@diegopetrucci/pi-extensions 0.1.76 → 0.1.78

package/extensions/triage-comments/index.ts

@@ -1,5 +1,8 @@
 import * as fs from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import type {
   AgentSession,
@@ -17,6 +20,7 @@ import {
   getAgentDir,
   getMarkdownTheme,
 } from "@earendil-works/pi-coding-agent";
+import * as piCodingAgent from "@earendil-works/pi-coding-agent";
 import { Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
@@ -58,6 +62,91 @@ const TRIAGE_COMMAND_USAGE =
 const IMPLEMENTATION_NOTE =
   "Do not implement changes from this triage automatically; ask the parent/user which option to take before implementation.";
 
+const SUBAGENT_MCP_TOOLS = [
+  "mcp__*",
+  "tool_search",
+  "list_mcp_resources",
+  "list_mcp_resource_templates",
+  "read_mcp_resource",
+];
+
+// Derive project-trust for the isolated subagent session from the host tool context.
+// Fails closed: returns false if the host has not trusted the project, or if the subagent
+// runs in a different directory, preventing an untrusted project's .pi/mcp.json from
+// being loaded by the MCP extension.
+function resolveSubagentProjectTrusted(
+  ctx: { cwd: string; isProjectTrusted(): boolean },
+  subagentCwd: string,
+): boolean {
+  // Feature-detected for older Pi hosts that may lack isProjectTrusted.
+  const hostTrusted =
+    typeof (ctx as { isProjectTrusted?: unknown }).isProjectTrusted === "function"
+      ? ctx.isProjectTrusted()
+      : false;
+  if (!hostTrusted) return false;
+  try {
+    return realpathSync(subagentCwd) === realpathSync(ctx.cwd);
+  } catch {
+    return false; // fail closed if realpath resolution fails
+  }
+}
+
+function isSubagentMcpTool(toolName: string): boolean {
+  return (
+    toolName.startsWith("mcp__") ||
+    toolName === "tool_search" ||
+    toolName === "list_mcp_resources" ||
+    toolName === "list_mcp_resource_templates" ||
+    toolName === "read_mcp_resource"
+  );
+}
+
+/** Returns true when v is a semver string >=1.0.4 (ignores prerelease; missing/garbage -> false). */
+function isMcpCompatibleVersion(v: string | undefined): boolean {
+  if (!v) return false;
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+  if (!m) return false;
+  const major = Number(m[1]),
+    minor = Number(m[2]),
+    patch = Number(m[3]);
+  if (major !== 1) return major > 1;
+  if (minor !== 0) return minor > 0;
+  return patch >= 4;
+}
+
+// Gated on VERSION >=1.0.4: on older hosts mcp__* allowlist entries are exact-name
+// matches that resolve nothing, so spawning MCP servers provides no benefit.
+function createMcpSubagentFactories(): ExtensionFactory[] {
+  const ns = piCodingAgent as Record<string, unknown>;
+  if (!isMcpCompatibleVersion(ns["VERSION"] as string | undefined)) return [];
+  const factories: ExtensionFactory[] = [];
+  const mcp = ns["createMcpExtension"];
+  const toolSearch = ns["createToolSearchExtension"];
+  if (typeof mcp === "function") factories.push((mcp as () => ExtensionFactory)());
+  if (typeof toolSearch === "function") factories.push((toolSearch as () => ExtensionFactory)());
+  return factories;
+}
+
+// Emit session_shutdown before dispose so MCP closes server connections (no leaked child processes).
+async function disposeSubagentSession(session: AgentSession | undefined): Promise<void> {
+  if (!session) return;
+  try {
+    const runner = (
+      session as unknown as {
+        extensionRunner?: {
+          hasHandlers(n: string): boolean;
+          emit(e: { type: string; reason: string }): Promise<unknown>;
+        };
+      }
+    ).extensionRunner;
+    if (runner?.hasHandlers("session_shutdown")) {
+      await runner.emit({ type: "session_shutdown", reason: "quit" });
+    }
+  } catch {
+    // Shutdown errors must not prevent dispose.
+  }
+  session.dispose();
+}
 const READ_ONLY_TOOL_NAMES = new Set(["read", "grep", "find", "ls", "bash"]);
 const READ_ONLY_BASH_COMMANDS = new Set(["gh", "git", "pwd"]);
 const READ_ONLY_GIT_SUBCOMMANDS = new Set([
@@ -93,6 +182,69 @@ const SAFE_GIT_BRANCH_FLAGS = new Set([
   "--no-merged",
 ]);
 const SAFE_GIT_GLOBAL_FLAGS = new Set(["--no-pager", "--no-optional-locks"]);
