@duckmind/dm-windows-x64 0.61.4 → 0.61.9

package/extensions/dm-subagents/src/runs/shared/dm-args.js

@@ -1,33 +1,79 @@
+import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { encodeNestedPathEnv, parseNestedPathEnv } from "./nested-path.js";
-import { resolveMcpDirectToolNames } from "./mcp-direct-tool-allowlist.js";
-import { STRUCTURED_OUTPUT_CAPTURE_ENV, STRUCTURED_OUTPUT_SCHEMA_ENV } from "./structured-output.js";
-import { TEMP_ROOT_DIR } from "../../shared/types.js";
-import { TOOL_BUDGET_ENV, encodeToolBudgetEnv } from "./tool-budget.js";
-const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
+import {
+  encodeNestedPathEnv,
+  parseNestedPathEnv
+} from "./nested-path.js";
+import {
+  formatUnresolvedMcpDirectToolSelectors,
+  resolveMcpDirectToolResolution
+} from "./mcp-direct-tool-allowlist.js";
+import { resolvePiPackageRoot } from "./dm-spawn.js";
+import { encodeExtensionBindings, DM_SUBAGENT_EXTENSION_BINDINGS_ENV } from "./extension-bindings.js";
+import { RUNTIME_EXTENSION_ACK_PATH_ENV } from "./runtime-acknowledged-extensions.js";
+import {
+  STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE_ENV,
+  STRUCTURED_OUTPUT_CAPTURE_ENV,
+  STRUCTURED_OUTPUT_SCHEMA_ENV
+} from "./structured-output.js";
+import {
+  TEMP_ROOT_DIR
+} from "../../shared/types.js";
+import { THINKING_LEVELS } from "../../shared/model-info.js";
+import { decodeThinkingCeiling, intersectThinkingCeilings, SUBAGENT_THINKING_CEILING_ENV } from "../../shared/thinking-ceiling.js";
+import { encodeRunFanoutBudgetDescriptor, RUN_FANOUT_BUDGET_ENV } from "./run-fanout-budget.js";
+import {
+  TOOL_BUDGET_ENV,
+  TOOL_BUDGET_ZERO_AUTH_ENV,
+  encodeToolBudgetEnv
+} from "./tool-budget.js";
+import {
+  CHILD_TOOL_DIAGNOSTIC_PATH_ENV,
+  MCP_DIRECT_CHILD_TOOLS_ENV,
+  REQUIRED_CHILD_TOOLS_ENV
+} from "./tool-availability.js";
+import {
+  CHILD_WATCHDOG_CONFIG_ENV,
+  encodeChildWatchdogConfig
+} from "../../watchdog/child-status.js";
+import { WAIT_TOOL_DEFAULT_TIMEOUT_MS_ENV, WAIT_TOOL_ENABLED_ENV } from "../background/wait-config.js";
+import {
+  DM_CODING_AGENT_PACKAGE_ROOT_ENV,
+  getAgentDir
+} from "../../shared/utils.js";
+import {
+  encodePermissionRules,
+  PERMISSION_AUDIT_PATH_ENV,
+  PERMISSION_POLICY_ENV
+} from "./permissions.js";
+import {
+  SUBAGENT_CAPABILITY_CEILING_ENV,
+  capabilityCeilingAgentRestrictionSources,
+  decodeSubagentCapabilityCeiling,
+  encodeSubagentCapabilityCeiling,
+  intersectSubagentCapabilityCeilings,
+  isAgentAllowedByCapabilityCeiling
+} from "./capability-ceiling.js";
 const TASK_ARG_LIMIT = 8000;
-export function resolveRuntimeExtensionPath(moduleUrl, relativeStem) {
-  const modulePath = fileURLToPath(moduleUrl);
-  const moduleSuffix = path.extname(modulePath);
-  const runtimeSuffix = [".js", ".mjs", ".cjs", ".ts", ".mts", ".cts"].includes(moduleSuffix) ? moduleSuffix : ".ts";
-  return path.join(path.dirname(modulePath), `${relativeStem}${runtimeSuffix}`);
+export const SUBAGENT_TASK_DELIVERY_ENV = "DM_SUBAGENT_TASK_DELIVERY";
+export function resolveSubagentTaskDelivery(env = process.env) {
+  return env[SUBAGENT_TASK_DELIVERY_ENV]?.trim().toLowerCase() === "file" ? "file" : "auto";
 }
-function isStandaloneDmArgsModule(moduleUrl) {
-  return path.basename(fileURLToPath(moduleUrl)).startsWith("dm-args.");
+function shouldDeliverTaskViaFile(task, delivery) {
+  return delivery === "file" || task.length > TASK_ARG_LIMIT;
 }
-export function resolvePromptRuntimePath(moduleUrl = import.meta.url) {
-  const promptStem = isStandaloneDmArgsModule(moduleUrl) ? "subagent-prompt-runtime" : path.join("..", "runs", "shared", "subagent-prompt-runtime");
-  return resolveRuntimeExtensionPath(moduleUrl, promptStem);
-}
-export function resolveFanoutChildPath(moduleUrl = import.meta.url) {
-  const fanoutStem = isStandaloneDmArgsModule(moduleUrl) ? path.join("..", "..", "extension", "fanout-child") : "fanout-child";
-  return resolveRuntimeExtensionPath(moduleUrl, fanoutStem);
-}
-const PROMPT_RUNTIME_EXTENSION_PATH = resolvePromptRuntimePath();
-const FANOUT_CHILD_EXTENSION_PATH = resolveFanoutChildPath();
+const MAX_LAUNCH_RESOLVED_EXTENSION_IDS = 32;
