@narumitw/pi-subagents 0.42.0 → 0.43.1

package/src/cwd-policy.ts

@@ -0,0 +1,183 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getAgentDir, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
+import type { ConsultationCwdPolicy, DelegationCwdPolicy } from "./agents.js";
+import { safeTerminalLine } from "./safe-text.js";
+
+export type TargetBoundary = "current-workspace" | "external";
+export type TargetTrustKind =
+	| "session-trusted"
+	| "session-untrusted"
+	| "saved-trusted"
+	| "saved-denied"
+	| "unsaved"
+	| "trust-error";
+
+export interface ResolvedTargetTrust {
+	kind: TargetTrustKind;
+	projectTrusted: boolean;
+	sourcePath?: string;
+	warning?: string;
+}
+
+export interface ResolvedSubagentTarget {
+	cwd: string;
+	workspace: string;
+	boundary: TargetBoundary;
+	trust: ResolvedTargetTrust;
+}
+
+export interface TargetPolicyAudit {
+	cwd: string;
+	boundary: TargetBoundary;
+	trust: {
+		kind: TargetTrustKind;
+		projectTrusted: boolean;
+		sourcePath?: string;
+		warning?: string;
+	};
+}
+
+export function targetPolicyAudit(target: ResolvedSubagentTarget): TargetPolicyAudit {
+	return {
+		cwd: safeTerminalLine(target.cwd),
+		boundary: target.boundary,
+		trust: {
+			...target.trust,
+			sourcePath: target.trust.sourcePath ? safeTerminalLine(target.trust.sourcePath) : undefined,
+			warning: target.trust.warning ? safeTerminalLine(target.trust.warning, 512) : undefined,
+		},
+	};
+}
+
+export interface ResolveSubagentTargetOptions {
+	workspace: string;
+	requestedCwd?: string;
+	currentProjectTrusted: boolean;
+	agentDir?: string;
+}
+
+export function resolveSubagentTarget(
+	options: ResolveSubagentTargetOptions,
+): ResolvedSubagentTarget {
+	const workspace = canonicalDirectory(options.workspace, "Current workspace");
+	const requested = path.resolve(options.workspace, options.requestedCwd ?? options.workspace);
+	const cwd = canonicalDirectory(requested, "Subagent working directory");
+	const boundary: TargetBoundary = isEqualOrDescendant(cwd, workspace)
+		? "current-workspace"
+		: "external";
+	if (boundary === "current-workspace") {
+		return {
+			cwd,
+			workspace,
+			boundary,
+			trust: {
+				kind: options.currentProjectTrusted ? "session-trusted" : "session-untrusted",
+				projectTrusted: options.currentProjectTrusted,
+				sourcePath: workspace,
+			},
+		};
+	}
+	try {
+		const entry = new ProjectTrustStore(options.agentDir ?? getAgentDir()).getEntry(cwd);
+		if (!entry) {
+			return {
+				cwd,
+				workspace,
+				boundary,
+				trust: { kind: "unsaved", projectTrusted: false },
+			};
+		}
+		return {
+			cwd,
+			workspace,
+			boundary,
+			trust: {
+				kind: entry.decision ? "saved-trusted" : "saved-denied",
+				projectTrusted: entry.decision,
+				sourcePath: entry.path,
+			},
+		};
+	} catch {
+		return {
+			cwd,
+			workspace,
+			boundary,
+			trust: {
+				kind: "trust-error",
+				projectTrusted: false,
+				warning: safeTerminalLine(
+					"Could not resolve Pi trust store; protected target resources were disabled. Repair trust with Pi /trust and restart Pi.",
+					512,
+				),
+			},
+		};
+	}
+}
+
+export function assertConsultationTargetAllowed(
+	target: ResolvedSubagentTarget,
+	policy: ConsultationCwdPolicy,
+): void {
+	if (policy === "current-workspace" && target.boundary !== "current-workspace") {
+		throw new Error(
+			`Read-only consultation target is outside the current workspace: ${safeTerminalLine(target.cwd)}`,
+		);
+	}
+}
+
+export function assertDelegationTargetAllowed(
+	target: ResolvedSubagentTarget,
+	policy: DelegationCwdPolicy,
+): void {
+	if (target.boundary === "current-workspace" || policy === "anywhere") return;
+	if (policy === "trusted-targets" && target.trust.kind === "saved-trusted") return;
+	if (policy === "current-workspace") {
+		throw new Error(
+			`General delegation target is outside the current workspace: ${safeTerminalLine(target.cwd)}`,
+		);
+	}
+	const reason =
+		target.trust.kind === "trust-error"
+			? target.trust.warning
+			: `Target trust is ${target.trust.kind}.`;
+	throw new Error(
+		[
+			`General delegation target is not a saved-trusted folder: ${safeTerminalLine(target.cwd)}`,
+			reason,
+			"Open Pi in that folder, manage trust with /trust, restart Pi, or choose Anywhere in /subagents settings.",
+		]
+			.filter(Boolean)
+			.join(" "),
+	);
+}
+
+function canonicalDirectory(value: string, label: string): string {
+	let canonical: string;
+	try {
+		canonical = fs.realpathSync(value);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+			throw new Error(`${label} does not exist: ${safeTerminalLine(value)}`);
+		}
+		throw new Error(
+			`${label} cannot be resolved: ${safeTerminalLine(value)}: ${formatError(error)}`,
+		);
+	}
+	if (!fs.statSync(canonical).isDirectory()) {
+		throw new Error(`${label} is not a directory: ${safeTerminalLine(canonical)}`);
+	}
+	return canonical;
+}
+
+function isEqualOrDescendant(candidate: string, workspace: string): boolean {
+	const relative = path.relative(workspace, candidate);
+	return (
+		relative === "" ||
+		(!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative))
+	);
+}
+
+function formatError(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}

