@kushalkhemka/opensec-pi-subagents 0.20.2 → 0.20.3

package/dist/agent-runner.d.ts

@@ -37,6 +37,16 @@ export declare function extensionCanonicalName(extPath: string): string;
  * package name. The path-derived name is preserved, so it keeps matching too.
  */
 export declare function extensionCanonicalNames(extPath: string): string[];
+/**
+ * Built-ins a subagent must not load, whatever the settings say.
+ *
+ * Pi's MCP is off for subagents unless the agent asks for it by naming
+ * `builtin:mcp` in `extensions:`: with it on, every subagent would start its own
+ * set of `mcp.json` servers, one process tree per running child. Pi's CLI flags
+ * apply as in the main session: `--no-mcp` keeps MCP out even when asked for,
+ * and `--no-extensions` keeps all three out.
+ */
+export declare function disabledBuiltinExtensions(mcpRequested: boolean, argv?: readonly string[]): string[] | undefined;
 /**
  * Classify `extensions: string[]` frontmatter entries for the loader-level filter.
  *
@@ -227,6 +237,7 @@ export interface RunOptions {
     model?: Model<any>;
     maxTurns?: number;
     signal?: AbortSignal;
+    /** Applies only when the agent file leaves `isolated:` unset — frontmatter is authoritative. */
     isolated?: boolean;
     inheritContext?: boolean;
     thinkingLevel?: ThinkingLevel;

