@kushalkhemka/opensec-pi-subagents 0.20.5 → 0.20.6

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.6] - 2026-10-17
+
+Restores four fixes the Bun build had in 0.19.5-bun.6 to bun.8 (and 0.19.4-bun.0) that were lost when 0.20.x was
+cut from the Node sources. Both builds have them again.
+
+### Added
+
+- **Codemode scripts get a deadline.** Pi runs a `codemode` script with no time limit unless its first line sets
+  `timeout_ms`, so one stuck call held the agent forever. Scripts that set none now get `codemodeTimeoutSeconds`
+  (setting; default 1800, 0 = off), in the main session and in subagents; a deadline the script sets is kept.
+- **Codemode audit trail.** Every call a codemode script makes is written to
+  `$PI_CODEMODE_AUDIT_DIR/<session>/<call id>.log` (default `<agent dir>/opensec/codemode/`): the structured output
+  the script received (bash: up to 1 MiB), the exit code and the full-output path, capped per script by
+  `PI_CODEMODE_AUDIT_MAX_BYTES` (default 16 MiB). The script's result names the file and says that its filtered
+  output is not proof that something is absent; the script's structured result is kept.
+
+### Fixed
+
+- **A subagent's `bash` calls made by another tool are bounded too.** The subagent tool timeout only reached calls
+  the model made directly; calls a codemode script, `ctx.executeTool()` or a deferred tool made ran without a limit.
+  Since 0.20.3 loads codemode in every subagent, that was most of them. The subagent's tool-scope guard now sets the
+  timeout on every call path.
+- **Workflow scripts report the right line numbers on Bun.** Bun ignores a negative `lineOffset`, so every stack
+  frame pointed one line below the line the author wrote. The wrapper now needs no offset on either runtime.
+
 ## [0.20.5] - 2026-10-16
 
 Orchestration results the main agent can act on: failed runs are error results with what they produced, unfinished

package/README.md

@@ -313,6 +313,7 @@ To have them follow Pi's project trust decision instead, set `"projectTrust": "p
 | `backgroundKey` (`subagents.json`) | `ctrl+b` | Key that sends running foreground `Agent` calls to the background (see [Sending a foreground agent to the background](#sending-a-foreground-agent-to-the-background)); `"off"` disables it. |
 | Model override (`/agents → Settings`, `allowModelOverride`) | `false` | Whether a spawn's own `model` / `thinking` (Agent tool, nested tool, workflow `agent()`, scheduled jobs, RPC) may choose the subagent's model and thinking level. Off: subagents run on the parent's current model and level unless their agent file sets one, and the tools do not offer the parameters. |
 | Tool timeout (`/agents → Settings`, `toolTimeoutSeconds`) | `1200` | Seconds one subagent tool call may run (`0` = no limit). A `bash` call is killed at the limit and the agent sees the timeout; any other tool still running a minute later is stopped and the agent is told to continue another way (up to 3 times per run). The main agent's `bash` calls get the same timeout when they set none; a timeout the main agent asks for is kept. |
+| `codemodeTimeoutSeconds` (`subagents.json`) | `1800` | Deadline in seconds for a Pi `codemode` script whose first line sets no `timeout_ms` (`0` = none), in the main agent and in subagents; a deadline the script sets is kept. Every call a script makes is logged raw to `$PI_CODEMODE_AUDIT_DIR/<session>/<call id>.log` (default `<agent dir>/opensec/codemode/`, capped at `PI_CODEMODE_AUDIT_MAX_BYTES`, default 16 MiB), and the script's result names the file. |
 
 ## Notes
 

package/dist/agent-runner.d.ts

@@ -90,7 +90,8 @@ export interface ToolScopeGuard {
     setScope(inScope: () => Set<string>): void;
 }
 /**
- * A `tool_call` handler that blocks out-of-scope tools for every call path.
+ * A `tool_call` handler that blocks out-of-scope tools for every call path, and
+ * gives in-scope `bash` calls the tool timeout (see `toolTimeoutSeconds`).
  *
  * Replacing `session.agent.beforeToolCall` only covers calls the model makes
  * directly. Pi 1.0 also lets tools call tools (`ctx.executeTool()`, used by
@@ -203,7 +204,10 @@ export declare function boundBashTimeout(args: unknown, limitSeconds: number, ca
 /**
  * Bound a subagent session's tool calls (see `toolTimeoutSeconds`).
  *
- * `bash` calls without a timeout, or with a longer one, get the limit. The
+ * `bash` calls without a timeout, or with a longer one, get the limit: through
+ * the inline `tool_call` guard when the session loaded extensions (every call
+ * path), otherwise by wrapping `session.agent.beforeToolCall` (a session without
+ * extensions loads no built-ins either, so no tool calls tools). The
  * watchdog covers every tool: past the limit (plus slack) it aborts the run,
  * which kills a running command's process tree, and `takeHung()` then reports
  * the call so the caller can resume the agent with `hungToolPrompt()`. When the