+const PROMPT_RUNTIME_EXTENSION_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), "subagent-prompt-runtime.js");
+const FANOUT_CHILD_EXTENSION_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "extension", "fanout-child.js");
+const FAST_MODE_EXTENSION_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), "fast-mode-extension.js");
+const FAST_MODE_ALLOWED_MODELS = new Set([
+  "openai-codex/gpt-5.6-luna",
+  "openai-codex/gpt-5.6-sol"
+]);
+const OPENAI_PROMPT_CACHE_KEY_MAX_LENGTH = 64;
 export const SUBAGENT_CHILD_ENV = "DM_SUBAGENT_CHILD";
 export const SUBAGENT_ORCHESTRATOR_TARGET_ENV = "DM_SUBAGENT_ORCHESTRATOR_TARGET";
 export const SUBAGENT_ORCHESTRATOR_SESSION_ID_ENV = "DM_SUBAGENT_ORCHESTRATOR_SESSION_ID";
@@ -45,7 +91,20 @@ export const SUBAGENT_PARENT_DEPTH_ENV = "DM_SUBAGENT_PARENT_DEPTH";
 export const SUBAGENT_PARENT_PATH_ENV = "DM_SUBAGENT_PARENT_PATH";
 export const SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV = "DM_SUBAGENT_PARENT_CAPABILITY_TOKEN";
 export const SUBAGENT_PARENT_SESSION_ENV = "DM_SUBAGENT_PARENT_SESSION";
+export const SUBAGENT_FORK_CACHE_KEY_ENV = "DM_SUBAGENT_FORK_CACHE_KEY";
 export const SUBAGENT_STEER_INBOX_ENV = "DM_SUBAGENT_STEER_INBOX";
+export const SUBAGENT_STEER_CAPABILITY_ENV = "DM_SUBAGENT_STEER_CAPABILITY";
+export const SUBAGENT_STEER_ACK_DIR_ENV = "DM_SUBAGENT_STEER_ACK_DIR";
+export const PI_INTERCOM_STABLE_ID_ENV = "PI_INTERCOM_STABLE_ID";
+export const PI_INTERCOM_SESSION_ID_ENV = "PI_INTERCOM_SESSION_ID";
+export const SUBAGENT_INHERIT_GLOBAL_CONTEXT_ENV = "DM_SUBAGENT_INHERIT_GLOBAL_CONTEXT";
+export function deriveForkPromptCacheKey(parentSessionId) {
+  const parent = parentSessionId?.trim();
+  if (!parent)
+    return;
+  const digest = createHash("sha256").update(parent).digest("hex").slice(0, OPENAI_PROMPT_CACHE_KEY_MAX_LENGTH - "dm-fork:".length);
+  return `dm-fork:${digest}`;
+}
 function sanitizeSupervisorChannelSegment(value) {
   return value.trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
 }
@@ -56,11 +115,247 @@ export function applyThinkingSuffix(model, thinking, replaceExisting = false) {
   if (!model || !thinking)
     return model;
   const colonIdx = model.lastIndexOf(":");
-  if (colonIdx !== -1 && THINKING_LEVELS.includes(model.substring(colonIdx + 1))) {
+  if (colonIdx !== -1 && THINKING_LEVELS.some((level) => level === model.substring(colonIdx + 1))) {
     return replaceExisting ? `${model.slice(0, colonIdx)}:${thinking}` : model;
   }
   return `${model}:${thinking}`;
 }
+function stripThinkingSuffix(model) {
+  const colonIdx = model.lastIndexOf(":");
+  if (colonIdx === -1)
+    return model;
+  return THINKING_LEVELS.some((level) => level === model.substring(colonIdx + 1)) ? model.slice(0, colonIdx) : model;
+}
+function resolveFastModeExtension(input) {
+  if (!input.fast)
+    return [];
+  const candidates = ((input.modelCandidates?.length) ? input.modelCandidates : input.model ? [input.model] : []).map(stripThinkingSuffix);
+  if (candidates.length === 0) {
+    throw new Error(`fast mode requires an explicit supported native OpenAI-Codex model${input.agentName ? ` for agent '${input.agentName}'` : ""}.`);
+  }
+  const unsupported = candidates.filter((model) => !FAST_MODE_ALLOWED_MODELS.has(model));
+  if (unsupported.length > 0) {
+    throw new Error(`fast mode supports only ${[...FAST_MODE_ALLOWED_MODELS].join(", ")}; unsupported model${unsupported.length === 1 ? "" : "s"}: ${unsupported.join(", ")}.`);
+  }
+  return [FAST_MODE_EXTENSION_PATH];
+}
+function extensionIdentifier(value) {
+  return `sha256:${createHash("sha256").update(path.normalize(value.trim())).digest("hex").slice(0, 16)}`;
+}
+function boundedExtensionIdentifiers(values) {
+  const ids = [...new Set(values.map(extensionIdentifier))];
+  return {
+    ids: ids.slice(0, MAX_LAUNCH_RESOLVED_EXTENSION_IDS),
+    omitted: Math.max(0, ids.length - MAX_LAUNCH_RESOLVED_EXTENSION_IDS)
+  };
+}
+function hasPermissionRules(rules) {
+  return rules !== undefined && Object.keys(rules).length > 0;
+}
+function filterRuntimeMcpConfig(config, runtimeServerNames, effectiveRuntimeServerNames) {
+  const runtimeNames = new Set(runtimeServerNames);
+  const effectiveNames = new Set(effectiveRuntimeServerNames);