package/dist/agent-runner.js

@@ -4,7 +4,7 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { createAgentSession, DefaultResourceLoader, getAgentDir, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, createCodemodeExtension, createMcpExtension, createToolSearchExtension, DefaultResourceLoader, getAgentDir, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { BUILTIN_TOOL_NAMES, getAgentConfig, getConfig, getMemoryToolNames, getReadOnlyMemoryToolNames, getToolNamesForType } from "./agent-types.js";
 import { runInChildSessionContext } from "./child-context.js";
 import { buildParentContext, extractText } from "./context.js";
@@ -64,6 +64,9 @@ export function extensionCanonicalName(extPath) {
  * co-located file to `pi-subagents`.
  */
 function extensionPackageName(extPath) {
+    // `builtin:<name>` names no file; climbing from it would read the process cwd's manifest.
+    if (extPath.startsWith("builtin:"))
+        return undefined;
     const entry = resolve(extPath);
     let dir = dirname(extPath);
     for (;;) {
@@ -112,6 +115,37 @@ export function extensionCanonicalNames(extPath) {
 function isExtensionPathEntry(entry) {
     return entry.includes("/") || entry.includes("\\") || entry.startsWith("~");
 }
+/**
+ * Pi's built-in extensions, as its CLI hands them to the loader it builds. A
+ * subagent's loader is built here and would otherwise start with none, so a
+ * `builtin:<name>` entry matched nothing. Forwarded as `builtin:` resources they
+ * load as in the main session: default-on, disabled by `-builtin:<name>` in Pi's
+ * `extensions` setting, and filtered by the agent's `extensions:` like any other
+ * extension. Fresh factories per spawn: MCP state lives in the closure. Pi's
+ * `llama.cpp` built-in is CLI-only (not exported).
+ */
+const BUILTIN_EXTENSION_PATHS = new Set(["builtin:codemode", "builtin:tool-search", "builtin:mcp"]);
+function builtinExtensionFactories() {
+    return [
+        { name: "codemode", factory: createCodemodeExtension(), builtin: true, replaceable: true },
+        { name: "tool-search", factory: createToolSearchExtension(), builtin: true, replaceable: true },
+        { name: "mcp", factory: createMcpExtension(), builtin: true, replaceable: true },
+    ];
+}
+/**
+ * Built-ins a subagent must not load, whatever the settings say.
+ *
+ * Pi's MCP is off for subagents unless the agent asks for it by naming
+ * `builtin:mcp` in `extensions:`: with it on, every subagent would start its own
+ * set of `mcp.json` servers, one process tree per running child. Pi's CLI flags
+ * apply as in the main session: `--no-mcp` keeps MCP out even when asked for,
+ * and `--no-extensions` keeps all three out.
+ */
+export function disabledBuiltinExtensions(mcpRequested, argv = process.argv) {
+    if (argv.some((a) => a === "--no-extensions" || a === "-ne"))
+        return ["codemode", "tool-search", "mcp"];
+    return mcpRequested && !argv.includes("--no-mcp") ? undefined : ["mcp"];
+}
 /**
  * Classify `extensions: string[]` frontmatter entries for the loader-level filter.
  *
@@ -284,10 +318,31 @@ export function installExtensionToolScope(session, ctx) {
             keep.add(name);
         return keep;
     };
+    // Names this agent selects explicitly: its built-ins, injected tools, and
+    // `ext:foo/bar` narrowings. Pi activates a named tool even when it is
+    // `defaultActive: false`, as `--tools` does.
+    const named = new Set([...toolNames, ...readmitToolNames, ...[...narrowing.values()].flatMap((s) => [...s])]);
+    // Activate what Pi itself would: only tools declared to the model (`direct`/
+    // `model-only` exposure), and of those only named ones or ones not opted out
+    // with `defaultActive: false`. `codemode`/`deferred` tools (Pi's MCP tools by
+    // default) stay undeclared until their extension or `tool_search` activates
+    // them — so an already-active in-scope tool is kept, or turn_end would undo that.
     const renarrow = () => {
         const allowed = inScope();
-        const next = session.getAllTools().map((t) => t.name).filter((n) => allowed.has(n));
         const current = session.getActiveToolNames();
+        const active = new Set(current);
+        const next = session
+            .getAllTools()
+            .filter(({ name, exposure = "direct" }) => {
+            if (!allowed.has(name))
+                return false;
+            if (active.has(name))
+                return true;
+            if (exposure !== "direct" && exposure !== "model-only")
+                return false;
+            return named.has(name) || session.getToolDefinition(name)?.defaultActive !== false;
+        })
+            .map((t) => t.name);
         // setActiveToolsByName unconditionally rebuilds the system prompt, so skip
         // the no-op that steady-state turns would otherwise pay for every turn.
         if (next.length !== current.length || next.some((n, i) => n !== current[i])) {
@@ -601,27 +656,44 @@ function resolveConfiguredSessionDir(sessionDir, cwd) {
 export async function runAgent(ctx, type, prompt, options) {
     const config = getConfig(type);
     const agentConfig = getAgentConfig(type);
+    // Everything this run needs from the parent's context, read before the first
+    // await: a background agent keeps running across a session switch, and Pi
+    // invalidates the old session's ctx then (every read throws). The values are
+    // the parent's as of the spawn — its current model and thinking level.
+    const parent = {
+        cwd: ctx.cwd,
+        projectTrusted: isProjectTrustedBy(ctx),
+        systemPrompt: ctx.getSystemPrompt(),
+        model: ctx.model,
+        modelRegistry: ctx.modelRegistry,
+        thinkingLevel: ctx.thinkingLevel,
+        sessionFile: ctx.sessionManager?.getSessionFile?.(),
+        conversation: options.inheritContext ? buildParentContext(ctx) : "",
+    };
     // Resolve working directory: worktree override > parent cwd
-    const effectiveCwd = options.cwd ?? ctx.cwd;
+    const effectiveCwd = options.cwd ?? parent.cwd;
     // Filesystem work happens in effectiveCwd; config discovery in configCwd.
     // They differ only for SpawnOptions.cwd spawns (config stays with the parent).
     const configCwd = options.configCwd ?? effectiveCwd;
     const env = await detectEnv(options.pi, effectiveCwd);
-    const projectTrusted = isProjectTrustedBy(ctx);
+    const projectTrusted = parent.projectTrusted;
     // Get parent system prompt for append-mode agents
-    const parentSystemPrompt = ctx.getSystemPrompt();
+    const parentSystemPrompt = parent.systemPrompt;
     // Build prompt extras (memory, skill preloading)
     const extras = {};
     if (options.worktreeBase)
         extras.worktreeBase = options.worktreeBase;
