credible opposing case.
 
@@ -8,7 +8,7 @@ This is adapted from the TLH [`contrarian` subagent prompt](https://github.com/d
 
 ## What it does
 
-- creates an isolated read-only subprocess
+- creates an isolated subprocess with read-only built-in tools (read, grep, find, ls) and any configured MCP tools
 - prefers a strong model on the opposite model family/provider when available, then falls back to the best available model
 - requests `high` reasoning by default for reasoning models, then clamps to the model-supported thinking level
 - defaults to `read,grep,find,ls`, with optional non-mutating bash inspection
@@ -81,7 +81,8 @@ When the current Pi session has a non-empty model scope, Contrarian limits autom
 
 ## Notes
 
-- The contrarian is intentionally **read-only**.
+- The contrarian subprocess uses read-only built-in tools (read, grep, find, ls) by default, plus any configured MCP tools. It can optionally include bash for non-mutating inspection.
+- Configured MCP tools run without confirmation inside the subprocess and may have side effects — use them only for gathering evidence. MCP access requires host Pi >=1.0.4; older hosts degrade to no MCP, no error.
 - It never implements fixes or produces patches.
 - Its output separates confirmed objections, plausible concerns, and unresolved unknowns.
 - It is best for adversarial review before committing to a plan, design, or conclusion.