@henryqw/pi-subagent 26.1.4 → 26.2.1

package/CONTEXT.md

@@ -42,7 +42,7 @@ Own Role-configured Pi delegation through one `delegate_task` surface:
 ### Direct evidence
 
 - Direct mode admits declared write-capable resources for explicitly authorized scope while preserving read-only Role restrictions. Potential-writer requests serialize tasks and retain Pi checkout admission until exact owned worker termination is proved by pane absence and two empty private process-lease scans; uncertain termination retains admission and live recovery ownership. Potential-writer answers require an explicit structured `succeeded` outcome; failed, blocked, or malformed completion stops dispatch but does not prevent release after proved termination. `/subagent` Close/cancel-and-release retries termination under session, branch, epoch and exact ownership guards without replaying work or removing checkout/session evidence. This is a worker report, not proof of validation, cleanliness, rollback, or checked integration. Direct changesets require isolated mode.
-- Checkout admission in Main serializes write-capable Pi tool calls per checkout by their model-issued root call: a `codemode` script's nested writes share the script's ownership, independent writers wait, and reads never wait.
+- Only direct requests with potential writers reserve checkout admission. They cannot start while another direct writer holds it or a Main potentially-writing call is in flight. Main calls, including Bash and nested `codemode` writes, do not block each other. A direct writer blocks Main's writes until verified worker termination; use isolated mode when Main must continue writing. Reads never wait.
 - Each direct worker has a recorded Herdr tab and Pi session identity. The first handle returns before completion; subsequent tab identities remain recoverable on the session branch.
 - An exact settled worker with a bounded final Pi answer produces a follow-up to Main. Blocked, unknown, idle-stalled, truncated, or ambiguous outcomes retain actionable recovery identity. Session replacement never delivers to the wrong Main session.
 

package/README.md

@@ -6,7 +6,7 @@ Delegate work to configured Pi Roles with [Herdr](https://herdr.dev/). Authorize
 
 ## Install
 
-Requires Pi 1.0.0 or later. Development and automated checks use Pi 1.0.2. Older Pi releases are no longer supported.
+Requires Pi 1.0.0 or later. Development and automated checks use Pi 1.0.0. Older Pi releases are no longer supported.
 
 ```bash
 pi install npm:@henryqw/pi-task-models
@@ -44,7 +44,7 @@ Commands are for you. Delegation and state tools and the packaged skill are for
 
 ![Main, its coordinator extension, and a Herdr subagent through checked work, worker failure, and coordinator interruption](./docs/worker-lifecycle.svg)
 
-`delegate_task`, `subagent_resume`, `subagent_stage`, `subagent_integrate`, and `subagent_abort` are model-only: Pi's `codemode` scripts cannot call them, because delegation and guarded state transitions need Main's visible reasoning. `subagent_status` stays callable from scripts. In Main, one model-issued call at a time may write to a checkout through Pi tools; a `codemode` script owns the checkout from its first nested write until the script ends, so its own nested calls pass while an independent writer is blocked with a reason and retries after it settles. Reads never wait.
+`delegate_task`, `subagent_resume`, `subagent_stage`, `subagent_integrate`, and `subagent_abort` are model-only: Pi's `codemode` scripts cannot call them, because delegation and guarded state transitions need Main's visible reasoning. `subagent_status` stays callable from scripts. Main's potentially-writing calls can run together without writer ownership, including all Bash calls and nested `codemode` writes. Only potential-writer direct requests reserve the checkout. They can start only when no direct writer owns it and no Main potentially-writing call is in flight there. Each Main call is tracked separately until its result or execution end; a script's result does not release its active nested writes. Reads never wait. Use `mode: isolated` to keep Main free to write; this adds worktree checks and explicit integration.
 
 The coordinator is extension code running in Main's Pi process, not another agent. It persists the request, launches the Herdr subagent, checks its committed work, and reports saved results; Main chooses what to stage and promote. If a worker fails, the coordinator reports attention after the wave settles, not necessarily immediately while siblings work. If Main's Pi process stops, no follow-up is guaranteed: restart and run `/subagent recover` in the canonical repository to classify orphaned interruptions and send Main one recovery report. Main then uses `subagent_status` for exact evidence and deliberate next actions. A stale `running` state does not prove a worker is still active; interrupted or ambiguous actions are never replayed automatically.