+const SAFE_GIT_CONFIG_OVERRIDES = [
+  "core.pager=cat",
+  "core.fsmonitor=false",
+  "diff.external=",
+  "log.showSignature=false",
+];
+const GIT_SUBCOMMAND_SAFE_FLAGS: Partial<Record<string, string[]>> = {
+  blame: ["--no-textconv"],
+  diff: ["--no-ext-diff", "--no-textconv"],
+  log: ["--no-ext-diff", "--no-textconv"],
+  show: ["--no-ext-diff", "--no-textconv"],
+  whatchanged: ["--no-ext-diff", "--no-textconv"],
+};
+const GIT_OPTIONS_REQUIRING_LOCAL_FILE = [
+  {
+    flag: "--pathspec-from-file",
+    blockedPrefixes: ["--pathspec"],
+    reason:
+      "Triage bash blocks git --pathspec-from-file because it can read local files outside built-in path guards.",
+  },
+  {
+    flag: "--ignore-revs-file",
+    blockedPrefixes: ["--ignore-rev"],
+    reason:
+      "Triage bash blocks git --ignore-revs-file because it can read local files outside built-in path guards.",
+  },
+] as const;
+const GIT_SUBCOMMAND_OPTIONS_REQUIRING_LOCAL_FILE: Partial<
+  Record<string, Array<{ reason: string; matches: (token: string) => boolean }>>
+> = {
+  blame: [
+    {
+      reason:
+        "Triage bash blocks git blame --contents because it can read local files outside built-in path guards.",
+      matches: (token) => {
+        if (!token.startsWith("--")) return false;
+        const option = token.split("=", 1)[0]?.toLowerCase() ?? "";
+        return option === "--contents" || option.startsWith("--con");
+      },
+    },
+    {
+      reason:
+        "Triage bash blocks git blame -S because it can read local revs files outside built-in path guards.",
+      matches: (token) => token === "-S" || (token.startsWith("-S") && token.length > 2),
+    },
+  ],
+  "ls-files": [
+    {
+      reason:
+        "Triage bash blocks git ls-files -X/--exclude-from because it can read local files outside built-in path guards.",
+      matches: (token) => token === "-X" || (token.startsWith("-X") && token.length > 2),
+    },
+    {
+      reason:
+        "Triage bash blocks git ls-files -X/--exclude-from because it can read local files outside built-in path guards.",
+      matches: (token) => {
+        if (!token.startsWith("--")) return false;
+        const option = token.split("=", 1)[0]?.toLowerCase() ?? "";
+        return option === "--exclude-from" || option.startsWith("--exclude-f");
+      },
+    },
+  ],
+};
 const GH_GLOBAL_OPTIONS_WITH_VALUE = new Set([
   "--repo",
   "-R",
@@ -372,7 +524,7 @@ function buildSystemPrompt(options: {
   maxTurns: number;
   maxRunSeconds: number;
 }): string {
-  return `You are Triage Comments, an isolated read-only code-review investigation agent running inside the triage-comments package. Your job is to evaluate selected PR review comments against the local checkout and local git context.\n\nWorking directory: ${options.cwd}\nTurn budget: ${options.maxTurns} turns total, including your final answer.\nWall-clock budget: ${options.maxRunSeconds} seconds.\n\nAvailable tools are intended to be read-only: read, grep, find, ls, and bash. Use the built-in read, grep, find, and ls tools for local file inspection. Use bash only for a single read-only git, gh, or pwd invocation, such as git status/diff/show/log/blame, gh pr view/diff/list/status/checks, gh api GET calls, or pwd. A runtime guard blocks write/edit tools, shell pipelines/control operators, local filesystem utility commands, mutating git, and mutating gh/GitHub API calls.\n\nNon-negotiable constraints:\n- Never implement changes. Never edit, write, move, delete, format, commit, checkout, reset, clean, push, publish, or mutate GitHub.\n- Keep all inspection local to the checkout unless a read-only gh call is necessary for supplied PR metadata.\n- Treat the supplied comments as claims to verify, not as facts. Cite file paths, line ranges, git diff/status/log output, or supplied diff hunks as evidence.\n- If evidence is missing, stale, contradictory, or the local checkout does not match the PR context, say so and classify accordingly.\n- Distinguish objective correctness issues from style/preferences.