@ferris1225/pi-subagents 4.3.3 → 4.3.5

package/src/{prompt.ts → delegation/prompt.ts}

@@ -36,7 +36,6 @@ function phaseForAgent(agentName: string): string {
 	if (agentName === "scout") return "broad reconnaissance";
 	if (agentName === "artisan") return "primary change";
 	if (agentName === "steward") return "pre-commit cleanup and cross-cutting docs";
-	if (agentName === "sentinel") return "post-cleanup adversarial review";
 	return "delegated scope";
 }
 
@@ -105,19 +104,15 @@ export function buildDelegationDirective(
 	const hasScout = agents.some((agent) => agent.name === "scout");
 	const hasArtisan = agents.some((agent) => agent.name === "artisan");
 	const hasSteward = agents.some((agent) => agent.name === "steward");
-	const hasSentinel = agents.some((agent) => agent.name === "sentinel");
 
 	const dispatchRules = [
-		`Main owns routing, architecture, integration, the final gate, and release. Each child starts a paid context; delegate only when handoff saves more than it costs${hasSentinel ? ", except required sentinel review before commit" : ""}.`,
+		"Main owns routing, architecture, integration, the final gate, and release. Each child starts a paid context: proactively delegate substantial self-contained phases when the saved main-context work exceeds handoff cost.",
 		"Keep atomic lookups, focused edits, known answers, and context-heavy work in main. Cluster related reconnaissance into one scout brief, including external research.",
+		"Use available parallel capacity for genuinely independent scopes; batch them in one launch. Runtime runs at most six child processes and queues the rest.",
 		...(hasScout ? ["`scout`: read-only broad code mapping or external research; return file/source citations as leads, not proof."] : []),
 		...(hasArtisan ? ["`artisan`: one substantial primary change; own root cause, implementation, affected tests/docs, and targeted checks."] : []),
 		...(hasSteward ? ["`steward`: final cleanup/docs sync for a completed broad or multi-writer diff; keep focused hygiene inline."] : []),
-		...(hasSentinel ? ["`sentinel`: read-only post-cleanup review; use matching skills and report only evidenced defects."] : []),
-		...(hasSentinel
-			? [`Before every commit: cleanup -> sentinel review. ${hasSteward ? "Use steward once only for broad or multi-writer diffs" : "Keep cleanup inline"}. Then dispatch sentinel on the final diff and check evidence. After review fixes, clean and review once more; findings block commit.`]
-			: []),
-		"One owner per phase; dependent phases wait. A launch leases that phase: main may inspect its result, citations, diff, and checks, not redo the phase; main still runs the final gate.",
+		"One owner per phase; dependent phases wait. Main may consume a child's compact result and cited lines to plan, but never repeats delegated broad search, implementation, or cleanup. A launch leases that phase; main still inspects the integrated diff and runs the final gate.",
 		"Parallelize only independent, disjoint scopes. Brief goal, paths, constraints, and expected output; resume with `subagent_control`.",
 		"`wait: true` only when the result is the immediate dependency; otherwise continue disjoint work. Never sleep or poll, and never finish while a run is active.",
 		"Inspect the integrated diff and actual check output. Never report an unrun check as passed.",

package/src/{background.ts → execution/background.ts}

@@ -38,13 +38,10 @@ interface PendingAcquire {
 
 type PendingEntry = PendingTask | PendingAcquire;
 
-/** How many sub-agent processes may run at once, derived from the host instead
- * of being fixed: children wait on model I/O far more than on CPU, so the pool
- * scales with cores while the bounds keep tiny machines usable and huge ones
- * from fanning out into an API-rate-limit wall. Pacing only — the queue never
- * rejects work; a wider parallel `subagent` call simply waits for a slot. */
+/** Child-process concurrency scales with the host but stays within 4–6.
+ * The queue paces wider batches instead of rejecting independent work. */
 export function resolveSubagentConcurrency(cpuCount: number = cpus().length): number {
-	return Math.min(16, Math.max(4, Math.floor(cpuCount / 2)));
+	return Math.min(6, Math.max(4, Math.floor(cpuCount / 2)));
 }
 
