@narumitw/pi-subagents 0.46.0 → 0.47.0

package/README.md

@@ -253,11 +253,11 @@ without launching or charging a child.
 
 | Value | Behavior |
 | --- | --- |
-| `"project-context"` (default) | Keep ordinary user context/system files and trusted project `AGENTS.md`, `CLAUDE.md`, and `SYSTEM.md`; disable skills and prompt templates |
+| `"project-context"` (default) | Keep ordinary user context/system files and trusted project `AGENTS.md`, `CLAUDE.md`, `SYSTEM.md`, and `APPEND_SYSTEM.md`; disable skills and prompt templates |
 | `"none"` | Use only the package consultation base, selected agent prompt, and enforced read-only instruction |
 | `"all"` | Keep ordinarily discoverable trusted context/system/append-system files, skills, and prompt templates |
 
-Extensions remain disabled for all three values. A current target uses the session's effective project trust, including session-only or CLI overrides. An external target uses the nearest saved trust decision. For an untrusted, explicitly denied, unsaved, or trust-error target, consultation remains available when `cwdPolicy.consultation` permits it but automatically downgrades to `resources: "none"`. This also disables context files because Pi does not protect `AGENTS.md` and `CLAUDE.md` with project trust alone. A saved-trusted external target uses the configured resource policy and discovers `SYSTEM.md`, `APPEND_SYSTEM.md`, and ordinary child context from that target rather than the parent workspace.
+Extensions remain disabled for all three values. Pi core owns system-prompt source precedence: a trusted project prompt wins over the global prompt, with the global prompt used as fallback. A selected Pi prompt source must be a readable regular file; directories, FIFOs, devices, sockets, and unreadable sources fail before child launch. A current target uses the session's effective project trust, including session-only or CLI overrides. An external target uses the nearest saved trust decision. For an untrusted, explicitly denied, unsaved, or trust-error target, consultation remains available when `cwdPolicy.consultation` permits it but automatically downgrades to `resources: "none"`. This also disables context files because Pi does not protect `AGENTS.md` and `CLAUDE.md` with project trust alone. A saved-trusted external target uses the configured resource policy and discovers `SYSTEM.md`, `APPEND_SYSTEM.md`, and ordinary child context from that target rather than the parent workspace.
 
 Both settings are user-owned in `~/.pi/agent/pi-subagents.json`; projects cannot override them. `cwdPolicy.consultation: "current-workspace"` rejects every canonical external target before agent discovery or launch even when that target is saved-trusted. This is not a path sandbox: read-only tools can still read an explicitly requested accessible absolute path.
 
@@ -457,12 +457,12 @@ Reasoning, tool results, custom transport messages, and non-text parts are exclu
 Stateful execution uses a transport boundary:
 
 - `subprocess` is the default compatibility and rollback path.
-- `in-process` uses only public Pi SDK APIs: `createAgentSession()`, `SessionManager.inMemory()`, `DefaultResourceLoader`, and normal session lifecycle methods. It isolates conversation/tool selection, not memory or crashes; child failures share the parent Node.js process.
+- `in-process` uses only public Pi SDK APIs: `createAgentSessionServices()`, `createAgentSessionFromServices()`, `SessionManager.inMemory()`, and normal session lifecycle methods. It isolates conversation/tool selection, not memory or crashes; child failures share the parent Node.js process.
 - Child resource loading sets `noExtensions: true`, preventing recursive `pi-subagents` loading and duplicate extension side effects while retaining trust-eligible context/skill resources and the selected agent prompt. Both transports receive the same resolved target-trust boolean: subprocess children get explicit `--approve`/`--no-approve`, and in-process children set the same `SettingsManager.projectTrusted` value.
-- Agent model, thinking level, and built-in tool allow-list overrides are applied when the child is created. Parent model/thinking changes are snapshotted for subsequently created children; an existing child keeps its own session configuration.
+- Agent model strings use Pi core's CLI resolver, including provider/model patterns, fuzzy matching, custom provider model IDs, and `:<thinking>` suffixes. Thinking level and built-in tool allow-list overrides are applied when the child is created. Parent model/thinking changes are snapshotted for subsequently created children; an existing child keeps its own session configuration.
 - Extension/custom tool names are rejected in-process with an actionable recommendation to use `subprocess`; permissions are never silently widened.
 - Timeout, parent abort, close, expiry, and session shutdown abort/dispose owned child sessions. A child that does not settle after abort grace is discarded rather than reused.
-- In-process startup failures do not silently retry through subprocesses, preventing duplicate side effects.
+- In-process startup failures do not silently retry through subprocesses, preventing duplicate side effects. If the loaded Pi core lacks public `createAgentSessionServices()`, `createAgentSessionFromServices()`, or `resolveCliModel()` support, startup fails with an actionable instruction to select `stateful.transport: "subprocess"`.
 