 
@@ -88,7 +88,7 @@ Chain:    { mode: "direct", chain: [{ role, name, task, ... }] }
 
 Direct tasks use the selected Role's declared tools, extensions, Skills, and MCP servers, including write-capable resources. Authorization comes from your request and Main's bounded task packet, not the Role's capabilities: name allowed paths/actions and exclusions, preserve unrelated edits and staged changes, and authorize commits or external actions explicitly. For example, a configured Git operator with `bash` can stage named pending files and commit them on the `fast` route. Read-only Roles retain their tool restrictions. Use isolated mode for a checked changeset.
 
-Direct writes affect Main's checkout immediately. No clean-checkout prerequisite, automatic checks, rollback, or isolated integration guarantee applies. Requests containing potential writers (including any extensions or MCP servers) run their tasks serially and hold checkout admission after the initial handle returns; competing Pi writes fail until all owned workers are proved stopped. Pure read-only parallel requests still run concurrently. A failure in a potential-writer request stops further dispatch; an uncertain worker may still be running. Chains replace each literal `{previous}` with the preceding successful answer and stop on failure. Task outcome and worker termination are separate: after settlement the coordinator closes exact owned writer panes and releases admission only after pane absence and two empty private process-lease scans. Native `lsof` is required for this proof; no Git files, commits, or saved sessions are removed. Failure remains failure even when admission is released. If closing fails, identity changes, a leased child survives, or inspection is uncertain, admission stays held. Open `/subagent`, select the exact direct task, and choose **Close/cancel-and-release owned workers** to cancel dispatch and retry termination. The action checks session/branch/epoch and live ownership; recorded-only tasks cannot unlock anything. Resolve the reported blocker (including any surviving owned process), then repeat the same action. Restarting Pi is not termination proof. Inspect partial changes before new writes; never blindly retry a commit or delete work to recover.
+Direct writes affect Main's checkout immediately. No clean-checkout prerequisite, automatic checks, rollback, or isolated integration guarantee applies. Requests containing potential writers (including any extensions or MCP servers) can start only when no direct writer owns the checkout and no Main potentially-writing call is in flight there. They run their tasks serially and hold checkout admission after the initial handle returns; competing direct writers and Main writes fail until all owned workers are proved stopped. Use `mode: isolated` to keep Main free to write, with worktree checks and explicit integration instead of immediate shared-checkout changes. Pure read-only parallel requests still run concurrently. A failure in a potential-writer request stops further dispatch; an uncertain worker may still be running. Chains replace each literal `{previous}` with the preceding successful answer and stop on failure. Task outcome and worker termination are separate: after settlement the coordinator closes exact owned writer panes and releases admission only after pane absence and two empty private process-lease scans. Native `lsof` is required for this proof; no Git files, commits, or saved sessions are removed. Failure remains failure even when admission is released. If closing fails, identity changes, a leased child survives, or inspection is uncertain, admission stays held. Open `/subagent`, select the exact direct task, and choose **Close/cancel-and-release owned workers** to cancel dispatch and retry termination. The action checks session/branch/epoch and live ownership; recorded-only tasks cannot unlock anything. Resolve the reported blocker (including any surviving owned process), then repeat the same action. Restarting Pi is not termination proof. Inspect partial changes before new writes; never blindly retry a commit or delete work to recover.
 
 If tab creation times out or returns incomplete or mismatched identity, `/subagent` retains the allocation intent: workspace, checkout, label, private lease/session paths, and any returned tab/pane IDs. No worker is started until creation identity is verified. These records are evidence, not ownership: Close is unavailable for unverified allocation, and admission remains held pending manual reconciliation against Herdr. Do not recreate a tab, guess missing IDs, or restart to bypass this blocker. A Close begun while a worker is active keeps its branch/session/epoch guards through cancellation settlement; stale dialogs cannot close panes or release admission.
 
@@ -225,7 +225,7 @@ Each call is cancellable and limited to 30 seconds. Results retain at most the l
 
 Children run with `--no-extensions`, so a Role must list the extension that registers its route model's provider, and only declared resources plus required internal policy adapters load. `builtin:<name>` entries load Pi built-in extensions (`builtin:codemode`, `builtin:tool-search`, `builtin:llama.cpp`) explicitly; `builtin:mcp` is rejected because it would connect every configured server and bypass `mcps`. Extension tools registered with `codemode` or `deferred` exposure stay callable from scripts but are declared to the model only when `tools` names them.