package/dist/agent-runner.js

@@ -7,6 +7,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { createAgentSession, createCodemodeExtension, createMcpExtension, createToolSearchExtension, DefaultResourceLoader, getAgentDir, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { BUILTIN_TOOL_NAMES, getAgentConfig, getConfig, getMemoryToolNames, getReadOnlyMemoryToolNames, getToolNamesForType } from "./agent-types.js";
 import { runInChildSessionContext } from "./child-context.js";
+import { boundCodemodeTimeout, CODEMODE_TOOL_NAME, createCodemodeAudit, getCodemodeTimeoutSeconds } from "./codemode-guard.js";
 import { buildParentContext, extractText } from "./context.js";
 import { DEFAULT_AGENTS } from "./default-agents.js";
 import { detectEnv } from "./env.js";
@@ -227,7 +228,8 @@ const TOOL_SCOPE_GUARD_NAME = "subagent-tool-scope";
 /** The loader path pi gives that inline extension. */
 export const TOOL_SCOPE_GUARD_PATH = `<inline:${TOOL_SCOPE_GUARD_NAME}>`;
 /**
- * A `tool_call` handler that blocks out-of-scope tools for every call path.
+ * A `tool_call` handler that blocks out-of-scope tools for every call path, and
+ * gives in-scope `bash` calls the tool timeout (see `toolTimeoutSeconds`).
  *
  * Replacing `session.agent.beforeToolCall` only covers calls the model makes
  * directly. Pi 1.0 also lets tools call tools (`ctx.executeTool()`, used by
@@ -243,11 +245,23 @@ export function createToolScopeGuard() {
             name: TOOL_SCOPE_GUARD_NAME,
             hidden: true,
             factory: (pi) => {
-                pi.on("tool_call", (event) => {
-                    if (!inScope || inScope().has(event.toolName))
-                        return undefined;
-                    return { block: true, reason: `Tool "${event.toolName}" is not available to this subagent.` };
+                const audit = createCodemodeAudit();
+                pi.on("tool_call", (event, ctx) => {
+                    if (inScope && !inScope().has(event.toolName)) {
+                        return { block: true, reason: `Tool "${event.toolName}" is not available to this subagent.` };
+                    }
+                    // Pi executes the same input object, so this bounds the running call,
+                    // including calls another tool makes (codemode, ctx.executeTool), which
+                    // never pass through session.agent.beforeToolCall.
+                    if (event.toolName === "bash")
+                        boundBashTimeout(event.input, toolTimeoutSeconds, true);
+                    if (event.toolName === CODEMODE_TOOL_NAME)
+                        boundCodemodeTimeout(event.input, getCodemodeTimeoutSeconds());
+                    audit.recordCall(event, ctx);
+                    return undefined;
                 });
+                // Keeps the raw output of every call a codemode script makes; see codemode-guard.ts.
+                pi.on("tool_result", (event) => audit.onToolResult(event));
             },
         },
         setScope(fn) {
@@ -470,10 +484,19 @@ export function boundBashTimeout(args, limitSeconds, cap) {
         call.timeout = limitSeconds;
     }
 }
+/**
+ * Sessions whose `bash` calls are already bounded by the inline `tool_call`
+ * guard. Those must not also get the `beforeToolCall` patch: the guard covers
+ * nested calls too, and pi's own `beforeToolCall` is what runs the guard.
+ */
+const toolCallBoundSessions = new WeakSet();
 /**
  * Bound a subagent session's tool calls (see `toolTimeoutSeconds`).
  *
- * `bash` calls without a timeout, or with a longer one, get the limit. The
+ * `bash` calls without a timeout, or with a longer one, get the limit: through
+ * the inline `tool_call` guard when the session loaded extensions (every call
+ * path), otherwise by wrapping `session.agent.beforeToolCall` (a session without
+ * extensions loads no built-ins either, so no tool calls tools). The
  * watchdog covers every tool: past the limit (plus slack) it aborts the run,
  * which kills a running command's process tree, and `takeHung()` then reports
  * the call so the caller can resume the agent with `hungToolPrompt()`. When the
@@ -485,12 +508,15 @@ export function installToolTimeouts(session, limitSeconds = toolTimeoutSeconds)
         return { takeHung: () => undefined, stuck: new Promise(() => { }), dispose: () => { } };
     let resolveStuck;
     const stuck = new Promise(resolve => { resolveStuck = resolve; });
+    const patchBeforeToolCall = !toolCallBoundSessions.has(session);
     const priorBeforeToolCall = session.agent.beforeToolCall;
-    session.agent.beforeToolCall = async (context, signal) => {
-        if (context.toolCall.name === "bash")
-            boundBashTimeout(context.args, limitSeconds, true);
-        return priorBeforeToolCall?.(context, signal);
-    };
+    if (patchBeforeToolCall) {
+        session.agent.beforeToolCall = async (context, signal) => {
+            if (context.toolCall.name === "bash")
+                boundBashTimeout(context.args, limitSeconds, true);
+            return priorBeforeToolCall?.(context, signal);
+        };
+    }
     const running = new Map();
     let hung;
     let hungAt = 0;
@@ -535,7 +561,8 @@ export function installToolTimeouts(session, limitSeconds = toolTimeoutSeconds)
         dispose() {
             clearInterval(timer);
             unsubscribe();
-            session.agent.beforeToolCall = priorBeforeToolCall;
+            if (patchBeforeToolCall)
+                session.agent.beforeToolCall = priorBeforeToolCall;
         },
     };
 }
@@ -1084,6 +1111,8 @@ export async function runAgent(ctx, type, prompt, options) {
         sessionOpts.thinkingLevel = thinkingLevel;
     }
     const { session } = await runInChildSessionContext(() => createAgentSession(sessionOpts));
+    if (toolScopeGuard)
+        toolCallBoundSessions.add(session);
     const baseSessionName = agentConfig?.name ?? type;
     session.setSessionName(options.agentId ? `${baseSessionName}#${options.agentId.slice(0, 8)}` : baseSessionName);
     // Bind extensions so that session_start fires and extensions can initialize

package/dist/codemode-guard.d.ts

@@ -0,0 +1,44 @@
+import { type ToolResultEvent, type ToolResultEventResult } from "@earendil-works/pi-coding-agent";
+export declare const CODEMODE_TOOL_NAME = "codemode";
+export declare const CODEMODE_TIMEOUT_CEILING = 86400;
+/** Deadline in seconds given to codemode scripts that set none (0 = leave them unbounded). */
+export declare function getCodemodeTimeoutSeconds(): number;
+export declare function setCodemodeTimeoutSeconds(n: number): void;
+/**
+ * Give a codemode call a `timeout_ms` when its script sets none. Pi executes the same input
+ * object the `tool_call` handlers receive, so this changes the running script.
+ *
+ * - No options line: one is added. Line numbers in script errors then count from 2.
+ * - An options line without `timeout_ms`: the field is added to it.
+ * - An options line that sets `timeout_ms`, or that is not a JSON object: left as it is
+ *   (codemode itself reports a malformed line to the model).
+ */
+export declare function boundCodemodeTimeout(input: unknown, seconds: number): void;
+/** Default cap on one script's audit log; set `PI_CODEMODE_AUDIT_MAX_BYTES` to change it. */
+export declare const DEFAULT_AUDIT_MAX_BYTES: number;
+/** Where raw outputs of codemode script calls are kept: `PI_CODEMODE_AUDIT_DIR`, else `<agent dir>/opensec/codemode`. */
+export declare function codemodeAuditRoot(): string;
+interface ToolCallLike {
+    toolName: string;
+    toolCallId: string;
+}
+interface HandlerCtx {
+    sessionManager?: {
+        getSessionId?: () => string;
+    };
+}
+export interface CodemodeAudit {
+    /** Call from the session's (single) `tool_call` handler for every call that is allowed to run. */
+    recordCall(event: ToolCallLike, ctx?: HandlerCtx): void;
+    /** Register as a `tool_result` handler. */
+    onToolResult(event: ToolResultEvent): ToolResultEventResult | undefined;
+}
+/**
+ * The audit trail for one session. Every call a codemode script makes (a `tool_result` with a
+ * `parentToolCallId`) is appended to `<root>/<session>/<script call id>.log`, and the script's own
+ * result gets a line naming that file. Each script's log is capped (`PI_CODEMODE_AUDIT_MAX_BYTES`,
+ * default 16 MiB); past the cap only call headers are written. A write failure never fails a
+ * tool call; the note then says the raw outputs could not be saved.
+ */
+export declare function createCodemodeAudit(): CodemodeAudit;
+export {};