package/src/execution.ts

@@ -4,8 +4,15 @@ import {
 	type AgentConfig,
 	type AgentScope,
 	discoverAgents,
+	type SubagentSettings,
 	type SubagentThinkingLevel,
 } from "./agents.js";
+import {
+	assertDelegationTargetAllowed,
+	type ResolvedSubagentTarget,
+	resolveSubagentTarget,
+	targetPolicyAudit,
+} from "./cwd-policy.js";
 import { DEFAULT_MAX_CONTEXT_BYTES, truncateUtf8 } from "./limits.js";
 import { hasUsableAggregator, type SubagentParams } from "./params.js";
 import {
@@ -19,7 +26,12 @@ import {
 	type SingleResult,
 	type SubagentDetails,
 } from "./runner.js";
-import { readSubagentSettings, resolveSubagentThinkingLevel } from "./settings.js";
+import { safeTerminalLine } from "./safe-text.js";
+import {
+	DEFAULT_DELEGATION_CWD_POLICY,
+	readSubagentSettings,
+	resolveSubagentThinkingLevel,
+} from "./settings.js";
 
 const MAX_PARALLEL_TASKS = 8;
 const MAX_CONCURRENCY = 4;
@@ -104,11 +116,15 @@ export async function executeSubagent(
 	signal: AbortSignal | undefined,
 	onUpdate: AgentToolUpdateCallback<SubagentDetails> | undefined,
 	ctx: ExtensionContext,
+	settingsOverride?: SubagentSettings,
 ): Promise<AgentToolResult<SubagentDetails> & { isError?: boolean }> {
 	assertSubagentDepthAllowed();
 	const agentScope: AgentScope = params.agentScope ?? "user";
+	if ((agentScope === "project" || agentScope === "both") && !ctx.isProjectTrusted()) {
+		throw new Error("Project-local subagent definitions require a trusted project");
+	}
 	const aggregator = hasUsableAggregator(params.aggregator) ? params.aggregator : undefined;
-	const config = readSubagentSettings();
+	const config = settingsOverride ?? readSubagentSettings();
 	const discovery = discoverAgents(ctx.cwd, agentScope, config);
 	const agents = discovery.agents;
 	const confirmProjectAgents = params.confirmProjectAgents ?? true;
@@ -152,6 +168,28 @@ export async function executeSubagent(
 		};
 	}
 
