@gotgenes/pi-subagents 12.1.0 → 13.0.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [13.0.0](https://github.com/gotgenes/pi-packages/compare/pi-subagents-v12.1.0...pi-subagents-v13.0.0) (2026-05-30)
+
+
+### ⚠ BREAKING CHANGES
+
+* the `skills:` custom-agent frontmatter key and skill preloading are removed; children always load the parent's skills.
+* the `extensions:` custom-agent frontmatter key is removed; children always load the parent's extensions.
+* `SpawnOptions.isolated` and the `isolated:` custom-agent frontmatter key are removed. Children always load the parent's extensions.
+
+### Features
+
+* always inherit extensions; make the recursion guard unconditional ([#264](https://github.com/gotgenes/pi-packages/issues/264)) ([3cc682e](https://github.com/gotgenes/pi-packages/commit/3cc682ec401167f922a1f892f6260a10f9fa99f2))
+* always inherit skills; remove noSkills and the skill-preload path ([#264](https://github.com/gotgenes/pi-packages/issues/264)) ([93266ff](https://github.com/gotgenes/pi-packages/commit/93266ff4a204d154b357efac57912330fad240be))
+* remove isolated from the subagent spawn API and lifecycle ([#264](https://github.com/gotgenes/pi-packages/issues/264)) ([d08f340](https://github.com/gotgenes/pi-packages/commit/d08f34066ea472d850423e67349b7a623ca72f42))
+
 ## [12.1.0](https://github.com/gotgenes/pi-packages/compare/pi-subagents-v12.0.0...pi-subagents-v12.1.0) (2026-05-29)
 
 

package/dist/public.d.ts

@@ -25,7 +25,6 @@ interface AgentInvocation {
     modelName?: string;
     thinking?: ThinkingLevel;
     maxTurns?: number;
-    isolated?: boolean;
     inheritContext?: boolean;
     runInBackground?: boolean;
 }
@@ -125,7 +124,6 @@ interface SpawnOptions {
     model?: string;
     maxTurns?: number;
     thinkingLevel?: string;
-    isolated?: boolean;
     inheritContext?: boolean;
     foreground?: boolean;
     bypassQueue?: boolean;

package/docs/architecture/architecture.md

@@ -45,8 +45,6 @@ flowchart TB
         SessionConfig["assembleSessionConfig<br/>(pure assembler)"]
         Prompts["prompts<br/>(system prompt)"]
         Context["context<br/>(parent history)"]
-        SafeFs["safe-fs<br/>(symlink/name guards)"]
-        SkillLoader["skill-loader<br/>(preload skills)"]
         Env["env<br/>(git/platform)"]
         ModelResolver["model-resolver<br/>(fuzzy match)"]
     end
@@ -90,8 +88,7 @@ flowchart TB
     AgentManager --> AgentRunner
     AgentRunner --> SessionConfig
     SessionConfig --> AgentTypeRegistry
-    SessionConfig --> Prompts & SkillLoader & Env
-    SkillLoader --> SafeFs
+    SessionConfig --> Prompts & Env
     AgentTypeRegistry --> DefaultAgents & CustomAgents
     RecordObserver -.->|subscribes| AgentRunner
     UIObserver -.->|subscribes| AgentRunner
@@ -260,8 +257,6 @@ src/
 │   ├── prompts.ts                  system prompt building
 │   ├── content-items.ts            shared message content parsing (tool-call names, assistant content)
 │   ├── context.ts                  parent conversation extraction
-│   ├── safe-fs.ts                  symlink rejection and safe file reads
-│   ├── skill-loader.ts             skill preloading
 │   ├── env.ts                      git/platform detection
 │   ├── model-resolver.ts           fuzzy model name resolution
 │   └── session-dir.ts              session directory derivation
@@ -415,7 +410,7 @@ Key types:
 
 - `SubagentsService` — `spawn`, `getRecord`, `listAgents`, `abort`, `steer`, `waitForAll`, `hasRunning`.
 - `SubagentRecord` — serializable agent snapshot (no live session objects).
-- `SpawnOptions` — `description`, `model`, `maxTurns`, `thinkingLevel`, `isolated`, `inheritContext`, `foreground`, `bypassQueue`.
+- `SpawnOptions` — `description`, `model`, `maxTurns`, `thinkingLevel`, `inheritContext`, `foreground`, `bypassQueue`.
 - `SUBAGENT_EVENTS` — channel constants for `pi.events` subscriptions.
 
 ### Accessor pattern
@@ -482,11 +477,11 @@ Latent extensibility is the deliverable; a vacant hook is not.
 ### Core responsibilities (keep)
 
 - **Agent definitions** — name, model, thinking, system prompt, tools list.
-- **Prompt composition** — system prompt assembly, skill preloading into prompt.
+- **Prompt composition** — system prompt assembly.
 - **Session lifecycle** — create child sessions, bind extensions, run conversation loop, track results.
 - **Concurrency management** — queue, abort, resume, max concurrency.
 - **Recursion guard** — remove pi-subagents' own three tools from child sessions (prevent infinite nesting).
-  With `isolated` removed, children always load the parent's resources, so the guard becomes unconditional rather than gated on `cfg.extensions`.
+  With `isolated` removed (#264), children always load the parent's resources, so the guard is unconditional rather than gated on `cfg.extensions`.
   This is the core defending its own invariant, keyed off its own tool names — not policy.
 - **Lifecycle events** — emit awaited, ordered events when child sessions spawn, are created, complete, and are disposed.
 - **Workspace provider seam** — accept a registered `WorkspaceProvider` and consult it for the child's cwd; default to the parent's cwd when none is registered.
@@ -499,7 +494,8 @@ Latent extensibility is the deliverable; a vacant hook is not.
 - **Worktree isolation** (`worktree.ts`, `worktree-isolation.ts`, `GitWorktreeManager`, the `isolation: "worktree"` spawn mode) — environment policy, not core.
   Git worktrees are one *strategy* for choosing the child's working directory; containers, throwaway tmpdirs, and remote sandboxes are others.
   Evicted to `@gotgenes/pi-subagents-worktrees` (#263), the first consumer of the workspace provider seam.
-- **Extension lifecycle control** (`extensions: false`, `isolated`, `noSkills`) — deny-at-use (the in-child permission layer blocking disallowed tool calls) covers what `isolated` pretended to do for tools.
+- **Extension lifecycle control** (`extensions: false`, `isolated`, `noSkills`) — removed in #264.
+  Deny-at-use (the in-child permission layer blocking disallowed tool calls) covers what `isolated` pretended to do for tools.
   Prevent-load (refusing to bind an extension because of load-time side effects, cost, or true sandboxing) is genuinely generative and is left as a *latent* (un-built) provider seam, added only if a real consumer needs it.
 
 ### Composition model
@@ -536,20 +532,20 @@ This is achieved across phases: Phase 14 (strip policy), Phase 16 (invert depend
 These interfaces carry hidden dependencies that obscure true coupling.
 Bags with 10+ fields are the highest priority for decomposition.
 
-| Interface                   | Fields                                                 | Consumers                                         | Severity  |
-| --------------------------- | ------------------------------------------------------ | ------------------------------------------------- | --------- |
-| `ResolvedSpawnConfig`       | 3 nested                                               | foreground-runner, background-spawner, agent-tool | ✓ done    |
-| `AgentSpawnConfig`          | 13 → 13 (ParentSessionInfo nested)                     | agent-manager (internal)                          | ✓ done    |
-| `RunOptions`                | 9 (`RunContext` nested)                                | agent-runner                                      | ✓ done    |
-| `SessionConfig`             | 8 (flat fields, ToolFilterConfig removed)              | agent-runner (output of assembler)                | ✓ done    |
-| `NotificationDetails`       | 10                                                     | notification                                      | Low (DTO) |
-| `ResourceLoaderOptions`     | 10                                                     | agent-runner (SDK bridge)                         | Low (SDK) |
-| `RunnerIO`                  | split → `EnvironmentIO` (3) + `SessionFactoryIO` (5+1) | agent-runner                                      | ✓ done    |
-| `CreateSessionOptions`      | 9                                                      | agent-runner (SDK bridge)                         | Low (SDK) |
-| `AgentToolDeps`             | 8                                                      | agent-tool                                        | ✓ done    |
-| `AgentMenuDeps`             | 8                                                      | agent-menu                                        | ✓ done    |
-| `ConversationViewerOptions` | 8                                                      | conversation-viewer                               | Low       |
-| `AgentInit`                 | 8                                                      | agent                                             | Low       |
+| Interface                   | Fields                                                      | Consumers                                         | Severity  |
+| --------------------------- | ----------------------------------------------------------- | ------------------------------------------------- | --------- |
+| `ResolvedSpawnConfig`       | 3 nested                                                    | foreground-runner, background-spawner, agent-tool | ✓ done    |
+| `AgentSpawnConfig`          | 13 → 13 (ParentSessionInfo nested)                          | agent-manager (internal)                          | ✓ done    |
+| `RunOptions`                | 9 (`RunContext` nested)                                     | agent-runner                                      | ✓ done    |
+| `SessionConfig`             | 6 (flat fields; extensions/noSkills/extras removed in #264) | agent-runner (output of assembler)                | ✓ done    |
+| `NotificationDetails`       | 10                                                          | notification                                      | Low (DTO) |
+| `ResourceLoaderOptions`     | 10                                                          | agent-runner (SDK bridge)                         | Low (SDK) |
+| `RunnerIO`                  | split → `EnvironmentIO` (3) + `SessionFactoryIO` (5+1)      | agent-runner                                      | ✓ done    |
+| `CreateSessionOptions`      | 9                                                           | agent-runner (SDK bridge)                         | Low (SDK) |
+| `AgentToolDeps`             | 8                                                           | agent-tool                                        | ✓ done    |
+| `AgentMenuDeps`             | 8                                                           | agent-menu                                        | ✓ done    |
+| `ConversationViewerOptions` | 8                                                           | conversation-viewer                               | Low       |
+| `AgentInit`                 | 8                                                           | agent                                             | Low       |
 
 ### Complexity hotspots
 
@@ -604,7 +600,6 @@ interface SpawnExecution {
   thinking: ThinkingLevel | undefined;
   inheritContext: boolean;
   runInBackground: boolean;
-  isolated: boolean;
   agentInvocation: AgentInvocation;
 }
 
@@ -648,7 +643,7 @@ export interface RunContext {
 }
 ```
 
-The remaining `RunOptions` fields (`model`, `maxTurns`, `signal`, `isolated`, `thinkingLevel`, `defaultMaxTurns`, `graceTurns`, `onSessionCreated`) are genuine execution parameters.