package/dist/codemode-guard.js

@@ -0,0 +1,189 @@
+// Guards for pi's built-in `codemode` tool (a model-written script that calls other tools).
+//
+// - A deadline: codemode scripts run with no time limit unless the script's first line sets
+//   `timeout_ms` (`// @options: {"timeout_ms": …}`), so one stuck call held the agent forever.
+//   Scripts that set none get `codemodeTimeoutSeconds` (default 30 minutes).
+// - An audit trail: only the script's own output reaches the model, so a wrong filter can make
+//   a real hit look like "0 matches" with no trace. The raw output of every call a script makes
+//   is written to disk, and the script's result says where, and that it is not proof of absence.
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+export const CODEMODE_TOOL_NAME = "codemode";
+const OPTIONS_PREFIX = "// @options:";
+/** Largest `timeout_ms` codemode accepts (the `setTimeout` limit). */
+const MAX_TIMEOUT_MS = 2_147_483_647;
+export const CODEMODE_TIMEOUT_CEILING = 86_400;
+let codemodeTimeoutSeconds = 1800;
+/** Deadline in seconds given to codemode scripts that set none (0 = leave them unbounded). */
+export function getCodemodeTimeoutSeconds() { return codemodeTimeoutSeconds; }
+export function setCodemodeTimeoutSeconds(n) {
+    codemodeTimeoutSeconds = Math.min(CODEMODE_TIMEOUT_CEILING, Math.max(0, Math.floor(n)));
+}
+/**
+ * Give a codemode call a `timeout_ms` when its script sets none. Pi executes the same input
+ * object the `tool_call` handlers receive, so this changes the running script.
+ *
+ * - No options line: one is added. Line numbers in script errors then count from 2.
+ * - An options line without `timeout_ms`: the field is added to it.
+ * - An options line that sets `timeout_ms`, or that is not a JSON object: left as it is
+ *   (codemode itself reports a malformed line to the model).
+ */
+export function boundCodemodeTimeout(input, seconds) {
+    if (seconds <= 0 || !input || typeof input !== "object")
+        return;
+    const call = input;
+    if (typeof call.code !== "string" || call.code.trim() === "")
+        return;
+    const timeoutMs = Math.min(MAX_TIMEOUT_MS, seconds * 1000);
+    const code = call.code;
+    const newline = code.indexOf("\n");
+    const firstLine = (newline === -1 ? code : code.slice(0, newline)).replace(/\r$/, "");
+    const trimmed = firstLine.trimStart();
+    if (!trimmed.startsWith(OPTIONS_PREFIX)) {
+        call.code = `${OPTIONS_PREFIX} ${JSON.stringify({ timeout_ms: timeoutMs })}\n${code}`;
+        return;
+    }
+    let options;
+    try {
+        options = JSON.parse(trimmed.slice(OPTIONS_PREFIX.length).trim());
+    }
+    catch {
+        return;
+    }
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        return;
+    if (options.timeout_ms !== undefined)
+        return;
+    const rest = newline === -1 ? "" : code.slice(newline);
+    call.code = `${OPTIONS_PREFIX} ${JSON.stringify({ ...options, timeout_ms: timeoutMs })}${rest}`;
+}
+/** Default cap on one script's audit log; set `PI_CODEMODE_AUDIT_MAX_BYTES` to change it. */
+export const DEFAULT_AUDIT_MAX_BYTES = 16 * 1024 * 1024;
+function auditMaxBytes() {
+    const n = Number(process.env.PI_CODEMODE_AUDIT_MAX_BYTES);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_AUDIT_MAX_BYTES;
+}
+/** Where raw outputs of codemode script calls are kept: `PI_CODEMODE_AUDIT_DIR`, else `<agent dir>/opensec/codemode`. */
+export function codemodeAuditRoot() {
+    const configured = process.env.PI_CODEMODE_AUDIT_DIR?.trim();
+    return configured ? resolve(configured) : join(getAgentDir(), "opensec", "codemode");
+}
+const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "-");
+/**
+ * What a script received from one call. A script gets a tool's structured result when it has one:
+ * for `bash`, `structuredContent.output` holds up to 1 MiB, where the text the model would see from
+ * a direct call stops at 50 KB / 2,000 lines. So log the structured output when there is one, and
+ * any path pi wrote the complete output to.
+ */
+function rawOutput(event) {
+    const meta = [];
+    const structured = event.structuredContent;
+    let body;
+    if (structured && typeof structured === "object" && !Array.isArray(structured)) {
+        const record = structured;
+        if (typeof record.output === "string") {
+            body = record.output;
+            if (record.exit_code !== undefined)
+                meta.push(`exit_code: ${String(record.exit_code)}`);
+            if (record.truncated === true)
+                meta.push("truncated: true (the script got the first and last 512 KiB)");
+            if (typeof record.full_output_path === "string")
+                meta.push(`full output: ${record.full_output_path}`);
+        }
+        else {
+            meta.push(`structured: ${JSON.stringify(structured)}`);
+        }
+    }
+    else if (structured !== undefined) {
+        meta.push(`structured: ${JSON.stringify(structured)}`);
+    }
+    const details = event.details;
+    if (details && typeof details === "object") {
+        const fullOutputPath = details.fullOutputPath;
+        if (typeof fullOutputPath === "string" && !meta.some((m) => m.endsWith(fullOutputPath))) {
+            meta.push(`full output: ${fullOutputPath}`);
+        }
+    }
+    if (body === undefined) {
+        body = (event.content ?? []).map((c) => (c.type === "text" ? c.text : `[${c.type}]`)).join("\n");
+    }
+    return { body, meta };
+}
+/**
+ * The audit trail for one session. Every call a codemode script makes (a `tool_result` with a
+ * `parentToolCallId`) is appended to `<root>/<session>/<script call id>.log`, and the script's own
+ * result gets a line naming that file. Each script's log is capped (`PI_CODEMODE_AUDIT_MAX_BYTES`,
+ * default 16 MiB); past the cap only call headers are written. A write failure never fails a
+ * tool call; the note then says the raw outputs could not be saved.
+ */
+export function createCodemodeAudit() {
+    const scripts = new Map();
+    const recordCall = (event, ctx) => {
+        if (event.toolName !== CODEMODE_TOOL_NAME)
+            return;
+        const session = safe(ctx?.sessionManager?.getSessionId?.() ?? "session");
+        scripts.set(event.toolCallId, {
+            file: join(codemodeAuditRoot(), session, `${safe(event.toolCallId)}.log`),
+            calls: 0,
+            bytes: 0,
+            capped: false,
+        });
+    };
+    const onToolResult = (event) => {
+        if (event.parentToolCallId) {
+            const script = scripts.get(event.parentToolCallId);
+            if (!script)
+                return undefined;
+            script.calls += 1;
+            const { body, meta } = rawOutput(event);
+            const head = [
+                `===== call ${script.calls}: ${event.toolName} (${event.toolCallId})${event.isError ? " ERROR" : ""}`,
+                `input: ${JSON.stringify(event.input ?? {})}`,
+                ...meta,
+            ].join("\n");
+            const max = auditMaxBytes();
+            let entry;
+            if (script.capped) {
+                entry = `${head}\n[output not saved: log cap of ${max} bytes reached]\n\n`;
+            }
+            else {
+                entry = `${head}\n${body}\n\n`;
+                const size = Buffer.byteLength(entry);
+                if (script.bytes + size > max) {
+                    const room = Math.max(0, max - script.bytes - Buffer.byteLength(head) - 200);
+                    const kept = Buffer.from(body).subarray(0, room).toString();
+                    entry = `${head}\n${kept}\n[log cap of ${max} bytes reached: the rest of this output and later outputs are not saved]\n\n`;
+                    script.capped = true;
+                }
+            }
+            script.bytes += Buffer.byteLength(entry);
+            try {
+                mkdirSync(join(script.file, ".."), { recursive: true, mode: 0o700 });
+                appendFileSync(script.file, entry, { mode: 0o600 });
+            }
+            catch (error) {
+                script.failed ??= String(error?.code ?? error);
+            }
+            return undefined;
+        }
+        if (event.toolName !== CODEMODE_TOOL_NAME)
+            return undefined;
+        const script = scripts.get(event.toolCallId);
+        scripts.delete(event.toolCallId);
+        if (!script || script.calls === 0)
+            return undefined;
+        const where = script.failed
+            ? `could not be saved (${script.failed})`
+            : `are in ${script.file}${script.capped ? " (cut off at the log size cap)" : ""}`;
+        const note = `[Raw outputs of this script's ${script.calls} tool call${script.calls === 1 ? "" : "s"} ${where}. `
+            + "The script's printed output is filtered: it is not proof that something is absent. "
+            + "Before concluding absence, check the raw outputs or print the pattern, scope and count.]";
+        return {
+            content: [...(event.content ?? []), { type: "text", text: note }],
+            // Replacing content alone would drop the script's structured result.
+            ...(event.structuredContent === undefined ? {} : { structuredContent: event.structuredContent }),
+        };
+    };
+    return { recordCall, onToolResult };
+}

