@kushalkhemka/opensec-pi-subagents 0.20.1 → 0.20.2

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.2] - 2026-10-16
+
+### Changed
+
+- **Every project is trusted again by default**, as before 0.20.1: subagents load a project's `.pi` extensions and settings, and the extension uses its agents, skills, workflows and `subagents.json`, whatever Pi decided for the folder. To follow Pi's project trust decision instead (0.20.1's behaviour), set `"projectTrust": "pi"` in the global `~/.pi/agent/subagents.json`.
+
 ## [0.20.1] - 2026-10-16
 
 ### Fixed

package/README.md

@@ -116,7 +116,12 @@ them to have more.
 
 ### Project trust
 
-Subagents follow Pi's project trust decision for the parent session.
+By default (`projectTrust: "full"`) subagents and this extension trust every project: a child session loads the
+project's `.pi/extensions` and `.pi/settings.json`, and the extension uses the project's agents, skills, workflows and
+`subagents.json`, whatever Pi decided for the parent session.
+
+To have them follow Pi's project trust decision instead, set `"projectTrust": "pi"` in the global
+`~/.pi/agent/subagents.json` (a project's own file cannot change it). Then:
 
 - In a folder Pi does not trust, subagents load none of the project's `.pi/extensions`, `.pi/settings.json` (for
   example `shellCommandPrefix`), skills or prompts, exactly like the parent. This extension also ignores the project's

package/dist/project-trust.d.ts

@@ -4,8 +4,9 @@
  * Pi 1.x does not load a folder's `.pi` settings, extensions, skills or prompts
  * until the user trusts the folder. Subagents run in sessions this extension
  * builds itself, and this extension reads project files of its own (agents,
- * workflows, skills, `subagents.json`), so both have to follow the decision the
- * parent session made rather than assume trust.
+ * workflows, skills, `subagents.json`). By default (`projectTrust: "full"`) both
+ * trust every project, as before 0.20.1; with `projectTrust: "pi"` in the global
+ * subagents.json they follow the decision the parent session made.
  */
 /**
  * Whether the session behind `ctx` trusts its project.

package/dist/project-trust.js

@@ -4,10 +4,21 @@
  * Pi 1.x does not load a folder's `.pi` settings, extensions, skills or prompts
  * until the user trusts the folder. Subagents run in sessions this extension
  * builds itself, and this extension reads project files of its own (agents,
- * workflows, skills, `subagents.json`), so both have to follow the decision the
- * parent session made rather than assume trust.
+ * workflows, skills, `subagents.json`). By default (`projectTrust: "full"`) both
+ * trust every project, as before 0.20.1; with `projectTrust: "pi"` in the global
+ * subagents.json they follow the decision the parent session made.
  */
 import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { globalProjectTrustMode } from "./settings.js";
+/** Whether Pi's trust decision applies (`projectTrust: "pi"`); otherwise every project is trusted. */
+function followsPiTrust() {
+    try {
+        return globalProjectTrustMode() === "pi";
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Whether the session behind `ctx` trusts its project.
  *
@@ -16,6 +27,8 @@ import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore, Sett
  * context that throws (a session already torn down) is treated as untrusted.
  */
 export function isProjectTrustedBy(ctx) {
+    if (!followsPiTrust())
+        return true;
     if (typeof ctx?.isProjectTrusted !== "function")
         return true;
     try {
@@ -41,6 +54,8 @@ function defaultTrustIsAlways(cwd) {
  * reports otherwise.
  */
 export function predictProjectTrust(cwd) {
+    if (!followsPiTrust())
+        return true;
     try {
         if (!hasTrustRequiringProjectResources(cwd))
             return true;
@@ -65,6 +80,8 @@ export function predictProjectTrust(cwd) {
  * folder as trusted (`/trust`).
  */
 export function isProjectCodeTrusted(trusted, cwd) {
+    if (!followsPiTrust())
+        return true;
     if (!trusted)
         return false;
     try {

package/dist/settings.d.ts

@@ -1,4 +1,5 @@
 import type { AgentMentionMode, JoinMode, ViewerMarkdownMode, WidgetMode } from "./types.js";
+export type ProjectTrustMode = "full" | "pi";
 export interface SubagentsSettings {
     maxConcurrent?: number;
     /**
@@ -96,6 +97,17 @@ export interface SubagentsSettings {
      * Defaults to false.
      */
     strictAgentFiles?: boolean;
+    /**
+     * Which project files subagents and this extension may use.
+     * - "full" (default): every project's agents, skills, workflows, `subagents.json`,
+     *   agent-file `extensions:` and, in child sessions, its `.pi` extensions and settings,
+     *   as before 0.20.1.
+     * - "pi": follow Pi's trust decision for the folder: an untrusted project's files are
+     *   not used, and project code needs a saved decision (`/trust`).
+     * Read from the global `~/.pi/agent/subagents.json` only: a project's own file cannot
+     * decide whether that project is trusted.
+     */
+    projectTrust?: ProjectTrustMode;
     /**
      * When true, the three built-in default agents (general-purpose, Explore, Plan)
      * are not registered at startup. User-defined agents from project/global custom
@@ -335,6 +347,8 @@ export type SettingsEmit = (event: string, payload: unknown) => void;
  * `project: false` reads the global file only — the project is not trusted,
  * and Pi ignores its `.pi/settings.json` too.
  */
+/** `projectTrust` from the global settings file (see `SubagentsSettings.projectTrust`). */
+export declare function globalProjectTrustMode(): ProjectTrustMode;
 export declare function loadSettings(cwd?: string, project?: boolean): SubagentsSettings;
 /**
  * Write project-local settings. Global is never touched from code.