 export class BackgroundTaskQueue {

package/src/execution/rpc-control.ts

@@ -0,0 +1,200 @@
+/** Shared RPC result types and stable logical-run control. */
+
+import type { Message } from "@earendil-works/pi-ai";
+import type { ThinkingLevel } from "../configuration/config.ts";
+import type { IsolationMode, WorktreeFinalizationStatus } from "../isolation/worktree.ts";
+
+export interface UsageStats {
+	input: number;
+	output: number;
+	cacheRead: number;
+	cacheWrite: number;
+	cost: number;
+	contextTokens: number;
+	turns: number;
+}
+
+export interface RpcSingleResult {
+	agent: string;
+	task: string;
+	exitCode: number;
+	messages: Message[];
+	stderr: string;
+	usage: UsageStats;
+	model?: string;
+	thinking?: string;
+	stopReason?: string;
+	errorMessage?: string;
+	/** Selected model when this result handed off to the current main model. */
+	modelFallbackFrom?: string;
+	dispatchFailed?: boolean;
+	/** An accepted generation failed because an RPC prompt was rejected before
+	 * model execution. This remains main-model handoff eligible even when an
+	 * earlier, aborted objective left assistant text in the session. */
+	rpcPromptRejected?: boolean;
+	/** Startup handshake failed before the initial prompt was dispatched. This
+	 * transport miss is safe to retry and is not a model/provider failure. */
+	rpcStartupFailed?: boolean;
+	/** The parent dispatched the initial prompt command. Until its response is
+	 * observed, Pi may already be running it, so startup retries must not replay it. */
+	rpcPromptDispatched?: boolean;
+	/** The child confirmed prompt acceptance (or emitted agent activity). */
+	rpcPromptAccepted?: boolean;
+	/** Pi emitted agent/turn/model/tool activity for this attempt. */
+	rpcActivity?: boolean;
+	startupRetries?: number;
+	failedTools?: Array<{ toolName: string; error: string }>;
+	sessionId?: string;
+	sessionDir?: string;
+	/** Original task/project cwd used for result-artifact retention buckets. */
+	projectCwd?: string;
+	/** Stable logical run id assigned by dispatch (also present on queued results). */
+	runId?: number;
+	/** Filesystem isolation selected for this logical thread. */
+	isolation?: IsolationMode;
+	/** Final integration state for a worktree-isolated settlement. */
+	integrationStatus?: "pending" | WorktreeFinalizationStatus;
+	integrationApplied?: boolean;
+	integrationError?: string;
+	/** Retained only when integration/cleanup failed; never contains patch data. */
+	integrationWorktreePath?: string;
+	integrationPatchPath?: string;
+}
+
+export type SubagentLiveEvent =
+	| { kind: "status"; status: "queued" | "running" | "interrupting" | "done" | "failed" }
+	| { kind: "model"; model?: string; thinking?: ThinkingLevel; fallbackFrom?: string }
+	| { kind: "usage"; usage: UsageStats; model?: string }
+	| { kind: "session"; sessionId: string; sessionDir: string }
+	| { kind: "tool_start"; toolCallId?: string; toolName: string; args: unknown }
+	| { kind: "tool_end"; toolCallId?: string; toolName: string; isError: boolean }
+	| { kind: "thinking" }
+	| { kind: "text" };
+
+export type RpcControlPhase =
+	| "queued"
+	| "starting"
+	| "running"
+	| "interrupting"
+	| "retrying"
+	| "settled"
+	| "stopped";
+
+export interface AttemptControl {
+	stop(reason?: string): Promise<void>;
+}
+
+/**
+ * Stable control surface for a logical run generation. Startup/main-handoff attempts
+ * attach and detach beneath it, so callers never retain a stale child handle.
+ * Control calls are serialized to prevent overlapping abort/settle/prompt flows.
+ */
+export class RpcRunControl {
+	private objective: string;
+	private phase: RpcControlPhase = "queued";
+	private attempt?: { token: number; control: AttemptControl };
+	private nextToken = 1;
+	private serial: Promise<void> = Promise.resolve();
+	private stopRequested = false;
+	private stopMessage = "Subagent was aborted";
+	private childPids = new Set<number>();
+
+	constructor(
+		objective: string,
+		readonly generation: number,
+		private readonly onPhase?: (phase: RpcControlPhase) => void,
+	) {
+		this.objective = objective;
+	}
+
+	getObjective(): string {
+		return this.objective;
+	}
+
+	getPhase(): RpcControlPhase {
+		return this.phase;
+	}
+
+	isStopRequested(): boolean {
+		return this.stopRequested;
+	}
+
+	getStopMessage(): string {
+		return this.stopMessage;
+	}
+
+	/** Pids of every child process this generation spawned. Persisted with the
+	 * thread record so a later load can kill orphans that still hold the
+	 * retained session. */
+	noteChildPid(pid: number): void {
+		if (Number.isInteger(pid) && pid > 0) this.childPids.add(pid);
+	}
+
+	getChildPids(): number[] {
+		return [...this.childPids];
+	}
+
+	markStarting(): void {
+		this.setPhase("starting");
+	}
+
+	markRetrying(): void {
+		if (!this.stopRequested) this.setPhase("retrying");
+	}
+
+	markSettled(): void {
+		this.attempt = undefined;
+		if (!this.stopRequested) this.setPhase("settled");
+	}
+
+	/** Allocate an attempt token used to reject state updates from old children. */
+	beginAttempt(): number {
+		return this.nextToken++;
+	}
+
+	attach(token: number, control: AttemptControl): void {
+		this.attempt = { token, control };
+	}
+
+	detach(token: number): void {
+		if (this.attempt?.token === token) this.attempt = undefined;
+	}
+
+	updateAttemptPhase(token: number, phase: RpcControlPhase): void {
+		if (this.attempt?.token !== token) return;
+		this.setPhase(phase);
+	}
+
+	async stop(reason = "Subagent was aborted"): Promise<void> {
+		return this.serialize(async () => {
+			this.stopRequested = true;
+			this.stopMessage = reason;
+			const attempt = this.attempt?.control;
+			if (attempt) await attempt.stop(reason);
+			this.setPhase("stopped");
+		});
+	}
+
+	private setPhase(phase: RpcControlPhase): void {
+		if (this.phase === phase) return;
+		this.phase = phase;
+		try {
+			this.onPhase?.(phase);
+		} catch {
+			/* monitor callbacks must never break control flow */
+		}
+	}
+
+	private serialize<T>(operation: () => Promise<T>): Promise<T> {
+		const next = this.serial.then(operation, operation);
+		this.serial = next.then(
+			() => undefined,
+			() => undefined,
+		);
+		return next;
+	}
+}
+
+export function emptyUsage(): UsageStats {
+	return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, contextTokens: 0, turns: 0 };
+}