 No private Pi imports, runtime casts, or `ExtensionAPI` monkey-patching are used. Approval policy, sandbox profile, provider-header hooks, extension state, global scheduling, and parent/child transcript switching are not inherited or provided by the in-process transport.
 
@@ -610,7 +610,7 @@ For `subagent_spawn`, the root agent should choose the lowest sufficient level:
 
 Blocking thinking precedence is: task/chain step/aggregator `thinkingLevel` → top-level `thinkingLevel` → agent default from config or frontmatter → Pi subprocess default.
 
-Stateful spawn precedence is: `subagent_spawn.thinkingLevel` → agent default from config or frontmatter → transport fallback. The subprocess transport then uses spawned Pi model/default resolution. The in-process transport uses a configured model thinking suffix and then the parent thinking snapshot captured when the child is created. An explicit spawn value is retained for the agent lifecycle and wins over all of those fallbacks.
+Stateful spawn precedence is: `subagent_spawn.thinkingLevel` → agent default from config or frontmatter → transport fallback. The subprocess transport then uses spawned Pi model/default resolution. The in-process transport delegates configured model parsing to the loaded Pi core and uses its model thinking suffix before the parent thinking snapshot captured when the child is created. An explicit spawn value is retained for the agent lifecycle and wins over all of those fallbacks.
 
 Omit `thinkingLevel` to preserve existing behavior. Reported stateful details show the requested level, not a guarantee of the provider's effective value. Pi still owns model capability clamping; `pi-subagents` does not duplicate capability detection.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@narumitw/pi-subagents",
-	"version": "0.46.0",
+	"version": "0.47.0",
 	"description": "Pi extension for delegating work to specialized isolated subagents.",
 	"type": "module",
 	"license": "MIT",

package/src/agents.ts

@@ -4,7 +4,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import { CONFIG_DIR_NAME, getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 
 export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
@@ -316,7 +316,7 @@ function isDirectory(p: string): boolean {
 function findNearestProjectAgentsDir(cwd: string): string | null {
 	let currentDir = cwd;
 	while (true) {
-		const candidate = path.join(currentDir, ".pi", "agents");
+		const candidate = path.join(currentDir, CONFIG_DIR_NAME, "agents");
 		if (isDirectory(candidate)) return candidate;
 
 		const parentDir = path.dirname(currentDir);

package/src/consult-resources.ts

@@ -0,0 +1,74 @@
+import {
+	DefaultResourceLoader,
+	getAgentDir,
+	SettingsManager,
+} from "@earendil-works/pi-coding-agent";
+import type { ConsultResourcePolicy } from "./agents.js";
+import { DEFAULT_MAX_CONTEXT_BYTES, truncateUtf8 } from "./limits.js";
+import { assertPiPromptSourcesAreReadableFiles } from "./prompt-source-safety.js";
+import type { ChildLaunchPolicy } from "./runner.js";
+
+const MINIMAL_CONSULT_SYSTEM_PROMPT =
+	"You are a read-only consultation assistant. Analyze the delegated task using only executor-provided capabilities and return a grounded answer.";
+
+/**
+ * Resolve Pi-owned prompt files without loading target settings, packages, or extensions.
+ * The child still owns context-file, skill, and prompt-template loading according to this policy.
+ */
+export async function resolveConsultResourceLaunchPolicy(
+	policy: ConsultResourcePolicy,
+	projectTrusted: boolean,
+	cwd: string,
+): Promise<ChildLaunchPolicy> {
+	if (policy === "none") {
+		return {
+			disableExtensions: true,
+			disableSkills: true,
+			disablePromptTemplates: true,
+			disableContextFiles: true,
+			projectTrust: false,
+			baseSystemPrompt: MINIMAL_CONSULT_SYSTEM_PROMPT,
+		};
+	}
+
+	const agentDir = getAgentDir();
+	assertPiPromptSourcesAreReadableFiles(cwd, agentDir, projectTrusted, [
+		"SYSTEM.md",
+		"APPEND_SYSTEM.md",
+	]);
+	const loader = new DefaultResourceLoader({
+		cwd,
+		agentDir,
+		settingsManager: SettingsManager.inMemory({}, { projectTrusted }),
+		noExtensions: true,
+		noSkills: true,
+		noPromptTemplates: true,
+		noThemes: true,
+		noContextFiles: true,
+	});
+	await loader.reload();
+
+	const discoveredSystemPrompt = loader.getSystemPrompt();
+	const baseSystemPrompt = discoveredSystemPrompt
+		? truncateUtf8(discoveredSystemPrompt, DEFAULT_MAX_CONTEXT_BYTES).text
+		: undefined;
+	const appendSystemPromptPaths = loader
+		.getAppendSystemPromptSources()
+		.map((source) => source.path);
+	const shared = {
+		disableExtensions: true,
+		disableContextFiles: !projectTrusted,
+		projectTrust: projectTrusted,
+		baseSystemPrompt,
+		appendSystemPromptPaths:
+			appendSystemPromptPaths.length > 0 ? appendSystemPromptPaths : undefined,
+	};
+	if (policy === "project-context") {
+		return {
+			...shared,
+			disableSkills: true,
+			disablePromptTemplates: true,
+		};
+	}
+	return shared;
+}