     if (options.workflow && !options.structuredOutput)
         extras.workflowChild = true;
+    // Resolved here, not by each caller: mention and RPC spawns pass no `isolated`,
+    // and the agent file's value must hold on every path.
+    const isolated = agentConfig?.isolated ?? options.isolated;
     // Resolve extensions/skills: isolated overrides to false
-    const extensions = options.isolated ? false : config.extensions;
+    const extensions = isolated ? false : config.extensions;
     // Nulling excludes under isolated also suppresses the orphaned-exclude warning —
     // isolation is an intentional override, not a misconfiguration.
-    const excludeExtensions = options.isolated ? undefined : config.excludeExtensions;
-    const skills = options.isolated ? false : config.skills;
+    const excludeExtensions = isolated ? undefined : config.excludeExtensions;
+    const skills = isolated ? false : config.skills;
     // Skill preloading: when skills is string[], preload their content into prompt
     if (Array.isArray(skills)) {
         const loaded = preloadSkills(skills, configCwd, { project: projectTrusted });
@@ -689,7 +761,7 @@ export async function runAgent(ctx, type, prompt, options) {
     // the LLM. They do NOT control loading — `extensions:` is the sole authority for
     // which extensions load. `ext:foo` against an extension that `extensions:` excluded
     // is an orphan and warns after reload. `isolated` means no extension tools at all.
-    const { extNames, narrowing } = parseExtSelectors(options.isolated ? [] : (agentConfig?.extSelectors ?? []));
+    const { extNames, narrowing } = parseExtSelectors(isolated ? [] : (agentConfig?.extSelectors ?? []));
     const noExtensions = extensions === false;
     // A path entry loads that file as code, even where Pi itself would load no
     // project extension. From a project agent file it is therefore honoured only
@@ -755,7 +827,11 @@ export async function runAgent(ctx, type, prompt, options) {
         settingsManager,
         noExtensions,
         additionalExtensionPaths,
-        extensionFactories: toolScopeGuard ? [toolScopeGuard.extension] : undefined,
+        extensionFactories: [
+            ...builtinExtensionFactories(),
+            ...(toolScopeGuard ? [toolScopeGuard.extension] : []),
+        ],
+        disabledBuiltinExtensions: disabledBuiltinExtensions(keepNames.has("builtin:mcp")),
         extensionsOverride,
         noSkills,
         noPromptTemplates: true,
@@ -801,7 +877,8 @@ export async function runAgent(ctx, type, prompt, options) {
     // flags path-like and "*" entries — excludes are plain names only.
     if (hasExcludes && discoveredNames) {
         for (const name of excludeNames) {
-            if (!discoveredNames.has(name)) {
+            // A disabled built-in (MCP, by default) is never discovered, and excluding it is still valid.
+            if (!discoveredNames.has(name) && !BUILTIN_EXTENSION_PATHS.has(name)) {
                 options.onToolActivity?.({
                     type: "end",
                     toolName: `extension-error:exclude_extensions: "${name}" for agent "${type}" did not match any discovered extension`,
@@ -831,13 +908,13 @@ export async function runAgent(ctx, type, prompt, options) {
         }
     }
     // Resolve model: explicit option > config.model > parent model
-    const model = options.model ?? resolveDefaultModel(ctx.model, ctx.modelRegistry, agentConfig?.model);
+    const model = options.model ?? resolveDefaultModel(parent.model, parent.modelRegistry, agentConfig?.model);
     // Omitting this SDK option uses saved settings, not the live parent's effort.
     // A reopened session keeps the level it ran with — saved in its file —
     // unless explicitly overridden: neither the parent's current level nor the
     // type's frontmatter (which may have changed since) replaces it.
     const thinkingLevel = options.thinkingLevel
-        ?? (options.resumeSessionFile ? undefined : agentConfig?.thinking ?? ctx.thinkingLevel);
+        ?? (options.resumeSessionFile ? undefined : agentConfig?.thinking ?? parent.thinkingLevel);
     const disallowedSet = agentConfig?.disallowedTools
         ? new Set(agentConfig.disallowedTools)
         : undefined;
@@ -853,7 +930,7 @@ export async function runAgent(ctx, type, prompt, options) {
     const nestedRuntime = options.nestedRuntime && options.nestedRuntime.depth < effectiveMaxDepth
         ? options.nestedRuntime
         : undefined;
-    const nestedTools = agentConfig?.allowedSubagents && nestedRuntime && !options.isolated
+    const nestedTools = agentConfig?.allowedSubagents && nestedRuntime && !isolated
         ? createNestedSubagentTools({
             manager: nestedRuntime.manager,
             pi: options.pi,
@@ -967,19 +1044,19 @@ export async function runAgent(ctx, type, prompt, options) {
                 // `persist_session: true` agent; now it runs for every spawn, so a
                 // context without a session manager (a bare programmatic ctx) must
                 // still persist rather than take the whole spawn down.
-                parentSession: ctx.sessionManager?.getSessionFile?.(),
+                parentSession: parent.sessionFile,
             })
             : SessionManager.inMemory(effectiveCwd);
     // Pi 0.80.8 replaced createAgentSession's modelRegistry option with
     // modelRuntime, but ExtensionContext still exposes only the registry facade.
     // Pass both so the full supported Pi range retains the parent's providers.
-    const parentModelRuntime = ctx.modelRegistry.runtime;
+    const parentModelRuntime = parent.modelRegistry.runtime;
     const sessionOpts = {
         cwd: effectiveCwd,
         agentDir,
         sessionManager,
         settingsManager,
-        modelRegistry: ctx.modelRegistry,
+        modelRegistry: parent.modelRegistry,
         // `as never` is what keeps this assignable across the supported Pi range:
         // pre-0.80.8 the field exists only via the `modelRuntime?: unknown` shim
         // above, while newer Pi types it as `ModelRuntime` — a shape an opaque
@@ -1031,11 +1108,8 @@ export async function runAgent(ctx, type, prompt, options) {
     options.onSessionCreated?.(session);
     // Build the effective prompt: optionally prepend parent context
     let effectivePrompt = prompt;
-    if (options.inheritContext) {
-        const parentContext = buildParentContext(ctx);
-        if (parentContext) {
-            effectivePrompt = parentContext + prompt;
-        }
+    if (options.inheritContext && parent.conversation) {
+        effectivePrompt = parent.conversation + prompt;
     }
     let structuredRetried = false;
     const maxTurns = resolveEffectiveMaxTurns(type, options.maxTurns);