+	const delegationPolicy = config?.cwdPolicy?.delegation ?? DEFAULT_DELEGATION_CWD_POLICY;
+	const resolveTarget = (cwd: string | undefined): ResolvedSubagentTarget => {
+		const target = resolveSubagentTarget({
+			workspace: ctx.cwd,
+			requestedCwd: cwd,
+			currentProjectTrusted: ctx.isProjectTrusted(),
+		});
+		assertDelegationTargetAllowed(target, delegationPolicy);
+		return target;
+	};
+	const singleTarget = hasSingle ? resolveTarget(params.cwd) : undefined;
+	const chainTargets = params.chain?.map((step) => resolveTarget(step.cwd)) ?? [];
+	const parallelTargets = params.tasks?.map((task) => resolveTarget(task.cwd)) ?? [];
+	const aggregatorTarget = aggregator ? resolveTarget(aggregator.cwd) : undefined;
+	const attachTarget = (result: SingleResult, target: ResolvedSubagentTarget): SingleResult => {
+		result.target = targetPolicyAudit(target);
+		return result;
+	};
+	const launchPolicy = (target: ResolvedSubagentTarget) => ({
+		projectTrust: target.trust.projectTrusted,
+	});
+
 	if (agentScope === "project" || agentScope === "both") {
 		const requestedAgentNames = new Set<string>();
 		if (params.chain) for (const step of params.chain) requestedAgentNames.add(step.agent);
@@ -168,12 +206,19 @@ export async function executeSubagent(
 				throw new Error("Project-local subagent definitions require a trusted project");
 			}
 			if (confirmProjectAgents && ctx.hasUI) {
-				const names = projectAgentsRequested.map((a) => a.name).join(", ");
-				const dir = discovery.projectAgentsDir ?? "(unknown)";
+				const names = projectAgentsRequested
+					.map((agent) => safeTerminalLine(agent.name, 256))
+					.join(", ");
+				const dir = safeTerminalLine(discovery.projectAgentsDir ?? "(unknown)");
 				const ok = await ctx.ui.confirm(
 					"Run project-local agents?",
 					`Agents: ${names}\nSource: ${dir}\n\nProject agents are repo-controlled. Only continue for trusted repositories.`,
 				);
+				if (signal?.aborted) {
+					const error = new Error("Subagent call was aborted during project-agent confirmation");
+					error.name = "AbortError";
+					throw error;
+				}
 				if (!ok) {
 					return {
 						content: [{ type: "text", text: "Canceled: project-local agents not approved." }],
@@ -213,18 +258,24 @@ export async function executeSubagent(
 						}
 					: undefined;
 
-				const result = await runSingleAgent(
-					ctx.cwd,
-					agents,
-					step.agent,
-					taskWithContext,
-					step.cwd,
-					i + 1,
-					signal,
-					resolveThinkingLevel(step.agent, step.thinkingLevel),
-					resolveTimeoutMs(step.agent, step.timeoutMs),
-					chainUpdate,
-					makeDetails("chain"),
+				const target = chainTargets[i];
+				const result = attachTarget(
+					await runSingleAgent(
+						ctx.cwd,
+						agents,
+						step.agent,
+						taskWithContext,
+						target.cwd,
+						i + 1,
+						signal,
+						resolveThinkingLevel(step.agent, step.thinkingLevel),
+						resolveTimeoutMs(step.agent, step.timeoutMs),
+						chainUpdate,
+						makeDetails("chain"),
+						undefined,
+						launchPolicy(target),
+					),
+					target,
 				);
 				results.push(result);
 