package/dist/index.js

@@ -21,6 +21,7 @@ import { AgentManager, isTopLevelAgent, managerServices, RECORD_ENTRY_TYPE, RESU
 import { boundBashTimeout, getAgentConversation, getDefaultMaxTurns, getGraceTurns, getRememberAgents, getToolTimeoutSeconds, normalizeMaxTurns, resolveEffectiveMaxTurns, SUBAGENT_TOOL_NAMES, setDefaultMaxTurns, setGraceTurns, setRememberAgents, setToolTimeoutSeconds, steerAgent } from "./agent-runner.js";
 import { BUILTIN_TOOL_NAMES, getAgentConfig, getAllTypes, getAvailableTypes, getConfig, getFallbackSubagent, isDefaultsDisabled, NO_FALLBACK, registerAgents, resolveSpawnType, resolveType, setDefaultsDisabled, setFallbackSubagent } from "./agent-types.js";
 import { inChildSessionContext } from "./child-context.js";
+import { boundCodemodeTimeout, CODEMODE_TOOL_NAME, createCodemodeAudit, getCodemodeTimeoutSeconds, setCodemodeTimeoutSeconds } from "./codemode-guard.js";
 import { CompletionOutbox, NOTIFICATION_HOLD_MS } from "./completion-outbox.js";
 import { registerRpcHandlers } from "./cross-extension-rpc.js";
 import { loadCustomAgents } from "./custom-agents.js";
@@ -1998,11 +1999,19 @@ export default function (pi) {
     // so an unbounded `grep -r … /` or a server started in the foreground would
     // otherwise hold the turn until someone notices. (Subagents are also capped —
     // see installToolTimeouts in agent-runner.ts.)
-    pi.on("tool_call", (event) => {
+    const codemodeAudit = createCodemodeAudit();
+    pi.on("tool_call", (event, ctx) => {
         if (event.toolName === "bash")
             boundBashTimeout(event.input, getToolTimeoutSeconds(), false);
+        // Pi's codemode scripts have no deadline unless they set one; give those that don't
+        // `codemodeTimeoutSeconds` (default 30 minutes). A deadline the script sets is kept.
+        if (event.toolName === CODEMODE_TOOL_NAME)
+            boundCodemodeTimeout(event.input, getCodemodeTimeoutSeconds());
+        codemodeAudit.recordCall(event, ctx);
         return undefined;
     });
+    // Keeps the raw output of every call a codemode script makes; see codemode-guard.ts.
+    pi.on("tool_result", (event) => codemodeAudit.onToolResult(event));
     // The parent's turn is over: spend that arrived after its last subagent tool
     // result (background agents, workflows) reaches the session stats now.
     pi.on("agent_end", (_event, ctx) => {
@@ -2061,6 +2070,7 @@ export default function (pi) {
         setDefaultMaxTurns,
         setGraceTurns,
         setToolTimeoutSeconds,
+        setCodemodeTimeoutSeconds,
         setDefaultJoinMode,
         setBackgroundByDefault,
         setSchedulingEnabled,
@@ -4237,6 +4247,7 @@ Write the file using the write tool. Only write the file, nothing else.`;
             defaultMaxTurns: getDefaultMaxTurns() ?? 0,
             graceTurns: getGraceTurns(),
             toolTimeoutSeconds: getToolTimeoutSeconds(),
+            codemodeTimeoutSeconds: getCodemodeTimeoutSeconds(),
             defaultJoinMode: getDefaultJoinMode(),
             backgroundByDefault: getBackgroundByDefault(),
             schedulingEnabled: isSchedulingEnabled(),

package/dist/session-handoff.d.ts

@@ -35,7 +35,7 @@
  */
 import { type ExtensionContext } from "@earendil-works/pi-coding-agent";
 /** The package version this code ships in. `test/session-handoff.test.ts` keeps it equal to package.json. */
-export declare const PACKAGE_VERSION = "0.20.5";
+export declare const PACKAGE_VERSION = "0.20.6";
 /** Bumped when the shape of a parked entry changes within one version (never in a release). */
 export declare const HANDOFF_PROTOCOL = 1;
 /** Writes an entry into the session `owner` if the caller can (it is the active one there); false otherwise. */

package/dist/session-handoff.js

@@ -36,7 +36,7 @@
 import { existsSync } from "node:fs";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 /** The package version this code ships in. `test/session-handoff.test.ts` keeps it equal to package.json. */
-export const PACKAGE_VERSION = "0.20.5";
+export const PACKAGE_VERSION = "0.20.6";
 /** Bumped when the shape of a parked entry changes within one version (never in a release). */
 export const HANDOFF_PROTOCOL = 1;
 const HANDOFF_KEY = Symbol.for("pi-subagents:handoff:@kushalkhemka/opensec-pi-subagents");

package/dist/settings.d.ts

@@ -36,6 +36,11 @@ export interface SubagentsSettings {
      * default 1200). See `toolTimeoutSeconds` in agent-runner.ts.
      */
     toolTimeoutSeconds?: number;
+    /**
+     * Deadline in seconds for pi's `codemode` scripts that set no `timeout_ms`
+     * (0 = leave them unbounded, default 1800). See codemode-guard.ts.
+     */
+    codemodeTimeoutSeconds?: number;
     defaultJoinMode?: JoinMode;
     /**
      * Whether a top-level `Agent` spawn that doesn't say runs detached.
@@ -330,6 +335,7 @@ export interface SettingsAppliers {
     setDefaultMaxTurns: (n: number) => void;
     setGraceTurns: (n: number) => void;
     setToolTimeoutSeconds: (n: number) => void;
+    setCodemodeTimeoutSeconds: (n: number) => void;
     setDefaultJoinMode: (mode: JoinMode) => void;
     setBackgroundByDefault: (b: boolean) => void;
     setSchedulingEnabled: (b: boolean) => void;