\n- For valid or partially valid comments, propose one or more handling options, but do not choose implementation without parent/user confirmation.\n\nVerdicts must be one of: valid, invalid, partially valid, subjective, needs clarification.\n\nOutput format, exact order:\n## Summary\n1-3 concise sentences summarizing the triage.\n\n## Per-comment triage\nFor each selected comment, use:\n### Comment <index or id> — <verdict>\n- **What the reviewer asked:** concise paraphrase.\n- **Evidence:** path/line or command-output citations. If evidence is insufficient, state exactly what is missing.\n- **Reasoning:** why the evidence supports the verdict.\n- **Suggested response:** a short review-thread reply the parent/user can post or adapt.\n- **Handling options:** one or more options for valid/partially valid comments; for invalid/subjective/unclear comments, give the appropriate response/clarification path.\n\n## Read-only checks performed\nList the files/commands/probes used, or \`- (none)\`.\n\n## Before implementation\nState explicitly: \"Do not implement changes from this triage automatically; ask the parent/user which option to take before implementation.\"`;
+  return `You are Triage Comments, an isolated read-only code-review investigation agent running inside the triage-comments package. Your job is to evaluate selected PR review comments against the local checkout and local git context.\n\nWorking directory: ${options.cwd}\nTurn budget: ${options.maxTurns} turns total, including your final answer.\nWall-clock budget: ${options.maxRunSeconds} seconds.\n\nAvailable tools are intended to be read-only: read, grep, find, ls, and bash. Use the built-in read, grep, find, and ls tools for local file inspection. Use bash only for a single read-only git, gh, or pwd invocation, such as git status/diff/show/log/blame, gh pr view/diff/list/status/checks, gh api GET calls, or pwd. A runtime guard blocks write/edit tools, shell pipelines/control operators, local filesystem utility commands, mutating git, and mutating gh/GitHub API calls. Configured MCP tools are also available and run without confirmation; use them only to gather evidence or context, not for state-changing actions unless the task explicitly requires it. MCP access requires host Pi >=1.0.4; on older hosts MCP tools are absent with no error.\n\nNon-negotiable constraints:\n- Never implement changes. Never edit, write, move, delete, format, commit, checkout, reset, clean, push, publish, or mutate GitHub.\n- Keep all inspection local to the checkout unless a read-only gh call is necessary for supplied PR metadata.\n- Treat the supplied comments as claims to verify, not as facts. Cite file paths, line ranges, git diff/status/log output, or supplied diff hunks as evidence.\n- If evidence is missing, stale, contradictory, or the local checkout does not match the PR context, say so and classify accordingly.\n- Distinguish objective correctness issues from style/preferences.\n- For valid or partially valid comments, propose one or more handling options, but do not choose implementation without parent/user confirmation.\n\nVerdicts must be one of: valid, invalid, partially valid, subjective, needs clarification.\n\nOutput format, exact order:\n## Summary\n1-3 concise sentences summarizing the triage.\n\n## Per-comment triage\nFor each selected comment, use:\n### Comment <index or id> — <verdict>\n- **What the reviewer asked:** concise paraphrase.\n- **Evidence:** path/line or command-output citations. If evidence is insufficient, state exactly what is missing.\n- **Reasoning:** why the evidence supports the verdict.\n- **Suggested response:** a short review-thread reply the parent/user can post or adapt.\n- **Handling options:** one or more options for valid/partially valid comments; for invalid/subjective/unclear comments, give the appropriate response/clarification path.\n\n## Read-only checks performed\nList the files/commands/probes used, or \`- (none)\`.\n\n## Before implementation\nState explicitly: \"Do not implement changes from this triage automatically; ask the parent/user which option to take before implementation.\"`;
 }
 
