@ilya-lesikov/pi-pi 0.9.0 → 0.10.0

package/3p/pi-subagents/src/agent-runner.ts

@@ -2,135 +2,136 @@
  * agent-runner.ts — Core execution engine: creates sessions, runs agents, collects results.
  */
 
-import { AsyncLocalStorage } from "node:async_hooks";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
 import type { Model } from "@earendil-works/pi-ai";
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ExtensionContext, LoadExtensionsResult } from "@earendil-works/pi-coding-agent";
 import {
   type AgentSession,
   type AgentSessionEvent,
   createAgentSession,
   DefaultResourceLoader,
   type ExtensionAPI,
+  getAgentDir,
   SessionManager,
   SettingsManager,
 } from "@earendil-works/pi-coding-agent";
-import { getAgentConfig, getConfig, getMemoryTools, getReadOnlyMemoryTools, getToolsForType } from "./agent-types.js";
+import { BUILTIN_TOOL_NAMES, getAgentConfig, getConfig, getMemoryToolNames, getReadOnlyMemoryToolNames, getToolNamesForType } from "./agent-types.js";
 import { buildParentContext, extractText } from "./context.js";
+import { DEFAULT_AGENTS } from "./default-agents.js";
 import { detectEnv } from "./env.js";
 import { buildMemoryBlock, buildReadOnlyMemoryBlock } from "./memory.js";
 import { buildAgentPrompt, type PromptExtras } from "./prompts.js";
 import { preloadSkills } from "./skill-loader.js";
 import type { SubagentType, ThinkingLevel } from "./types.js";
 
+/**
+ * Tool names registered by THIS extension. Single source of truth so the
+ * registration sites (index.ts) and the subagent exclusion list below can't
+ * drift apart. These are our own tools, not pi built-ins, so they can't be
+ * derived from pi — but they only need defining once.
+ */
+export const SUBAGENT_TOOL_NAMES = {
+  AGENT: "Agent",
+  GET_RESULT: "get_subagent_result",
+  STEER: "steer_subagent",
+} as const;
+
 /** Names of tools registered by this extension that subagents must NOT inherit. */
-const EXCLUDED_TOOL_NAMES = ["Agent", "get_subagent_result", "steer_subagent"];
-
-const TRACER_KEY = Symbol.for("pi-pi:tracer");
-const SUBAGENT_SESSION_KEY = Symbol.for("pi-pi:subagent-session");
-
-// Concurrency-safe subagent lineage. The previous approach derived parent/depth
-// from the mutable process-global SUBAGENT_SESSION_KEY, which is racy for
-// CONCURRENT siblings: MAIN spawns opus/gpt/gemini in parallel, each runAgent's
-// synchronous prologue read whatever the *previous sibling* had just written to
-// the global — so gpt recorded opus as its parent, gemini recorded gpt, forming a
-// bogus opus→gpt→gemini chain with depth 3-6 instead of three depth-1 children of
-// MAIN. AsyncLocalStorage instead propagates DOWN the async call chain (a nested
-// spawn inherits its true parent's store) but NOT ACROSS sibling promises (each
-// sibling started from MAIN sees no store → parent=undefined, depth=1).
-interface SubagentLineage {
-  depth: number;
-  subagentId?: string;
-}
-const subagentLineage = new AsyncLocalStorage<SubagentLineage>();
-
-// The process-global SUBAGENT_SESSION_KEY marker is read elsewhere purely for
-// truthiness ("is any subagent running in this process?", e.g. orchestrator nudge
-// gates). Manage it with a ref-count so concurrent in-process siblings set/clear
-// it correctly regardless of completion order (a plain save/restore would leak a
-// stale marker whenever the last sibling to finish wasn't the last to start).
-let activeSubagentRuns = 0;
-let markerBeforeFirstRun: unknown;
-function enterSubagentMarker(): void {
-  if (activeSubagentRuns === 0) {
-    // Snapshot whatever was there before our first concurrent run (undefined in
-    // the main process; the orchestrator's persistent bootstrap { depth: 1 } in a
-    // subagent process) so we can restore it exactly when the last run exits.
-    markerBeforeFirstRun = (globalThis as any)[SUBAGENT_SESSION_KEY];
-  }
-  activeSubagentRuns++;
-  const marker = (globalThis as any)[SUBAGENT_SESSION_KEY];
-  if (typeof marker !== "object" || marker === null) {
-    (globalThis as any)[SUBAGENT_SESSION_KEY] = { depth: 1 };
-  }
-}
-function exitSubagentMarker(): void {
-  activeSubagentRuns = Math.max(0, activeSubagentRuns - 1);
-  if (activeSubagentRuns === 0) {
-    if (markerBeforeFirstRun === undefined) {
-      delete (globalThis as any)[SUBAGENT_SESSION_KEY];
-    } else {
-      (globalThis as any)[SUBAGENT_SESSION_KEY] = markerBeforeFirstRun;
-    }
-    markerBeforeFirstRun = undefined;
-  }
-}
+const EXCLUDED_TOOL_NAMES: string[] = Object.values(SUBAGENT_TOOL_NAMES);
 