+  return {
+    ...config,
+    mcpServers: Object.fromEntries(Object.entries(config.mcpServers).filter(([name]) => !runtimeNames.has(name) || effectiveNames.has(name)))
+  };
+}
+export function projectLaunchResolvedChildExtensions(toolPlan) {
+  const runtime = boundedExtensionIdentifiers(toolPlan.runtimeExtensions);
+  const configured = boundedExtensionIdentifiers(toolPlan.configuredExtensions);
+  const effective = boundedExtensionIdentifiers(toolPlan.extensionArgs);
+  return {
+    version: 1,
+    source: "launch-resolved",
+    disableAmbientExtensions: toolPlan.disableAmbientExtensions,
+    runtime: runtime.ids,
+    configured: configured.ids,
+    effective: effective.ids,
+    omitted: {
+      runtime: runtime.omitted,
+      configured: configured.omitted,
+      effective: effective.omitted
+    }
+  };
+}
+export function resolvePermissionSystemExtension() {
+  const agentDir = getAgentDir();
+  const candidates = [
+    path.join(agentDir, "npm", "node_modules", "@gotgenes", "dm-permission-system"),
+    path.join(agentDir, "extensions", "dm-permission-system")
+  ];
+  const errors = [];
+  for (const extDir of candidates) {
+    if (!fs.existsSync(extDir))
+      continue;
+    const pkgPath = path.join(extDir, "package.json");
+    if (!fs.existsSync(pkgPath)) {
+      errors.push(new Error(`Permission-system package manifest is missing at ${pkgPath}.`));
+      continue;
+    }
+    try {
+      let pkg;
+      const parsed = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("manifest root must be an object");
+      }
+      pkg = parsed;
+      const extensions = pkg.dm?.extensions;
+      const entry = Array.isArray(extensions) ? extensions[0] : undefined;
+      if (typeof entry !== "string" || !entry.trim()) {
+        throw new Error(`Permission-system package manifest at ${pkgPath} must declare dm.extensions[0] as a non-empty string.`);
+      }
+      const resolved = path.resolve(extDir, entry);
+      if (fs.existsSync(resolved))
+        return resolved;
+      throw new Error(`Permission-system extension entry ${JSON.stringify(entry)} in ${pkgPath} does not exist at ${resolved}.`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(message.startsWith("Permission-system") ? new Error(message) : new Error(`Cannot read permission-system package manifest at ${pkgPath}: ${message}`));
+    }
+  }
+  if (errors.length > 0)
+    throw errors[0];
+  return;
+}
+export function resolvePiLaunchToolPlan(input) {
+  const capabilityCeiling = intersectSubagentCapabilityCeilings(input.capabilityCeiling, input.inheritedCapabilityCeiling);
+  const allowedToolSet = capabilityCeiling?.allowedTools === undefined ? undefined : new Set(capabilityCeiling.allowedTools);
+  const requestedBuiltinTools = input.tools?.filter((tool) => !(tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js"))) ?? [];
+  if (input.requireReadTool && allowedToolSet && !allowedToolSet.has("read")) {
+    throw new Error(`Capability ceiling from ${capabilityCeiling?.sources.join(", ") || "unknown source"} excludes required tool 'read' for lazy skill loading.`);
+  }
+  const declaredBuiltinTools = input.tools === undefined ? allowedToolSet ? [...allowedToolSet] : [] : (input.requireReadTool && requestedBuiltinTools.length > 0 && !requestedBuiltinTools.includes("read") && !allowedToolSet ? ["read", ...requestedBuiltinTools] : requestedBuiltinTools).filter((tool) => !allowedToolSet || allowedToolSet.has(tool));
+  const fanoutAuthorized = declaredBuiltinTools.includes("subagent") || input.allowNestedSubagents === true && (!allowedToolSet || allowedToolSet.has("subagent"));
+  const toolExtensionPaths = capabilityCeiling?.denyExtensions ? [] : (input.tools ?? []).filter((tool) => !requestedBuiltinTools.includes(tool) && (tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js")));
+  const mcpResolution = capabilityCeiling?.denyExtensions ? { selections: [], unresolvedSelectors: [] } : resolveMcpDirectToolResolution(input.mcpDirectTools, input.cwd, input.runtimeSnapshotHost, input.mcpConfig);
+  if (mcpResolution.unresolvedSelectors.length > 0) {
+    throw new Error(formatUnresolvedMcpDirectToolSelectors(mcpResolution.unresolvedSelectors));