 function buildUserPrompt(input: NormalizedInput, cwd: string): string {
@@ -508,6 +660,82 @@ function isInside(parent: string, child: string): boolean {
   );
 }
 
+const UNICODE_SPACES_PATTERN = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
+/**
+ * Mirrors normalizeWindowsShellPath from dist/utils/paths.js. No-op on
+ * non-win32 paths.
+ */
+function normalizeWindowsShellPathLocal(filePath: string): string {
+  if (!filePath.startsWith("/") || filePath.startsWith("//") || filePath.includes("\\"))
+    return filePath;
+  const match = filePath.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+  if (!match) return filePath;
+  const suffix = match[2]?.replaceAll("/", "\\");
+  return `${match[1].toUpperCase()}:\\${suffix ?? ""}`;
+}
+
+/**
+ * Mirrors Pi's normalizePath (dist/utils/paths.js). On win32, Git Bash / WSL
+ * drive-path normalisation always runs; only tilde expansion is gated by
+ * expandTilde.
+ */
+function normalizePath(
+  input: string,
+  opts: { normalizeUnicodeSpaces?: boolean; stripAtPrefix?: boolean; expandTilde?: boolean } = {},
+): string {
+  const { normalizeUnicodeSpaces = false, stripAtPrefix = false, expandTilde = true } = opts;
+  let p = input;
+  if (normalizeUnicodeSpaces) p = p.replace(UNICODE_SPACES_PATTERN, " ");
+  if (stripAtPrefix && p.startsWith("@")) p = p.slice(1);
+  if (process.platform === "win32") p = normalizeWindowsShellPathLocal(p);
+  if (expandTilde) {
+    const home = os.homedir();
+    if (p === "~") p = home;
+    else if (p.startsWith("~/") || (process.platform === "win32" && p.startsWith("~\\")))
+      p = path.join(home, p.slice(2));
+  }
+  if (/^file:\/\//.test(p)) p = fileURLToPath(p);
+  return p;
+}
+
+/**
+ * Mirrors Pi's resolveToCwd (dist/core/tools/path-utils.js). Exposed via
+ * __test__ for parity tests; not imported by other extensions.
+ */
+function resolveToCwd(rawPath: string, cwd: string): string {
+  const normalized = normalizePath(rawPath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });
+  const base = normalizePath(cwd);
+  return path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(base, normalized);
+}
+
+/** Mirrors tryMacOSScreenshotPath from dist/core/tools/path-utils.js */
+function tryMacOSScreenshotPathVariant(filePath: string): string {
+  return filePath.replace(/ (AM|PM)\./gi, " $1.");
+}
+/** Mirrors tryNFDVariant from dist/core/tools/path-utils.js */
+function tryNFDPathVariant(filePath: string): string {
+  return filePath.normalize("NFD");
+}
+/** Mirrors tryCurlyQuoteVariant from dist/core/tools/path-utils.js */
+function tryCurlyQuotePathVariant(filePath: string): string {
+  return filePath.replace(/'/g, "’");
+}
+/**