-interface PiPiTracer {
-  openSubagent(meta: {
-    subagentId: string;
-    type?: string;
-    description?: string;
-    parentToolCallId?: string;
-    parentSubagentId?: string;
-    depth: number;
-    systemPrompt?: string;
-    effectivePrompt?: string;
-  }): void;
-  traceSubagent(subagentId: string, kind: string, payload: Record<string, unknown>): void;
+/**
+ * Canonical name of an extension for `extensions: [...]` allowlist matching.
+ * Lowercased — extension names match case-insensitively so `extensions: [Mcp]`
+ * resolves the same as `[mcp]`. Tool names within `ext:foo/bar` are not affected.
+ * Directory extensions (`foo/index.ts`) resolve to the parent directory name;
+ * single-file extensions to the basename minus `.ts`/`.js`.
+ */
+export function extensionCanonicalName(extPath: string): string {
+  const base = basename(extPath);
+  const name = base === "index.ts" || base === "index.js"
+    ? basename(dirname(extPath))
+    : base.replace(/\.(ts|js)$/, "");
+  return name.toLowerCase();
 }
 
-function getTracer(): PiPiTracer | undefined {
-  return (globalThis as any)[TRACER_KEY];
+/**
+ * Classify `extensions: string[]` frontmatter entries for the loader-level filter.
+ *
+ * An entry is a PATH iff it contains a path separator or starts with `~`; otherwise
+ * it is a NAME. `"*"` sets the wildcard flag (keep all default-discovered extensions).
+ *
+ * Path entries are resolved (`~` expanded, made absolute against `cwd`) into `paths`
+ * — and their canonical name is also added to `names`. The loader override matches
+ * everything by canonical name, so path-loaded extensions are matched via their name
+ * rather than their post-staging `Extension.path`.
+ */
+export function parseExtensionsSpec(
+  entries: string[],
+  cwd: string,
+): { names: Set<string>; paths: string[]; wildcard: boolean } {
+  const names = new Set<string>();
+  const paths: string[] = [];
+  let wildcard = false;
+  for (const entry of entries) {
+    if (!entry) continue;
+    if (entry === "*") {
+      wildcard = true;
+      continue;
+    }
+    const isPathEntry = entry.includes("/") || entry.includes("\\") || entry.startsWith("~");
+    if (!isPathEntry) {
+      names.add(entry.toLowerCase());
+      continue;
+    }
+    let p = entry;
+    if (p === "~" || p.startsWith("~/") || p.startsWith("~\\")) {
+      p = homedir() + p.slice(1);
+    }
+    const abs = isAbsolute(p) ? p : resolve(cwd, p);
+    paths.push(abs);
+    names.add(extensionCanonicalName(abs));
+  }
+  return { names, paths, wildcard };
 }
 
-function traceSubagentEvent(subagentId: string | undefined, event: AgentSessionEvent, turnIndex: number): void {
-  if (!subagentId) return;
-  const tracer = getTracer();
-  if (!tracer) return;
-  try {
-    switch (event.type) {
-      case "agent_start":
-        tracer.traceSubagent(subagentId, "agent_start", {});
-        break;
-      case "agent_end":
-        tracer.traceSubagent(subagentId, "agent_end", { messages: (event as any).messages, willRetry: (event as any).willRetry });
-        break;
-      case "turn_start":
-        tracer.traceSubagent(subagentId, "turn_start", { turnIndex });
-        break;
-      case "turn_end":
-        tracer.traceSubagent(subagentId, "turn_end", { turnIndex, message: (event as any).message, toolResults: (event as any).toolResults });
-        break;
-      case "message_start":
-        tracer.traceSubagent(subagentId, "message_start", { turnIndex, message: (event as any).message });
-        break;
-      case "message_update":
-        tracer.traceSubagent(subagentId, "message_update", { turnIndex, assistantMessageEvent: (event as any).assistantMessageEvent });
-        break;
-      case "message_end":
-        tracer.traceSubagent(subagentId, "message_end", { turnIndex, message: (event as any).message });
-        break;
-      case "tool_execution_start":
-        tracer.traceSubagent(subagentId, "tool_execution_start", { turnIndex, toolCallId: (event as any).toolCallId, toolName: (event as any).toolName, args: (event as any).args });
-        break;
-      case "tool_execution_update":
-        tracer.traceSubagent(subagentId, "tool_execution_update", { turnIndex, toolCallId: (event as any).toolCallId, toolName: (event as any).toolName, args: (event as any).args, partialResult: (event as any).partialResult });
-        break;
-      case "tool_execution_end":
-        tracer.traceSubagent(subagentId, "tool_execution_end", { turnIndex, toolCallId: (event as any).toolCallId, toolName: (event as any).toolName, result: (event as any).result, isError: (event as any).isError });
-        break;
+/**
+ * Parse raw `ext:` selector strings (from the `tools:` CSV) into the set of
+ * extension names to keep loaded and a per-extension tool-narrowing map.
+ *
+ * `ext:foo` → `extNames` has `foo`, no narrowing entry (all of foo's tools).
+ * `ext:foo/bar` → `extNames` has `foo`, `narrowing.foo` has `bar` (only `bar`).
+ * A name lands in `narrowing` only when a `/tool` form is seen, so a bare
+ * `ext:foo` alongside `ext:foo/bar` leaves narrowing in effect (narrowing wins).
+ * The split is on the first `/`; extension canonical names never contain `/`.
+ */
+export function parseExtSelectors(entries: string[]): {
+  extNames: Set<string>;
+  narrowing: Map<string, Set<string>>;
+} {
+  const extNames = new Set<string>();
+  const narrowing = new Map<string, Set<string>>();
+  for (const raw of entries) {
+    if (!raw) continue;
+    const body = raw.slice("ext:".length);
+    const slash = body.indexOf("/");
+    // Extension name matches case-insensitively (matches the loader-side canonical
+    // name). Tool names are case-preserved — they're matched against pi-mono's
+    // registered identifiers, which are case-sensitive.
+    const name = (slash === -1 ? body : body.slice(0, slash)).trim().toLowerCase();
+    if (!name) continue;
+    extNames.add(name);
+    if (slash === -1) continue;
+    const tool = body.slice(slash + 1).trim();
+    if (!tool) continue;
+    let set = narrowing.get(name);
+    if (!set) {
+      set = new Set();
+      narrowing.set(name, set);
     }
-  } catch {}
+    set.add(tool);
+  }
+  return { extNames, narrowing };
 }
 