+  }
+  const resolvedMcpSelections = mcpResolution.selections;
+  const resolvedMcpNames = new Set(resolvedMcpSelections.map((selection) => selection.name));
+  const legacyMcpNameCounts = countLegacyUnderscoreMcpToolNames(resolvedMcpSelections);
+  const effectiveMcpSelections = resolvedMcpSelections.filter((selection) => !allowedToolSet || allowedToolSet.has(selection.name) || isLegacyUnderscoreMcpToolAllowed(selection, allowedToolSet, resolvedMcpNames, legacyMcpNameCounts));
+  const effectiveMcpTools = effectiveMcpSelections.map((selection) => selection.name);
+  const runtimeServerNames = mcpResolution.runtimeServerNames ?? input.runtimeServerNames ?? [];
+  const effectiveRuntimeServerNames = runtimeServerNames.filter((serverName) => effectiveMcpSelections.some((selection) => selection.selector.startsWith(`${serverName}/`)));
+  const effectiveMcpConfig = mcpResolution.mcpConfig ?? input.mcpConfig;
+  const filteredMcpConfig = effectiveMcpConfig ? filterRuntimeMcpConfig(effectiveMcpConfig, runtimeServerNames, effectiveRuntimeServerNames) : undefined;
+  const explicitToolAllowlist = input.tools !== undefined || (input.mcpDirectTools?.length ?? 0) > 0 || allowedToolSet !== undefined;
+  const internalTools = input.structuredOutput ? ["structured_output"] : [];
+  const effectiveToolAllowlist = [
+    ...new Set([
+      ...declaredBuiltinTools,
+      ...effectiveMcpTools,
+      ...internalTools
+    ])
+  ];
+  const legacySupervisorPairing = declaredBuiltinTools.includes("contact_supervisor");
+  const requiredChildTools = explicitToolAllowlist ? [
+    ...new Set([
+      ...input.tools !== undefined ? declaredBuiltinTools : [],
+      ...input.mcpDirectTools?.length ? effectiveMcpTools : [],
+      ...internalTools
+    ].filter((tool) => tool !== "contact_supervisor" && (!legacySupervisorPairing || tool !== "intercom")))
+  ] : [];
+  const permSystemExt = capabilityCeiling?.denyExtensions ? undefined : hasPermissionRules(input.permissionRules) ? resolvePermissionSystemExtension() : undefined;
+  if (input.fast && capabilityCeiling?.denyExtensions)
+    throw new Error("fast mode requires a child runtime extension, but this launch denies extensions.");
+  const fastModeExtensions = resolveFastModeExtension({ fast: input.fast, model: input.model, modelCandidates: input.modelCandidates, agentName: input.agentName });
+  const runtimeExtensions = [
+    PROMPT_RUNTIME_EXTENSION_PATH,
+    ...fastModeExtensions,
+    ...fanoutAuthorized ? [FANOUT_CHILD_EXTENSION_PATH] : [],
+    ...permSystemExt ? [permSystemExt] : []
+  ];
+  const disableAmbientExtensions = capabilityCeiling?.denyExtensions === true || input.extensions !== undefined;
+  const warnings = [];
+  if (capabilityCeiling?.denyExtensions !== true && Array.isArray(input.extensions) && input.extensions.length === 0) {
+    const agentLabel = input.agentName ? ` for agent '${input.agentName}'` : "";
+    warnings.push(`extensions: [] override${agentLabel} disables ALL ambient extensions for this child (not just "adds nothing"), ` + "including any model-provider extension needed to resolve a provider-qualified model. " + "List the extensions this child actually needs instead of an empty array.");
+  }
+  const configuredExtensions = capabilityCeiling?.denyExtensions ? [] : [
+    ...toolExtensionPaths,
+    ...input.extensions ?? [],
+    ...input.subagentOnlyExtensions ?? []
+  ];
+  const extensionArgs = disableAmbientExtensions ? [...new Set([...runtimeExtensions, ...configuredExtensions])] : [
+    ...new Set([
+      ...runtimeExtensions,
+      ...toolExtensionPaths,
+      ...input.subagentOnlyExtensions ?? []
+    ])
+  ];
+  const requestedToolNames = input.tools !== undefined ? [
+    ...new Set([
+      ...requestedBuiltinTools,
+      ...resolvedMcpSelections.map((selection) => selection.name)
+    ])
+  ] : undefined;
+  const capabilityAudit = capabilityCeiling ? {
+    ceiling: capabilityCeiling,
+    ...requestedToolNames ? { requestedTools: requestedToolNames } : {},
+    effectiveTools: effectiveToolAllowlist,
+    removedTools: requestedToolNames?.filter((tool) => !effectiveToolAllowlist.includes(tool)) ?? [],