package/dist/completion-outbox.d.ts

@@ -0,0 +1,65 @@
+/**
+ * completion-outbox.ts — When background completions reach the parent.
+ *
+ * Claude Code queues each completion and, after every tool batch, hands the
+ * model everything that queued up in one go: a busy parent sees what finished
+ * during the batch before its next model call, and nothing waits for a sibling.
+ * pi's steering queue would split those into one model call each under its
+ * default `one-at-a-time` mode, so the outbox holds them and sends ONE message
+ * at the boundary instead.
+ *
+ * - Parent busy: held until `turn_end`, which pi emits after the tool batch and
+ *   before it reads the steering queue.
+ * - Parent idle: sent after a short hold, so near-simultaneous completions
+ *   share a turn and `get_subagent_result` still gets a moment to consume one.
+ * - Parent turn aborted (Esc) or failed: held through it — pi clears its own
+ *   queues on Esc — and sent once the run has ended, starting a turn. Claude
+ *   Code keeps an agent's completion queued through Esc the same way and runs
+ *   it as soon as the interrupted turn stops.
+ */
+import type { NotificationDetails } from "./types.js";
+/** How long an idle parent's notification is held before it is sent. */
+export declare const NOTIFICATION_HOLD_MS = 200;
+export interface OutboxMessage {
+    content: string;
+    details: NotificationDetails;
+}
+/**
+ * A notification for one or more agents, built when they finished: a resume
+ * before the send must not rewrite it. Reading an agent's result cancels its
+ * id, and an item left with none is dropped; `build` gets the ids still pending.
+ */
+export interface OutboxItem {
+    ids: string[];
+    build(ids: readonly string[]): OutboxMessage;
+}
+export declare class CompletionOutbox {
+    /** Delivers one message as a steer that triggers a turn when the parent is idle. */
+    private send;
+    /** Whether the parent has a run in flight, so a `turn_end` is coming. */
+    private parentRunning;
+    private items;
+    private timer;
+    constructor(
+    /** Delivers one message as a steer that triggers a turn when the parent is idle. */
+    send: (message: OutboxMessage) => void, 
+    /** Whether the parent has a run in flight, so a `turn_end` is coming. */
+    parentRunning: () => boolean);
+    /** A newer completion of the same agent (a resume) replaces its pending one. */
+    add(item: OutboxItem): void;
+    /** The parent finished a turn: its tool batch is done, the next model call is not. */
+    onTurnEnd(stopReason: string | undefined): void;
+    /** The agent's result was read: it must not also be notified. */
+    cancel(id: string): void;
+    /**
+     * Completions that landed after the run's last `turn_end` would otherwise wait for the next run.
+     * Called at `agent_end` and again at `agent_settled`: one can land while the ending run is still open.
+     */
+    onAgentEnd(): void;
+    /** Ids of everything still waiting to be sent. */
+    pendingIds(): string[];
+    dispose(): void;
+    /** Not reset by later items: the first completion is never pushed back. */
+    private arm;
+    private flush;
+}