 /** Default max turns. undefined = unlimited (no turn limit). */
@@ -195,6 +196,8 @@ export interface ToolActivity {
 export interface RunOptions {
   /** ExtensionAPI instance — used for pi.exec() instead of execSync. */
   pi: ExtensionAPI;
+  /** Manager-assigned id; suffixes session name to disambiguate parallel spawns (e.g. `Explore#a1b2c3d4`). */
+  agentId?: string;
   model?: Model<any>;
   maxTurns?: number;
   signal?: AbortSignal;
@@ -203,6 +206,20 @@ export interface RunOptions {
   thinkingLevel?: ThinkingLevel;
   /** Override working directory (e.g. for worktree isolation). */
   cwd?: string;
+  /**
+   * Where .pi config is discovered (project extensions, skills, pi settings,
+   * agent memory). Default: same as the working directory. The manager sets
+   * this to the parent session's cwd when `SpawnOptions.cwd` points the
+   * working directory elsewhere — the agent works *there* but carries the
+   * parent project's config (the target's `.pi` extensions never execute).
+   *
+   * WARNING for future callers: if you pass `cwd` pointing at a directory the
+   * user didn't open, you almost certainly must pass `configCwd` too —
+   * omitting it makes the target's `.pi` extensions execute in this process.
+   * (Worktree isolation is the one intentional exception: its copy IS the
+   * parent's repo, so config resolving inside it is correct.)
+   */
+  configCwd?: string;
   /** Called on tool start/end with activity info. */
   onToolActivity?: (activity: ToolActivity) => void;
   /** Called on streaming text deltas from the assistant response. */
@@ -211,18 +228,16 @@ export interface RunOptions {
   /** Called at the end of each agentic turn with the cumulative count. */
   onTurnEnd?: (turnCount: number) => void;
   /**
-   * Called after the agent finishes (session.prompt() returns) but before
-   * the run is considered complete. Return a non-empty string to re-prompt
-   * the agent with that message. Return undefined/empty to accept completion.
-   * Called up to maxValidationRetries times (default: 2).
+   * Called once per assistant message_end with that message's usage delta.
+   * Lets callers maintain a lifetime accumulator that survives compaction
+   * (which replaces session.state.messages and resets stats-derived sums).
    */
-  validateCompletion?: () => string | undefined;
-  maxValidationRetries?: number;
-  /** Correlation IDs for session tracing. */
-  subagentId?: string;
-  subagentType?: string;
-  subagentDescription?: string;
-  parentToolCallId?: string;
+  onAssistantUsage?: (usage: { input: number; output: number; cacheWrite: number }) => void;
+  /**
+   * Called when the session successfully compacts. `tokensBefore` is upstream's
+   * pre-compaction context size estimate. Aborted compactions don't fire.
+   */
+  onCompaction?: (info: { reason: "manual" | "threshold" | "overflow"; tokensBefore: number }) => void;
 }
 
 export interface RunResult {
@@ -273,6 +288,12 @@ function forwardAbortSignal(session: AgentSession, signal?: AbortSignal): () =>
   return () => signal.removeEventListener("abort", onAbort);
 }
 
+function resolveConfiguredSessionDir(sessionDir: string | undefined, cwd: string): string | undefined {
+  if (!sessionDir) return undefined;
+  if (sessionDir === "~" || sessionDir.startsWith("~/")) return resolve(homedir(), sessionDir.slice(2));
+  if (isAbsolute(sessionDir)) return sessionDir;
+  return resolve(cwd, sessionDir);
+}
 
 export async function runAgent(
   ctx: ExtensionContext,
@@ -285,264 +306,374 @@ export async function runAgent(
 