package/src/consult.ts

@@ -1,11 +1,10 @@
-import * as fs from "node:fs";
 import * as path from "node:path";
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
 import { StringEnum, type Usage } from "@earendil-works/pi-ai";
 import {
+	CONFIG_DIR_NAME,
 	type ExtensionAPI,
 	type ExtensionContext,
-	getAgentDir,
 	type ToolDefinition,
 } from "@earendil-works/pi-coding-agent";
 import { type Static, Type } from "typebox";
@@ -22,6 +21,7 @@ import {
 } from "./agents.js";
 import { resolveConsultTools } from "./consult-policy.js";
 import { renderConsultCall, renderConsultResult } from "./consult-render.js";
+import { resolveConsultResourceLaunchPolicy } from "./consult-resources.js";
 import {
 	assertConsultationTargetAllowed,
 	type ResolvedSubagentTarget,
@@ -32,7 +32,6 @@ import {
 	DEFAULT_MAX_CONTEXT_BYTES,
 	DEFAULT_MAX_STDERR_BYTES,
 	MAX_SUBAGENT_TIMEOUT_MS,
-	truncateUtf8,
 } from "./limits.js";
 import {
 	type ChildLaunchPolicy,
@@ -88,6 +87,7 @@ export interface RegisterSubagentConsultOptions {
 	getSettings(): SubagentSettings | undefined;
 	runChild?: (request: ConsultChildRequest) => Promise<SingleResult>;
 	invocationOverride?: { command: string; argsPrefix?: string[] };
+	resolveResourceLaunchPolicy?: typeof resolveConsultResourceLaunchPolicy;
 }
 
 export interface ConsultProgressActivity {
@@ -159,8 +159,6 @@ const READ_ONLY_INSTRUCTION = [
 	"If the task asks for implementation, return analysis or instructions instead of claiming changes.",
 ].join("\n");
 
-const MINIMAL_CONSULT_SYSTEM_PROMPT =
-	"You are a read-only consultation assistant. Analyze the delegated task using only executor-provided capabilities and return a grounded answer.";
 const MAX_UNKNOWN_AGENT_NAME_BYTES = 128;
 
 export function registerSubagentConsult(
@@ -169,7 +167,7 @@ export function registerSubagentConsult(
 ): (catalog: string) => void {
 	let generation = 0;
 	const active = new Set<AbortController>();
-	const activeChildren = new Set<Promise<SingleResult>>();
+	const activeWork = new Set<Promise<unknown>>();
 	const cancelActive = (reason: string) => {
 		generation++;
 		for (const controller of active) {
@@ -177,14 +175,12 @@ export function registerSubagentConsult(
 		}
 		active.clear();
 	};
-	const cancelAndWaitForChildren = async (reason: string) => {
+	const cancelAndWaitForWork = async (reason: string) => {
 		cancelActive(reason);
-		await Promise.allSettled([...activeChildren]);
+		await Promise.allSettled([...activeWork]);
 	};
-	pi.on("session_start", () => cancelAndWaitForChildren("Subagent consultation session replaced"));
-	pi.on("session_shutdown", () =>
-		cancelAndWaitForChildren("Subagent consultation session shut down"),
-	);
+	pi.on("session_start", () => cancelAndWaitForWork("Subagent consultation session replaced"));
+	pi.on("session_shutdown", () => cancelAndWaitForWork("Subagent consultation session shut down"));
 