 
-Checkout admission keeps a script's writer ownership until the script and all its admitted nested writes finish, including writes still settling after cancellation. Independent writers stay blocked during that time; nested writes that have not passed admission before the script ends are rejected.
+Main's nested calls pass admission by their own tool names, not by script or ancestor ownership. Each potentially-writing call, including Bash, prevents a direct writer from starting until that call returns a result or execution end. Main calls do not block each other. A script's completion does not release its active nested calls; a nested call can still pass admission after its parent ends if no direct writer owns the checkout.
 
 To let a Role run `codemode` scripts, list `builtin:codemode` in `extensions` and `codemode` in `tools`; both are required, because the built-in registers the tool inactive and the Role tool policy activates it. `codemode` alone in `tools` fails the launch as an unavailable tool. Pi's `codemode.mode` and `codemode.inlineBudget` settings apply in the child unchanged, so the Role never forces codemode-only operation, and MCP configuration never activates `codemode` in a child. Scripts can call only the Role's active tools plus `codemode`/`deferred` extension and MCP tools; inactive base tools such as `bash` stay unreachable.
 

package/dist/direct-herdr.js

@@ -34,11 +34,14 @@ function exactFinalTurn(jsonl, prompt) {
     const parents = new Map();
     for (const line of lines) {
         const entry = object(JSON.parse(line), "session entry");
-        if (entry.type !== "message")
+        if (entry.type === "session")
             continue;
-        const id = field(entry.id, "message id");
+        const id = field(entry.id, "session entry id");
+        // Non-message entries also link the exact session branch.
         if (typeof entry.parentId === "string")
             parents.set(id, entry.parentId);
+        if (entry.type !== "message")
+            continue;
         const message = object(entry.message, "session message");
         if (message.role === "user" && Array.isArray(message.content)
             && message.content.length === 1 && object(message.content[0], "user content").text === prompt) {

package/extensions/admission.ts

@@ -26,71 +26,51 @@ async function checkoutKey(pi: ExtensionAPI, ctx: ExtensionContext): Promise<str
 }
 
 /**
- * Coordinate Pi-owned calls that can mutate one checkout. This is admission,
- * not an OS sandbox: external processes and trusted extension lifecycle code
- * remain outside interception. A model-issued call owns the checkout for the
- * calls it makes through `ctx.executeTool()` (codemode scripts), so its nested
- * writes pass while independent writers wait until it settles.
+ * Reserve checkouts only for direct writers. Main writes can run together, but
+ * each call must finish before a direct writer can start in that checkout.
+ * External processes and trusted extension lifecycle code are not intercepted.
  */
 export function registerCheckoutAdmission(pi: ExtensionAPI, directCanWrite: (input: unknown) => boolean): (toolCallId: string) => () => void {
 	const heldCalls = new Set<string>();
 	const ownerByCheckout = new Map<string, string>();
-	const checkoutByRoot = new Map<string, string>();
-	const writersByRoot = new Map<string, Set<string>>();
-	/** Model-issued ancestor of each in-flight call; Pi names nested calls `<parent id>/<n>`. */
-	const rootByCall = new Map<string, string>();
+	const calls = new Map<string, { direct: boolean; key?: string }>();
 	const release = (toolCallId: string) => {
 		if (heldCalls.has(toolCallId)) return;
-		const root = rootByCall.get(toolCallId);
-		if (root === undefined) return;
-		rootByCall.delete(toolCallId);
-		const writers = writersByRoot.get(root);
-		writers?.delete(toolCallId);
-		if (rootByCall.has(root) || writers?.size) return;
-		writersByRoot.delete(root);
-		const key = checkoutByRoot.get(root);
-		if (!key) return;
-		checkoutByRoot.delete(root);
-		if (ownerByCheckout.get(key) === root) ownerByCheckout.delete(key);
+		const call = calls.get(toolCallId);
+		calls.delete(toolCallId);
+		if (call?.key && ownerByCheckout.get(call.key) === toolCallId) ownerByCheckout.delete(call.key);
 	};
 	pi.on("tool_call", async (event, ctx) => {
-		const root = event.parentToolCallId === undefined
-			? event.toolCallId
-			: rootByCall.get(event.parentToolCallId) ?? event.parentToolCallId;
-		rootByCall.set(event.toolCallId, root);
-		const potentiallyWriting = event.toolName === "delegate_task"
-			? directCanWrite(event.input)
-			: !READ_ONLY_TOOLS.has(event.toolName);
-		if (!potentiallyWriting) return;
+		const direct = event.toolName === "delegate_task";
+		if (direct ? !directCanWrite(event.input) : READ_ONLY_TOOLS.has(event.toolName)) return;
+		const call: { direct: boolean; key?: string } = { direct };
+		calls.set(event.toolCallId, call);
 		const key = await checkoutKey(pi, ctx);
-		// A codemode result can settle while an unawaited nested call is still resolving its checkout.