+The remaining `RunOptions` fields (`model`, `maxTurns`, `signal`, `thinkingLevel`, `defaultMaxTurns`, `graceTurns`, `onSessionCreated`) are genuine execution parameters.
 `RunOptions` now has 9 fields: 1 nested `context: RunContext` (2 per-call fields) plus 8 flat execution fields.
 
 #### SessionConfig (11 fields → extract ToolFilterConfig) — done ([#168][168])
@@ -781,13 +776,14 @@ Removed `worktree.ts`, `worktree-isolation.ts`, `GitWorktreeManager`, and the `i
   From the release carrying #272, all five workspace types are importable by name: `WorkspaceProvider`, `Workspace`, `WorkspacePrepareContext`, `WorkspaceDisposeOutcome`, and `WorkspaceDisposeResult`.
 - Outcome: git leaves the core; worktree users install one package, everyone else pays nothing.
 
-#### Step 4: Remove `isolated` / `extensions: false` / `noSkills` — [#264]
+#### Step 4: Remove `isolated` / `extensions: false` / `noSkills` — [#264] ✅ Delivered
 
-Children always load the parent's extensions and skills; the recursion guard becomes unconditional.
+Children always load the parent's extensions and skills; the recursion guard is now unconditional.
 Deny-at-use (the in-child permission layer) covers tool restriction; prevent-load is left as a latent provider seam (not shipped).
+The `skills` curation axis collapsed symmetrically with `extensions`: `AgentConfig.skills`, the skill-preload path (`skill-loader.ts`, `safe-fs.ts`, `preloadSkills`, `PromptExtras`), `SessionConfig.{extensions,noSkills,extras}`, and the `isolated:` / `extensions:` / `skills:` custom-agent frontmatter keys are all gone.
 
-- Depends on: Step 1 (deny-at-use over events).
-- Outcome: the `isolated`/`extensions`/`noSkills` axis is gone; one fewer conditional in the guard.
+- Depended on: Step 1 (deny-at-use over events).
+- Outcome: the `isolated`/`extensions`/`noSkills`/`skills` axis is gone; the guard is unconditional.
 
 #### Step 5: Born-complete child execution; dissolve the runner — [#265]
 

package/docs/plans/0264-remove-extension-lifecycle-control.md

@@ -0,0 +1,275 @@
+---
+issue: 264
+issue_title: "Remove isolated / extensions:false / noSkills from core"
+---
+
+# Remove the extension-lifecycle-control axis from the core
+
+## Problem Statement
+
+The core still carries an extension-lifecycle-control axis — `isolated`, `extensions: false`, and `noSkills` — that lets a spawn blanket-disable a child's extensions and skills.
+Per ADR 0002, this is policy that does not belong in a minimal orchestrator.
+Deny-at-use (the in-child permission layer, shipped in Step 1 / #261) already covers what `isolated` pretended to do for tools.
+Prevent-load (refusing to bind an extension for true sandboxing) is genuinely generative and is deliberately left as a *latent, un-built* provider seam — we do not ship a vacant hook.
+
+This is Phase 16, Step 4.
+With the axis gone, children always load the parent's extensions and skills, and the recursion guard — which currently gates on `cfg.extensions` — becomes unconditional.
+
+## Goals
+
+- Remove `isolated` from the spawn API, `SubagentsService`, the lifecycle plumbing, and the config assembler.
+- Remove the `extensions` boolean from `AgentConfig` and the assembler (children always inherit extensions).
+- Remove `noSkills` from the assembler and the resource-loader options.
+- Collapse the skill-curation axis symmetrically: remove `AgentConfig.skills` and the skill-**preload** path (`skill-loader.ts`, `safe-fs.ts`, `preloadSkills`, `PromptExtras`, `extras.skillBlocks`).
+  Children always load Pi's full skill system, exactly as `skills: true` does today.
+- Make the recursion guard unconditional — it always strips `subagent` / `get_subagent_result` / `steer_subagent` from children, keyed off the core's own tool names.
+- This is a **breaking** change: the public `SpawnOptions.isolated` field and the `isolated:` / `extensions:` / `skills:` custom-agent frontmatter keys are removed.
+  Suggested commits use `feat!:`.
+
+## Non-Goals
+
+- Born-complete child execution / dissolving the runner — that is Step 5 (#265) and depends on this step.
+  `RunOptions`, `runAgent`, `ConcreteAgentRunner`, and `Agent.run()` survive this issue (with `isolated` removed from them).
+- Shipping a prevent-load provider seam — ADR 0002 leaves it latent until a real consumer needs it.
+- Changing `builtinToolNames` (the `tools:` frontmatter allowlist) — that is a separate, surviving concern.
+- Changing deny-at-use behavior in `@gotgenes/pi-permission-system` — already in place from #261.
+
+## Background
+
+Relevant modules and how they relate:
+
+- `src/types.ts` — declares `AgentConfig` (`extensions`, `skills`, `isolated`) and `AgentInvocation` (`isolated`).
+- `src/config/default-agents.ts` — the three embedded agents set `extensions: true`, `skills: true`.
+- `src/config/custom-agents.ts` — parses `extensions` / `skills` / `isolated` from `.md` frontmatter via `resolveBoolExtensions` and `inheritField`.
+- `src/config/invocation-config.ts` — merges `isolated` from agent config + tool params.
+- `src/config/agent-types.ts` — an absolute-fallback `AgentConfig` literal sets `extensions: true`, `skills: true`.
+- `src/session/session-config.ts` — `assembleSessionConfig` derives `extensions`/`skills` from `options.isolated`, calls `io.preloadSkills` when `skills` is `string[]`, and computes `noSkills`.
+  Returns `SessionConfig.{ extensions, noSkills, extras }`.
+- `src/session/prompts.ts` — `buildAgentPrompt` injects `extras.skillBlocks` as `# Preloaded Skill:` sections; `PromptExtras` carries only `skillBlocks` (memory was removed in #185).
+- `src/session/skill-loader.ts` — `preloadSkills` reads named skill files from disk; consumes `safe-fs.ts`.
+- `src/session/safe-fs.ts` — symlink/path-traversal guards; **only consumer is `skill-loader.ts`**.
+- `src/lifecycle/agent-runner.ts` — `RunOptions.isolated` flows into the assembler; `createResourceLoader` is called with `noExtensions: !cfg.extensions` and `noSkills: cfg.noSkills`; the recursion guard runs only `if (cfg.extensions)`.
+  `ResourceLoaderOptions` (a local narrow interface, not the SDK type) declares `noExtensions?` / `noSkills?`.
+- `src/lifecycle/agent.ts` — `AgentInit.isolated`, the `_isolated` field, and `isolated:` in the `runner.run(...)` call.
+- `src/lifecycle/agent-manager.ts` — `AgentSpawnConfig.isolated` and its pass-through to `new Agent(...)`.
+- `src/tools/{agent-tool,spawn-config,foreground-runner,background-spawner}.ts` — tool schema `isolated`, `SpawnExecution.isolated`, and pass-through.
+- `src/service/{service,service-adapter}.ts` — public `SpawnOptions.isolated` and its pass-through to the manager.
+- `src/ui/{display,agent-config-editor,agent-creation-wizard}.ts` — `isolated` tag, eject-content emission, and generation-prompt template text.
+- `src/index.ts` — wires `preloadSkills` and `buildAgentPrompt` into `assemblerIO`.