+ * Returns all read path candidates including Pi's resolveReadPathAsync fallback
+ * variants. Used only for the read tool guard; grep/find/ls use resolveToCwd only.
+ */
+function getReadPathCandidates(resolved: string): string[] {
+  const nfd = tryNFDPathVariant(resolved);
+  return [
+    resolved,
+    tryMacOSScreenshotPathVariant(resolved),
+    nfd,
+    tryCurlyQuotePathVariant(resolved),
+    tryCurlyQuotePathVariant(nfd),
+  ];
+}
+
 function resolveToolPath(cwd: string, rawPath: string | undefined): string {
   const input = rawPath?.trim() || ".";
   const normalized = input.startsWith("@") ? input.slice(1) : input;
@@ -521,10 +749,33 @@ async function assertToolPathInsideCwd(
 ): Promise<string | undefined> {
   if (rawPath !== undefined && typeof rawPath !== "string")
     return `${toolName} path must be a string.`;
+  // A path is allowed if it resolves inside EITHER the realpath'd root (root) OR
+  // the lexical cwd (lexicalCwd). This handles missing files in symlinked workspaces
+  // where realpath fails and the lexical fallback starts with the alias prefix.
   const root = await fs.realpath(cwd).catch(() => path.resolve(cwd));
+  const lexicalCwd = path.resolve(cwd);
   const resolved = resolveToolPath(cwd, rawPath);
   const realPath = await fs.realpath(resolved).catch(() => resolved);
-  if (!isInside(root, realPath)) return `${toolName} is limited to the local checkout: ${realPath}`;
+  if (!isInside(root, realPath) && !isInside(lexicalCwd, realPath))
+    return `${toolName} is limited to the local checkout: ${realPath}`;
+  // Pi-effective path check (monotonic: block if either resolution is outside).
+  // For the read tool, also check Pi's resolveReadPathAsync fallback variants so
+  // a missing file whose variant resolves outside is not silently allowed.
+  try {
+    const piResolved = resolveToCwd(typeof rawPath === "string" ? rawPath : ".", cwd);
+    const candidates = toolName === "read" ? getReadPathCandidates(piResolved) : [piResolved];
+    // Deliberate policy: all candidates are checked regardless of existence (not
+    // Pi's existence-ordered selection) so the guard cannot be raced by creating
+    // a variant between the hook and the read. Trade-off: a read is blocked when
+    // an escaping variant symlink sits next to a safe primary file.
+    for (const candidate of candidates) {
+      const candidateRealPath = await fs.realpath(candidate).catch(() => candidate);
+      if (!isInside(root, candidateRealPath) && !isInside(lexicalCwd, candidateRealPath))
+        return `${toolName} is limited to the local checkout: ${candidateRealPath}`;
+    }
+  } catch {
+    return `${toolName} path could not be resolved safely.`;
+  }
   return undefined;
 }
 