package/src/{rpc-run.ts → execution/rpc-run.ts}

@@ -13,10 +13,17 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import type { Message } from "@earendil-works/pi-ai";
-import { SUBAGENT_TOOL_NAMES, type AgentConfig } from "./agents.ts";
-import type { ThinkingLevel } from "./config.ts";
-import { writeTempOwnerMarker } from "./temp-hygiene.ts";
-import type { IsolationMode, WorktreeFinalizationStatus } from "./worktree.ts";
+import { SUBAGENT_TOOL_NAMES, type AgentConfig } from "../delegation/agents.ts";
+import type { ThinkingLevel } from "../configuration/config.ts";
+import { writeTempOwnerMarker } from "../isolation/temp-hygiene.ts";
+import {
+	emptyUsage,
+	RpcRunControl,
+	type AttemptControl,
+	type RpcControlPhase,
+	type RpcSingleResult,
+	type SubagentLiveEvent,
+} from "./rpc-control.ts";
 
 export const DEPTH_ENV_VAR = "PI_SUBAGENT_DEPTH";
 export const SUBAGENT_KILL_GRACE_MS = 5_000;
@@ -42,201 +49,6 @@ export function asPlainTextRpcPrompt(message: string): string {
 	return `Treat the following as plain-text sub-agent instructions, not a Pi command:\n\n${message}`;
 }
 