+
+AGENTS.md constraints that apply:
+
+- Conventional Commits; breaking changes use `feat!:`.
+- Do not edit `CHANGELOG.md` (release-please owns it).
+- When removing an export, grep all `src/` and `test/` for the symbol before finalizing (done below).
+- When adding/removing a module, check `docs/architecture/` for layout listings and complexity tables that reference it (done below — Mermaid + tree + field tables).
+- One-sentence-per-line markdown; sequential numbering restarting per heading.
+
+## Design Overview
+
+This is a **symmetric collapse**, not a refactor.
+Two parallel axes leave the core together:
+
+| Axis       | Today                                                          | After                                         |
+| ---------- | -------------------------------------------------------------- | --------------------------------------------- |
+| Extensions | `extensions: true \| false`; `isolated` forces `false`         | always inherit (field gone)                   |
+| Skills     | `skills: true \| string[] \| false`; `isolated` forces `false` | always inherit full skill system (field gone) |
+
+The `skills` field collapses for the same reason `extensions` does: `noSkills` is the single mechanism behind **both** restriction modes (`skills: false` → no skills; `skills: string[]` → only those, preloaded into the prompt with the SDK loader suppressed).
+Removing `noSkills` without removing `AgentConfig.skills` would leave a field that silently stops restricting — a `string[]` agent would get its baked-in skills *plus* the full system.
+ADR 0002 says children always load the parent's skills, which is exactly the `skills: true` path; the other two values are skill curation/policy and leave the core.
+
+### Assembler after collapse
+
+`assembleSessionConfig` loses the `isolated` branch, the `preloadSkills` block, and the `noSkills`/`extensions`/`extras` outputs:
+
+```typescript
+export interface AssemblerOptions {
+  cwd?: string;
+  model?: unknown;
+  thinkingLevel?: ThinkingLevel;
+  // isolated removed
+}
+
+export interface SessionConfig {
+  effectiveCwd: string;
+  systemPrompt: string;
+  toolNames: string[];
+  model: unknown;
+  thinkingLevel: ThinkingLevel | undefined;
+  agentMaxTurns: number | undefined;
+  // extensions, noSkills, extras removed
+}
+```
+
+`AssemblerIO` drops `preloadSkills`, keeping only `buildAgentPrompt` (now called without `extras`).
+
+### Runner after collapse
+
+The resource-loader call drops the two suppression flags, and the guard runs unconditionally:
+
+```typescript
+const loader = deps.io.createResourceLoader({
+  cwd: cfg.effectiveCwd,
+  agentDir,
+  noPromptTemplates: true,
+  noThemes: true,
+  noContextFiles: true,
+  systemPromptOverride: () => cfg.systemPrompt,
+  appendSystemPromptOverride: () => [],
+  // noExtensions, noSkills removed
+});
+// ...
+await session.bindExtensions({});
+// Recursion guard — now unconditional (children always load extensions).
+const filtered = filterActiveTools(session.getActiveToolNames());
+session.setActiveToolsByName(filtered);
+```
+
+`ResourceLoaderOptions` drops `noExtensions?` / `noSkills?` (a local narrow interface — removing the latent fields keeps us honest per ADR 0002's "no vacant hooks").
+
+### Call-site sketch — recursion guard (Tell-Don't-Ask check)
+
+The guard already asks the session for its active tools and tells it the filtered set — unchanged except for removing the `if`.
+No new collaborator, no reach-through; the only structural change is that `cfg.extensions` is no longer consulted, so `SessionConfig` no longer needs to expose it.
+This is a narrowing of the assembler's output contract, which is the desired direction.
+
+### Edge cases
+
+- Append-mode agents: `parentSystemPrompt` still embeds parent context via `systemPromptOverride`; nothing about that path depends on skills/extensions flags.
+- Custom agents with legacy `extensions:` / `skills:` / `isolated:` frontmatter: the keys are silently ignored after this change (no parse, no warning).
+  `resolveBoolExtensions` already warned on the deprecated allowlist syntax; that warning path is removed with the parser.
+- The absolute-fallback `AgentConfig` in `agent-types.ts` drops `extensions`/`skills` like every other construction site.
+
+## Module-Level Changes
+
+### Source — `isolated` axis
+
+- `src/types.ts` — remove `AgentConfig.isolated`, `AgentInvocation.isolated`.
+- `src/config/invocation-config.ts` — remove `isolated` from `AgentInvocationParams` and the return object.
+- `src/config/custom-agents.ts` — remove the `isolated:` frontmatter parse.
+- `src/session/session-config.ts` — remove `AssemblerOptions.isolated` and the `options.isolated ? false : ...` derivation (read `agentConfig.extensions`/`agentConfig.skills` directly, for now).
+- `src/lifecycle/agent-runner.ts` — remove `RunOptions.isolated` and the `isolated:` argument passed to `assembleSessionConfig`.
+- `src/lifecycle/agent.ts` — remove `AgentInit.isolated`, the `_isolated` field + constructor assignment, and `isolated:` in the `runner.run(...)` call.
+- `src/lifecycle/agent-manager.ts` — remove `AgentSpawnConfig.isolated` and its pass-through to `new Agent(...)`.
+- `src/tools/agent-tool.ts` — remove the `isolated` schema property.
+- `src/tools/spawn-config.ts` — remove `SpawnExecution.isolated`, the `const isolated = resolvedConfig.isolated`, `isolated` in `agentInvocation`, and `isolated` in the `execution` return.
+- `src/tools/foreground-runner.ts` / `src/tools/background-spawner.ts` — remove `isolated: execution.isolated`.
+- `src/service/service.ts` — remove `SpawnOptions.isolated`.
+- `src/service/service-adapter.ts` — remove `isolated: options?.isolated` from the `manager.spawn(...)` call.
+- `src/ui/display.ts` — remove `if (invocation.isolated) tags.push("isolated")` and the `isolated` mention in the JSDoc example.
+- `src/ui/agent-config-editor.ts` — remove the `isolated: true` line from `buildEjectContent`.
+- `src/ui/agent-creation-wizard.ts` — remove the `isolated:` template line and the "Set isolated: true …" guideline.
+
+### Source — `extensions` axis + unconditional guard
+
+- `src/types.ts` — remove `AgentConfig.extensions`.
+- `src/config/default-agents.ts` — remove `extensions: true` from all three agents.
+- `src/config/agent-types.ts` — remove `extensions: true` from the absolute-fallback literal.
+- `src/config/custom-agents.ts` — remove the `extensions:` frontmatter parse and delete `resolveBoolExtensions`.
+- `src/session/session-config.ts` — remove `SessionConfig.extensions` and stop assigning it.
+- `src/lifecycle/agent-runner.ts` — remove `ResourceLoaderOptions.noExtensions`, drop `noExtensions` from the `createResourceLoader` call, and make the recursion guard unconditional (delete `if (cfg.extensions)`); update the explanatory comment.
+- `src/ui/agent-config-editor.ts` — remove the `extensions: false` line from `buildEjectContent`.
+- `src/ui/agent-creation-wizard.ts` — remove the `extensions:` template line.
+
+### Source — `skills` axis + preload path
+
+- `src/types.ts` — remove `AgentConfig.skills`.
+- `src/config/default-agents.ts` — remove `skills: true` from all three agents.
+- `src/config/agent-types.ts` — remove `skills: true` from the absolute-fallback literal.
+- `src/config/custom-agents.ts` — remove the `skills:` frontmatter parse and delete `inheritField` (its only remaining callers are `skills`/`extensions`; `csvList`, `parseCsvField`, `str`, `nonNegativeInt` stay — `csvList` still serves `tools:`).
+- `src/session/session-config.ts` — remove `AssemblerIO.preloadSkills`, `SessionConfig.noSkills`, `SessionConfig.extras`, the `extras`/`preloadSkills` block, and the `extras` argument to `buildAgentPrompt`.
+- `src/session/prompts.ts` — remove `PromptExtras`, the `extras` parameter, and the `extrasSuffix` logic.
+- `src/session/skill-loader.ts` — **delete** (export `preloadSkills`, `PreloadedSkill`).
+- `src/session/safe-fs.ts` — **delete** (sole consumer was `skill-loader.ts`).
+- `src/lifecycle/agent-runner.ts` — remove `ResourceLoaderOptions.noSkills` and drop `noSkills` from the `createResourceLoader` call.
+- `src/index.ts` — remove the `preloadSkills` import and its `assemblerIO.preloadSkills` wiring.
+- `src/ui/agent-config-editor.ts` — remove the `skills: false` / `skills: <list>` lines from `buildEjectContent`.
+- `src/ui/agent-creation-wizard.ts` — remove the `skills:` template line.
+
+### Tests
+
+- `test/session/skill-loader.test.ts` — **delete**.
+- `test/session/safe-fs.test.ts` — **delete**.
+- `test/session/session-config.test.ts` — remove the `isolated`-mode `describe`, the `noSkills` assertions, and the preload tests; keep model-resolution and prompt-assembly assertions.