   // Resolve working directory: worktree override > parent cwd
   const effectiveCwd = options.cwd ?? ctx.cwd;
-
-  // Derive lineage from the async-context store (see subagentLineage above).
-  // Reading it BEFORE entering the child's own als.run means concurrent siblings
-  // each see their real parent (MAIN → undefined store), not a leaked sibling.
-  const parentLineage = subagentLineage.getStore();
-  const parentSubagentId = parentLineage?.subagentId;
-  const traceDepth = (parentLineage?.depth ?? 0) + 1;
-  const childLineage: SubagentLineage = { depth: traceDepth, subagentId: options.subagentId };
-
-  // Mark the process as "running a subagent" for truthiness readers (see
-  // enter/exitSubagentMarker). Lineage (parent/depth) comes from als above, so
-  // this marker no longer participates in nesting math and its old sibling-race
-  // can no longer corrupt the org chart.
-  enterSubagentMarker();
-
-  return subagentLineage.run(childLineage, async () => {
-  try {
-    const env = await detectEnv(options.pi, effectiveCwd);
-
-    // Get parent system prompt for append-mode agents
-    const parentSystemPrompt = ctx.getSystemPrompt();
-
-    // Build prompt extras (memory, skill preloading)
-    const extras: PromptExtras = {};
-
-    // Resolve extensions/skills: isolated overrides to false
-    const extensions = options.isolated ? false : config.extensions;
-    const skills = options.isolated ? false : config.skills;
-
-    // Skill preloading: when skills is string[], preload their content into prompt
-    if (Array.isArray(skills)) {
-      const loaded = preloadSkills(skills, effectiveCwd);
-      if (loaded.length > 0) {
-        extras.skillBlocks = loaded;
-      }
-    }
-
-    let tools = getToolsForType(type, effectiveCwd);
-
-    // Persistent memory: detect write capability and branch accordingly.
-    // Account for disallowedTools — a tool in the base set but on the denylist is not truly available.
-    if (agentConfig?.memory) {
-      const existingNames = new Set(tools.map(t => t.name));
-      const denied = agentConfig.disallowedTools ? new Set(agentConfig.disallowedTools) : undefined;
-      const effectivelyHas = (name: string) => existingNames.has(name) && !denied?.has(name);
-      const hasWriteTools = effectivelyHas("write") || effectivelyHas("edit");
-
-      if (hasWriteTools) {
-        const memTools = getMemoryTools(effectiveCwd, existingNames);
-        if (memTools.length > 0) tools = [...tools, ...memTools];
-        extras.memoryBlock = buildMemoryBlock(agentConfig.name, agentConfig.memory, effectiveCwd);
-      } else {
-        if (!existingNames.has("read")) {
-          const readTools = getReadOnlyMemoryTools(effectiveCwd, existingNames);
-          if (readTools.length > 0) tools = [...tools, ...readTools];
-        }
-        extras.memoryBlock = buildReadOnlyMemoryBlock(agentConfig.name, agentConfig.memory, effectiveCwd);
-      }
+  // Filesystem work happens in effectiveCwd; config discovery in configCwd.
+  // They differ only for SpawnOptions.cwd spawns (config stays with the parent).
+  const configCwd = options.configCwd ?? effectiveCwd;
+
+  const env = await detectEnv(options.pi, effectiveCwd);
+
+  // Get parent system prompt for append-mode agents
+  const parentSystemPrompt = ctx.getSystemPrompt();
+
+  // Build prompt extras (memory, skill preloading)
+  const extras: PromptExtras = {};
+
+  // Resolve extensions/skills: isolated overrides to false
+  const extensions = options.isolated ? false : config.extensions;
+  // Nulling excludes under isolated also suppresses the orphaned-exclude warning —
+  // isolation is an intentional override, not a misconfiguration.
+  const excludeExtensions = options.isolated ? undefined : config.excludeExtensions;
+  const skills = options.isolated ? false : config.skills;
+
+  // Skill preloading: when skills is string[], preload their content into prompt
+  if (Array.isArray(skills)) {
+    const loaded = preloadSkills(skills, configCwd);
+    if (loaded.length > 0) {
+      extras.skillBlocks = loaded;
     }
+  }
 
-    // Build system prompt from agent config
-    let systemPrompt: string;
-    if (agentConfig) {
-      systemPrompt = buildAgentPrompt(agentConfig, effectiveCwd, env, parentSystemPrompt, extras);
+  let toolNames = getToolNamesForType(type);
+
+  // Persistent memory: detect write capability and branch accordingly.
+  // Account for disallowedTools — a tool in the base set but on the denylist is not truly available.
+  if (agentConfig?.memory) {
+    const existingNames = new Set(toolNames);
+    const denied = agentConfig.disallowedTools ? new Set(agentConfig.disallowedTools) : undefined;
+    const effectivelyHas = (name: string) => existingNames.has(name) && !denied?.has(name);
+    const hasWriteTools = effectivelyHas("write") || effectivelyHas("edit");
+
+    if (hasWriteTools) {
+      // Read-write memory: add any missing memory tool names (read/write/edit)
+      const extraNames = getMemoryToolNames(existingNames);
+      if (extraNames.length > 0) toolNames = [...toolNames, ...extraNames];
+      extras.memoryBlock = buildMemoryBlock(agentConfig.name, agentConfig.memory, configCwd);
     } else {
-      systemPrompt = buildAgentPrompt({
-        name: type,
-        description: "General-purpose agent",
-        systemPrompt: "",
-        promptMode: "append",
-        extensions: true,
-        skills: true,
-        inheritContext: false,
-        runInBackground: false,
-        isolated: false,
-      }, effectiveCwd, env, parentSystemPrompt, extras);
+      // Read-only memory: only add read tool name, use read-only prompt
+      const extraNames = getReadOnlyMemoryToolNames(existingNames);
+      if (extraNames.length > 0) toolNames = [...toolNames, ...extraNames];
+      extras.memoryBlock = buildReadOnlyMemoryBlock(agentConfig.name, agentConfig.memory, configCwd);
     }
+  }
 
-    const noSkills = skills === false || Array.isArray(skills);
-
-    const loader = new DefaultResourceLoader({
-      cwd: effectiveCwd,
-      agentDir: `${effectiveCwd}/.pi/agents`,
-      noExtensions: extensions === false,
-      noSkills,
-      noPromptTemplates: true,
-      noThemes: true,
-      systemPromptOverride: () => systemPrompt,
-    });
-    await loader.reload();
-
-    const model = options.model ?? resolveDefaultModel(
-      ctx.model, ctx.modelRegistry, agentConfig?.model,
-    );
-
-    const thinkingLevel = options.thinkingLevel ?? agentConfig?.thinking;
-
-    const sessionOpts: Record<string, unknown> = {
-      cwd: effectiveCwd,
-      sessionManager: SessionManager.inMemory(effectiveCwd),
-      settingsManager: SettingsManager.create(effectiveCwd, `${effectiveCwd}/.pi/agents`),
-      modelRegistry: ctx.modelRegistry,
-      model,
-      tools: tools.map((tool) => tool.name),
-      customTools: tools,
-      resourceLoader: loader,
-    };
-    if (thinkingLevel) {
-      sessionOpts.thinkingLevel = thinkingLevel;
-    }
+  // Build system prompt from agent config
+  let systemPrompt: string;
+  if (agentConfig) {
+    systemPrompt = buildAgentPrompt(agentConfig, effectiveCwd, env, parentSystemPrompt, extras);
+  } else {
+    // Unknown type fallback: spread the canonical general-purpose config (defensive —
+    // unreachable in practice since index.ts resolves unknown types before calling runAgent).
+    const fallback = DEFAULT_AGENTS.get("general-purpose");
+    if (!fallback) throw new Error(`No fallback config available for unknown type "${type}"`);
+    systemPrompt = buildAgentPrompt({ ...fallback, name: type }, effectiveCwd, env, parentSystemPrompt, extras);
+  }
 