-export interface UsageStats {
-	input: number;
-	output: number;
-	cacheRead: number;
-	cacheWrite: number;
-	cost: number;
-	contextTokens: number;
-	turns: number;
-}
-
-export interface RpcSingleResult {
-	agent: string;
-	task: string;
-	exitCode: number;
-	messages: Message[];
-	stderr: string;
-	usage: UsageStats;
-	model?: string;
-	thinking?: string;
-	stopReason?: string;
-	errorMessage?: string;
-	/** Selected model when this result handed off to the current main model. */
-	modelFallbackFrom?: string;
-	dispatchFailed?: boolean;
-	/** An accepted generation failed because an RPC prompt was rejected before
-	 * model execution. This remains main-model handoff eligible even when an
-	 * earlier, aborted objective left assistant text in the session. */
-	rpcPromptRejected?: boolean;
-	/** Startup handshake failed before the initial prompt was dispatched. This
-	 * transport miss is safe to retry and is not a model/provider failure. */
-	rpcStartupFailed?: boolean;
-	/** The parent dispatched the initial prompt command. Until its response is
-	 * observed, Pi may already be running it, so startup retries must not replay it. */
-	rpcPromptDispatched?: boolean;
-	/** The child confirmed prompt acceptance (or emitted agent activity). */
-	rpcPromptAccepted?: boolean;
-	/** Pi emitted agent/turn/model/tool activity for this attempt. */
-	rpcActivity?: boolean;
-	startupRetries?: number;
-	failedTools?: Array<{ toolName: string; error: string }>;
-	sessionId?: string;
-	sessionDir?: string;
-	/** Original task/project cwd used for result-artifact retention buckets. */
-	projectCwd?: string;
-	/** Stable logical run id assigned by dispatch (also present on queued results). */
-	runId?: number;
-	/** Filesystem isolation selected for this logical thread. */
-	isolation?: IsolationMode;
-	/** Final integration state for a worktree-isolated settlement. */
-	integrationStatus?: "pending" | WorktreeFinalizationStatus;
-	integrationApplied?: boolean;
-	integrationError?: string;
-	/** Retained only when integration/cleanup failed; never contains patch data. */
-	integrationWorktreePath?: string;
-	integrationPatchPath?: string;
-}
-
-export type SubagentLiveEvent =
-	| { kind: "status"; status: "queued" | "running" | "interrupting" | "done" | "failed" }
-	| { kind: "model"; model?: string; thinking?: ThinkingLevel; fallbackFrom?: string }
-	| { kind: "usage"; usage: UsageStats; model?: string }
-	| { kind: "session"; sessionId: string; sessionDir: string }
-	| { kind: "tool_start"; toolCallId?: string; toolName: string; args: unknown }
-	| { kind: "tool_end"; toolCallId?: string; toolName: string; isError: boolean }
-	| { kind: "thinking" }
-	| { kind: "text" };
-
-export type RpcControlPhase =
-	| "queued"
-	| "starting"
-	| "running"
-	| "interrupting"
-	| "retrying"
-	| "settled"
-	| "stopped";
-
-interface AttemptControl {
-	stop(reason?: string): Promise<void>;
-}
-
-/**
- * Stable control surface for a logical run generation. Startup/main-handoff attempts
- * attach and detach beneath it, so callers never retain a stale child handle.
- * Control calls are serialized to prevent overlapping abort/settle/prompt flows.
- */
-export class RpcRunControl {
-	private objective: string;
-	private phase: RpcControlPhase = "queued";
-	private attempt?: { token: number; control: AttemptControl };
-	private nextToken = 1;
-	private serial: Promise<void> = Promise.resolve();
-	private stopRequested = false;
-	private stopMessage = "Subagent was aborted";
-	private childPids = new Set<number>();
-
-	constructor(
-		objective: string,
-		readonly generation: number,
-		private readonly onPhase?: (phase: RpcControlPhase) => void,
-	) {
-		this.objective = objective;
-	}
-
-	getObjective(): string {
-		return this.objective;
-	}
-
-	getPhase(): RpcControlPhase {
-		return this.phase;
-	}
-
-	isStopRequested(): boolean {
-		return this.stopRequested;
-	}
-
-	getStopMessage(): string {
-		return this.stopMessage;
-	}
-
-	/** Pids of every child process this generation spawned. Persisted with the
-	 * thread record so a later load can kill orphans that still hold the
-	 * retained session. */
-	noteChildPid(pid: number): void {
-		if (Number.isInteger(pid) && pid > 0) this.childPids.add(pid);
-	}
-
-	getChildPids(): number[] {
-		return [...this.childPids];
-	}
-
-	markStarting(): void {
-		this.setPhase("starting");
-	}
-
-	markRetrying(): void {
-		if (!this.stopRequested) this.setPhase("retrying");
-	}
-
-	markSettled(): void {
-		this.attempt = undefined;
-		if (!this.stopRequested) this.setPhase("settled");
-	}
-
-	/** Allocate an attempt token used to reject state updates from old children. */
-	beginAttempt(): number {
-		return this.nextToken++;
-	}
-
-	attach(token: number, control: AttemptControl): void {
-		this.attempt = { token, control };
-	}
-
-	detach(token: number): void {
-		if (this.attempt?.token === token) this.attempt = undefined;
-	}
-
-	updateAttemptPhase(token: number, phase: RpcControlPhase): void {
-		if (this.attempt?.token !== token) return;
-		this.setPhase(phase);
-	}
-
-	async stop(reason = "Subagent was aborted"): Promise<void> {
-		return this.serialize(async () => {
-			this.stopRequested = true;
-			this.stopMessage = reason;
-			const attempt = this.attempt?.control;
-			if (attempt) await attempt.stop(reason);
-			this.setPhase("stopped");
-		});
-	}
-
-	private setPhase(phase: RpcControlPhase): void {
-		if (this.phase === phase) return;
-		this.phase = phase;
-		try {
-			this.onPhase?.(phase);
-		} catch {
-			/* monitor callbacks must never break control flow */
-		}
-	}
-
-	private serialize<T>(operation: () => Promise<T>): Promise<T> {
-		const next = this.serial.then(operation, operation);
-		this.serial = next.then(
-			() => undefined,
-			() => undefined,
-		);
-		return next;
-	}
-}
-
-export function emptyUsage(): UsageStats {
-	return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, contextTokens: 0, turns: 0 };
-}
-
 export function currentSubagentDepth(env: NodeJS.ProcessEnv = process.env): number {
 	const raw = env[DEPTH_ENV_VAR];
 	const parsed = raw === undefined ? 0 : Number.parseInt(raw, 10);