package/dist/settings.js

@@ -72,6 +72,9 @@ function sanitize(raw) {
     if (typeof r.strictAgentFiles === "boolean") {
         out.strictAgentFiles = r.strictAgentFiles;
     }
+    if (r.projectTrust === "full" || r.projectTrust === "pi") {
+        out.projectTrust = r.projectTrust;
+    }
     if (typeof r.disableDefaultAgents === "boolean") {
         out.disableDefaultAgents = r.disableDefaultAgents;
     }
@@ -158,6 +161,10 @@ function readSettingsFile(path) {
  * `project: false` reads the global file only — the project is not trusted,
  * and Pi ignores its `.pi/settings.json` too.
  */
+/** `projectTrust` from the global settings file (see `SubagentsSettings.projectTrust`). */
+export function globalProjectTrustMode() {
+    return readSettingsFile(globalPath()).projectTrust ?? "full";
+}
 export function loadSettings(cwd = process.cwd(), project = true) {
     return { ...readSettingsFile(globalPath()), ...(project ? readSettingsFile(projectPath(cwd)) : {}) };
 }

package/docs/workflows.md

@@ -124,7 +124,7 @@ A script you will run more than once belongs somewhere durable. Copy it out of t
 
 First hit wins, in that order, so a project file shadows a same-named global one.
 
-The two project locations are used only when Pi trusts the project to run its own code: the folder was trusted at Pi's prompt (or by `defaultProjectTrust`, or a CLI flag), or `/trust` recorded it. Pi trusts a folder without asking when it holds nothing Pi gates, and `.pi/workflows` is not gated, so a cloned repo that ships only workflows does not get them run by name until you run `/trust`. A refused name says so and runs nothing.
+With `"projectTrust": "pi"` in the global subagents.json (the default, `"full"`, uses them in every project), the two project locations are used only when Pi trusts the project to run its own code: the folder was trusted at Pi's prompt (or by `defaultProjectTrust`, or a CLI flag), or `/trust` recorded it. Pi trusts a folder without asking when it holds nothing Pi gates, and `.pi/workflows` is not gated, so a cloned repo that ships only workflows does not get them run by name until you run `/trust`. A refused name says so and runs nothing.
 
 The file must carry an `export const meta = { name, description }` declaration. Those are ordinary directories that may hold anything, so that declaration is what marks a file as a workflow — name something else and you are told it is not a workflow rather than getting a parse error from halfway through it. Nothing in the file is executed to decide that.
 
@@ -288,7 +288,7 @@ The child runs in the *same* worker and vm context under its own globals, so it
 |---|---|
 | An inline script, as run | `<tmp>/pi-subagents-<uid>/<encoded-cwd>/<session>/tasks/<run id>.workflow.js` |
 | The resume journal | the same directory, `<run id>.workflow.jsonl` |
-| Saved workflows | `.pi/workflows/` → `.agents/workflows/` → `<agent dir>/workflows/`, first hit wins (project locations only in a project trusted to run its code) |
+| Saved workflows | `.pi/workflows/` → `.agents/workflows/` → `<agent dir>/workflows/`, first hit wins (with `projectTrust: "pi"`, project locations only in a project trusted to run its code) |
 
 The first two are scratch: temp storage, wiped by a reboot or a temp sweep. Only the third is durable, and copying a script there is a manual step.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kushalkhemka/opensec-pi-subagents",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "OpenSec Subagents for Pi: a fork of @tintinweb/pi-subagents with parent model and thinking-level inheritance and cached agent discovery.",
   "author": "OpenSec",
   "contributors": [

package/src/index.ts

@@ -3827,9 +3827,10 @@ Write the file using the write tool. Only write the file, nothing else.`;
   // Compile-time completeness guard for snapshotSettings(). If a field is added
   // to SubagentsSettings and not mirrored above, this Exclude is non-empty and
   // fails to satisfy `never` — turning a silent settings-erasure bug into a
-  // typecheck error. `npm run typecheck` runs in CI.
+  // typecheck error. `npm run typecheck` runs in CI. (`projectTrust` is read from the
+  // global file only, so it is never part of the project snapshot.)
   type _NoMissingSettingsKeys =
-    Exclude<keyof SubagentsSettings, keyof ReturnType<typeof snapshotSettings>> extends never
+    Exclude<keyof SubagentsSettings, keyof ReturnType<typeof snapshotSettings> | "projectTrust"> extends never
       ? true
       : ["snapshotSettings() is missing a SubagentsSettings key"];
   const _settingsSnapshotIsComplete: _NoMissingSettingsKeys = true;