 	const baseDescription = () =>
 		`Run one ephemeral subagent synchronously under enforced read-only tool and resource policies and return its answer. The child can use only the effective subset of Pi's built-in read, grep, find, and ls tools. Shell commands, file writes, extension tools, detached lifecycle operations, and persistent agent state are disabled. Working-directory target policy: ${options.getSettings()?.cwdPolicy?.consultation ?? DEFAULT_CONSULTATION_CWD_POLICY}; configured trusted-target resources: ${options.getSettings()?.consult?.resources ?? DEFAULT_CONSULT_RESOURCE_POLICY}; allowed targets without effective trust inherit no target/project resources. This is not a filesystem sandbox.`;
@@ -217,11 +213,11 @@ export function registerSubagentConsult(
 						onUpdate?.(partial);
 					},
 					() => ownerGeneration === generation,
-					(child) => {
-						activeChildren.add(child);
-						void child.then(
-							() => activeChildren.delete(child),
-							() => activeChildren.delete(child),
+					(work) => {
+						activeWork.add(work);
+						void work.then(
+							() => activeWork.delete(work),
+							() => activeWork.delete(work),
 						);
 					},
 				);
@@ -334,7 +330,7 @@ async function executeConsult(
 	options: RegisterSubagentConsultOptions,
 	emitUpdate: (partial: AgentToolResult<ConsultDetails>) => void,
 	isCurrent: () => boolean,
-	trackChild: (child: Promise<SingleResult>) => void,
+	trackWork: (work: Promise<unknown>) => void,
 ): Promise<AgentToolResult<ConsultDetails>> {
 	if (
 		(operation.agentScope === "project" || operation.agentScope === "both") &&
@@ -360,7 +356,10 @@ async function executeConsult(
 				`Available agents for agentScope "${operation.agentScope}": ${formatAvailableConsultAgents(discovery)}`,
 		);
 	}
-	const setup = resolveConsultSetup(operation, agent, settings, target);
+	const setupWork = resolveConsultSetup(operation, agent, settings, target, options);
+	trackWork(setupWork);
+	const setup = await setupWork;
+	assertCurrentRequest(signal, isCurrent);
 
 	if (agent.source === "project" && operation.confirmProjectAgents) {
 		if (!ctx.hasUI) {
@@ -370,7 +369,7 @@ async function executeConsult(
 		}
 		const approved = await ctx.ui.confirm(
 			"Run project-local read-only agent?",
-			`Agent: ${safeTerminalLine(agent.name, 256)}\nSource: ${safeTerminalLine(path.posix.join(".pi", "agents", path.basename(agent.filePath)))}`,
+			`Agent: ${safeTerminalLine(agent.name, 256)}\nSource: ${safeTerminalLine(path.posix.join(CONFIG_DIR_NAME, "agents", path.basename(agent.filePath)))}`,
 		);
 		assertCurrentRequest(signal, isCurrent);
 		if (!approved) {
@@ -400,7 +399,7 @@ async function executeConsult(
 			emitUpdate(consultUpdate(result, setup.details));
 		},
 	});
-	trackChild(child);
+	trackWork(child);
 	const result = await child;
 	if (!isCurrent()) throw abortError("Subagent consultation owner was replaced");
 	if (result.aborted && !result.processStarted) {
@@ -432,18 +431,17 @@ async function executeConsult(
 	};
 }
 
