@linimin/pi-letscook 0.1.65 → 0.1.66

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.66
+
+### Changed
+
+- blocked `completion_role` outside explicit `/cook` workflow-driver turns so ordinary chat can no longer silently dispatch completion subagents on its own
+- tightened ordinary-chat reminders and skill contracts to forbid loading `completion-protocol` before explicit `/cook`
+- expanded smoke and release-parity checks to keep the ordinary-chat vs `/cook` boundary enforced in shipped behavior
+
 ## 0.1.62
 
 ### Changed

package/extensions/completion/index.ts

@@ -1055,11 +1055,13 @@ export default function completionExtension(pi: ExtensionAPI) {
 		const snapshot = await loadCompletionSnapshot(cwd);
 		const completionActive = Boolean(snapshot) && asString(snapshot?.state?.continuation_policy) !== "done";
 		const root = snapshot?.files.root ?? findRepoRoot(cwd) ?? cwd;
+		const completionRoleDispatchAllowed = Boolean(role) || (hasCompletionRoutingActivation(snapshot) && isCompletionDriverPromptTurn(ctx));
 		const reason = toolCallBlockReason({
 			toolName: event.toolName,
 			input: isRecord(event.input) ? event.input : undefined,
 			role,
 			completionActive,
+			completionRoleDispatchAllowed,
 			root,
 		});
 		if (reason) return { block: true, reason };
@@ -1074,6 +1076,7 @@ export default function completionExtension(pi: ExtensionAPI) {
 			"Use completion_role when driving the completion workflow and a mandatory completion role must act next.",
 			"Use completion_role only for completion-bootstrapper, completion-regrounder, completion-implementer, completion-reviewer, completion-auditor, or completion-stop-judge.",
 			"Do not use completion_role from inside a completion role; only the workflow driver may dispatch roles.",
+			"Do not call completion_role from ordinary chat; it is reserved for explicit /cook workflow driver turns.",
 		],
 		parameters: Type.Object({
 			role: StringEnum(ROLE_NAMES, { description: "The completion role to invoke." }),

package/extensions/completion/policy-guards.ts

@@ -62,14 +62,19 @@ export function toolCallBlockReason(args: {
 	input?: JsonRecord;
 	role?: string;
 	completionActive: boolean;
+	completionRoleDispatchAllowed: boolean;
 	root: string;
 }): string | undefined {
-	const { toolName, input, role, completionActive, root } = args;
+	const { toolName, input, role, completionActive, completionRoleDispatchAllowed, root } = args;
 
 	if (toolName === "completion_role" && role) {
 		return `Nested completion role dispatch is forbidden for ${role}.`;
 	}
 
+	if (toolName === "completion_role" && !completionRoleDispatchAllowed) {
+		return "completion_role may only be used from an explicit /cook workflow driver turn.";
+	}
+
 	if (toolName === "edit" || toolName === "write") {
 		const rawPath = asString(input?.path);
 		if (!rawPath) return undefined;

package/extensions/completion/prompt-surfaces.ts

@@ -30,6 +30,7 @@ export function buildCookHandoffBoundaryReminder(): string {
 		"Ordinary chat may clarify requirements, discuss tradeoffs, refine scope, and directly implement requested repo changes, including multi-file work, when that is the most helpful response.",
 		"Do not proactively tell the user to run /cook just because a task looks workflow-worthy, and do not emit a ```cook_handoff``` capsule by default in ordinary chat.",
 		"/cook is optional workflow mode for resumability, review, audit, canonical .agent state, or deliberate multi-session control; it is not required just to edit repo files in ordinary chat.",
+		"In ordinary chat, do not load or follow completion-protocol, and do not call completion_role.",
 		"If the user wants direct implementation now, stay in ordinary chat and help directly instead of blocking on /cook.",
 		"If the user asks follow-up questions or wants to keep refining scope, continue helping naturally in ordinary chat.",
 		"If the user explicitly runs /cook, the extension should call a primary-agent handoff synthesis step from the current task context, then show Start/Cancel confirmation without making the user rerun /cook.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linimin/pi-letscook",
-  "version": "0.1.65",
+  "version": "0.1.66",
   "description": "Pi package for long-running completion workflows with canonical .agent state, role-based subagents, continuity, and verification helpers.",
   "license": "MIT",
   "private": false,