package/dist/settings.js

@@ -17,6 +17,7 @@ const MAX_CONCURRENT_CEILING = 1024;
 const MAX_TURNS_CEILING = 10_000;
 const GRACE_TURNS_CEILING = 1_000;
 const TOOL_TIMEOUT_CEILING = 86_400;
+const CODEMODE_TIMEOUT_CEILING = 86_400;
 const SUBAGENT_DEPTH_CEILING = 16;
 /** Drop fields that don't match the expected shape. Silent — garbage becomes absent. */
 function sanitize(raw) {
@@ -51,6 +52,11 @@ function sanitize(raw) {
         r.toolTimeoutSeconds <= TOOL_TIMEOUT_CEILING) {
         out.toolTimeoutSeconds = r.toolTimeoutSeconds;
     }
+    if (Number.isInteger(r.codemodeTimeoutSeconds) &&
+        r.codemodeTimeoutSeconds >= 0 &&
+        r.codemodeTimeoutSeconds <= CODEMODE_TIMEOUT_CEILING) {
+        out.codemodeTimeoutSeconds = r.codemodeTimeoutSeconds;
+    }
     if (Number.isInteger(r.maxSubagentDepth) &&
         r.maxSubagentDepth >= 0 &&
         r.maxSubagentDepth <= SUBAGENT_DEPTH_CEILING) {
@@ -200,6 +206,8 @@ export function applySettings(s, appliers) {
         appliers.setGraceTurns(s.graceTurns);
     if (typeof s.toolTimeoutSeconds === "number")
         appliers.setToolTimeoutSeconds(s.toolTimeoutSeconds);
+    if (typeof s.codemodeTimeoutSeconds === "number")
+        appliers.setCodemodeTimeoutSeconds(s.codemodeTimeoutSeconds);
     if (typeof s.maxSubagentDepth === "number")
         appliers.setMaxSubagentDepth(s.maxSubagentDepth);
     if (typeof s.fallbackSubagent === "string")

package/dist/workflow/worker-source.js

@@ -51,9 +51,14 @@
 /**
  * Runs inside the realm, ahead of the script body, on a single line.
  *
- * One line matters: the body is compiled at `\n` + line 1, and the host passes
- * `lineOffset: -1` so reported line numbers match the file the author wrote. Any
- * newline in here shifts every stack frame in every workflow script.
+ * One line matters: the body starts on the same line as the wrapper and this
+ * prelude, so the script's line N is the compiled source's line N and reported
+ * line numbers match the file the author wrote. Any newline in here shifts every
+ * stack frame in every workflow script.
+ *
+ * Same line rather than `\n` + `lineOffset: -1`: Bun's `vm.Script` honours a
+ * positive `lineOffset` but ignores a negative one, which put every frame one
+ * line below the line the author wrote.
  */
 const DETERMINISM_PRELUDE = "const Date = (function () {" +
     " const RealDate = globalThis.Date;" +
@@ -729,8 +734,8 @@ async function workflowIn(scope, nameOrRef, args) {
       // \`meta\` is deliberately not a parameter: the body still opens with its
       // own \`const meta = { ... }\` (extractMeta strips only the \`export\`), so a
       // parameter of that name would collide with it.
-      "(async (agent, phase, log, workflow, console, args) => {" + PRELUDE + "\\n" + loaded.body + "\\n})",
-      { filename: "workflow:" + loaded.name + ".js", lineOffset: -1 }
+      "(async (agent, phase, log, workflow, console, args) => {" + PRELUDE + loaded.body + "\\n})",
+      { filename: "workflow:" + loaded.name + ".js" }
     );
     run = compiled.runInContext(realmContext);
   } catch (error) {
@@ -802,11 +807,10 @@ async function main() {
   sandbox.meta = realmParse(workerData.metaJson);
   sandbox.args = workerData.argsJson === undefined ? undefined : realmParse(workerData.argsJson);
 
-  const script = new vm.Script("(async () => {" + PRELUDE + "\\n" + workerData.body + "\\n})()", {
+  // The wrapper and prelude share the body's first line (see PRELUDE), so a
+  // thrown error points at the line the author wrote with no lineOffset.
+  const script = new vm.Script("(async () => {" + PRELUDE + workerData.body + "\\n})()", {
     filename: "workflow.js",
-    // The wrapper adds exactly one line above the body; undo it so a thrown
-    // error points at the line the author wrote.
-    lineOffset: -1,
   });
 
   const value = await script.runInContext(context);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kushalkhemka/opensec-pi-subagents",
-  "version": "0.20.5",
+  "version": "0.20.6",
   "description": "OpenSec Subagents for Pi: a fork of @tintinweb/pi-subagents with parent model and thinking-level inheritance and cached agent discovery.",
   "author": "OpenSec",
   "contributors": [

package/src/agent-runner.ts

@@ -23,6 +23,7 @@ import {
 } from "@earendil-works/pi-coding-agent";
 import { BUILTIN_TOOL_NAMES, getAgentConfig, getConfig, getMemoryToolNames, getReadOnlyMemoryToolNames, getToolNamesForType } from "./agent-types.js";
 import { runInChildSessionContext } from "./child-context.js";
+import { boundCodemodeTimeout, CODEMODE_TOOL_NAME, createCodemodeAudit, getCodemodeTimeoutSeconds } from "./codemode-guard.js";
 import { buildParentContext, extractText } from "./context.js";
 import { DEFAULT_AGENTS } from "./default-agents.js";
 import { detectEnv } from "./env.js";
@@ -263,7 +264,8 @@ export interface ToolScopeGuard {
 }
 
 /**
- * A `tool_call` handler that blocks out-of-scope tools for every call path.
+ * A `tool_call` handler that blocks out-of-scope tools for every call path, and
+ * gives in-scope `bash` calls the tool timeout (see `toolTimeoutSeconds`).
  *
  * Replacing `session.agent.beforeToolCall` only covers calls the model makes
  * directly. Pi 1.0 also lets tools call tools (`ctx.executeTool()`, used by
@@ -279,10 +281,21 @@ export function createToolScopeGuard(): ToolScopeGuard {
       name: TOOL_SCOPE_GUARD_NAME,
       hidden: true,
       factory: (pi) => {
-        pi.on("tool_call", (event) => {
-          if (!inScope || inScope().has(event.toolName)) return undefined;
-          return { block: true, reason: `Tool "${event.toolName}" is not available to this subagent.` };
+        const audit = createCodemodeAudit();
+        pi.on("tool_call", (event, ctx) => {
+          if (inScope && !inScope().has(event.toolName)) {
+            return { block: true, reason: `Tool "${event.toolName}" is not available to this subagent.` };
+          }
+          // Pi executes the same input object, so this bounds the running call,
+          // including calls another tool makes (codemode, ctx.executeTool), which
+          // never pass through session.agent.beforeToolCall.
+          if (event.toolName === "bash") boundBashTimeout(event.input, toolTimeoutSeconds, true);
+          if (event.toolName === CODEMODE_TOOL_NAME) boundCodemodeTimeout(event.input, getCodemodeTimeoutSeconds());
+          audit.recordCall(event, ctx);
+          return undefined;
         });
+        // Keeps the raw output of every call a codemode script makes; see codemode-guard.ts.
+        pi.on("tool_result", (event) => audit.onToolResult(event));
       },
     },
     setScope(fn) {
@@ -540,10 +553,20 @@ export function boundBashTimeout(args: unknown, limitSeconds: number, cap: boole
   }
 }
 
+/**
+ * Sessions whose `bash` calls are already bounded by the inline `tool_call`
+ * guard. Those must not also get the `beforeToolCall` patch: the guard covers
+ * nested calls too, and pi's own `beforeToolCall` is what runs the guard.
+ */
+const toolCallBoundSessions = new WeakSet<object>();
+
 /**
  * Bound a subagent session's tool calls (see `toolTimeoutSeconds`).
  *
- * `bash` calls without a timeout, or with a longer one, get the limit. The
+ * `bash` calls without a timeout, or with a longer one, get the limit: through
+ * the inline `tool_call` guard when the session loaded extensions (every call
+ * path), otherwise by wrapping `session.agent.beforeToolCall` (a session without
+ * extensions loads no built-ins either, so no tool calls tools). The
  * watchdog covers every tool: past the limit (plus slack) it aborts the run,
  * which kills a running command's process tree, and `takeHung()` then reports
  * the call so the caller can resume the agent with `hungToolPrompt()`. When the
@@ -560,11 +583,14 @@ export function installToolTimeouts(session: AgentSession, limitSeconds = toolTi
   let resolveStuck!: () => void;
   const stuck = new Promise<void>(resolve => { resolveStuck = resolve; });
 