+- `test/session/prompts.test.ts` — remove `isolated`/`extensions`/`skills` from `AgentConfig` fixtures and any `skillBlocks`/`extras` cases.
+- `test/config/invocation-config.test.ts` — remove `isolated` cases and fixture fields.
+- `test/config/custom-agents.test.ts` — remove `extensions` / `skills` / `isolated` frontmatter-parsing tests.
+- `test/config/agent-types.test.ts` — remove `extensions` / `skills` / `isolated` from fixtures.
+- `test/lifecycle/agent-runner-extension-tools.test.ts` — remove `extensions`/`skills`/`isolated` from the mock config; delete the "extensions: false skips the filter entirely" test; keep/adjust the post-bind guard tests to assert the guard runs unconditionally.
+- `test/tools/spawn-config.test.ts` — remove the "sets isolated from params" test and `isolated` fixture fields.
+- `test/tools/background-spawner.test.ts` / `test/tools/foreground-runner.test.ts` — remove `isolated` from fixtures and `agentInvocation` assertions.
+- `test/tools/result-renderer.test.ts` — remove the `"isolated"` tag case.
+- `test/ui/agent-config-editor.test.ts` — remove the `isolated` / `extensions: false` eject-emission tests.
+- `test/display.test.ts` — remove `extensions`/`skills` from `AgentConfig` fixtures.
+- `test/helpers/runner-io.ts` — remove `extensions`/`skills`/`isolated` from `DEFAULT_AGENT_CONFIG`.
+- `test/helpers/runner-io.test.ts` — remove the `config.extensions`/`config.skills` assertions and the `extensions: true` override case.
+- `test/helpers/ui-stubs.ts` — remove `extensions: true` / `skills: true` from the stub `AgentConfig`.
+
+### Docs
+
+- `docs/architecture/architecture.md` —
+  remove the `SafeFs` and `SkillLoader` nodes from the session-domain Mermaid subgraph;
+  remove `safe-fs.ts` and `skill-loader.ts` from the directory-tree listing;
+  drop `isolated` from the `SpawnOptions` field list (≈ line 418) and the `RunOptions` field list (≈ line 651);
+  mark Phase 16 Step 4 (#264) done in the roadmap and update the "Children always load the parent's extensions and skills" note;
+  reflect the smaller session domain (8 → 6 modules).
+- `.pi/skills/package-pi-subagents/SKILL.md` — update the Session domain row (module count 8 → 6, drop `safe-fs.ts` / `skill-loader.ts` from the file list).
+
+## Test Impact Analysis
+
+1. New coverage enabled — minimal (this is a removal).
+   The one behavioral assertion worth strengthening: the post-bind recursion guard now runs **unconditionally**.
+   Update `agent-runner-extension-tools.test.ts` so a case that previously relied on `extensions: true` instead asserts the guard always calls `setActiveToolsByName` and always excludes `EXCLUDED_TOOL_NAMES`, with no config dependence.
+2. Tests that become redundant and are removed —
+   `skill-loader.test.ts` and `safe-fs.test.ts` (modules deleted);
+   the `isolated`-mode `describe` in `session-config.test.ts`;
+   the "extensions: false skips the filter entirely" case;
+   `isolated` parameter tests in `spawn-config.test.ts` / `invocation-config.test.ts`;
+   `extensions` / `skills` frontmatter-parsing tests in `custom-agents.test.ts`.
+3. Tests that must stay (genuinely exercise surviving layers) —
+   prompt assembly (`prompts.test.ts`, minus `extras`);
+   model resolution in `session-config.test.ts`;
+   the post-bind guard ordering tests (adjusted, not removed);
+   custom-agent `tools:` parsing (`csvList` survives).
+
+## TDD Order
+
+Each cycle ends green (`pnpm run check` + `pnpm -r run test`).
+Because removing a field from `AgentConfig` / `AgentInvocation` breaks every reader and every object-literal construction site at once (TS excess-property + property-access), each cycle folds its test updates into the same commit (per the testing skill's removal rule).
+The three axes are split so each commit stays reviewable and leaves the repo compiling.
+
+1. Remove the `isolated` axis end-to-end.
+   Surface: `types.ts` (`AgentConfig.isolated`, `AgentInvocation.isolated`), `invocation-config.ts`, `custom-agents.ts` (parse only), `session-config.ts` (`AssemblerOptions.isolated` + derivation), `agent-runner.ts` (`RunOptions.isolated`), `agent.ts`, `agent-manager.ts`, `tools/*`, `service*.ts`, `ui/*` (isolated bits), plus all listed tests.
+   After: `extensions`/`skills`/`noSkills` still function; the assembler reads `agentConfig.extensions`/`agentConfig.skills` directly.
+   Commit: `feat!: remove isolated from the subagent spawn API and lifecycle (#264)`.
+2. Remove the `extensions` axis; make the recursion guard unconditional.
+   Surface: `types.ts` (`AgentConfig.extensions`), `default-agents.ts`, `agent-types.ts` (fallback), `custom-agents.ts` (parse + delete `resolveBoolExtensions`), `session-config.ts` (`SessionConfig.extensions`), `agent-runner.ts` (`ResourceLoaderOptions.noExtensions`, drop `noExtensions` arg, unconditional guard), `ui/agent-config-editor.ts` + `ui/agent-creation-wizard.ts` (extensions bits), plus tests (including the guard-always-runs update and deleting the "skips filter" case).
+   Commit: `feat!: always inherit extensions; make the recursion guard unconditional (#264)`.
+3. Remove the `skills` axis, `noSkills`, and the skill-preload path.
+   Surface: `types.ts` (`AgentConfig.skills`), `default-agents.ts`, `agent-types.ts` (fallback), `custom-agents.ts` (parse + delete `inheritField`), `session-config.ts` (`AssemblerIO.preloadSkills`, `SessionConfig.noSkills`/`extras`, preload block, `buildAgentPrompt` call), `prompts.ts` (`PromptExtras`/`extras`/`extrasSuffix`), delete `skill-loader.ts` + `safe-fs.ts`, `agent-runner.ts` (`ResourceLoaderOptions.noSkills`, drop arg), `index.ts` (wiring), `ui/*` (skills bits), plus tests (delete `skill-loader.test.ts` + `safe-fs.test.ts`).
+   Commit: `feat!: always inherit skills; remove noSkills and the skill-preload path (#264)`.
+4. Update the architecture doc and package skill.
+   Surface: `docs/architecture/architecture.md` (Mermaid session subgraph, directory tree, `SpawnOptions`/`RunOptions` field lists, roadmap status), `.pi/skills/package-pi-subagents/SKILL.md` (session domain row).
+   Commit: `docs: record removal of the extension-lifecycle-control axis (#264)`.
+
+## Risks and Mitigations
+
+- Risk: `resolveBoolExtensions` / `inheritField` deletion removes a helper still used elsewhere.
+  Mitigation: greps confirm `resolveBoolExtensions` is used only by the removed `extensions` parse, and `inheritField` only by `extensions`/`skills`; `csvList`/`parseCsvField` (used by `tools:`) stay.
+- Risk: deleting `safe-fs.ts` orphans an import.
+  Mitigation: grep confirms `skill-loader.ts` is its sole consumer; `safe-fs.test.ts` is deleted in the same cycle.
+- Risk: removing `SpawnOptions.isolated` breaks a published consumer of the service.
+  Mitigation: this is an intentional breaking change (ADR 0002); `feat!:` triggers a major bump via release-please.
+  The public type surface is verified by `pnpm run verify:public-types` after Step 3.
+- Risk: skill behavior silently changes for agents that relied on `skills: string[]` curation.
+  Mitigation: documented in Goals as breaking; children now inherit the full skill system, which is strictly more capable, and deny-at-use governs what they may act on.
+- Risk: a test file is touched in multiple cycles (e.g. `runner-io.ts`).
+  Mitigation: each cycle removes only the field it owns; ordering is fixed (isolated → extensions → skills) so no cycle leaves a dangling reference.
+
+## Open Questions
+
+- Should custom-agent `.md` files with now-defunct `extensions:` / `skills:` / `isolated:` frontmatter emit a one-time deprecation warning, or be silently ignored?
+  Deferred: silent-ignore matches the Phase 14 precedent for the removed `disallowed_tools` field; revisit only if users report confusion.
+- Does `verify:public-types` need a new negative assertion that `isolated` is absent from `SpawnOptions`?
+  Deferred to Step 3 implementation — the existing consumer type-check will fail if a stale field lingers.

package/docs/retro/0264-remove-extension-lifecycle-control.md

@@ -0,0 +1,48 @@
+---
+issue: 264
+issue_title: "Remove isolated / extensions:false / noSkills from core"
+---
+
+# Retro: #264 — Remove isolated / extensions:false / noSkills from core
+
+## Stage: Planning (2026-05-30T00:09:21Z)
+
+### Session summary
+
+Planned Phase 16, Step 4: removing the extension-lifecycle-control axis (`isolated`, `extensions: false`, `noSkills`) from the pi-subagents core per ADR 0002.