package/src/{session-fork.ts → execution/session-fork.ts}

@@ -4,7 +4,7 @@ import { SessionManager } from "@earendil-works/pi-coding-agent";
 import { existsSync } from "node:fs";
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { join } from "node:path";
-import { writeTempOwnerMarker } from "./temp-hygiene.ts";
+import { writeTempOwnerMarker } from "../isolation/temp-hygiene.ts";
 
 export interface ForkedSession {
 	sessionDir: string;

package/src/{spawn.ts → execution/spawn.ts}

@@ -13,25 +13,27 @@ import { type Dirent, mkdirSync, readdirSync, realpathSync, rmSync, statSync, wr
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import type { Message } from "@earendil-works/pi-ai";
-import type { AgentConfig } from "./agents.ts";
-import { DEFAULT_THINKING_LEVEL, type ThinkingLevel } from "./config.ts";
+import type { AgentConfig } from "../delegation/agents.ts";
+import { DEFAULT_THINKING_LEVEL, type ThinkingLevel } from "../configuration/config.ts";
+import {
+	emptyUsage,
+	RpcRunControl,
+	type RpcSingleResult,
+	type SubagentLiveEvent,
+	type UsageStats,
+} from "./rpc-control.ts";
 import {
 	currentSubagentDepth,
 	DEPTH_ENV_VAR,
-	emptyUsage,
 	extractToolErrorText,
 	getPiInvocation,
 	isRpcCommandTimeoutError,
-	RpcRunControl,
 	runRpcAgentAttempt,
 	sessionExists,
 	writeChildRetryPolicyExtension,
 	SUBAGENT_KILL_GRACE_MS,
-	type RpcSingleResult,
-	type SubagentLiveEvent,
-	type UsageStats,
 } from "./rpc-run.ts";
-import { writeTempOwnerMarker } from "./temp-hygiene.ts";
+import { writeTempOwnerMarker } from "../isolation/temp-hygiene.ts";
 