-    let createdSession: Awaited<ReturnType<typeof createAgentSession>> | undefined;
-    try {
-      createdSession = await createAgentSession(sessionOpts as Parameters<typeof createAgentSession>[0]);
-    } catch (error) {
-      throw error;
-    }
-    const { session } = createdSession;
-
-    const disallowedSet = agentConfig?.disallowedTools
-      ? new Set(agentConfig.disallowedTools)
-      : undefined;
-
-    if (extensions !== false) {
-      const builtinToolNames = new Set(tools.map(t => t.name));
-      const activeTools = session.getActiveToolNames().filter((t) => {
-        if (EXCLUDED_TOOL_NAMES.includes(t)) return false;
-        if (disallowedSet?.has(t)) return false;
-        if (builtinToolNames.has(t)) return true;
-        if (Array.isArray(extensions)) {
-          return extensions.some(ext => t.startsWith(ext) || t.includes(ext));
-        }
-        return true;
-      });
-      session.setActiveToolsByName(activeTools);
-    } else if (disallowedSet) {
-      const activeTools = session.getActiveToolNames().filter(t => !disallowedSet.has(t));
-      session.setActiveToolsByName(activeTools);
+  // When skills is string[], we've already preloaded them into the prompt.
+  // Still pass noSkills: true since we don't need the skill loader to load them again.
+  const noSkills = skills === false || Array.isArray(skills);
+
+  const agentDir = getAgentDir();
+
+  // Extension loading:
+  // - true  → all default-discovered extensions
+  // - false → none (noExtensions)
+  // - string[] → loader-level allowlist. Bare names keep the matching
+  //   default-discovered extension; path entries load that extension fresh;
+  //   "*" keeps all default-discovered extensions. Excluded extensions never
+  //   bind handlers or register tools (their factory still runs once).
+  //
+  // Suppress AGENTS.md/CLAUDE.md and APPEND_SYSTEM.md — upstream's
+  // buildSystemPrompt() re-appends both AFTER systemPromptOverride, which
+  // would defeat prompt_mode: replace and isolated: true. Parent context, if
+  // wanted, reaches the subagent via prompt_mode: append (parentSystemPrompt
+  // is embedded in systemPromptOverride) or inherit_context (conversation).
+  // `ext:` selectors from the `tools:` CSV narrow which extension tools surface to
+  // the LLM. They do NOT control loading — `extensions:` is the sole authority for
+  // which extensions load. `ext:foo` against an extension that `extensions:` excluded
+  // is an orphan and warns after reload. `isolated` means no extension tools at all.
+  const { extNames, narrowing } = parseExtSelectors(
+    options.isolated ? [] : (agentConfig?.extSelectors ?? []),
+  );
+  const noExtensions = extensions === false;
+
+  const extensionsSpec = Array.isArray(extensions)
+    ? parseExtensionsSpec(extensions, configCwd)
+    : undefined;
+  const keepNames = extensionsSpec?.names ?? new Set<string>();
+  // `exclude_extensions:` is a denylist applied AFTER the include set — exclude wins.
+  // Plain canonical names only (case-insensitive). Note: excluded extensions'
+  // factories still run once during reload() (see comment above) — exclusion
+  // suppresses handler binding and tool registration; it is not a sandbox.
+  const excludeNames = new Set((excludeExtensions ?? []).map((n) => n.toLowerCase()));
+  const hasExcludes = excludeNames.size > 0;
+  // The override filters loaded extensions down to `keepNames` minus `excludeNames`.
+  // It's only needed when we're neither loading everything without excludes
+  // (`extensions: true` or a `"*"` wildcard) nor nothing (`noExtensions`).
+  const loadAll = extensions === true || extensionsSpec?.wildcard === true;
+  const additionalExtensionPaths = extensionsSpec?.paths.length ? extensionsSpec.paths : undefined;
+  // Pre-filter discovered set, captured by the override — the exclude-typo warning
+  // must compare against this, not the surviving set (absence from survivors is
+  // an exclude *succeeding*).
+  let discoveredNames: Set<string> | undefined;
+  const extensionsOverride: ((base: LoadExtensionsResult) => LoadExtensionsResult) | undefined =
+    noExtensions || (loadAll && !hasExcludes)
+      ? undefined
+      : (base) => {
+          discoveredNames = new Set(base.extensions.map((e) => extensionCanonicalName(e.path)));
+          return {
+            ...base,
+            extensions: base.extensions.filter((e) => {
+              const name = extensionCanonicalName(e.path);
+              if (excludeNames.has(name)) return false; // exclude wins
+              return loadAll || keepNames.has(name);
+            }),
+          };
+        };
+
+  const loader = new DefaultResourceLoader({
+    cwd: configCwd,
+    agentDir,
+    noExtensions,
+    additionalExtensionPaths,
+    extensionsOverride,
+    noSkills,
+    noPromptTemplates: true,
+    noThemes: true,
+    noContextFiles: true,
+    systemPromptOverride: () => systemPrompt,
+    appendSystemPromptOverride: () => [],
+  });
+  await loader.reload();
+
+  // Plain entries in `tools:` are expected to be built-in names (extension tools
+  // go through `ext:`), so an unknown name there is unambiguously a typo. Previously
+  // this produced a silently broken agent (#75) — pi-mono accepted the bogus name
+  // into the allowlist, then dropped it at registration with no signal back.
+  if (agentConfig?.builtinToolNames?.length) {
+    const knownBuiltins = new Set(BUILTIN_TOOL_NAMES);
+    for (const name of agentConfig.builtinToolNames) {
+      if (!knownBuiltins.has(name)) {
+        options.onToolActivity?.({
+          type: "end",
+          toolName: `tools-error:tool "${name}" requested by agent "${type}" is not a known built-in`,
+        });
+      }
     }
+  }
 