+Confirmed all three prerequisite Phase 16 steps (#261, #262, #263) are closed, so the explicit "deny-at-use" dependency is satisfied.
+Produced a four-cycle TDD plan (`isolated` → `extensions` → `skills`/`noSkills`/preload → docs) and committed it.
+
+### Observations
+
+- Scope expansion decided with the user: the issue names only `isolated` / `extensions: false` / `noSkills`, but `noSkills` is the single mechanism behind **both** skill-restriction modes (`skills: false` and `skills: string[]` preload).
+  Removing `noSkills` without also removing `AgentConfig.skills` would leave a field that silently stops restricting.
+  Chose the **collapse-skills-fully** option (symmetric with `extensions`): retire `AgentConfig.skills`, `skill-loader.ts`, `safe-fs.ts` (sole consumer was the skill loader), `preloadSkills`, `PromptExtras`, and `extras.skillBlocks`.
+  Children always inherit Pi's full skill system — the `skills: true` path.
+- The recursion guard's `if (cfg.extensions)` gate is removed in the `extensions` cycle (cycle 2), since `SessionConfig.extensions` disappears there.
+  A guard-always-runs assertion replaces the deleted "extensions: false skips the filter entirely" test.
+- This is a **breaking** change (`feat!:`): public `SpawnOptions.isolated` and the `isolated:` / `extensions:` / `skills:` custom-agent frontmatter keys are removed.
+  Custom agents with legacy frontmatter will silently ignore those keys (matches the Phase 14 precedent for `disallowed_tools`).
+- Sequencing note surfaced to the user: some `isolated`-threading removed here (`RunOptions.isolated`, `Agent.run()` plumbing) is structure that Step 5 (#265, dissolve the runner) will delete anyway — small, unavoidable, and #265 depends on this step, so no reordering benefit.
+- Helper-file churn accepted: `test/helpers/runner-io.ts` is touched in all three removal cycles (one field per cycle); ordering is fixed (`isolated` → `extensions` → `skills`) so no cycle leaves a dangling reference.
+- Doc updates identified: `docs/architecture/architecture.md` (Mermaid session subgraph, directory tree, `SpawnOptions`/`RunOptions` field lists, roadmap status) and the `package-pi-subagents` SKILL.md session-domain row (8 → 6 modules).
+
+## Stage: Implementation — TDD (2026-05-30T00:38:00Z)
+
+### Session summary
+
+Executed all four plan cycles (`isolated` → `extensions` + unconditional guard → `skills`/`noSkills`/preload → docs) as three `feat!:` commits plus one `docs:` commit.
+The extension-lifecycle-control axis and the `skills` curation axis are gone; children always inherit the parent's extensions and full skill system, and the recursion guard is unconditional.
+Test count went 1016 → 951 (−65): deleted `skill-loader.test.ts` and `safe-fs.test.ts`, plus removed isolated/extensions/skills/preload-specific cases; `check`, `lint`, `fallow dead-code`, and `verify:public-types` all green.
+
+### Observations
+
+- The plan's cycle split held up cleanly.
+  The only interleaving friction was `test/config/custom-agents.test.ts`, where `extensions` and `skills` assertions shared the same `it` blocks.
+  Handled it by retitling the shared tests to skills-only in cycle 2 (keeping skills compiling/passing), then deleting them in cycle 3 — no dangling references between commits.
+- BSD `sed` (macOS) does not support `\|` alternation in basic regex; the standalone-fixture-line deletions needed `sed -E`.
+  Worth remembering for future bulk fixture removals.
+- Two in-scope judgment calls beyond the literal plan: (1) kept the generic tag-rendering test in `result-renderer.test.ts` by swapping the example tag `"isolated"` → `"inherit context"` rather than deleting coverage; (2) removed the now-unused `vi` import from `custom-agents.test.ts` after dropping the extensions-deprecation-warning test.
+- The `spawn-config.test.ts` `agentInvocation` snapshot carried a stale `isolation: undefined` leftover (from the #263 worktree eviction) that `toEqual` had been silently ignoring; removed it alongside `isolated: false` for a clean exact-match assertion.
+- `verify:public-types` confirmed the breaking `SpawnOptions.isolated` removal type-checks against an external consumer; no lockfile changes; `dist/` correctly gitignored after the type-bundle build.
+- Pre-completion reviewer: **PASS** — both acceptance criteria code-verified, all deterministic checks green, 6 Mermaid diagrams render, docs accurate, zero dead code.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-subagents",
-  "version": "12.1.0",
+  "version": "13.0.0",
   "type": "module",
   "exports": {
     ".": {

package/src/config/agent-types.ts

@@ -114,8 +114,6 @@ export class AgentTypeRegistry implements AgentConfigLookup {
       displayName: "Agent",
       description: "General-purpose agent for complex, multi-step tasks",
       builtinToolNames: BUILTIN_TOOL_NAMES,
-      extensions: true,
-      skills: true,
       systemPrompt: "",
       promptMode: "append",
     };

package/src/config/custom-agents.ts

@@ -58,8 +58,6 @@ function loadFromDir(dir: string, agents: Map<string, AgentConfig>, source: "pro
       displayName: str(fm.display_name),
       description: str(fm.description) ?? name,
       builtinToolNames: csvList(fm.tools, BUILTIN_TOOL_NAMES),
-      extensions: resolveBoolExtensions(fm.extensions ?? fm.inherit_extensions),
-      skills: inheritField(fm.skills ?? fm.inherit_skills),
       model: str(fm.model),
       thinking: str(fm.thinking) as ThinkingLevel | undefined,
       maxTurns: nonNegativeInt(fm.max_turns),
@@ -67,7 +65,6 @@ function loadFromDir(dir: string, agents: Map<string, AgentConfig>, source: "pro
       promptMode: fm.prompt_mode === "append" ? "append" : "replace",
       inheritContext: fm.inherit_context != null ? fm.inherit_context === true : undefined,
       runInBackground: fm.run_in_background != null ? fm.run_in_background === true : undefined,
-      isolated: fm.isolated != null ? fm.isolated === true : undefined,
       enabled: fm.enabled !== false,  // default true; explicitly false disables
       source,
     });
@@ -107,30 +104,3 @@ function csvList(val: unknown, defaults: string[]): string[] {
   if (val === undefined || val === null) return defaults;
   return parseCsvField(val) ?? [];
 }
-
-/**
- * Resolve the `extensions` field to a boolean.
- * CSV/array values (legacy allowlist syntax) are coerced to `true` with a warning.
- */
-function resolveBoolExtensions(val: unknown): boolean {
-  const result = inheritField(val);
-  if (Array.isArray(result)) {
-    console.warn(
-      "[pi-subagents] extensions allowlist syntax is deprecated — treating as \"true\" (inherit all).\n" +
-        "Use \"permission:\" frontmatter in pi-permission-system for per-tool access control.",
-    );
-    return true;
-  }
-  return result;
-}
-
-/**
- * Parse an inherit field (extensions, skills).
- * omitted/true → true (inherit all); false/"none"/empty → false; csv → listed names.
- */
-function inheritField(val: unknown): true | string[] | false {
-  if (val === undefined || val === null || val === true) return true;
-  if (val === false || val === "none") return false;
-  const items = csvList(val, []);
-  return items.length > 0 ? items : false;
-}

package/src/config/default-agents.ts

@@ -16,10 +16,8 @@ export const DEFAULT_AGENTS: Map<string, AgentConfig> = new Map([
       displayName: "Agent",
       description: "General-purpose agent for complex, multi-step tasks",
       // builtinToolNames omitted — means "all available tools" (resolved at lookup time)
-      // inheritContext / runInBackground / isolated omitted — strategy fields, callers decide per-call.
+      // inheritContext / runInBackground omitted — strategy fields, callers decide per-call.
       // Setting them to false would lock callsite intent (see resolveAgentInvocationConfig in invocation-config.ts).
-      extensions: true,
-      skills: true,
       systemPrompt: "",
       promptMode: "append",
       isDefault: true,
@@ -32,8 +30,6 @@ export const DEFAULT_AGENTS: Map<string, AgentConfig> = new Map([
       displayName: "Explore",
       description: "Fast codebase exploration agent (read-only)",
       builtinToolNames: READ_ONLY_TOOLS,
-      extensions: true,
-      skills: true,
       model: "anthropic/claude-haiku-4-5-20251001",
       systemPrompt: `# CRITICAL: READ-ONLY MODE - NO FILE MODIFICATIONS
 You are a file search specialist. You excel at thoroughly navigating and exploring codebases.
@@ -74,8 +70,6 @@ Use Bash ONLY for read-only operations: ls, git status, git log, git diff, find,
       displayName: "Plan",
       description: "Software architect for implementation planning (read-only)",
       builtinToolNames: READ_ONLY_TOOLS,
-      extensions: true,
-      skills: true,
       systemPrompt: `# CRITICAL: READ-ONLY MODE - NO FILE MODIFICATIONS
 You are a software architect and planning specialist.