+    internalTools,
+    extensionsDenied: capabilityCeiling.denyExtensions,
+    removedExtensionCount: capabilityCeiling.denyExtensions ? (input.extensions?.length ?? 0) + (input.subagentOnlyExtensions?.length ?? 0) + (input.tools ?? []).filter((tool) => tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js")).length : 0,
+    requestedMcpToolCount: input.mcpDirectTools?.length ?? 0,
+    effectiveMcpTools,
+    agentAllowed: input.agentName === undefined ? true : isAgentAllowedByCapabilityCeiling(input.agentName, capabilityCeiling),
+    ...capabilityCeilingAgentRestrictionSources(capabilityCeiling) ? {
+      agentRestrictionSources: capabilityCeilingAgentRestrictionSources(capabilityCeiling)
+    } : {}
+  } : undefined;
+  return {
+    ...capabilityCeiling ? { capabilityCeiling } : {},
+    requestedBuiltinTools,
+    declaredBuiltinTools,
+    toolExtensionPaths,
+    resolvedMcpSelections,
+    effectiveMcpSelections,
+    effectiveMcpTools,
+    explicitToolAllowlist,
+    internalTools,
+    effectiveToolAllowlist,
+    requiredChildTools,
+    fanoutAuthorized,
+    runtimeExtensions,
+    configuredExtensions,
+    extensionArgs,
+    disableAmbientExtensions,
+    warnings,
+    ...effectiveRuntimeServerNames.length > 0 && filteredMcpConfig ? { mcpConfig: filteredMcpConfig, runtimeServerNames: effectiveRuntimeServerNames } : {},
+    ...capabilityAudit ? { capabilityAudit } : {}
+  };
+}
+function countLegacyUnderscoreMcpToolNames(selections) {
+  const counts = new Map;
+  for (const selection of selections) {
+    const legacyName = legacyUnderscoreMcpToolName(selection);
+    if (legacyName !== selection.name)
+      counts.set(legacyName, (counts.get(legacyName) ?? 0) + 1);
+  }
+  return counts;
+}
+function isLegacyUnderscoreMcpToolAllowed(selection, allowedToolSet, resolvedMcpNames, legacyMcpNameCounts) {
+  const legacyName = legacyUnderscoreMcpToolName(selection);
+  return legacyMcpNameCounts.get(legacyName) === 1 && !resolvedMcpNames.has(legacyName) && allowedToolSet.has(legacyName);
+}
+function legacyUnderscoreMcpToolName(selection) {
+  const slash = selection.selector.indexOf("/");
+  if (slash < 1)
+    return selection.name;
+  const toolName = selection.selector.slice(slash + 1);
+  const suffix = `_${toolName}`;
+  if (!selection.name.endsWith(suffix))
+    return selection.name;
+  const prefix = selection.name.slice(0, -suffix.length);
+  return `${prefix.replace(/-/g, "_")}${suffix}`;
+}
+function escapeXmlAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 export function buildPiArgs(input) {
   const args = [...input.baseArgs];
   if (input.sessionFile) {
@@ -79,47 +374,62 @@ export function buildPiArgs(input) {
   if (modelArg) {
     args.push("--model", modelArg);
   }
-  const declaredBuiltinToolsBase = input.tools?.filter((tool) => !(tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js"))) ?? [];
-  const declaredBuiltinTools = input.requireReadTool && input.tools?.length && !declaredBuiltinToolsBase.includes("read") ? ["read", ...declaredBuiltinToolsBase] : declaredBuiltinToolsBase;
-  const fanoutAuthorized = declaredBuiltinTools.includes("subagent");
-  const toolExtensionPaths = [];
-  if (input.tools?.length) {
-    const builtinTools = [...declaredBuiltinTools];
-    for (const tool of input.tools) {
-      if (!declaredBuiltinTools.includes(tool) && (tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js"))) {
-        toolExtensionPaths.push(tool);
-      }
-    }
-    if (builtinTools.length > 0) {
-      if (input.mcpDirectTools?.length) {
-        builtinTools.push(...resolveMcpDirectToolNames(input.mcpDirectTools, input.cwd));
-      }
-      args.push("--tools", builtinTools.join(","));
-    }
+  const toolPlan = resolvePiLaunchToolPlan({
+    tools: input.tools,
+    allowNestedSubagents: input.allowNestedSubagents,
+    extensions: input.extensions,
+    subagentOnlyExtensions: input.subagentOnlyExtensions,
+    mcpDirectTools: input.mcpDirectTools,
+    mcpConfig: input.mcpConfig,
+    runtimeServerNames: input.runtimeServerNames,
+    cwd: input.cwd,
+    requireReadTool: input.requireReadTool,
+    structuredOutput: input.structuredOutput,
+    fast: input.fast,