package/dist/completion-outbox.js

@@ -0,0 +1,108 @@
+/**
+ * completion-outbox.ts — When background completions reach the parent.
+ *
+ * Claude Code queues each completion and, after every tool batch, hands the
+ * model everything that queued up in one go: a busy parent sees what finished
+ * during the batch before its next model call, and nothing waits for a sibling.
+ * pi's steering queue would split those into one model call each under its
+ * default `one-at-a-time` mode, so the outbox holds them and sends ONE message
+ * at the boundary instead.
+ *
+ * - Parent busy: held until `turn_end`, which pi emits after the tool batch and
+ *   before it reads the steering queue.
+ * - Parent idle: sent after a short hold, so near-simultaneous completions
+ *   share a turn and `get_subagent_result` still gets a moment to consume one.
+ * - Parent turn aborted (Esc) or failed: held through it — pi clears its own
+ *   queues on Esc — and sent once the run has ended, starting a turn. Claude
+ *   Code keeps an agent's completion queued through Esc the same way and runs
+ *   it as soon as the interrupted turn stops.
+ */
+/** How long an idle parent's notification is held before it is sent. */
+export const NOTIFICATION_HOLD_MS = 200;
+export class CompletionOutbox {
+    send;
+    parentRunning;
+    items = [];
+    timer;
+    constructor(
+    /** Delivers one message as a steer that triggers a turn when the parent is idle. */
+    send, 
+    /** Whether the parent has a run in flight, so a `turn_end` is coming. */
+    parentRunning) {
+        this.send = send;
+        this.parentRunning = parentRunning;
+    }
+    /** A newer completion of the same agent (a resume) replaces its pending one. */
+    add(item) {
+        for (const id of item.ids)
+            this.cancel(id);
+        this.items.push(item);
+        if (!this.parentRunning())
+            this.arm();
+    }
+    /** The parent finished a turn: its tool batch is done, the next model call is not. */
+    onTurnEnd(stopReason) {
+        // An aborted turn ends its run; a failed one may be retried. Either way
+        // what is held waits for the next boundary or the run's end — sent now,
+        // it would sit in a queue pi is about to clear.
+        if (stopReason !== "aborted" && stopReason !== "error")
+            this.flush();
+    }
+    /** The agent's result was read: it must not also be notified. */
+    cancel(id) {
+        for (const item of this.items)
+            item.ids = item.ids.filter(i => i !== id);
+        this.items = this.items.filter(item => item.ids.length > 0);
+    }
+    /**
+     * Completions that landed after the run's last `turn_end` would otherwise wait for the next run.
+     * Called at `agent_end` and again at `agent_settled`: one can land while the ending run is still open.
+     */
+    onAgentEnd() {
+        if (this.items.length > 0)
+            this.arm();
+    }
+    /** Ids of everything still waiting to be sent. */
+    pendingIds() {
+        return this.items.flatMap(item => item.ids);
+    }
+    dispose() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = undefined;
+        this.items = [];
+    }
+    /** Not reset by later items: the first completion is never pushed back. */
+    arm() {
+        this.timer ??= setTimeout(() => {
+            this.timer = undefined;
+            this.flush();
+        }, NOTIFICATION_HOLD_MS);
+    }
+    flush() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = undefined;
+        const items = this.items;
+        this.items = [];
+        const messages = items.map(item => item.build(item.ids));
+        if (messages.length === 0)
+            return;
+        // A send from a timer can outlive the session it was meant for (pi -p
+        // tearing down): pi throws on the stale context, and nothing is left to tell.
+        try {
+            this.send(combine(messages));
+        }
+        catch { /* stale context */ }
+    }
+}
+/** One message stays as it was built; several become one message with every agent's details. */
+function combine(messages) {
+    if (messages.length === 1)
+        return messages[0];
+    const [first, ...rest] = messages.flatMap(({ details: { others, ...own } }) => [own, ...(others ?? [])]);
+    return {
+        content: `${messages.length} background tasks finished.\n\n${messages.map(m => m.content).join("\n\n")}`,
+        details: { ...first, others: rest },
+    };
+}