 export {
 	currentSubagentDepth,

package/src/isolation/git-command.ts

@@ -0,0 +1,147 @@
+/** Bounded, abortable process runner used by Git isolation operations. */
+
+import { spawn, type ChildProcess } from "node:child_process";
+
+export interface CommandRunOptions {
+	cwd: string;
+	input?: Buffer;
+	signal?: AbortSignal;
+	timeoutMs?: number;
+	maxOutputBytes?: number;
+	/** Extra environment entries merged over the inherited environment. */
+	env?: Record<string, string>;
+}
+
+export interface CommandResult {
+	code: number;
+	stdout: Buffer;
+	stderr: Buffer;
+}
+
+/** Injectable, shell-free command runner used by every Git operation. */
+export type CommandRunner = (
+	command: string,
+	args: readonly string[],
+	options: CommandRunOptions,
+) => Promise<CommandResult>;
+
+export const GIT_COMMAND_TIMEOUT_MS = 120_000;
+export const GIT_COMMAND_KILL_GRACE_MS = 2_000;
+export const GIT_OUTPUT_MAX_BYTES = 64 * 1024 * 1024;
+export const WORKTREE_PATCH_MAX_BYTES = GIT_OUTPUT_MAX_BYTES;
+
+/** Terminate the complete spawned process tree so checkout filters cannot
+ * survive an abort or timeout. */
+function terminateCommandTree(child: ChildProcess, force: boolean, processGroup: boolean): void {
+	if (process.platform === "win32" && child.pid !== undefined) {
+		const fallback = (): void => {
+			try {
+				child.kill(force ? "SIGKILL" : "SIGTERM");
+			} catch {
+				/* process may already be gone */
+			}
+		};
+		const killer = spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+			stdio: "ignore",
+			windowsHide: true,
+		});
+		killer.once("error", fallback);
+		killer.once("close", (code) => {
+			if (code !== 0) fallback();
+		});
+		return;
+	}
+	try {
+		if (processGroup && child.pid !== undefined) {
+			process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM");
+		} else {
+			child.kill(force ? "SIGKILL" : "SIGTERM");
+		}
+	} catch {
+		/* process may already be gone */
+	}
+}
+
+/** Default argument-safe runner. Output is bounded before binary patches enter
+ * memory, and timeout/abort terminates the complete checkout-filter process tree. */
+export const runCommand: CommandRunner = (command, args, options) =>
+	new Promise<CommandResult>((resolveResult, reject) => {
+		if (options.signal?.aborted) {
+			reject(new Error(`Command aborted before start: ${command}`));
+			return;
+		}
+		const usePosixProcessGroup = process.platform !== "win32";
+		const child = spawn(command, [...args], {
+			cwd: options.cwd,
+			shell: false,
+			windowsHide: true,
+			stdio: ["pipe", "pipe", "pipe"],
+			detached: usePosixProcessGroup,
+			...(options.env ? { env: { ...process.env, ...options.env } } : {}),
+		});
+		const stdout: Buffer[] = [];
+		const stderr: Buffer[] = [];
+		const maxOutputBytes = options.maxOutputBytes ?? GIT_OUTPUT_MAX_BYTES;
+		let outputBytes = 0;
+		let finished = false;
+		let failure: Error | undefined;
+		let timeout: ReturnType<typeof setTimeout> | undefined;
+		let forceKillTimer: ReturnType<typeof setTimeout> | undefined;
+
+		const terminate = (): void => {
+			terminateCommandTree(child, false, usePosixProcessGroup);
+			if (!forceKillTimer) {
+				forceKillTimer = setTimeout(
+					() => terminateCommandTree(child, true, usePosixProcessGroup),
+					GIT_COMMAND_KILL_GRACE_MS,
+				);
+				if (typeof forceKillTimer.unref === "function") forceKillTimer.unref();
+			}
+		};
+		const fail = (error: Error): void => {
+			if (failure || finished) return;
+			failure = error;
+			terminate();
+		};
+		const append = (target: Buffer[], chunk: Buffer | string): void => {
+			if (failure || finished) return;
+			const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			outputBytes += value.length;
+			if (outputBytes > maxOutputBytes) {
+				fail(new Error(`Command output exceeded ${maxOutputBytes} bytes: ${command}`));
+				return;
+			}
+			target.push(value);
+		};
+		const onAbort = (): void => fail(new Error(`Command aborted: ${command}`));
+		options.signal?.addEventListener("abort", onAbort, { once: true });
+		if (options.timeoutMs !== undefined && options.timeoutMs > 0) {
+			timeout = setTimeout(
+				() => fail(new Error(`Command timed out after ${options.timeoutMs}ms: ${command}`)),
+				options.timeoutMs,
+			);
+			if (typeof timeout.unref === "function") timeout.unref();
+		}
+
+		child.stdout?.on("data", (chunk: Buffer | string) => append(stdout, chunk));
+		child.stderr?.on("data", (chunk: Buffer | string) => append(stderr, chunk));
+		child.once("error", (error) => fail(error));
+		child.once("close", (code) => {
+			if (finished) return;
+			finished = true;
+			if (timeout) clearTimeout(timeout);
+			if (forceKillTimer) clearTimeout(forceKillTimer);
+			options.signal?.removeEventListener("abort", onAbort);
+			if (failure) {
+				reject(failure);
+				return;
+			}
+			resolveResult({
+				code: code ?? 1,
+				stdout: Buffer.concat(stdout),
+				stderr: Buffer.concat(stderr),
+			});
+		});
+		child.stdin?.once("error", () => undefined);
+		child.stdin?.end(options.input);
+	});

package/src/{recovery.ts → isolation/recovery.ts}

@@ -5,7 +5,7 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { stripVTControlCharacters } from "node:util";
-import { getSubagentsRoot } from "./spawn.ts";
+import { getSubagentsRoot } from "../execution/spawn.ts";
 import { removeWorktreeGroup, worktreeGroupDir, type WorktreeFinalization } from "./worktree.ts";
 
 export const RECOVERY_MANIFEST_FILE_NAME = "pi-subagents-recovery.json";