+    model: modelArg,
+    modelCandidates: input.modelCandidates,
+    capabilityCeiling: input.capabilityCeiling,
+    inheritedCapabilityCeiling: decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV]),
+    agentName: input.childAgentName,
+    permissionRules: input.permissionRules,
+    runtimeSnapshotHost: input.runtimeSnapshotHost
+  });
+  if (toolPlan.explicitToolAllowlist) {
+    args.push(toolPlan.effectiveToolAllowlist.length > 0 ? "--tools" : "--no-tools");
+    if (toolPlan.effectiveToolAllowlist.length > 0)
+      args.push(toolPlan.effectiveToolAllowlist.join(","));
   }
-  const runtimeExtensions = fanoutAuthorized ? [PROMPT_RUNTIME_EXTENSION_PATH, FANOUT_CHILD_EXTENSION_PATH] : [PROMPT_RUNTIME_EXTENSION_PATH];
-  if (input.extensions !== undefined) {
+  if (toolPlan.disableAmbientExtensions) {
     args.push("--no-extensions");
-    for (const extPath of [...new Set([...runtimeExtensions, ...toolExtensionPaths, ...input.extensions, ...input.subagentOnlyExtensions ?? []])]) {
-      args.push("--extension", extPath);
-    }
-  } else {
-    for (const extPath of [...new Set([...runtimeExtensions, ...toolExtensionPaths, ...input.subagentOnlyExtensions ?? []])]) {
-      args.push("--extension", extPath);
-    }
+  }
+  for (const extPath of toolPlan.extensionArgs)
+    args.push("--extension", extPath);
+  let tempDir;
+  if (toolPlan.mcpConfig && toolPlan.runtimeServerNames?.length) {
+    if (!tempDir)
+      tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagent-"));
+    const mcpConfigPath = path.join(tempDir, "mcp-config.json");
+    fs.writeFileSync(mcpConfigPath, JSON.stringify(toolPlan.mcpConfig, null, 2), { mode: 384 });
+    args.push("--mcp-config", mcpConfigPath);
+  }
+  if (!input.inheritProjectContext) {
+    args.push("--no-context-files");
   }
   if (!input.inheritSkills) {
     args.push("--no-skills");
   }
-  let tempDir;
   if (input.systemPrompt !== undefined && input.systemPrompt !== null) {
-    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagent-"));
+    if (!tempDir)
+      tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagent-"));
     const stem = (input.promptFileStem ?? "prompt").replace(/[^\w.-]/g, "_");
     const promptPath = path.join(tempDir, `${stem}.md`);
-    fs.writeFileSync(promptPath, input.systemPrompt, { mode: 384 });
+    const taggedPrompt = input.childAgentName ? `<active_agent name="${escapeXmlAttr(input.childAgentName)}"/>
+
+${input.systemPrompt}` : input.systemPrompt;
+    fs.writeFileSync(promptPath, taggedPrompt, { mode: 384 });
     args.push(input.systemPromptMode === "replace" ? "--system-prompt" : "--append-system-prompt", promptPath);
   }
-  if (input.task.length > TASK_ARG_LIMIT) {
+  if (shouldDeliverTaskViaFile(input.task, input.taskDelivery ?? resolveSubagentTaskDelivery())) {
     if (!tempDir) {
       tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagent-"));
     }
@@ -130,8 +440,31 @@ export function buildPiArgs(input) {
     args.push(`Task: ${input.task}`);
   }
   const env = {};
+  env[DM_SUBAGENT_EXTENSION_BINDINGS_ENV] = encodeExtensionBindings(input.extensionBindings);
+  const piPackageRoot = process.env[DM_CODING_AGENT_PACKAGE_ROOT_ENV] ?? resolvePiPackageRoot();
+  if (piPackageRoot)
+    env[DM_CODING_AGENT_PACKAGE_ROOT_ENV] = piPackageRoot;
+  if (!tempDir)
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagent-"));
+  const runtimeAcknowledgedExtensionsPath = path.join(tempDir, "runtime-acknowledged-extensions.json");
+  env[RUNTIME_EXTENSION_ACK_PATH_ENV] = runtimeAcknowledgedExtensionsPath;
+  let toolDiagnosticPath;
+  if (toolPlan.requiredChildTools.length > 0) {
+    if (!tempDir)
+      tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagent-"));
+    toolDiagnosticPath = path.join(tempDir, "tool-diagnostic.json");
+    env[REQUIRED_CHILD_TOOLS_ENV] = JSON.stringify(toolPlan.requiredChildTools);
+    env[CHILD_TOOL_DIAGNOSTIC_PATH_ENV] = toolDiagnosticPath;
+  }
+  env[MCP_DIRECT_CHILD_TOOLS_ENV] = toolPlan.effectiveMcpTools.length > 0 ? JSON.stringify(toolPlan.effectiveMcpTools) : undefined;
   env[SUBAGENT_CHILD_ENV] = "1";
-  env[SUBAGENT_FANOUT_CHILD_ENV] = fanoutAuthorized ? "1" : "0";