 Your role is EXCLUSIVELY to explore the codebase and design implementation plans.

package/src/config/invocation-config.ts

@@ -6,7 +6,6 @@ interface AgentInvocationParams {
   max_turns?: number;
   run_in_background?: boolean;
   inherit_context?: boolean;
-  isolated?: boolean;
 }
 
 export function resolveAgentInvocationConfig(
@@ -19,7 +18,6 @@ export function resolveAgentInvocationConfig(
   maxTurns?: number;
   inheritContext: boolean;
   runInBackground: boolean;
-  isolated: boolean;
 } {
   return {
     modelInput: agentConfig?.model ?? params.model,
@@ -28,6 +26,5 @@ export function resolveAgentInvocationConfig(
     maxTurns: agentConfig?.maxTurns ?? params.max_turns,
     inheritContext: agentConfig?.inheritContext ?? params.inherit_context ?? false,
     runInBackground: agentConfig?.runInBackground ?? params.run_in_background ?? false,
-    isolated: agentConfig?.isolated ?? params.isolated ?? false,
   };
 }

package/src/index.ts

@@ -38,7 +38,6 @@ import { detectEnv } from "#src/session/env";
 import { resolveModel } from "#src/session/model-resolver";
 import { buildAgentPrompt } from "#src/session/prompts";
 import { deriveSubagentSessionDir } from "#src/session/session-dir";
-import { preloadSkills } from "#src/session/skill-loader";
 import { SettingsManager } from "#src/settings";
 import { AgentTool } from "#src/tools/agent-tool";
 import { GetResultTool } from "#src/tools/get-result-tool";
@@ -143,7 +142,6 @@ export default function (pi: ExtensionAPI) {
       createSettingsManager: (cwd, dir) => SdkSettingsManager.create(cwd, dir),
       createSession: (opts) => createAgentSession(opts as any),
       assemblerIO: {
-        preloadSkills,
         buildAgentPrompt,
       },
     },

package/src/lifecycle/agent-manager.ts

@@ -41,7 +41,6 @@ export interface AgentSpawnConfig {
   description: string;
   model?: Model<any>;
   maxTurns?: number;
-  isolated?: boolean;
   inheritContext?: boolean;
   thinkingLevel?: ThinkingLevel;
   isBackground?: boolean;
@@ -149,7 +148,6 @@ export class AgentManager {
       prompt,
       model: options.model,
       maxTurns: options.maxTurns,
-      isolated: options.isolated,
       thinkingLevel: options.thinkingLevel,
       parentSession: options.parentSession,
       signal: options.signal,

package/src/lifecycle/agent-runner.ts

@@ -55,8 +55,6 @@ export interface SessionManagerLike {
 export interface ResourceLoaderOptions {
   cwd: string;
   agentDir: string;
-  noExtensions?: boolean;
-  noSkills?: boolean;
   noPromptTemplates?: boolean;
   noThemes?: boolean;
   noContextFiles?: boolean;
@@ -148,7 +146,6 @@ export interface RunOptions {
   model?: Model<any>;
   maxTurns?: number;
   signal?: AbortSignal;
-  isolated?: boolean;
   thinkingLevel?: ThinkingLevel;
   /** Called once after session creation - session delivery mechanism. */
   onSessionCreated?: (session: AgentSession) => void;
@@ -283,7 +280,6 @@ export async function runAgent(
     },
     {
       cwd: options.context.cwd,
-      isolated: options.isolated,
       model: options.model,
       thinkingLevel: options.thinkingLevel,
     },
@@ -294,17 +290,15 @@ export async function runAgent(
 
   const agentDir = deps.io.getAgentDir();
 
-  // Load extensions/skills: true → load; false → don't.
+  // Children always load the parent's extensions and skills.
   // Suppress AGENTS.md/CLAUDE.md and APPEND_SYSTEM.md - upstream's
   // buildSystemPrompt() re-appends both AFTER systemPromptOverride, which
-  // would defeat prompt_mode: replace and isolated: true. Parent context, if
+  // would defeat prompt_mode: replace. Parent context, if
   // wanted, reaches the subagent via prompt_mode: append (parentSystemPrompt
   // is embedded in systemPromptOverride) or inherit_context (conversation).
   const loader = deps.io.createResourceLoader({
     cwd: cfg.effectiveCwd,
     agentDir,
-    noExtensions: !cfg.extensions,
-    noSkills: cfg.noSkills,
     noPromptTemplates: true,
     noThemes: true,
     noContextFiles: true,
@@ -348,12 +342,10 @@ export async function runAgent(
 
   // Apply recursion guard: remove our own tools from the child's active set.
   // Runs after bindExtensions so extension-registered tools are included in the
-  // post-bind active set. Only needed when extensions are loaded (extensions: false
-  // means no extension tools were registered, so the guard is a no-op).
-  if (cfg.extensions) {
-    const filtered = filterActiveTools(session.getActiveToolNames());
-    session.setActiveToolsByName(filtered);
-  }
+  // post-bind active set. Unconditional: children always load the parent's
+  // extensions, so the guard must always strip our dispatch tools.
+  const filtered = filterActiveTools(session.getActiveToolNames());
+  session.setActiveToolsByName(filtered);
 
   options.onSessionCreated?.(session);
 

package/src/lifecycle/agent.ts

@@ -81,7 +81,6 @@ export interface AgentInit {
 	prompt?: string;
 	model?: Model<any>;
 	maxTurns?: number;
-	isolated?: boolean;
 	thinkingLevel?: ThinkingLevel;
 	parentSession?: ParentSessionInfo;
 	isBackground?: boolean;
@@ -140,7 +139,6 @@ export class Agent {
 	private readonly _prompt?: string;
 	private readonly _model?: Model<any>;
 	private readonly _maxTurns?: number;
-	private readonly _isolated?: boolean;
 	private readonly _thinkingLevel?: ThinkingLevel;
 	private readonly _parentSession?: ParentSessionInfo;
 	private readonly _signal?: AbortSignal;
@@ -198,7 +196,6 @@ export class Agent {
 		this._prompt = init.prompt;
 		this._model = init.model;
 		this._maxTurns = init.maxTurns;
-		this._isolated = init.isolated;
 		this._thinkingLevel = init.thinkingLevel;
 		this._parentSession = init.parentSession;
 		this._signal = init.signal;
@@ -261,7 +258,6 @@ export class Agent {
 				maxTurns: this._maxTurns,
 				defaultMaxTurns: runConfig?.defaultMaxTurns,
 				graceTurns: runConfig?.graceTurns,
-				isolated: this._isolated,
 				thinkingLevel: this._thinkingLevel,
 				signal: this.abortController.signal,
 				onSessionCreated: (session) => {

package/src/service/service-adapter.ts

@@ -66,7 +66,6 @@ export class SubagentsServiceAdapter implements SubagentsService {
       model,
       maxTurns: options?.maxTurns,
       thinkingLevel: options?.thinkingLevel,
-      isolated: options?.isolated,
       inheritContext: options?.inheritContext,
       bypassQueue: options?.bypassQueue,
       isBackground,

package/src/service/service.ts

@@ -61,7 +61,6 @@ export interface SpawnOptions {
   model?: string;
   maxTurns?: number;
   thinkingLevel?: string;
-  isolated?: boolean;
   inheritContext?: boolean;
   foreground?: boolean;
   bypassQueue?: boolean;

package/src/session/prompts.ts

@@ -5,12 +5,6 @@
 import type { EnvInfo } from "#src/session/env";
 import type { AgentPromptConfig } from "#src/types";
 
-/** Extra sections to inject into the system prompt (skills, etc.). */
-export interface PromptExtras {
-  /** Preloaded skill contents to inject. */
-  skillBlocks?: { name: string; content: string }[];
-}
-
 /**
  * Build the system prompt for an agent from its config.
  *
@@ -25,14 +19,12 @@ export interface PromptExtras {
  * inherited content so the stable prefix is cacheable by the LLM's KV cache.
  *
  * @param parentSystemPrompt  The parent agent's effective system prompt (for append mode).
- * @param extras  Optional extra sections to inject (memory, preloaded skills).
  */
 export function buildAgentPrompt(
   config: AgentPromptConfig,
   cwd: string,
   env: EnvInfo,
   parentSystemPrompt?: string,
-  extras?: PromptExtras,
 ): string {
   const activeAgentTag = `<active_agent name="${config.name}"/>\n\n`;
 
@@ -41,18 +33,6 @@ Working directory: ${cwd}
 ${env.isGitRepo ? `Git repository: yes\nBranch: ${env.branch}` : "Not a git repository"}
 Platform: ${env.platform}`;
 
-  // Build optional extras suffix
-  const extraSections: string[] = [];
-  if (extras?.skillBlocks?.length) {
-    for (const skill of extras.skillBlocks) {
-      extraSections.push(
-        `\n# Preloaded Skill: ${skill.name}\n${skill.content}`,
-      );
-    }
-  }
-  const extrasSuffix =
-    extraSections.length > 0 ? "\n\n" + extraSections.join("\n") : "";
-
   if (config.promptMode === "append") {
     const identity = parentSystemPrompt ?? genericBase;
 
@@ -85,8 +65,7 @@ You are operating as a sub-agent invoked to handle a specific task.