+  const patchBeforeToolCall = !toolCallBoundSessions.has(session);
   const priorBeforeToolCall = session.agent.beforeToolCall;
-  session.agent.beforeToolCall = async (context, signal) => {
-    if (context.toolCall.name === "bash") boundBashTimeout(context.args, limitSeconds, true);
-    return priorBeforeToolCall?.(context, signal);
-  };
+  if (patchBeforeToolCall) {
+    session.agent.beforeToolCall = async (context, signal) => {
+      if (context.toolCall.name === "bash") boundBashTimeout(context.args, limitSeconds, true);
+      return priorBeforeToolCall?.(context, signal);
+    };
+  }
 
   const running = new Map<string, { toolName: string; started: number }>();
   let hung: HungTool | undefined;
@@ -608,7 +634,7 @@ export function installToolTimeouts(session: AgentSession, limitSeconds = toolTi
     dispose() {
       clearInterval(timer);
       unsubscribe();
-      session.agent.beforeToolCall = priorBeforeToolCall;
+      if (patchBeforeToolCall) session.agent.beforeToolCall = priorBeforeToolCall;
     },
   };
 }
@@ -1342,6 +1368,7 @@ export async function runAgent(
   }
 
   const { session } = await runInChildSessionContext(() => createAgentSession(sessionOpts));
+  if (toolScopeGuard) toolCallBoundSessions.add(session);
 
   const baseSessionName = agentConfig?.name ?? type;
   session.setSessionName(

package/src/codemode-guard.ts

@@ -0,0 +1,200 @@
+// Guards for pi's built-in `codemode` tool (a model-written script that calls other tools).
+//
+// - A deadline: codemode scripts run with no time limit unless the script's first line sets
+//   `timeout_ms` (`// @options: {"timeout_ms": …}`), so one stuck call held the agent forever.
+//   Scripts that set none get `codemodeTimeoutSeconds` (default 30 minutes).
+// - An audit trail: only the script's own output reaches the model, so a wrong filter can make
+//   a real hit look like "0 matches" with no trace. The raw output of every call a script makes
+//   is written to disk, and the script's result says where, and that it is not proof of absence.
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getAgentDir, type ToolResultEvent, type ToolResultEventResult } from "@earendil-works/pi-coding-agent";
+
+export const CODEMODE_TOOL_NAME = "codemode";
+const OPTIONS_PREFIX = "// @options:";
+/** Largest `timeout_ms` codemode accepts (the `setTimeout` limit). */
+const MAX_TIMEOUT_MS = 2_147_483_647;
+export const CODEMODE_TIMEOUT_CEILING = 86_400;
+
+let codemodeTimeoutSeconds = 1800;
+
+/** Deadline in seconds given to codemode scripts that set none (0 = leave them unbounded). */
+export function getCodemodeTimeoutSeconds(): number { return codemodeTimeoutSeconds; }
+export function setCodemodeTimeoutSeconds(n: number): void {
+  codemodeTimeoutSeconds = Math.min(CODEMODE_TIMEOUT_CEILING, Math.max(0, Math.floor(n)));
+}
+
+/**
+ * Give a codemode call a `timeout_ms` when its script sets none. Pi executes the same input
+ * object the `tool_call` handlers receive, so this changes the running script.
+ *
+ * - No options line: one is added. Line numbers in script errors then count from 2.
+ * - An options line without `timeout_ms`: the field is added to it.
+ * - An options line that sets `timeout_ms`, or that is not a JSON object: left as it is
+ *   (codemode itself reports a malformed line to the model).
+ */
+export function boundCodemodeTimeout(input: unknown, seconds: number): void {
+  if (seconds <= 0 || !input || typeof input !== "object") return;
+  const call = input as { code?: unknown };
+  if (typeof call.code !== "string" || call.code.trim() === "") return;
+  const timeoutMs = Math.min(MAX_TIMEOUT_MS, seconds * 1000);
+  const code = call.code;
+  const newline = code.indexOf("\n");
+  const firstLine = (newline === -1 ? code : code.slice(0, newline)).replace(/\r$/, "");
+  const trimmed = firstLine.trimStart();
+  if (!trimmed.startsWith(OPTIONS_PREFIX)) {
+    call.code = `${OPTIONS_PREFIX} ${JSON.stringify({ timeout_ms: timeoutMs })}\n${code}`;
+    return;
+  }
+  let options: unknown;
+  try {
+    options = JSON.parse(trimmed.slice(OPTIONS_PREFIX.length).trim());
+  } catch {
+    return;
+  }
+  if (!options || typeof options !== "object" || Array.isArray(options)) return;
+  if ((options as Record<string, unknown>).timeout_ms !== undefined) return;
+  const rest = newline === -1 ? "" : code.slice(newline);
+  call.code = `${OPTIONS_PREFIX} ${JSON.stringify({ ...(options as object), timeout_ms: timeoutMs })}${rest}`;
+}
+
+/** Default cap on one script's audit log; set `PI_CODEMODE_AUDIT_MAX_BYTES` to change it. */
+export const DEFAULT_AUDIT_MAX_BYTES = 16 * 1024 * 1024;
+
+function auditMaxBytes(): number {
+  const n = Number(process.env.PI_CODEMODE_AUDIT_MAX_BYTES);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_AUDIT_MAX_BYTES;
+}
+
+/** Where raw outputs of codemode script calls are kept: `PI_CODEMODE_AUDIT_DIR`, else `<agent dir>/opensec/codemode`. */
+export function codemodeAuditRoot(): string {
+  const configured = process.env.PI_CODEMODE_AUDIT_DIR?.trim();
+  return configured ? resolve(configured) : join(getAgentDir(), "opensec", "codemode");
+}
+
+const safe = (s: string) => s.replace(/[^A-Za-z0-9._-]/g, "-");
+
+interface ToolCallLike {
+  toolName: string;
+  toolCallId: string;
+}
+interface HandlerCtx { sessionManager?: { getSessionId?: () => string } }
+
+export interface CodemodeAudit {
+  /** Call from the session's (single) `tool_call` handler for every call that is allowed to run. */
+  recordCall(event: ToolCallLike, ctx?: HandlerCtx): void;
+  /** Register as a `tool_result` handler. */
+  onToolResult(event: ToolResultEvent): ToolResultEventResult | undefined;
+}
+
+/**
+ * What a script received from one call. A script gets a tool's structured result when it has one:
+ * for `bash`, `structuredContent.output` holds up to 1 MiB, where the text the model would see from
+ * a direct call stops at 50 KB / 2,000 lines. So log the structured output when there is one, and
+ * any path pi wrote the complete output to.
+ */
+function rawOutput(event: ToolResultEvent): { body: string; meta: string[] } {
+  const meta: string[] = [];
+  const structured = event.structuredContent;
+  let body: string | undefined;
+  if (structured && typeof structured === "object" && !Array.isArray(structured)) {
+    const record = structured as Record<string, unknown>;
+    if (typeof record.output === "string") {
+      body = record.output;
+      if (record.exit_code !== undefined) meta.push(`exit_code: ${String(record.exit_code)}`);
+      if (record.truncated === true) meta.push("truncated: true (the script got the first and last 512 KiB)");
+      if (typeof record.full_output_path === "string") meta.push(`full output: ${record.full_output_path}`);
+    } else {
+      meta.push(`structured: ${JSON.stringify(structured)}`);
+    }
+  } else if (structured !== undefined) {
+    meta.push(`structured: ${JSON.stringify(structured)}`);
+  }
+  const details = (event as { details?: unknown }).details;
+  if (details && typeof details === "object") {
+    const fullOutputPath = (details as { fullOutputPath?: unknown }).fullOutputPath;
+    if (typeof fullOutputPath === "string" && !meta.some((m) => m.endsWith(fullOutputPath))) {
+      meta.push(`full output: ${fullOutputPath}`);
+    }
+  }
+  if (body === undefined) {
+    body = (event.content ?? []).map((c) => (c.type === "text" ? c.text : `[${c.type}]`)).join("\n");
+  }
+  return { body, meta };
+}
+
+/**
+ * The audit trail for one session. Every call a codemode script makes (a `tool_result` with a
+ * `parentToolCallId`) is appended to `<root>/<session>/<script call id>.log`, and the script's own
+ * result gets a line naming that file. Each script's log is capped (`PI_CODEMODE_AUDIT_MAX_BYTES`,
+ * default 16 MiB); past the cap only call headers are written. A write failure never fails a
+ * tool call; the note then says the raw outputs could not be saved.
+ */
+export function createCodemodeAudit(): CodemodeAudit {
+  const scripts = new Map<string, { file: string; calls: number; bytes: number; capped: boolean; failed?: string }>();
+
+  const recordCall = (event: ToolCallLike, ctx?: HandlerCtx): void => {
+    if (event.toolName !== CODEMODE_TOOL_NAME) return;
+    const session = safe(ctx?.sessionManager?.getSessionId?.() ?? "session");
+    scripts.set(event.toolCallId, {
+      file: join(codemodeAuditRoot(), session, `${safe(event.toolCallId)}.log`),
+      calls: 0,
+      bytes: 0,
+      capped: false,
+    });
+  };
+
+  const onToolResult = (event: ToolResultEvent): ToolResultEventResult | undefined => {
+    if (event.parentToolCallId) {
+      const script = scripts.get(event.parentToolCallId);
+      if (!script) return undefined;
+      script.calls += 1;
+      const { body, meta } = rawOutput(event);
+      const head = [
+        `===== call ${script.calls}: ${event.toolName} (${event.toolCallId})${event.isError ? " ERROR" : ""}`,
+        `input: ${JSON.stringify(event.input ?? {})}`,
+        ...meta,
+      ].join("\n");
+      const max = auditMaxBytes();
+      let entry: string;
+      if (script.capped) {
+        entry = `${head}\n[output not saved: log cap of ${max} bytes reached]\n\n`;
+      } else {
+        entry = `${head}\n${body}\n\n`;
+        const size = Buffer.byteLength(entry);
+        if (script.bytes + size > max) {
+          const room = Math.max(0, max - script.bytes - Buffer.byteLength(head) - 200);
+          const kept = Buffer.from(body).subarray(0, room).toString();
+          entry = `${head}\n${kept}\n[log cap of ${max} bytes reached: the rest of this output and later outputs are not saved]\n\n`;
+          script.capped = true;
+        }
+      }
+      script.bytes += Buffer.byteLength(entry);
+      try {
+        mkdirSync(join(script.file, ".."), { recursive: true, mode: 0o700 });
+        appendFileSync(script.file, entry, { mode: 0o600 });
+      } catch (error) {
+        script.failed ??= String((error as { code?: string })?.code ?? error);
+      }
+      return undefined;
+    }
+    if (event.toolName !== CODEMODE_TOOL_NAME) return undefined;
+    const script = scripts.get(event.toolCallId);
+    scripts.delete(event.toolCallId);
+    if (!script || script.calls === 0) return undefined;
+    const where = script.failed
+      ? `could not be saved (${script.failed})`
+      : `are in ${script.file}${script.capped ? " (cut off at the log size cap)" : ""}`;
+    const note = `[Raw outputs of this script's ${script.calls} tool call${script.calls === 1 ? "" : "s"} ${where}. `
+      + "The script's printed output is filtered: it is not proof that something is absent. "
+      + "Before concluding absence, check the raw outputs or print the pattern, scope and count.]";
+    return {
+      content: [...(event.content ?? []), { type: "text", text: note }],
+      // Replacing content alone would drop the script's structured result.
+      ...(event.structuredContent === undefined ? {} : { structuredContent: event.structuredContent }),
+    };
+  };
+
+  return { recordCall, onToolResult };
+}