-    await session.bindExtensions({
-      onError: (err) => {
+  // A subagent spawns mid-task, so a bad `extensions:`/`ext:` entry warns rather
+  // than aborts. Two distinct misconfigurations to catch:
+  //   - `extensions: [foo]` but no extension named foo was discovered (typo or
+  //     path that failed to load — path entries fold their canonical name into
+  //     `keepNames`, so this covers them too).
+  //   - `tools: ext:foo` but foo isn't in the loaded set (because `extensions:`
+  //     didn't include it). Since v0.9, `ext:` no longer pulls extensions in;
+  //     loading is `extensions:`-authoritative.
+  // An exclude_extensions: alongside extensions: false is contradictory — nothing
+  // loads, so there is nothing to exclude.
+  if (hasExcludes && noExtensions) {
+    options.onToolActivity?.({
+      type: "end",
+      toolName: `extension-error:exclude_extensions has no effect for agent "${type}" — extensions: false loads nothing`,
+    });
+  }
+  // Exclude typo check: compares against the PRE-filter discovered set (an excluded
+  // name absent from the surviving set is the exclude working as intended). Also
+  // flags path-like and "*" entries — excludes are plain names only.
+  if (hasExcludes && discoveredNames) {
+    for (const name of excludeNames) {
+      if (!discoveredNames.has(name)) {
         options.onToolActivity?.({
           type: "end",
-          toolName: `extension-error:${err.extensionPath}`,
+          toolName: `extension-error:exclude_extensions: "${name}" for agent "${type}" did not match any discovered extension`,
         });
-      },
-    });
-
-    options.onSessionCreated?.(session);
-    try {
-      const originalDispose = session.dispose?.bind(session);
-      if (originalDispose) {
-        session.dispose = (() => {
-          return originalDispose();
-        }) as typeof session.dispose;
-      }
-    } catch {}
-
-    let turnCount = 0;
-    const maxTurns = normalizeMaxTurns(options.maxTurns ?? agentConfig?.maxTurns ?? defaultMaxTurns);
-    let softLimitReached = false;
-    let aborted = false;
-    let lastTurnError: string | undefined;
-
-    let currentMessageText = "";
-    const unsubTurns = session.subscribe((event: AgentSessionEvent) => {
-      traceSubagentEvent(options.subagentId, event, turnCount);
-      if (event.type === "turn_end") {
-        turnCount++;
-        const msg = (event as any).message;
-        if (msg?.stopReason === "error") {
-          lastTurnError = msg.errorMessage || "Model API error";
-        }
-        options.onTurnEnd?.(turnCount);
-        if (maxTurns != null) {
-          if (!softLimitReached && turnCount >= maxTurns) {
-            softLimitReached = true;
-            session.steer("You have reached your turn limit. Wrap up immediately — provide your final answer now.");
-          } else if (softLimitReached && turnCount >= maxTurns + graceTurns) {
-            aborted = true;
-            session.abort();
-          }
-        }
-      }
-      if (event.type === "message_start") {
-        currentMessageText = "";
       }
-      if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
-        currentMessageText += event.assistantMessageEvent.delta;
-        options.onTextDelta?.(event.assistantMessageEvent.delta, currentMessageText);
-      }
-      if (event.type === "tool_execution_start") {
-        options.onToolActivity?.({ type: "start", toolName: event.toolName });
+    }
+  }
+  if (keepNames.size > 0 || extNames.size > 0) {
+    const survivingNames = new Set(
+      loader.getExtensions().extensions.map((e) => extensionCanonicalName(e.path)),
+    );
+    for (const name of keepNames) {
+      if (!survivingNames.has(name)) {
+        options.onToolActivity?.({
+          type: "end",
+          toolName: excludeNames.has(name)
+            ? `extension-error:extension "${name}" is in both extensions: and exclude_extensions: for agent "${type}" — exclude wins`
+            : `extension-error:extension "${name}" requested by agent "${type}" was not loaded`,
+        });
       }
-      if (event.type === "tool_execution_end") {
-        options.onToolActivity?.({ type: "end", toolName: event.toolName });
+    }
+    for (const name of extNames) {
+      if (!survivingNames.has(name)) {
+        options.onToolActivity?.({
+          type: "end",
+          toolName: `extension-error:ext:${name} referenced by agent "${type}" but extension "${name}" is not loaded (check extensions:/exclude_extensions:)`,
+        });
       }
-    });
-
-    const collector = collectResponseText(session);
-    const cleanupAbort = forwardAbortSignal(session, options.signal);
+    }
+  }
 