       "\n\n" +
       activeAgentTag +
       envBlock +
-      customSection +
-      extrasSuffix
+      customSection
     );
   }
 
@@ -97,7 +76,7 @@ You have been invoked to handle a specific task autonomously.
 ${envBlock}`;
 
   return (
-    activeAgentTag + replaceHeader + "\n\n" + config.systemPrompt + extrasSuffix
+    activeAgentTag + replaceHeader + "\n\n" + config.systemPrompt
   );
 }
 

package/src/session/session-config.ts

@@ -12,8 +12,6 @@
 
 import type { AgentConfigLookup } from "#src/config/agent-types";
 import type { EnvInfo } from "#src/session/env";
-import type { PromptExtras } from "#src/session/prompts";
-import type { PreloadedSkill } from "#src/session/skill-loader";
 import type { AgentPromptConfig, SubagentType, ThinkingLevel } from "#src/types";
 
 // ── Public interfaces ────────────────────────────────────────────────────────
@@ -21,19 +19,17 @@ import type { AgentPromptConfig, SubagentType, ThinkingLevel } from "#src/types"
 /**
  * IO collaborators injected into `assembleSessionConfig`.
  *
- * Bundling the four IO-touching (or promptly testable) functions into a single
+ * Bundling the IO-touching (or promptly testable) function into a single
  * interface keeps the assembler free of direct module imports and makes it
  * trivially testable without `vi.mock()` — callers inject real implementations
  * at the edge (`agent-runner.ts`) or stubs in tests.
  */
 export interface AssemblerIO {
-  preloadSkills: (skills: string[], cwd: string) => PreloadedSkill[];
   buildAgentPrompt: (
     config: AgentPromptConfig,
     cwd: string,
     env: EnvInfo,
     parentPrompt?: string,
-    extras?: PromptExtras,
   ) => string;
 }
 
@@ -67,8 +63,6 @@ export interface AssemblerContext {
 export interface AssemblerOptions {
   /** Override working directory (e.g. for worktree isolation). */
   cwd?: string;
-  /** When true, forces extensions and skills to false. */
-  isolated?: boolean;
   /** Explicit model override — wins over agentConfig.model and parent model. */
   model?: unknown;
   /** Explicit thinking level — wins over agentConfig.thinking. */
@@ -87,8 +81,6 @@ export interface SessionConfig {
   systemPrompt: string;
   /** Built-in tool name allowlist for this agent type. */
   toolNames: string[];
-  /** Resolved extensions setting: true = inherit all, false = none. */
-  extensions: boolean;
   /**
    * Resolved model instance (undefined → use parent model as passed to SDK).
    * Opaque handle — the assembler passes it through without inspection.
@@ -97,10 +89,6 @@ export interface SessionConfig {
   model: unknown;
   /** Resolved thinking level (undefined → inherit from session). */
   thinkingLevel: ThinkingLevel | undefined;
-  /** Whether to skip skill loading in the resource loader (`noSkills` flag). */
-  noSkills: boolean;
-  /** Prompt extras (memory block, preloaded skill blocks) — for transparency. */
-  extras: PromptExtras;
   /** Per-agent configured max turns (from agentConfig.maxTurns). */
   agentMaxTurns: number | undefined;
 }
@@ -150,7 +138,7 @@ function resolveDefaultModel(
  *
  * @param type       The subagent type name (case-insensitive registry lookup).
  * @param ctx        Narrow context from the parent session.
- * @param options    Per-call overrides (cwd, isolated, model, thinkingLevel).
+ * @param options    Per-call overrides (cwd, model, thinkingLevel).
  * @param env        Pre-resolved environment info from `detectEnv()`.
  * @param registry   Agent config lookup — provides resolveAgentConfig and getToolNamesForType.
  * @param io         IO collaborators (skill loader, memory builder, prompt builder).
@@ -167,21 +155,6 @@ export function assembleSessionConfig(
 
   const effectiveCwd = options.cwd ?? ctx.cwd;
 
-  // Resolve extensions/skills: isolated overrides to false
-  const extensions = options.isolated ? false : agentConfig.extensions;
-  const skills = options.isolated ? false : agentConfig.skills;
-
-  // Build prompt extras (memory, preloaded skills)
-  const extras: PromptExtras = {};
-
-  // Skill preloading: when skills is string[], preload their content into the prompt
-  if (Array.isArray(skills)) {
-    const loaded = io.preloadSkills(skills, effectiveCwd);
-    if (loaded.length > 0) {
-      extras.skillBlocks = loaded;
-    }
-  }
-
   const toolNames = registry.getToolNamesForType(type);
 
   // Build system prompt from the resolved agent config
@@ -190,13 +163,8 @@ export function assembleSessionConfig(
     effectiveCwd,
     env,
     ctx.parentSystemPrompt,
-    extras,
   );
 
-  // noSkills: when we've already preloaded skills into the prompt, or skills = false,
-  // tell the resource loader not to load them again.
-  const noSkills = skills === false || Array.isArray(skills);
-
   // Model resolution: explicit option > config model string > parent model
   const model =
     options.model ??
@@ -212,11 +180,8 @@ export function assembleSessionConfig(
     effectiveCwd,
     systemPrompt,
     toolNames,
-    extensions,
     model,
     thinkingLevel,
-    noSkills,
-    extras,
     agentMaxTurns,
   };
 }

package/src/tools/agent-tool.ts

@@ -220,11 +220,6 @@ Guidelines:
 						description: "Optional agent ID to resume from. Continues from previous context.",
 					}),
 				),
-				isolated: Type.Optional(
-					Type.Boolean({
-						description: "If true, agent gets no extension/MCP tools — only built-in tools.",
-					}),
-				),
 				inherit_context: Type.Optional(
 					Type.Boolean({
 						description:

package/src/tools/background-spawner.ts

@@ -48,7 +48,6 @@ export function spawnBackground(
       description: execution.description,
       model: execution.model,
       maxTurns: execution.effectiveMaxTurns,
-      isolated: execution.isolated,
       inheritContext: execution.inheritContext,
       thinkingLevel: execution.thinking,
       isBackground: true,

package/src/tools/foreground-runner.ts

@@ -102,7 +102,6 @@ export async function runForeground(
         description: execution.description,
         model: execution.model,
         maxTurns: execution.effectiveMaxTurns,
-        isolated: execution.isolated,
         inheritContext: execution.inheritContext,
         thinkingLevel: execution.thinking,
         invocation: execution.agentInvocation,

package/src/tools/spawn-config.ts

@@ -43,7 +43,6 @@ export interface SpawnExecution {
   thinking: ThinkingLevel | undefined;
   inheritContext: boolean;
   runInBackground: boolean;
-  isolated: boolean;
   agentInvocation: AgentInvocation;
 }
 
@@ -102,7 +101,6 @@ export function resolveSpawnConfig(
   const thinking = resolvedConfig.thinking;
   const inheritContext = resolvedConfig.inheritContext;
   const runInBackground = resolvedConfig.runInBackground;
-  const isolated = resolvedConfig.isolated;
 
   // Compute display model name (only shown when different from parent)
   const parentModelId = modelInfo.parentModel?.id;
@@ -120,7 +118,6 @@ export function resolveSpawnConfig(
     modelName,
     thinking,
     maxTurns: normalizeMaxTurns(resolvedConfig.maxTurns),
-    isolated,
     inheritContext,
     runInBackground,
   };
@@ -147,7 +144,6 @@ export function resolveSpawnConfig(
       thinking,
       inheritContext,
       runInBackground,
-      isolated,
       agentInvocation,
     },
     presentation: { modelName, agentTags, detailBase },

package/src/types.ts

@@ -39,10 +39,6 @@ export interface AgentPromptConfig {
 /** Unified agent configuration — used for both default and user-defined agents. */
 export interface AgentConfig extends AgentIdentity, AgentPromptConfig {
   builtinToolNames?: string[];
-  /** true = inherit all extensions, false = none */
-  extensions: boolean;
-  /** true = inherit all, string[] = only listed, false = none */
-  skills: true | string[] | false;
   model?: string;
   thinking?: ThinkingLevel;
   maxTurns?: number;
@@ -50,8 +46,6 @@ export interface AgentConfig extends AgentIdentity, AgentPromptConfig {
   inheritContext?: boolean;
   /** Default for spawn: run in background. undefined = caller decides. */
   runInBackground?: boolean;
-  /** Default for spawn: no extension tools. undefined = caller decides. */
-  isolated?: boolean;
   /** true = this is an embedded default agent (informational) */
   isDefault?: boolean;
   /** false = agent is hidden from the registry */
@@ -65,7 +59,6 @@ export interface AgentInvocation {
   modelName?: string;
   thinking?: ThinkingLevel;
   maxTurns?: number;
-  isolated?: boolean;
   inheritContext?: boolean;