+  env[SUBAGENT_FANOUT_CHILD_ENV] = toolPlan.fanoutAuthorized ? "1" : "0";
+  if (input.waitToolEnabled !== undefined) {
+    env[WAIT_TOOL_ENABLED_ENV] = input.waitToolEnabled ? "true" : "false";
+  }
+  if (input.waitToolDefaultTimeoutMs !== undefined) {
+    env[WAIT_TOOL_DEFAULT_TIMEOUT_MS_ENV] = String(input.waitToolDefaultTimeoutMs);
+  }
   const inheritedNestedRoute = Boolean(process.env[SUBAGENT_PARENT_EVENT_SINK_ENV] && process.env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] && process.env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV]);
   const parentRunId = input.parentRunId ?? input.runId ?? (inheritedNestedRoute ? process.env[SUBAGENT_RUN_ID_ENV] : undefined) ?? process.env[SUBAGENT_PARENT_RUN_ID_ENV] ?? "";
   const parentChildIndex = input.parentChildIndex !== undefined ? String(input.parentChildIndex) : input.childIndex !== undefined ? String(input.childIndex) : process.env[SUBAGENT_PARENT_CHILD_INDEX_ENV] ?? "";
@@ -139,31 +472,41 @@ export function buildPiArgs(input) {
   const parentDepth = input.parentDepth ?? (inheritedNestedRoute && Number.isFinite(inheritedDepth) ? inheritedDepth + 1 : 1);
   const parentPath = input.parentPath ?? [
     ...parseNestedPathEnv(process.env[SUBAGENT_PARENT_PATH_ENV]),
-    ...parentRunId ? [{
-      runId: parentRunId,
-      ...parentChildIndex && /^\d+$/.test(parentChildIndex) ? { stepIndex: Number(parentChildIndex) } : {},
-      ...input.childAgentName ? { agent: input.childAgentName } : {}
-    }] : []
+    ...parentRunId ? [
+      {
+        runId: parentRunId,
+        ...parentChildIndex && /^\d+$/.test(parentChildIndex) ? { stepIndex: Number(parentChildIndex) } : {},
+        ...input.childAgentName ? { agent: input.childAgentName } : {}
+      }
+    ] : []
   ];
-  env[SUBAGENT_PARENT_EVENT_SINK_ENV] = fanoutAuthorized ? input.parentEventSink ?? process.env[SUBAGENT_PARENT_EVENT_SINK_ENV] ?? "" : "";
-  env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] = fanoutAuthorized ? input.parentControlInbox ?? process.env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] ?? "" : "";
-  env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] = fanoutAuthorized ? input.parentRootRunId ?? process.env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] ?? input.runId ?? "" : "";
-  env[SUBAGENT_PARENT_RUN_ID_ENV] = fanoutAuthorized ? parentRunId : "";
-  env[SUBAGENT_PARENT_CHILD_INDEX_ENV] = fanoutAuthorized ? parentChildIndex : "";
-  env[SUBAGENT_PARENT_DEPTH_ENV] = fanoutAuthorized ? String(parentDepth) : "";
-  env[SUBAGENT_PARENT_PATH_ENV] = fanoutAuthorized ? encodeNestedPathEnv(parentPath) : "";
-  env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] = fanoutAuthorized ? input.parentCapabilityToken ?? process.env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] ?? "" : "";
+  env[SUBAGENT_PARENT_EVENT_SINK_ENV] = toolPlan.fanoutAuthorized ? input.parentEventSink ?? process.env[SUBAGENT_PARENT_EVENT_SINK_ENV] ?? "" : "";
+  env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] = toolPlan.fanoutAuthorized ? input.parentControlInbox ?? process.env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] ?? "" : "";
+  env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] = toolPlan.fanoutAuthorized ? input.parentRootRunId ?? process.env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] ?? input.runId ?? "" : "";
+  env[SUBAGENT_PARENT_RUN_ID_ENV] = toolPlan.fanoutAuthorized ? parentRunId : "";
+  env[SUBAGENT_PARENT_CHILD_INDEX_ENV] = toolPlan.fanoutAuthorized ? parentChildIndex : "";
+  env[SUBAGENT_PARENT_DEPTH_ENV] = toolPlan.fanoutAuthorized ? String(parentDepth) : "";
+  env[SUBAGENT_PARENT_PATH_ENV] = toolPlan.fanoutAuthorized ? encodeNestedPathEnv(parentPath) : "";
+  env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] = toolPlan.fanoutAuthorized ? input.parentCapabilityToken ?? process.env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] ?? "" : "";
+  env[RUN_FANOUT_BUDGET_ENV] = toolPlan.fanoutAuthorized ? input.runFanoutBudget ? encodeRunFanoutBudgetDescriptor(input.runFanoutBudget) : process.env[RUN_FANOUT_BUDGET_ENV] : undefined;
   env.DM_SUBAGENT_INHERIT_PROJECT_CONTEXT = input.inheritProjectContext ? "1" : "0";