-function resolveConsultSetup(
+async function resolveConsultSetup(
 	operation: ReturnType<typeof validateConsultParams>,
 	agent: AgentConfig,
 	settings: SubagentSettings | undefined,
 	target: ResolvedSubagentTarget,
+	options: RegisterSubagentConsultOptions,
 ) {
 	const requestedResourcePolicy = settings?.consult?.resources ?? DEFAULT_CONSULT_RESOURCE_POLICY;
 	const resourcePolicy = target.trust.projectTrusted ? requestedResourcePolicy : "none";
 	const effectiveTools = resolveConsultTools(agent.tools);
 	const projectTrusted = target.trust.projectTrusted;
-	const launchPolicy = resourceLaunchPolicy(resourcePolicy, projectTrusted, target.cwd);
-	launchPolicy.tools = effectiveTools;
 	const thinkingLevel = resolveSubagentThinkingLevel([agent], agent.name, operation.thinkingLevel);
 	const timeoutMs = operation.timeoutMs ?? agent.timeoutMs ?? resolveDefaultSubagentTimeoutMs();
 	if (!Number.isFinite(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_SUBAGENT_TIMEOUT_MS) {
@@ -451,6 +449,10 @@ function resolveConsultSetup(
 			`Subagent consultation timeout must be between 1 and ${MAX_SUBAGENT_TIMEOUT_MS}ms`,
 		);
 	}
+	const resolveResources =
+		options.resolveResourceLaunchPolicy ?? resolveConsultResourceLaunchPolicy;
+	const launchPolicy = await resolveResources(resourcePolicy, projectTrusted, target.cwd);
+	launchPolicy.tools = effectiveTools;
 	const childAgent: AgentConfig = {
 		...agent,
 		tools: effectiveTools,
@@ -625,95 +627,6 @@ function emptyProgressUsage(): ConsultProgress["usage"] {
 	};
 }
 
-function resourceLaunchPolicy(
-	policy: ConsultResourcePolicy,
-	projectTrusted: boolean,
-	workspace: string,
-): ChildLaunchPolicy {
-	if (policy === "none") {
-		return {
-			disableExtensions: true,
-			disableSkills: true,
-			disablePromptTemplates: true,
-			disableContextFiles: true,
-			projectTrust: false,
-			baseSystemPrompt: MINIMAL_CONSULT_SYSTEM_PROMPT,
-		};
-	}
-	const baseSystemPrompt = discoverSystemPrompt(workspace, projectTrusted);
-	if (policy === "project-context") {
-		return {
-			disableExtensions: true,
-			disableSkills: true,
-			disablePromptTemplates: true,
-			disableContextFiles: !projectTrusted,
-			projectTrust: projectTrusted,
-			baseSystemPrompt,
-		};
-	}
-	return {
-		disableExtensions: true,
-		disableContextFiles: !projectTrusted,
-		projectTrust: projectTrusted,
-		baseSystemPrompt,
-		appendSystemPromptPaths: discoverAppendSystemPrompts(workspace, projectTrusted),
-	};
-}
-
-function discoverSystemPrompt(workspace: string, projectTrusted: boolean): string | undefined {
-	const candidates = [
-		...(projectTrusted ? [path.join(workspace, ".pi", "SYSTEM.md")] : []),
-		path.join(getAgentDir(), "SYSTEM.md"),
-	];
-	for (const candidate of candidates) {
-		const prompt = readBoundedOptionalPrompt(candidate);
-		if (prompt !== undefined) return prompt;
-	}
-	return undefined;
-}
-
-function readBoundedOptionalPrompt(filePath: string): string | undefined {
-	let descriptor: number | undefined;
-	try {
-		descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
-		if (!fs.fstatSync(descriptor).isFile()) return undefined;
-		const buffer = Buffer.alloc(DEFAULT_MAX_CONTEXT_BYTES + 4);
-		let bytesRead = 0;
-		while (bytesRead < buffer.length) {
-			const next = fs.readSync(descriptor, buffer, bytesRead, buffer.length - bytesRead, bytesRead);
-			if (next === 0) break;
-			bytesRead += next;
-		}
-		return truncateUtf8(buffer.subarray(0, bytesRead).toString("utf8"), DEFAULT_MAX_CONTEXT_BYTES)
-			.text;
-	} catch {
-		// Match Pi resource discovery: an unreadable optional prompt is skipped.
-		return undefined;
-	} finally {
-		if (descriptor !== undefined) {
-			try {
-				fs.closeSync(descriptor);
-			} catch {
-				// Optional prompt cleanup must not make consultation discovery fail.
-			}
-		}
-	}
-}
-
-function discoverAppendSystemPrompts(cwd: string, projectTrusted: boolean): string[] {
-	const candidates = [
-		path.join(getAgentDir(), "APPEND_SYSTEM.md"),
-		...(projectTrusted ? [path.join(cwd, ".pi", "APPEND_SYSTEM.md")] : []),
-	];
-	return candidates.filter((candidate) => {
-		try {
-			return fs.statSync(candidate).isFile();
-		} catch {
-			return false;
-		}
-	});
-}
-
 function projectChildResult(result: SingleResult): Record<string, unknown> {
 	return {
 		exitCode: result.exitCode,