-    let effectivePrompt = prompt;
-    if (options.inheritContext) {
-      const parentContext = buildParentContext(ctx);
-      if (parentContext) {
-        effectivePrompt = parentContext + prompt;
+  // Resolve model: explicit option > config.model > parent model
+  const model = options.model ?? resolveDefaultModel(
+    ctx.model, ctx.modelRegistry, agentConfig?.model,
+  );
+
+  // Resolve thinking level: explicit option > agent config > undefined (inherit)
+  const thinkingLevel = options.thinkingLevel ?? agentConfig?.thinking;
+
+  const disallowedSet = agentConfig?.disallowedTools
+    ? new Set(agentConfig.disallowedTools)
+    : undefined;
+
+  // Enumerate extension-registered tool names from the loaded resource loader.
+  // Extensions populate `extension.tools` during `loader.reload()` and the set
+  // is stable afterwards — `bindExtensions` does not register new tools.
+  //
+  // Opt-in flip: when any `ext:` selector is present, extension tools become an
+  // explicit allowlist — a loaded extension not named by a selector contributes
+  // no tools (its handlers still ran), and `ext:foo/bar` narrows `foo` to `bar`.
+  const extensionToolNames: string[] = [];
+  if (!noExtensions) {
+    const optInActive = extNames.size > 0;
+    for (const extension of loader.getExtensions().extensions) {
+      const canon = extensionCanonicalName(extension.path);
+      if (optInActive && !extNames.has(canon)) continue;
+      const narrowed = narrowing.get(canon);
+      for (const toolName of extension.tools.keys()) {
+        if (narrowed && !narrowed.has(toolName)) continue;
+        extensionToolNames.push(toolName);
       }
     }
+  }
 
-    if (options.subagentId) {
-      try {
-        getTracer()?.openSubagent({
-          subagentId: options.subagentId,
-          type: options.subagentType ?? type,
-          description: options.subagentDescription,
-          parentToolCallId: options.parentToolCallId,
-          parentSubagentId,
-          depth: traceDepth,
-          systemPrompt,
-          effectivePrompt,
-        });
-      } catch {}
-    }
+  // Build the master tool allowlist applied at session construction.
+  // pi-mono's `allowedToolNames` gates BOTH registration and the initial active
+  // set, so listing the exact final set here means the session is correctly
+  // scoped from the first instant — no post-construction narrowing required.
+  const builtinToolNameSet = new Set(toolNames);
+  const allowedTools = [...toolNames, ...extensionToolNames].filter((t) => {
+    if (EXCLUDED_TOOL_NAMES.includes(t)) return false;
+    if (disallowedSet?.has(t)) return false;
+    if (builtinToolNameSet.has(t)) return true;
+    // Reached only for extension tools. The extension set was already filtered
+    // at the loader (extensionsOverride / noExtensions) and at enumeration
+    // (`ext:` opt-in flip), so any extension tool in `extensionToolNames` is allowed.
+    return !noExtensions;
+  });
 
-    try {
-      await session.prompt(effectivePrompt);
+  const settingsManager = SettingsManager.create(configCwd, agentDir);
+  const configuredSessionDir = resolveConfiguredSessionDir(agentConfig?.sessionDir, effectiveCwd);
+  const defaultSessionDir = process.env.PI_CODING_AGENT_SESSION_DIR ?? settingsManager.getSessionDir?.();
+  const sessionManager = agentConfig?.persistSession
+    ? SessionManager.create(effectiveCwd, configuredSessionDir ?? defaultSessionDir)
+    : SessionManager.inMemory(effectiveCwd);
+
+  const sessionOpts: Parameters<typeof createAgentSession>[0] = {
+    cwd: effectiveCwd,
+    agentDir,
+    sessionManager,
+    settingsManager,
+    modelRegistry: ctx.modelRegistry,
+    model,
+    tools: allowedTools,
+    resourceLoader: loader,
+  };
+  if (thinkingLevel) {
+    sessionOpts.thinkingLevel = thinkingLevel;
+  }
 