package/dist/cross-extension-rpc.js

@@ -13,6 +13,7 @@
  * completion-notification race, and what protocol version 2 does not promise.
  */
 import { isTopLevelAgent } from "./agent-manager.js";
+import { isModelOverrideAllowed } from "./invocation-config.js";
 import { resolveModel } from "./model-resolver.js";
 import { checkModelScope } from "./model-scope.js";
 /** RPC protocol version — bumped when the envelope or method contracts change. */
@@ -58,6 +59,13 @@ export function registerRpcHandlers(deps) {
         // agent's auth lookup doesn't crash with "No API key found for
         // undefined".
         let normalizedOptions = options ?? {};
+        // Per-call model and thinking choices are refused unless the user turned
+        // on `allowModelOverride`: the agent runs on the parent's current model
+        // and level (or its agent file's), on this path as on every other.
+        if (!isModelOverrideAllowed()) {
+            const { model: _model, thinkingLevel: _thinking, ...rest } = normalizedOptions;
+            normalizedOptions = rest;
+        }
         // `!= null` on purpose: a JSON-forwarding caller can serialize an unset
         // field as null, and the runner reads `options.model ?? default`, so null
         // means "inherit" — not an override to resolve or scope-check.

package/dist/env.js

@@ -1,6 +1,7 @@
 /**
  * env.ts — Detect environment info (git, platform) for subagent system prompts.
  */
+import { commandExec } from "./exec-tree.js";
 /**
  * How long a detection is reused for the same `pi` and cwd. Every spawn needs
  * this, and it costs two sequential git processes (~25 ms), which is most of a
@@ -28,7 +29,7 @@ async function detectEnvUncached(pi, cwd) {
     let isGitRepo = false;
     let branch = "";
     try {
-        const result = await pi.exec("git", ["rev-parse", "--is-inside-work-tree"], { cwd, timeout: 5000 });
+        const result = await commandExec(pi)("git", ["rev-parse", "--is-inside-work-tree"], { cwd, timeout: 5000 });
         isGitRepo = result.code === 0 && result.stdout.trim() === "true";
     }
     catch {
@@ -36,7 +37,7 @@ async function detectEnvUncached(pi, cwd) {
     }
     if (isGitRepo) {
         try {
-            const result = await pi.exec("git", ["branch", "--show-current"], { cwd, timeout: 5000 });
+            const result = await commandExec(pi)("git", ["branch", "--show-current"], { cwd, timeout: 5000 });
             branch = result.code === 0 ? result.stdout.trim() : "unknown";
         }
         catch {

package/dist/exec-tree.js

@@ -132,8 +132,17 @@ export function execTree(command, args, options = {}) {
             timeoutId = setTimeout(kill, options.timeout);
     });
 }
-/** The API objects whose commands run through {@link execTree}. */
-const treeKillingApis = new WeakSet();
+/**
+ * The API objects whose commands run through {@link execTree}. Process-global:
+ * Pi loads a fresh copy of this module for every session, and a background
+ * agent that outlives its session (see session-handoff.ts) still runs git with
+ * the `pi` it was spawned with — stale by then, so its own `exec` throws, while
+ * this one does not need it.
+ */
+const TREE_KILLING_KEY = Symbol.for("pi-subagents:tree-killing-apis");
+const treeKillingGlobal = globalThis;
+treeKillingGlobal[TREE_KILLING_KEY] ??= new WeakSet();
+const treeKillingApis = treeKillingGlobal[TREE_KILLING_KEY];
 /**
  * Run this API object's gate and git commands through {@link execTree}.
  *

package/dist/index.d.ts

@@ -11,11 +11,17 @@
  */
 import { type ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Container } from "@earendil-works/pi-tui";
-import { type AgentConfig } from "./types.js";
+import { type AgentConfig, type AgentRecord } from "./types.js";
 import { type Theme } from "./ui/agent-widget.js";
 import { FOREIGN_WORKFLOW_TOOL_NAMES } from "./workflow/collisions.js";
 import { WORKFLOW_ENTRY_TYPE, type WorkflowEntryData, workflowEntryData } from "./workflow/entry.js";
 export declare function renderRunningAgentStatus(frame: string, statsText: string, activity: string, theme: Pick<Theme, "fg">): Container;
+/**
+ * The `pending` results among a session's entries that no later
+ * `subagents:delivered` entry covers, in order, as record-shaped objects a
+ * notification can be rendered from.
+ */
+export declare function pendingResultsFromEntries(entries: readonly unknown[]): AgentRecord[];
 /**
  * Format an agent's tool scope for the Agent tool description.
  *