@@ -683,6 +934,10 @@ function getExecutableName(token: string): string {
   return path.basename(token).toLowerCase();
 }
 
+function shellQuoteToken(token: string): string {
+  return `'${token.replace(/'/g, `'"'"'`)}'`;
+}
+
 function getShellSyntaxReason(command: string): string | undefined {
   return tokenizeShellCommand(command).reason;
 }
@@ -805,8 +1060,24 @@ function isSafeGitRemoteCommand(tokens: string[], subcommandIndex: number): bool
   return remoteAction === "show" || remoteAction === "get-url";
 }
 
-function getUnsafeGitArgumentReason(tokens: string[]): string | undefined {
-  for (const token of tokens.slice(1)) {
+function isBlockedGitLocalFileOption(
+  token: string,
+  flag: string,
+  blockedPrefixes: readonly string[],
+): boolean {
+  if (!token.startsWith("--")) return false;
+  const option = token.split("=", 1)[0]?.toLowerCase() ?? "";
+  if (option === flag) return true;
+  return blockedPrefixes.some((prefix) => option.startsWith(prefix));
+}
+
+function getUnsafeGitArgumentReason(
+  tokens: string[],
+  parsed: { subcommand?: string; index: number },
+): string | undefined {
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    const lowerToken = token.toLowerCase();
     if (token === "--no-index" || token.startsWith("--no-index=")) {
       return "Triage bash blocks git --no-index because it can inspect arbitrary filesystem paths outside the checkout.";
     }
@@ -825,21 +1096,62 @@ function getUnsafeGitArgumentReason(tokens: string[]): string | undefined {
     if (token === "--textconv" || token.startsWith("--textconv=")) {
       return "Triage bash blocks git --textconv because it can execute external text conversion filters.";
     }
+    if (token === "--filters" || token.startsWith("--filters=")) {
+      return "Triage bash blocks git --filters because it can execute clean/smudge filters from local config.";
+    }
+    if (token === "--show-signature" || lowerToken.startsWith("--show-signat")) {
+      return "Triage bash blocks git signature verification flags because they can execute configured GPG helpers.";
+    }
+    if (token === "--help" || token.startsWith("--help=")) {
+      return "Triage bash blocks git help output because it can execute configured help, man, or browser helpers.";
+    }
+    if (token.includes("%G") || /%\((?:[^)]*signature[^)]*)\)/i.test(token)) {
+      return "Triage bash blocks git signature format atoms because they can execute configured GPG helpers.";
+    }
     if (token === "--output" || token.startsWith("--output=")) {
       return "Triage bash blocks git output-writing flags.";
     }
+    for (const { flag, blockedPrefixes, reason } of GIT_OPTIONS_REQUIRING_LOCAL_FILE) {
+      if (isBlockedGitLocalFileOption(token, flag, blockedPrefixes)) return reason;
+    }
+    if (index > parsed.index) {
+      for (const option of GIT_SUBCOMMAND_OPTIONS_REQUIRING_LOCAL_FILE[parsed.subcommand ?? ""] ??
+        []) {
+        if (option.matches(token)) return option.reason;
+      }
+    }
     const pathReason = getUnsafeGitTokenPathReason(token);
     if (pathReason) return pathReason;
   }
   return undefined;
 }
 
+function buildSafeGitCommand(tokens: string[]): string {
+  const parsed = getGitSubcommand(tokens);
+  const prefix = [
+    "git",
+    "--no-pager",
+    "--no-optional-locks",
+    ...SAFE_GIT_CONFIG_OVERRIDES.flatMap((value) => ["-c", value]),
+  ];
+  const subcommand = parsed.subcommand;
+  if (!subcommand) return prefix.map(shellQuoteToken).join(" ");
+  const args = tokens.slice(parsed.index + 1);
+  const injectedFlags = (GIT_SUBCOMMAND_SAFE_FLAGS[subcommand] ?? []).filter(
+    (flag) => !args.includes(flag),
+  );
+  return [...prefix, subcommand, ...injectedFlags, ...args].map(shellQuoteToken).join(" ");
+}
+
 function getBlockedGitReason(command: string): string | undefined {
   const tokens = tokenizeSegment(command);
   if (getExecutableName(tokens[0] ?? "") !== "git") return undefined;
   const parsed = getGitSubcommand(tokens);
   if (parsed.reason) return parsed.reason;
-  const argumentReason = getUnsafeGitArgumentReason(tokens);
+  if (parsed.subcommand === "help") {
+    return "Triage bash blocks git help because it can execute configured help, man, or browser helpers.";
+  }
+  const argumentReason = getUnsafeGitArgumentReason(tokens, parsed);
   if (argumentReason) return argumentReason;
   if (!parsed.subcommand) return undefined;
   if (parsed.subcommand === "branch") {
@@ -998,10 +1310,10 @@ function createTriageRuntimeGuardExtension(options: {
     });
 
     pi.on("tool_call", async (event) => {
-      if (!READ_ONLY_TOOL_NAMES.has(event.toolName)) {
+      if (!READ_ONLY_TOOL_NAMES.has(event.toolName) && !isSubagentMcpTool(event.toolName)) {
         return {
           block: true,
-          reason: `triage_comments exposes read-only tools only; ${event.toolName} is not allowed.`,
+          reason: `triage_comments exposes read-only built-in tools and MCP tools; ${event.toolName} is not allowed.`,
         };
       }
 