package/src/index.ts

@@ -22,6 +22,7 @@ import { AgentManager, type CompactionInfo, isTopLevelAgent, type ManagerObserve
 import { boundBashTimeout, getAgentConversation, getDefaultMaxTurns, getGraceTurns, getRememberAgents, getToolTimeoutSeconds, normalizeMaxTurns, resolveEffectiveMaxTurns, SUBAGENT_TOOL_NAMES, setDefaultMaxTurns, setGraceTurns, setRememberAgents, setToolTimeoutSeconds, steerAgent } from "./agent-runner.js";
 import { BUILTIN_TOOL_NAMES, getAgentConfig, getAllTypes, getAvailableTypes, getConfig, getFallbackSubagent, isDefaultsDisabled, NO_FALLBACK, registerAgents, resolveSpawnType, resolveType, setDefaultsDisabled, setFallbackSubagent } from "./agent-types.js";
 import { inChildSessionContext } from "./child-context.js";
+import { boundCodemodeTimeout, CODEMODE_TOOL_NAME, createCodemodeAudit, getCodemodeTimeoutSeconds, setCodemodeTimeoutSeconds } from "./codemode-guard.js";
 import { CompletionOutbox, NOTIFICATION_HOLD_MS } from "./completion-outbox.js";
 import { type RpcHandle, registerRpcHandlers } from "./cross-extension-rpc.js";
 import { loadCustomAgents } from "./custom-agents.js";
@@ -2098,10 +2099,17 @@ export default function (pi: ExtensionAPI) {
   // so an unbounded `grep -r … /` or a server started in the foreground would
   // otherwise hold the turn until someone notices. (Subagents are also capped —
   // see installToolTimeouts in agent-runner.ts.)
-  pi.on("tool_call", (event) => {
+  const codemodeAudit = createCodemodeAudit();
+  pi.on("tool_call", (event, ctx) => {
     if (event.toolName === "bash") boundBashTimeout(event.input, getToolTimeoutSeconds(), false);
+    // Pi's codemode scripts have no deadline unless they set one; give those that don't
+    // `codemodeTimeoutSeconds` (default 30 minutes). A deadline the script sets is kept.
+    if (event.toolName === CODEMODE_TOOL_NAME) boundCodemodeTimeout(event.input, getCodemodeTimeoutSeconds());
+    codemodeAudit.recordCall(event, ctx);
     return undefined;
   });
+  // Keeps the raw output of every call a codemode script makes; see codemode-guard.ts.
+  pi.on("tool_result", (event) => codemodeAudit.onToolResult(event));
 