-		if (root !== event.toolCallId && !rootByCall.has(root)) {
-			return { block: true, reason: `Parent call ${root} already settled; ${event.toolCallId} is not admitted.` };
+		if (calls.get(event.toolCallId) !== call) {
+			return { block: true, reason: `Call ${event.toolCallId} already settled; use mode: isolated to keep Main free.` };
 		}
 		const owner = ownerByCheckout.get(key);
-		if (owner && owner !== root) {
+		const main = direct ? [...calls].find(([, active]) => !active.direct && active.key === key)?.[0] : undefined;
+		if (owner || main) {
+			release(event.toolCallId);
 			return {
 				block: true,
-				reason: `Checkout ${key} already has an admitted Pi writer (${owner}); retry after it settles.`,
+				reason: `Checkout ${key} has ${owner ? `an admitted direct writer (${owner})` : `a Main potentially-writing call in flight (${main})`}; retry after it stops, or use mode: isolated to keep Main free.`,
 			};
 		}
-		ownerByCheckout.set(key, root);
-		checkoutByRoot.set(root, key);
-		const writers = writersByRoot.get(root) ?? new Set<string>();
-		writers.add(event.toolCallId);
-		writersByRoot.set(root, writers);
+		call.key = key;
+		if (direct) ownerByCheckout.set(key, event.toolCallId);
 	});
 	pi.on("tool_result", (event) => release(event.toolCallId));
 	pi.on("tool_execution_end", (event) => release(event.toolCallId));
 	pi.on("session_shutdown", () => {
 		// Session replacement is not proof that a held direct worker stopped.
-		for (const call of rootByCall.keys()) release(call);
+		for (const toolCallId of calls.keys()) release(toolCallId);
 	});
-	// A direct handle settles the tool call before the worker settles. Keep its
-	// admission until proved termination; uncertain workers require guarded recovery.
+	// The tool returns a handle before its worker stops. Release only after verified termination.
 	return (toolCallId) => {
-		const root = rootByCall.get(toolCallId);
-		if (root === undefined || !writersByRoot.get(root)?.has(toolCallId)) {
+		const call = calls.get(toolCallId);
+		if (!call?.direct || !call.key) {
 			throw new Error(`Direct call ${toolCallId} was not admitted as a checkout writer; delegate again with the current Role resources.`);
 		}
 		heldCalls.add(toolCallId);

package/extensions/subagent.ts

@@ -173,7 +173,7 @@ export default function subagentExtension(pi: ExtensionAPI): void {
 	const canWrite = (input: unknown): boolean => {
 		try {
 			const parsed = parseDelegateTask(input);
-			if (parsed.mode === "isolated") return true;
+			if (parsed.mode === "isolated") return false;
 			const roles = new Map(loadRoles().map((role) => [role.name, role]));
 			return parsed.workflow.delegations.some((delegation) => {
 				const role = roles.get(delegation.role);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henryqw/pi-subagent",
-  "version": "26.1.4",
+  "version": "26.2.1",
   "description": "Delegate bounded direct work or durable checked isolated task graphs to Pi roles.",
   "keywords": [
     "pi-package",
@@ -66,17 +66,17 @@
     "image": "https://raw.githubusercontent.com/HenryQW/pi-harness/main/extensions/pi-subagent/example.png"
   },
   "dependencies": {
-    "@henryqw/pi-config-store": "^2.0.0",
+    "@henryqw/pi-config-store": "^3.0.0",
     "@henryqw/pi-herdr": "^0.4.9",
-    "@henryqw/pi-multi-codex": "^2.0.0",
+    "@henryqw/pi-multi-codex": "^3.0.0",
     "@henryqw/pi-process": "^0.2.0",
     "@henryqw/pi-task-models": "^7.0.0",
     "proper-lockfile": "^4.1.2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.0.2",
-    "@earendil-works/pi-coding-agent": "1.0.2",
-    "@earendil-works/pi-tui": "1.0.2",
+    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-coding-agent": "1.0.0",
+    "@earendil-works/pi-tui": "1.0.0",
     "@types/proper-lockfile": "^4.1.4"
   }
 }

package/skills/pi-subagent/SKILL.md

@@ -24,7 +24,7 @@ After delegation acknowledges a handle or durable request, do other work or end
 