@@ -1050,6 +1362,9 @@ function createTriageRuntimeGuardExtension(options: {
         const command = typeof input.command === "string" ? input.command : "";
         const reason = getBlockedBashReason(command);
         if (reason) return { block: true, reason };
+        const tokens = tokenizeSegment(command.trim());
+        if (getExecutableName(tokens[0] ?? "") === "git")
+          input.command = buildSafeGitCommand(tokens);
       }
 
       return undefined;
@@ -1287,10 +1602,8 @@ function parseTriageCommandArgs(args: string): ParsedTriageCommandArgs {
 
   if (normalized === "--help" || normalized === "-h" || normalized === "help")
     return { help: true };
-  if (normalized === "paste" || normalized === "manual")
-    return { mode: "paste", pastePrefill: rest || undefined };
-  if (normalized === "pr" || normalized === "pull" || normalized === "pull-request")
-    return { mode: "pr", target: rest || undefined };
+  if (normalized === "paste") return { mode: "paste", pastePrefill: rest || undefined };
+  if (normalized === "pr") return { mode: "pr", target: rest || undefined };
   if (looksLikePrTarget(trimmed)) return { mode: "pr", target: trimmed };
 
   return { error: `Unknown /triage-comments option: ${first}\n${TRIAGE_COMMAND_USAGE}` };
@@ -2001,14 +2314,6 @@ function applyInlineCommentFilter(
     kept.push(comment);
   }
 
-  const commentsWithFilterMetadata = kept.map((comment) => ({
-    ...comment,
-    metadata: compactRecord({
-      ...comment.metadata,
-      preFilterDisplayNumber: comment.displayNumber,
-    }),
-  }));
-
   const summary: AppliedInlineCommentFilter = {
     filter,
     originalCount: comments.length,
@@ -2019,7 +2324,7 @@ function applyInlineCommentFilter(
     keptInlineWithoutThreadMetadataCount,
   };
 
-  return { comments: assignDisplayNumbers(commentsWithFilterMetadata), summary };
+  return { comments: assignDisplayNumbers(kept), summary };
 }
 
 function parseSelectionList(input: string, max: number): SelectionParseResult {
@@ -2327,23 +2632,29 @@ async function runPrMode(
 }
 
 export const __test__ = {
+  SUBAGENT_MCP_TOOLS,
+  isMcpCompatibleVersion,
+  resolveSubagentProjectTrusted,
+  createMcpSubagentFactories,
+  disposeSubagentSession,
+  createTriageRuntimeGuardExtension,
+  applyInlineCommentFilter,
   assertToolPathInsideCwd,
+  resolveToCwd,
+  buildSafeGitCommand,
   buildCommandPayload,
   buildSystemPrompt,
   buildUserPrompt,
-  createTriageRuntimeGuardExtension,
   ensureImplementationNote,
   formatFetchedCommentsForSelection,
   formatInlineFilterContext,
   formatToolCall,
   getBlockedBashReason,
-  normalizeComment,
   normalizeInput,
   parseSelectionList,
   parseTriageCommandArgs,
   prepareArguments,
   aggregateAssistantUsage,
-  addAssistantMessageUsage,
   addSessionEventUsage,
   inspectFinalAssistant,
   classifyRunFailure,
@@ -2411,9 +2722,9 @@ export default function triageCommentsExtension(pi: ExtensionAPI) {
     name: "triage_comments",
     label: "Triage comments",
     description:
-      "Read-only subagent that triages selected PR review comments against the local checkout and git context. It classifies each comment with evidence, suggests review responses, and proposes handling options without implementing changes.",
+      "Isolated subagent with read-only built-in tools and configured MCP tools that triages selected PR review comments against the local checkout and git context. It classifies each comment with evidence, suggests review responses, and proposes handling options without implementing changes.",
     promptSnippet:
-      "Triage selected PR review comments in a read-only isolated subagent; returns verdicts, evidence, response text, and handling options without editing files.",
+      "Triage selected PR review comments in an isolated subagent using read-only built-in tools plus any configured MCP tools; returns verdicts, evidence, response text, and handling options without editing files.",
     promptGuidelines: [
       "Use triage_comments when selected PR review comments need evidence-based classification against the local checkout.",
       "Do not use triage_comments to implement changes; ask the user which valid handling option to take after triage.",
@@ -2476,7 +2787,8 @@ export default function triageCommentsExtension(pi: ExtensionAPI) {
         });
 