+  env[SUBAGENT_INHERIT_GLOBAL_CONTEXT_ENV] = input.inheritGlobalContext ? "1" : "0";
   env.DM_SUBAGENT_INHERIT_SKILLS = input.inheritSkills ? "1" : "0";
+  env[PI_INTERCOM_STABLE_ID_ENV] = input.intercomSessionName || undefined;
+  env[PI_INTERCOM_SESSION_ID_ENV] = undefined;
   if (input.intercomSessionName) {
     env.DM_SUBAGENT_INTERCOM_SESSION_NAME = input.intercomSessionName;
   }
+  if (input.sessionName?.trim()) {
+    env.DM_SUBAGENT_SESSION_NAME = input.sessionName.trim();
+  }
   if (input.orchestratorIntercomTarget) {
     env[SUBAGENT_ORCHESTRATOR_TARGET_ENV] = input.orchestratorIntercomTarget;
   }
   if (input.parentSessionId) {
     env[SUBAGENT_ORCHESTRATOR_SESSION_ID_ENV] = input.parentSessionId;
   }
+  const encodedPermissionRules = encodePermissionRules(input.permissionRules);
   if (input.orchestratorIntercomTarget && input.parentSessionId && input.runId && input.childAgentName) {
     const childIndex = input.childIndex ?? 0;
     const channelDir = supervisorChannelDir(input.runId, input.childAgentName, childIndex);
@@ -171,6 +514,8 @@ export function buildPiArgs(input) {
     fs.mkdirSync(path.join(channelDir, "replies"), { recursive: true });
     env[SUBAGENT_SUPERVISOR_CHANNEL_DIR_ENV] = channelDir;
   }
+  if (encodedPermissionRules)
+    env[PERMISSION_AUDIT_PATH_ENV] = input.permissionAuditPath ?? path.join(tempDir, "permission-audit.jsonl");
   if (input.runId) {
     env[SUBAGENT_RUN_ID_ENV] = input.runId;
   }
@@ -180,23 +525,51 @@ export function buildPiArgs(input) {
   if (input.childIndex !== undefined) {
     env[SUBAGENT_CHILD_INDEX_ENV] = String(input.childIndex);
   }
-  if (input.mcpDirectTools?.length) {
+  if (!toolPlan.capabilityCeiling && input.mcpDirectTools?.length)
     env.MCP_DIRECT_TOOLS = input.mcpDirectTools.join(",");
-  } else {
+  else if (toolPlan.capabilityCeiling && toolPlan.effectiveMcpSelections.length && !toolPlan.capabilityCeiling.denyExtensions)
+    env.MCP_DIRECT_TOOLS = toolPlan.effectiveMcpSelections.map((selection) => selection.selector).join(",");
+  else
     env.MCP_DIRECT_TOOLS = "__none__";
-  }
+  const encodedCapabilityCeiling = encodeSubagentCapabilityCeiling(toolPlan.capabilityCeiling);
+  const thinkingCeiling = intersectThinkingCeilings(input.thinkingCeiling, decodeThinkingCeiling(process.env[SUBAGENT_THINKING_CEILING_ENV]));
+  if (thinkingCeiling)
+    env[SUBAGENT_THINKING_CEILING_ENV] = thinkingCeiling;
+  if (encodedCapabilityCeiling)
+    env[SUBAGENT_CAPABILITY_CEILING_ENV] = encodedCapabilityCeiling;
+  if (encodedPermissionRules)
+    env[PERMISSION_POLICY_ENV] = encodedPermissionRules;
   if (input.structuredOutput) {
     env[STRUCTURED_OUTPUT_CAPTURE_ENV] = input.structuredOutput.outputPath;
     env[STRUCTURED_OUTPUT_SCHEMA_ENV] = input.structuredOutput.schemaPath;
+    if (input.structuredOutput.acceptanceReportPath)
+      env[STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE_ENV] = input.structuredOutput.acceptanceReportPath;
   }
   if (input.steerInboxDir) {
     env[SUBAGENT_STEER_INBOX_ENV] = input.steerInboxDir;
   }
+  if (input.steerCapabilityPath)
+    env[SUBAGENT_STEER_CAPABILITY_ENV] = input.steerCapabilityPath;
+  if (input.steerAckDir)
+    env[SUBAGENT_STEER_ACK_DIR_ENV] = input.steerAckDir;
   const encodedToolBudget = encodeToolBudgetEnv(input.toolBudget);
   if (encodedToolBudget)
     env[TOOL_BUDGET_ENV] = encodedToolBudget;
+  env[TOOL_BUDGET_ZERO_AUTH_ENV] = input.allowZeroToolBudget ? "1" : undefined;
+  const encodedChildWatchdog = encodeChildWatchdogConfig(input.childWatchdog);
+  if (encodedChildWatchdog)
+    env[CHILD_WATCHDOG_CONFIG_ENV] = encodedChildWatchdog;
   env[SUBAGENT_PARENT_SESSION_ENV] = input.parentSessionId ?? process.env[SUBAGENT_PARENT_SESSION_ENV] ?? "";
-  return { args, env, tempDir };
+  env[SUBAGENT_FORK_CACHE_KEY_ENV] = input.forkCacheKey?.trim() || undefined;
+  return {
+    args,
+    env,
+    warnings: toolPlan.warnings,
+    tempDir,
+    toolDiagnosticPath,
+    runtimeAcknowledgedExtensionsPath,
+    capabilityAudit: toolPlan.capabilityAudit
+  };
 }
 export const parseParentPathEnv = parseNestedPathEnv;
 export function cleanupTempDir(tempDir) {