package/src/project-trust.ts

@@ -4,8 +4,9 @@
  * Pi 1.x does not load a folder's `.pi` settings, extensions, skills or prompts
  * until the user trusts the folder. Subagents run in sessions this extension
  * builds itself, and this extension reads project files of its own (agents,
- * workflows, skills, `subagents.json`), so both have to follow the decision the
- * parent session made rather than assume trust.
+ * workflows, skills, `subagents.json`). By default (`projectTrust: "full"`) both
+ * trust every project, as before 0.20.1; with `projectTrust: "pi"` in the global
+ * subagents.json they follow the decision the parent session made.
  */
 
 import {
@@ -14,6 +15,16 @@ import {
   ProjectTrustStore,
   SettingsManager,
 } from "@earendil-works/pi-coding-agent";
+import { globalProjectTrustMode } from "./settings.js";
+
+/** Whether Pi's trust decision applies (`projectTrust: "pi"`); otherwise every project is trusted. */
+function followsPiTrust(): boolean {
+  try {
+    return globalProjectTrustMode() === "pi";
+  } catch {
+    return false;
+  }
+}
 
 /**
  * Whether the session behind `ctx` trusts its project.
@@ -23,6 +34,7 @@ import {
  * context that throws (a session already torn down) is treated as untrusted.
  */
 export function isProjectTrustedBy(ctx: { isProjectTrusted?: () => boolean } | undefined): boolean {
+  if (!followsPiTrust()) return true;
   if (typeof ctx?.isProjectTrusted !== "function") return true;
   try {
     return ctx.isProjectTrusted() === true;
@@ -49,6 +61,7 @@ function defaultTrustIsAlways(cwd: string): boolean {
  * reports otherwise.
  */
 export function predictProjectTrust(cwd: string): boolean {
+  if (!followsPiTrust()) return true;
   try {
     if (!hasTrustRequiringProjectResources(cwd)) return true;
     const saved = savedDecision(cwd);
@@ -71,6 +84,7 @@ export function predictProjectTrust(cwd: string): boolean {
  * folder as trusted (`/trust`).
  */
 export function isProjectCodeTrusted(trusted: boolean, cwd: string): boolean {
+  if (!followsPiTrust()) return true;
   if (!trusted) return false;
   try {
     return hasTrustRequiringProjectResources(cwd) || savedDecision(cwd) === true || defaultTrustIsAlways(cwd);

package/src/settings.ts

@@ -9,6 +9,8 @@ import { NO_FALLBACK } from "./agent-types.js";
 import { createDiscoveryCache } from "./discovery-cache.js";
 import type { AgentMentionMode, JoinMode, ViewerMarkdownMode, WidgetMode } from "./types.js";
 
+export type ProjectTrustMode = "full" | "pi";
+
 export interface SubagentsSettings {
   maxConcurrent?: number;
   /**
@@ -106,6 +108,17 @@ export interface SubagentsSettings {
    * Defaults to false.
    */
   strictAgentFiles?: boolean;
+  /**
+   * Which project files subagents and this extension may use.
+   * - "full" (default): every project's agents, skills, workflows, `subagents.json`,
+   *   agent-file `extensions:` and, in child sessions, its `.pi` extensions and settings,
+   *   as before 0.20.1.
+   * - "pi": follow Pi's trust decision for the folder: an untrusted project's files are
+   *   not used, and project code needs a saved decision (`/trust`).
+   * Read from the global `~/.pi/agent/subagents.json` only: a project's own file cannot
+   * decide whether that project is trusted.
+   */
+  projectTrust?: ProjectTrustMode;
   /**
    * When true, the three built-in default agents (general-purpose, Explore, Plan)
    * are not registered at startup. User-defined agents from project/global custom
@@ -424,6 +437,9 @@ function sanitize(raw: unknown): SubagentsSettings {
   if (typeof r.strictAgentFiles === "boolean") {
     out.strictAgentFiles = r.strictAgentFiles;
   }
+  if (r.projectTrust === "full" || r.projectTrust === "pi") {
+    out.projectTrust = r.projectTrust;
+  }
   if (typeof r.disableDefaultAgents === "boolean") {
     out.disableDefaultAgents = r.disableDefaultAgents;
   }
@@ -514,6 +530,11 @@ function readSettingsFile(path: string): SubagentsSettings {
  * `project: false` reads the global file only — the project is not trusted,
  * and Pi ignores its `.pi/settings.json` too.
  */
+/** `projectTrust` from the global settings file (see `SubagentsSettings.projectTrust`). */
+export function globalProjectTrustMode(): ProjectTrustMode {
+  return readSettingsFile(globalPath()).projectTrust ?? "full";
+}
+
 export function loadSettings(cwd: string = process.cwd(), project = true): SubagentsSettings {
   return { ...readSettingsFile(globalPath()), ...(project ? readSettingsFile(projectPath(cwd)) : {}) };
 }