         // Keep the guarded subagent from inheriting user/project shell prefix or shell path settings.
-        const isolatedSettingsManager = SettingsManager.inMemory({});
+        const projectTrusted = resolveSubagentProjectTrusted(ctx, cwd);
+        const isolatedSettingsManager = SettingsManager.inMemory({}, { projectTrusted });
         const resourceLoader = new DefaultResourceLoader({
           cwd,
           agentDir: getAgentDir(),
@@ -2486,7 +2798,10 @@ export default function triageCommentsExtension(pi: ExtensionAPI) {
           noPromptTemplates: true,
           noThemes: true,
           noContextFiles: true,
-          extensionFactories: [createTriageRuntimeGuardExtension({ cwd, maxTurns: MAX_TURNS })],
+          extensionFactories: [
+            createTriageRuntimeGuardExtension({ cwd, maxTurns: MAX_TURNS }),
+            ...createMcpSubagentFactories(),
+          ],
           systemPromptOverride: () => systemPrompt,
           appendSystemPromptOverride: () => [],
           skillsOverride: () => ({ skills: [], diagnostics: [] }),
@@ -2505,10 +2820,15 @@ export default function triageCommentsExtension(pi: ExtensionAPI) {
           sessionManager: SessionManager.inMemory(cwd),
           model: ctx.model,
           thinkingLevel: pi.getThinkingLevel(),
-          tools: ["read", "grep", "find", "ls", "bash"],
+          tools: ["read", "grep", "find", "ls", "bash", ...SUBAGENT_MCP_TOOLS],
         });
 
+        // Assign session BEFORE bindExtensions so the finally block can dispose it
+        // even if binding fails partway through (e.g. a server starts then an
+        // extension's session_start throws).
         session = created.session;
+        // Connect extensions (MCP servers) before prompting. Feature-detected: Pi >=0.99.0.
+        await (created.session as any).bindExtensions?.({ mode: "json" });
         unsubscribe = session.subscribe((event) => {
           addSessionEventUsage(usage, event);
           switch (event.type) {
@@ -2598,7 +2918,7 @@ export default function triageCommentsExtension(pi: ExtensionAPI) {
         if (runTimeout) clearTimeout(runTimeout);
         if (signal && abortListenerAdded) signal.removeEventListener("abort", abortFromCaller);
         unsubscribe?.();
-        session?.dispose();
+        await disposeSubagentSession(session);
       }
     },
 

package/extensions/triage-comments/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-triage-comments",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "A pi extension that adds /triage-comments and a read-only triage_comments subagent tool for review-comment triage.",
   "keywords": [
     "pi-package",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-extensions",
-  "version": "0.1.76",
+  "version": "0.1.78",
   "description": "A collection of pi extensions and skills for annotation UIs, context management, workflow audits, contrarian review, review-comment triage, notifications, brrr push alerts, safety guards, GitHub research, repo-local knowledge, todos, tool rendering, model/provider helpers, and Xiaohei-style article illustrations.",
   "keywords": [
     "pi-package",
@@ -74,9 +74,9 @@
     ]
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^1.0.0",
-    "@earendil-works/pi-coding-agent": "^1.0.0",
-    "@earendil-works/pi-tui": "^1.0.0",
+    "@earendil-works/pi-ai": "^1.0.4",
+    "@earendil-works/pi-coding-agent": "^1.0.4",
+    "@earendil-works/pi-tui": "^1.0.4",
     "@types/node": "^25.9.1",
     "oxfmt": "0.67.0",
     "typebox": "^1.3.6",