   // The parent's turn is over: spend that arrived after its last subagent tool
   // result (background agents, workflows) reaches the session stats now.
@@ -2172,6 +2180,7 @@ export default function (pi: ExtensionAPI) {
     setDefaultMaxTurns,
     setGraceTurns,
     setToolTimeoutSeconds,
+    setCodemodeTimeoutSeconds,
     setDefaultJoinMode,
     setBackgroundByDefault,
     setSchedulingEnabled,
@@ -4500,6 +4509,7 @@ Write the file using the write tool. Only write the file, nothing else.`;
       defaultMaxTurns: getDefaultMaxTurns() ?? 0,
       graceTurns: getGraceTurns(),
       toolTimeoutSeconds: getToolTimeoutSeconds(),
+      codemodeTimeoutSeconds: getCodemodeTimeoutSeconds(),
       defaultJoinMode: getDefaultJoinMode(),
       backgroundByDefault: getBackgroundByDefault(),
       schedulingEnabled: isSchedulingEnabled(),

package/src/session-handoff.ts

@@ -38,7 +38,7 @@ import { existsSync } from "node:fs";
 import { type ExtensionContext, SessionManager } from "@earendil-works/pi-coding-agent";
 
 /** The package version this code ships in. `test/session-handoff.test.ts` keeps it equal to package.json. */
-export const PACKAGE_VERSION = "0.20.5";
+export const PACKAGE_VERSION = "0.20.6";
 
 /** Bumped when the shape of a parked entry changes within one version (never in a release). */
 export const HANDOFF_PROTOCOL = 1;

package/src/settings.ts

@@ -47,6 +47,11 @@ export interface SubagentsSettings {
    * default 1200). See `toolTimeoutSeconds` in agent-runner.ts.
    */
   toolTimeoutSeconds?: number;
+  /**
+   * Deadline in seconds for pi's `codemode` scripts that set no `timeout_ms`
+   * (0 = leave them unbounded, default 1800). See codemode-guard.ts.
+   */
+  codemodeTimeoutSeconds?: number;
   defaultJoinMode?: JoinMode;
   /**
    * Whether a top-level `Agent` spawn that doesn't say runs detached.
@@ -344,6 +349,7 @@ export interface SettingsAppliers {
   setDefaultMaxTurns: (n: number) => void;
   setGraceTurns: (n: number) => void;
   setToolTimeoutSeconds: (n: number) => void;
+  setCodemodeTimeoutSeconds: (n: number) => void;
   setDefaultJoinMode: (mode: JoinMode) => void;
   setBackgroundByDefault: (b: boolean) => void;
   setSchedulingEnabled: (b: boolean) => void;
@@ -382,6 +388,7 @@ const MAX_CONCURRENT_CEILING = 1024;
 const MAX_TURNS_CEILING = 10_000;
 const GRACE_TURNS_CEILING = 1_000;
 const TOOL_TIMEOUT_CEILING = 86_400;
+const CODEMODE_TIMEOUT_CEILING = 86_400;
 const SUBAGENT_DEPTH_CEILING = 16;
 
 /** Drop fields that don't match the expected shape. Silent — garbage becomes absent. */
@@ -426,6 +433,13 @@ function sanitize(raw: unknown): SubagentsSettings {
   ) {
     out.toolTimeoutSeconds = r.toolTimeoutSeconds as number;
   }
+  if (
+    Number.isInteger(r.codemodeTimeoutSeconds) &&
+    (r.codemodeTimeoutSeconds as number) >= 0 &&
+    (r.codemodeTimeoutSeconds as number) <= CODEMODE_TIMEOUT_CEILING
+  ) {
+    out.codemodeTimeoutSeconds = r.codemodeTimeoutSeconds as number;
+  }
   if (
     Number.isInteger(r.maxSubagentDepth) &&
     (r.maxSubagentDepth as number) >= 0 &&
@@ -579,6 +593,7 @@ export function applySettings(s: SubagentsSettings, appliers: SettingsAppliers):
   if (typeof s.defaultMaxTurns === "number") appliers.setDefaultMaxTurns(s.defaultMaxTurns);
   if (typeof s.graceTurns === "number") appliers.setGraceTurns(s.graceTurns);
   if (typeof s.toolTimeoutSeconds === "number") appliers.setToolTimeoutSeconds(s.toolTimeoutSeconds);
+  if (typeof s.codemodeTimeoutSeconds === "number") appliers.setCodemodeTimeoutSeconds(s.codemodeTimeoutSeconds);
   if (typeof s.maxSubagentDepth === "number") appliers.setMaxSubagentDepth(s.maxSubagentDepth);
   if (typeof s.fallbackSubagent === "string") appliers.setFallbackSubagent(s.fallbackSubagent);
   if (s.defaultJoinMode) appliers.setDefaultJoinMode(s.defaultJoinMode);

package/src/workflow/worker-source.ts

@@ -52,9 +52,14 @@
 /**
  * Runs inside the realm, ahead of the script body, on a single line.
  *
- * One line matters: the body is compiled at `\n` + line 1, and the host passes
- * `lineOffset: -1` so reported line numbers match the file the author wrote. Any
- * newline in here shifts every stack frame in every workflow script.
+ * One line matters: the body starts on the same line as the wrapper and this
+ * prelude, so the script's line N is the compiled source's line N and reported
+ * line numbers match the file the author wrote. Any newline in here shifts every
+ * stack frame in every workflow script.
+ *
+ * Same line rather than `\n` + `lineOffset: -1`: Bun's `vm.Script` honours a
+ * positive `lineOffset` but ignores a negative one, which put every frame one
+ * line below the line the author wrote.
  */
 const DETERMINISM_PRELUDE =
   "const Date = (function () {" +
@@ -732,8 +737,8 @@ async function workflowIn(scope, nameOrRef, args) {
       // \`meta\` is deliberately not a parameter: the body still opens with its
       // own \`const meta = { ... }\` (extractMeta strips only the \`export\`), so a
       // parameter of that name would collide with it.
-      "(async (agent, phase, log, workflow, console, args) => {" + PRELUDE + "\\n" + loaded.body + "\\n})",
-      { filename: "workflow:" + loaded.name + ".js", lineOffset: -1 }
+      "(async (agent, phase, log, workflow, console, args) => {" + PRELUDE + loaded.body + "\\n})",
+      { filename: "workflow:" + loaded.name + ".js" }
     );
     run = compiled.runInContext(realmContext);
   } catch (error) {
@@ -805,11 +810,10 @@ async function main() {
   sandbox.meta = realmParse(workerData.metaJson);
   sandbox.args = workerData.argsJson === undefined ? undefined : realmParse(workerData.argsJson);
 
-  const script = new vm.Script("(async () => {" + PRELUDE + "\\n" + workerData.body + "\\n})()", {
+  // The wrapper and prelude share the body's first line (see PRELUDE), so a
+  // thrown error points at the line the author wrote with no lineOffset.
+  const script = new vm.Script("(async () => {" + PRELUDE + workerData.body + "\\n})()", {
     filename: "workflow.js",
-    // The wrapper adds exactly one line above the body; undo it so a thrown
-    // error points at the line the author wrote.
-    lineOffset: -1,
   });
 
   const value = await script.runInContext(context);