package/scripts/release-check.sh

@@ -27,10 +27,23 @@ checks = {
     "extensions/completion/prompt-surfaces.ts": [
         '"If the user explicitly runs /cook, the extension should call a primary-agent handoff synthesis step from the current task context, then show Start/Cancel confirmation without making the user rerun /cook."',
         '"Do not expect /cook to infer or guess startup intent from recent discussion alone; /cook should use explicit primary-agent handoff data, whether it already exists or is synthesized in the same /cook entry."',
+        '"In ordinary chat, do not load or follow completion-protocol, and do not call completion_role."',
     ],
     "extensions/completion/index.ts": [
         '"/cook failed closed because the primary-agent handoff step could not prepare a concrete startup handoff from the current task context. Clarify the mission, first slice, or verification intent in the main chat, then rerun /cook."',
         'description: "/cook workflow: start or replace workflow only from an explicit primary-agent handoff, or resume the current workflow from canonical state"',
+        '"Do not call completion_role from ordinary chat; it is reserved for explicit /cook workflow driver turns."',
+    ],
+    "extensions/completion/policy-guards.ts": [
+        'return "completion_role may only be used from an explicit /cook workflow driver turn.";',
+    ],
+    "skills/cook-handoff-boundary/SKILL.md": [
+        '- load or follow `completion-protocol` while still in ordinary chat',
+        '- call `completion_role` before the user has explicitly entered `/cook`',
+    ],
+    "skills/completion-protocol/SKILL.md": [
+        'Load this skill only after the user explicitly enters `/cook` and you are operating inside the `completion` workflow as the workflow driver or a completion role.',
+        'Do not load or follow this skill from ordinary chat.',
     ],
 }
 

package/scripts/smoke-test.sh

@@ -269,6 +269,7 @@ assert 'ordinary main chat unless the user explicitly runs /cook' in handoff_tex
 assert 'directly implement requested repo changes, including multi-file work' in handoff_text, 'ordinary handoff reminder should allow direct ordinary-chat implementation'
 assert 'Do not proactively tell the user to run /cook' in handoff_text, 'ordinary handoff reminder should keep ordinary chat neutral until explicit /cook entry'
 assert '/cook is optional workflow mode' in handoff_text, 'ordinary handoff reminder should position /cook as optional workflow mode'
+assert 'In ordinary chat, do not load or follow completion-protocol, and do not call completion_role.' in handoff_text, 'ordinary handoff reminder should forbid workflow-role routing before explicit /cook'
 assert 'If the user wants direct implementation now, stay in ordinary chat and help directly instead of blocking on /cook.' in handoff_text, 'ordinary handoff reminder should avoid blocking implementation on /cook'
 assert 'the extension should call a primary-agent handoff synthesis step from the current task context' in handoff_text, 'ordinary handoff reminder should describe same-entry primary-agent handoff synthesis for /cook'
 assert 'Do not expect /cook to infer or guess startup intent from recent discussion alone' in handoff_text, 'ordinary handoff reminder should forbid /cook-side guessing'

package/skills/completion-protocol/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: completion-protocol
-description: Shared completion workflow protocol for long-running coding tasks with canonical .agent state, one-slice execution, mandatory role dispatch, recovery, and final stop criteria. Use when driving persistent end-to-end completion work across multiple sessions.
+description: Shared completion workflow protocol for long-running coding tasks with canonical .agent state, one-slice execution, mandatory role dispatch, recovery, and final stop criteria. Use only after the user explicitly enters `/cook` and the main session becomes the completion workflow driver.
 ---
 
 # Completion Protocol
 
-Load this skill whenever you are operating inside the `completion` workflow.
+Load this skill only after the user explicitly enters `/cook` and you are operating inside the `completion` workflow as the workflow driver or a completion role.
+
+Do not load or follow this skill from ordinary chat.
 
 This skill defines shared protocol facts only. Role-specific behavior belongs in the dedicated completion agents:
 

package/skills/cook-handoff-boundary/SKILL.md

@@ -34,6 +34,8 @@ The primary agent should not:
 
 - proactively tell the user to run `/cook` just because the task looks workflow-worthy
 - proactively emit a `cook_handoff` capsule by default
+- load or follow `completion-protocol` while still in ordinary chat
+- call `completion_role` before the user has explicitly entered `/cook`
 - act as though workflow has already started when it has not
 - silently rewrite ordinary-chat discussion into canonical workflow state
 
@@ -115,6 +117,8 @@ Suggested wording:
 Before the user explicitly runs `/cook`, the primary agent must not:
 
 - pretend `/cook` has already been invoked
+- load or follow `completion-protocol`
+- call `completion_role` or any completion subagent
 - silently rewrite ordinary-chat discussion into active workflow state
 - claim canonical `.agent/**` startup state exists when it does not
 - refuse ordinary-chat implementation solely because `/cook` would also be possible