-      if (options.validateCompletion && !aborted) {
-        const maxRetries = options.maxValidationRetries ?? 2;
-        for (let attempt = 0; attempt < maxRetries; attempt++) {
-          const error = options.validateCompletion();
-          if (!error) break;
-          await session.prompt(error);
-          if (aborted) break;
+  const { session } = await createAgentSession(sessionOpts);
+
+  const baseSessionName = agentConfig?.name ?? type;
+  session.setSessionName(
+    options.agentId ? `${baseSessionName}#${options.agentId.slice(0, 8)}` : baseSessionName,
+  );
+
+  // Bind extensions so that session_start fires and extensions can initialize
+  // (e.g. loading credentials, setting up state). Tool gating already happened
+  // at session construction via the `tools:` allowlist above — no separate
+  // post-bind filter is needed. All ExtensionBindings fields are optional.
+  await session.bindExtensions({
+    onError: (err) => {
+      options.onToolActivity?.({
+        type: "end",
+        toolName: `extension-error:${err.extensionPath}`,
+      });
+    },
+  });
+
+  options.onSessionCreated?.(session);
+
+  // Track turns for graceful max_turns enforcement
+  let turnCount = 0;
+  const maxTurns = normalizeMaxTurns(options.maxTurns ?? agentConfig?.maxTurns ?? defaultMaxTurns);
+  let softLimitReached = false;
+  let aborted = false;
+
+  let currentMessageText = "";
+  const unsubTurns = session.subscribe((event: AgentSessionEvent) => {
+    if (event.type === "turn_end") {
+      turnCount++;
+      options.onTurnEnd?.(turnCount);
+      if (maxTurns != null) {
+        if (!softLimitReached && turnCount >= maxTurns) {
+          softLimitReached = true;
+          session.steer("You have reached your turn limit. Wrap up immediately — provide your final answer now.");
+        } else if (softLimitReached && turnCount >= maxTurns + graceTurns) {
+          aborted = true;
+          session.abort();
         }
       }
-    } finally {
-      unsubTurns();
-      collector.unsubscribe();
-      cleanupAbort();
     }
-
-    if (lastTurnError && turnCount <= 1) {
-      throw new Error(lastTurnError);
+    if (event.type === "message_start") {
+      currentMessageText = "";
+    }
+    if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
+      currentMessageText += event.assistantMessageEvent.delta;
+      options.onTextDelta?.(event.assistantMessageEvent.delta, currentMessageText);
+    }
+    if (event.type === "tool_execution_start") {
+      options.onToolActivity?.({ type: "start", toolName: event.toolName });
     }
+    if (event.type === "tool_execution_end") {
+      options.onToolActivity?.({ type: "end", toolName: event.toolName });
+    }
+    if (event.type === "message_end" && event.message.role === "assistant") {
+      const u = (event.message as any).usage;
+      if (u) options.onAssistantUsage?.({
+        input: u.input ?? 0,
+        output: u.output ?? 0,
+        cacheWrite: u.cacheWrite ?? 0,
+      });
+    }
+    if (event.type === "compaction_end" && !event.aborted && event.result) {
+      options.onCompaction?.({ reason: event.reason, tokensBefore: event.result.tokensBefore });
+    }
+  });
+
+  const collector = collectResponseText(session);
+  const cleanupAbort = forwardAbortSignal(session, options.signal);
 
-    const responseText = collector.getText().trim() || getLastAssistantText(session);
-    if (lastTurnError) {
-      const errorSuffix = `\n\n[Agent error on final turn: ${lastTurnError}]`;
-      return { responseText: (responseText || "No output.") + errorSuffix, session, aborted, steered: softLimitReached };
+  // Build the effective prompt: optionally prepend parent context
+  let effectivePrompt = prompt;
+  if (options.inheritContext) {
+    const parentContext = buildParentContext(ctx);
+    if (parentContext) {
+      effectivePrompt = parentContext + prompt;
     }
-    return { responseText, session, aborted, steered: softLimitReached };
+  }
+
+  try {
+    await session.prompt(effectivePrompt);
   } finally {
-    exitSubagentMarker();
+    unsubTurns();
+    collector.unsubscribe();
+    cleanupAbort();
   }
-  });
+
+  const responseText = collector.getText().trim() || getLastAssistantText(session);
+  return { responseText, session, aborted, steered: softLimitReached };
 }
 
 /**
@@ -551,34 +682,39 @@ export async function runAgent(
 export async function resumeAgent(
   session: AgentSession,
   prompt: string,
-  options: { onToolActivity?: (activity: ToolActivity) => void; signal?: AbortSignal; subagentId?: string } = {},
+  options: {
+    onToolActivity?: (activity: ToolActivity) => void;
+    onAssistantUsage?: (usage: { input: number; output: number; cacheWrite: number }) => void;
+    onCompaction?: (info: { reason: "manual" | "threshold" | "overflow"; tokensBefore: number }) => void;
+    signal?: AbortSignal;
+  } = {},
 ): Promise<string> {
   const collector = collectResponseText(session);
   const cleanupAbort = forwardAbortSignal(session, options.signal);
 
-  // Seed from prior assistant turns so resumed turn indexes don't collide with
-  // the turns already written to this subagent's trace file.
-  let resumeTurnCount = session.messages.filter((m) => m.role === "assistant").length;
-  const unsubTrace = session.subscribe((event: AgentSessionEvent) => {
-    traceSubagentEvent(options.subagentId, event, resumeTurnCount);
-    if (event.type === "turn_end") resumeTurnCount++;
-    if (options.onToolActivity) {
-      if (event.type === "tool_execution_start") options.onToolActivity({ type: "start", toolName: event.toolName });
-      if (event.type === "tool_execution_end") options.onToolActivity({ type: "end", toolName: event.toolName });
-    }
-  });
-
-  if (options.subagentId) {
-    try {
-      getTracer()?.traceSubagent(options.subagentId, "resume_start", { prompt });
-    } catch {}
-  }
+  const unsubEvents = (options.onToolActivity || options.onAssistantUsage || options.onCompaction)
+    ? session.subscribe((event: AgentSessionEvent) => {
+        if (event.type === "tool_execution_start") options.onToolActivity?.({ type: "start", toolName: event.toolName });
+        if (event.type === "tool_execution_end") options.onToolActivity?.({ type: "end", toolName: event.toolName });
+        if (event.type === "message_end" && event.message.role === "assistant") {
+          const u = (event.message as any).usage;
+          if (u) options.onAssistantUsage?.({
+            input: u.input ?? 0,
+            output: u.output ?? 0,
+            cacheWrite: u.cacheWrite ?? 0,
+          });
+        }
+        if (event.type === "compaction_end" && !event.aborted && event.result) {
+          options.onCompaction?.({ reason: event.reason, tokensBefore: event.result.tokensBefore });
+        }
+      })
+    : () => {};
 
   try {
     await session.prompt(prompt);
   } finally {
     collector.unsubscribe();
-    unsubTrace();
+    unsubEvents();
     cleanupAbort();
   }