@@ -346,24 +397,30 @@ export async function executeSubagent(
 				params.tasks,
 				MAX_CONCURRENCY,
 				async (t, index) => {
-					const result = await runSingleAgent(
-						ctx.cwd,
-						agents,
-						t.agent,
-						t.task,
-						t.cwd,
-						undefined,
-						signal,
-						resolveThinkingLevel(t.agent, t.thinkingLevel),
-						resolveTimeoutMs(t.agent, t.timeoutMs),
-						// Per-task update callback
-						(partial) => {
-							if (partial.details?.results[0]) {
-								allResults[index] = { ...partial.details.results[0], exitCode: -1 };
-								emitParallelUpdate();
-							}
-						},
-						makeDetails("parallel"),
+					const target = parallelTargets[index];
+					const result = attachTarget(
+						await runSingleAgent(
+							ctx.cwd,
+							agents,
+							t.agent,
+							t.task,
+							target.cwd,
+							undefined,
+							signal,
+							resolveThinkingLevel(t.agent, t.thinkingLevel),
+							resolveTimeoutMs(t.agent, t.timeoutMs),
+							// Per-task update callback
+							(partial) => {
+								if (partial.details?.results[0]) {
+									allResults[index] = { ...partial.details.results[0], exitCode: -1 };
+									emitParallelUpdate();
+								}
+							},
+							makeDetails("parallel"),
+							undefined,
+							launchPolicy(target),
+						),
+						target,
 					);
 					allResults[index] = result;
 					doneCount += 1;
@@ -399,26 +456,32 @@ export async function executeSubagent(
 						: `${aggregator.task}\n\nParallel task outputs:\n\n${fanInContext}`,
 					DEFAULT_MAX_CONTEXT_BYTES,
 				).text;
-				aggregatorResult = await runSingleAgent(
-					ctx.cwd,
-					agents,
-					aggregator.agent,
-					aggregatorTask,
-					aggregator.cwd,
-					undefined,
-					signal,
-					resolveThinkingLevel(aggregator.agent, aggregator.thinkingLevel),
-					resolveTimeoutMs(aggregator.agent, aggregator.timeoutMs),
-					(partial) => {
-						status.update(fanInStatus(aggregator.agent));
-						if (onUpdate && partial.details?.results[0]) {
-							onUpdate({
-								content: partial.content,
-								details: makeDetails("parallel")(results, partial.details.results[0]),
-							});
-						}
-					},
-					makeDetails("parallel"),
+				const target = aggregatorTarget as ResolvedSubagentTarget;
+				aggregatorResult = attachTarget(
+					await runSingleAgent(
+						ctx.cwd,
+						agents,
+						aggregator.agent,
+						aggregatorTask,
+						target.cwd,
+						undefined,
+						signal,
+						resolveThinkingLevel(aggregator.agent, aggregator.thinkingLevel),
+						resolveTimeoutMs(aggregator.agent, aggregator.timeoutMs),
+						(partial) => {
+							status.update(fanInStatus(aggregator.agent));
+							if (onUpdate && partial.details?.results[0]) {
+								onUpdate({
+									content: partial.content,
+									details: makeDetails("parallel")(results, partial.details.results[0]),
+								});
+							}
+						},
+						makeDetails("parallel"),
+						undefined,
+						launchPolicy(target),
+					),
+					target,
 				);
 			}
 
@@ -463,18 +526,24 @@ export async function executeSubagent(
 		const status = startSubagentStatus(ctx, toolCallId, singleStatus(params.agent));
 
 		try {
-			const result = await runSingleAgent(
-				ctx.cwd,
-				agents,
-				params.agent,
-				params.task,
-				params.cwd,
-				undefined,
-				signal,
-				resolveThinkingLevel(params.agent, params.thinkingLevel),
-				resolveTimeoutMs(params.agent, params.timeoutMs),
-				onUpdate,
-				makeDetails("single"),
+			const target = singleTarget as ResolvedSubagentTarget;
+			const result = attachTarget(
+				await runSingleAgent(
+					ctx.cwd,
+					agents,
+					params.agent,
+					params.task,
+					target.cwd,
+					undefined,
+					signal,
+					resolveThinkingLevel(params.agent, params.thinkingLevel),
+					resolveTimeoutMs(params.agent, params.timeoutMs),
+					onUpdate,
+					makeDetails("single"),
+					undefined,
+					launchPolicy(target),
+				),
+				target,
 			);
 			const isError = isResultError(result);
 			if (isError) {

package/src/in-process-transport.ts

@@ -339,7 +339,8 @@ export async function createSdkChildSession(
 		options.agent.cwd,
 		agentDir,
 		options.agentConfig.systemPrompt,
-		options.agent.agentScope === "project" || options.agent.agentScope === "both",
+		options.agent.target?.trust.projectTrusted ??
+			(options.agent.agentScope === "project" || options.agent.agentScope === "both"),
 	);
 	const resolved = await resolveChildModel(options);
 	const modelRuntime = await createChildModelRuntime(
@@ -508,8 +509,7 @@ export async function createInProcessResourceLoader(
 	agentSystemPrompt: string,
 	projectTrusted = false,
 ): Promise<{ loader: DefaultResourceLoader; settingsManager: SettingsManager }> {
-	const settingsManager = SettingsManager.create(cwd, agentDir);
-	settingsManager.setProjectTrusted(projectTrusted);
+	const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
 	const loader = new DefaultResourceLoader({
 		cwd,
 		agentDir,