 # Direct requests
 
-Use one compact `role`/`name`/`task` packet, `tasks` for independent packets, or `chain` for dependent packets. Only answer-returning tasks (`kind: text`) are accepted; writes and commits are allowed within explicit task authorization, but `kind: changeset`, structured checks, and judgment require isolated mode. State scope, exclusions, commit policy, and external-action permission; preserve unrelated files and staged changes. Direct writes take effect immediately with no automatic validation, rollback, or isolated integration guarantees. Requests with potential writers run serially and block competing Pi writes until owned workers are proved stopped. Main may read or do work elsewhere while waiting, not mutate the reserved checkout. Task failure is not proof a worker stopped. The coordinator closes exact owned writer panes and releases admission only after pane absence and two empty private process-lease scans. If termination remains uncertain, inspect `/subagent` identities and choose **Close/cancel-and-release owned workers** for the exact locally owned task. Resolve the reported blocker, then retry that guarded action; it never replays the prompt or removes dirty files, commits, or sessions. Recorded-only tasks have no live release authority; restarting Pi is not termination proof. An unverified tab allocation retains its workspace, checkout, label, lease/session paths and any returned IDs for manual reconciliation; it cannot authorize Close, guessed identities or replayed creation. Close keeps its branch/session/epoch guards while an active task cancels and settles. Preserve and inspect changes before writing or retrying. A failed commit may already have happened; never replay it blindly. The tool returns a handle after launching Herdr tabs in the current workspace. Main receives the verified result as a follow-up after the workflow finishes, without interrupting an active turn. If observation stops, open `/subagent` to inspect exact recorded tabs and session files on this session branch; recorded does not prove still running.
+Use one compact `role`/`name`/`task` packet, `tasks` for independent packets, or `chain` for dependent packets. Only answer-returning tasks (`kind: text`) are accepted; writes and commits are allowed within explicit task authorization, but `kind: changeset`, structured checks, and judgment require isolated mode. State scope, exclusions, commit policy, and external-action permission; preserve unrelated files and staged changes. Direct writes take effect immediately with no automatic validation, rollback, or isolated integration guarantees. Main's potentially-writing calls, including all Bash and nested `codemode` writes, can run together and do not acquire writer ownership. Only potential-writer direct requests reserve the checkout. Start one only when no direct writer owns it and no Main potentially-writing call is in flight there. Each Main call ends separately; a parent's result does not release active nested writes. Direct requests with potential writers run serially and block competing direct writers and Main writes until owned workers are proved stopped. Main may read or do work elsewhere while waiting, not mutate the reserved checkout. Choose `mode: isolated` to keep Main free to write; it adds worktree checks and explicit integration instead of immediate shared-checkout changes. Task failure is not proof a worker stopped. The coordinator closes exact owned writer panes and releases admission only after pane absence and two empty private process-lease scans. If termination remains uncertain, inspect `/subagent` identities and choose **Close/cancel-and-release owned workers** for the exact locally owned task. Resolve the reported blocker, then retry that guarded action; it never replays the prompt or removes dirty files, commits, or sessions. Recorded-only tasks have no live release authority; restarting Pi is not termination proof. An unverified tab allocation retains its workspace, checkout, label, lease/session paths and any returned IDs for manual reconciliation; it cannot authorize Close, guessed identities or replayed creation. Close keeps its branch/session/epoch guards while an active task cancels and settles. Preserve and inspect changes before writing or retrying. A failed commit may already have happened; never replay it blindly. The tool returns a handle after launching Herdr tabs in the current workspace. Main receives the verified result as a follow-up after the workflow finishes, without interrupting an active turn. If observation stops, open `/subagent` to inspect exact recorded tabs and session files on this session branch; recorded does not prove still running.
 
 # Isolated requests