   runInBackground?: boolean;
 }

package/src/ui/agent-config-editor.ts

@@ -47,13 +47,8 @@ export function buildEjectContent(cfg: AgentConfig): string {
   if (cfg.thinking) fmFields.push(`thinking: ${cfg.thinking}`);
   if (cfg.maxTurns) fmFields.push(`max_turns: ${cfg.maxTurns}`);
   fmFields.push(`prompt_mode: ${cfg.promptMode}`);
-  if (!cfg.extensions) fmFields.push("extensions: false");
-  if (cfg.skills === false) fmFields.push("skills: false");
-  else if (Array.isArray(cfg.skills))
-    fmFields.push(`skills: ${cfg.skills.join(", ")}`);
   if (cfg.inheritContext) fmFields.push("inherit_context: true");
   if (cfg.runInBackground) fmFields.push("run_in_background: true");
-  if (cfg.isolated) fmFields.push("isolated: true");
   return `---\n${fmFields.join("\n")}\n---\n\n${cfg.systemPrompt}\n`;
 }
 

package/src/ui/agent-creation-wizard.ts

@@ -104,11 +104,8 @@ model: <optional model as "provider/modelId", e.g. "anthropic/claude-haiku-4-5-2
 thinking: <optional thinking level: off, minimal, low, medium, high, xhigh. Omit to inherit>
 max_turns: <optional max agentic turns. 0 or omit for unlimited (default)>
 prompt_mode: <"replace" (body IS the full system prompt) or "append" (body is appended to default prompt). Default: replace>
-extensions: <true (inherit all MCP/extension tools) or false (none). Default: true>
-skills: <true (inherit all), false (none), or comma-separated skill names to preload into prompt. Default: true>
 inherit_context: <true to fork parent conversation into agent so it sees chat history. Default: false>
 run_in_background: <true to run in background by default. Default: false>
-isolated: <true for no extension/MCP tools, only built-in tools. Default: false>
 ---
 
 <system prompt body — instructions for the agent>
@@ -120,7 +117,6 @@ Guidelines for choosing settings:
 - Use prompt_mode: append if the agent should keep the default system prompt and add specialization on top
 - Use prompt_mode: replace for fully custom agents with their own personality/instructions
 - Set inherit_context: true if the agent needs to know what was discussed in the parent conversation
-- Set isolated: true if the agent should NOT have access to MCP servers or other extensions
 - Only include frontmatter fields that differ from defaults — omit fields where the default is fine
 
 Write the file using the write tool. Only write the file, nothing else.`;

package/src/ui/display.ts

@@ -30,7 +30,7 @@ export interface AgentDetails {
   spinnerFrame?: number;
   /** Short model name if different from parent (e.g. "haiku", "sonnet"). */
   modelName?: string;
-  /** Notable config tags (e.g. ["thinking: high", "isolated"]). */
+  /** Notable config tags (e.g. ["thinking: high", "inherit context"]). */
   tags?: string[];
   /** Current turn count. */
   turnCount?: number;
@@ -135,7 +135,6 @@ export function buildInvocationTags(
   const tags: string[] = [];
   if (!invocation) return { tags };
   if (invocation.thinking) tags.push(`thinking: ${invocation.thinking}`);
-  if (invocation.isolated) tags.push("isolated");
   if (invocation.inheritContext) tags.push("inherit context");
   if (invocation.runInBackground) tags.push("background");
   if (invocation.maxTurns != null) tags.push(`max turns: ${invocation.maxTurns}`);

package/src/session/safe-fs.ts

@@ -1,45 +0,0 @@
-/**
- * safe-fs.ts — Filesystem safety utilities for reading untrusted paths.
- *
- * Used by skill-loader.ts to reject symlinks and path-traversal names
- * before reading skill files from disk.
- */
-
-import { existsSync, lstatSync, readFileSync } from "node:fs";
-import { debugLog } from "#src/debug";
-
-/**
- * Returns true if a name contains characters not allowed in agent/skill names.
- * Uses a whitelist: only alphanumeric, hyphens, underscores, and dots (no leading dot).
- */
-export function isUnsafeName(name: string): boolean {
-  if (!name || name.length > 128) return true;
-  return !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name);
-}
-
-/**
- * Returns true if the given path is a symlink (defense against symlink attacks).
- */
-export function isSymlink(filePath: string): boolean {
-  try {
-    return lstatSync(filePath).isSymbolicLink();
-  } catch (err) {
-    debugLog("lstatSync", err);
-    return false;
-  }
-}
-
-/**
- * Safely read a file, rejecting symlinks.
- * Returns undefined if the file doesn't exist, is a symlink, or can't be read.
- */
-export function safeReadFile(filePath: string): string | undefined {
-  if (!existsSync(filePath)) return undefined;
-  if (isSymlink(filePath)) return undefined;
-  try {
-    return readFileSync(filePath, "utf-8");
-  } catch (err) {
-    debugLog("readFileSync", err);
-    return undefined;
-  }
-}

package/src/session/skill-loader.ts

@@ -1,104 +0,0 @@
-/**
- * skill-loader.ts — Preload named skills.
- *
- * Roots, in precedence order:
- *   - <cwd>/.pi/skills           (project, Pi's standard)
- *   - <cwd>/.agents/skills       (project, cross-tool Agent Skills spec — https://agentskills.io)
- *   - getAgentDir()/skills       (user, default ~/.pi/agent/skills — Pi's standard)
- *   - ~/.agents/skills           (user, cross-tool Agent Skills spec)
- *   - ~/.pi/skills               (legacy global, pre-Pi)
- *
- * Layout per root:
- *   - <root>/<name>.md            (flat file at the top level)
- *   - <root>/.../<name>/SKILL.md  (directory skill, may be nested — Pi's standard)
- *
- * Recursion skips dotfile entries and node_modules. A directory that itself contains
- * SKILL.md is a skill — we don't descend into it (Pi: skills don't nest).
- *
- * Symlinks are rejected for security (deviation from Pi, which follows them).
- */
-
-import type { Dirent } from "node:fs";
-import { existsSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { getAgentDir } from "@earendil-works/pi-coding-agent";
-import { debugLog } from "#src/debug";
-import { isSymlink, isUnsafeName, safeReadFile } from "#src/session/safe-fs";
-
-export interface PreloadedSkill {
-  name: string;
-  content: string;
-}
-
-export function preloadSkills(skillNames: string[], cwd: string): PreloadedSkill[] {
-  return skillNames.map((name) => ({ name, content: loadSkillContent(name, cwd) }));
-}
-
-function loadSkillContent(name: string, cwd: string): string {
-  if (isUnsafeName(name)) {
-    return `(Skill "${name}" skipped: name contains path traversal characters)`;
-  }
-  const roots = [
-    join(cwd, ".pi", "skills"), // project — Pi standard
-    join(cwd, ".agents", "skills"), // project — Agent Skills spec
-    join(getAgentDir(), "skills"), // user — Pi standard
-    join(homedir(), ".agents", "skills"), // user — Agent Skills spec
-    join(homedir(), ".pi", "skills"), // legacy global, pre-Pi
-  ];
-  for (const root of roots) {
-    const content = findInRoot(root, name);
-    if (content !== undefined) return content;
-  }
-  return `(Skill "${name}" not found in .pi/skills/, .agents/skills/, or global skill locations)`;
-}
-
-function findInRoot(root: string, name: string): string | undefined {
-  if (isSymlink(root)) return undefined; // reject symlinked roots entirely
-  const flat = safeReadFile(join(root, `${name}.md`))?.trim();
-  if (flat !== undefined) return flat;
-  return findSkillDirectory(root, name);
-}
-
-/** BFS under `root` for a directory named `name` containing `SKILL.md`. Pi-conforming filters. */
-function findSkillDirectory(root: string, name: string): string | undefined {
-  if (!existsSync(root)) return undefined;
-  const queue: string[] = [root];
-
-  while (queue.length > 0) {
-    const current = queue.shift();
-    if (current === undefined) continue;
-
-    let entries: Dirent[];
-    try {
-      entries = readdirSync(current, { withFileTypes: true });
-    } catch (err) {
-      debugLog("readdirSync skill root", err);
-      continue;
-    }
-
-    // Deterministic byte-order traversal — locale-independent.
-    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-
-      // Symlinked dirs already filtered by entry.isDirectory() — Dirent uses lstat semantics.
-      const path = join(current, entry.name);
-      const skillMd = join(path, "SKILL.md");
-      const isSkillDir = existsSync(skillMd);
-
-      if (isSkillDir) {
-        if (entry.name === name) {
-          const content = safeReadFile(skillMd)?.trim();
-          if (content !== undefined) return content;
-        }
-        continue; // Pi rule: skills don't nest — don't descend into a skill dir
-      }
-
-      queue.push(path);
-    }
-  }
-  return undefined;
-}