package/src/in-process-transport.ts

@@ -1,22 +1,17 @@
-import { join } from "node:path";
 import type { Api, Model } from "@earendil-works/pi-ai";
 import {
-	createAgentSession,
-	DefaultResourceLoader,
+	type AgentSessionServices,
 	getAgentDir,
 	type ModelRegistry,
+	type ModelRuntime,
 	SessionManager,
 	SettingsManager,
 } from "@earendil-works/pi-coding-agent";
-import {
-	type AgentConfig,
-	discoverAgents,
-	isThinkingLevel,
-	type SubagentThinkingLevel,
-} from "./agents.js";
+import { type AgentConfig, discoverAgents, type SubagentThinkingLevel } from "./agents.js";
 import { redactPrivateText } from "./context.js";
 import { resolveDefaultSubagentTimeoutMs } from "./execution.js";
 import { DEFAULT_MAX_CONTEXT_BYTES, DEFAULT_MAX_OUTPUT_BYTES, truncateUtf8 } from "./limits.js";
+import { assertPiPromptSourcesAreReadableFiles } from "./prompt-source-safety.js";
 import type { AgentTurn, ManagedAgent, TurnOutcome } from "./registry.js";
 import { readSubagentSettings } from "./settings.js";
 import type { SubagentTransport } from "./transport.js";
@@ -32,9 +27,20 @@ interface ChildModelRuntime {
 }
 
 interface CodingAgentRuntimeModule {
-	ModelRuntime?: {
-		create(options?: { authPath?: string; modelsPath?: string | null }): Promise<ChildModelRuntime>;
-	};
+	createAgentSessionFromServices?: typeof import("@earendil-works/pi-coding-agent").createAgentSessionFromServices;
+	createAgentSessionServices?: typeof import("@earendil-works/pi-coding-agent").createAgentSessionServices;
+	resolveCliModel?: typeof import("@earendil-works/pi-coding-agent").resolveCliModel;
+}
+
+interface CoreModelSupport {
+	modelRuntime: ModelRuntime;
+	resolveCliModel: typeof import("@earendil-works/pi-coding-agent").resolveCliModel;
+}
+
+interface CoreSessionSupport {
+	createAgentSessionFromServices: typeof import("@earendil-works/pi-coding-agent").createAgentSessionFromServices;
+	createAgentSessionServices: typeof import("@earendil-works/pi-coding-agent").createAgentSessionServices;
+	resolveCliModel: typeof import("@earendil-works/pi-coding-agent").resolveCliModel;
 }
 
 interface RegisteredProviderRegistry {
@@ -335,39 +341,36 @@ export async function createSdkChildSession(
 	options: ChildSessionCreateOptions,
 ): Promise<ChildSession> {
 	const agentDir = getAgentDir();
-	const { loader: resourceLoader, settingsManager } = await createInProcessResourceLoader(
+	const projectTrusted =
+		options.agent.target?.trust.projectTrusted ??
+		(options.agent.agentScope === "project" || options.agent.agentScope === "both");
+	const { services, support: coreSupport } = await prepareInProcessServices(
 		options.agent.cwd,
 		agentDir,
 		options.agentConfig.systemPrompt,
-		options.agent.target?.trust.projectTrusted ??
-			(options.agent.agentScope === "project" || options.agent.agentScope === "both"),
+		projectTrusted,
 	);
-	const resolved = await resolveChildModel(options);
-	const modelRuntime = await createChildModelRuntime(
-		options.modelRegistry,
-		resolved.model,
-		agentDir,
+	copyRegisteredProviders(
+		options.modelRegistry as unknown as RegisteredProviderRegistry,
+		services.modelRuntime as unknown as ChildModelRuntime,
 	);
-	const model =
-		modelRuntime?.getModel(resolved.model.provider, resolved.model.id) ?? resolved.model;
+	const modelSupport: CoreModelSupport = {
+		modelRuntime: services.modelRuntime,
+		resolveCliModel: coreSupport.resolveCliModel,
+	};
+	const resolved = await resolveChildModel(options, modelSupport);
+	await transferChildModelAuth(options.modelRegistry, resolved.model, services.modelRuntime);
+	const model = resolved.model;
 	const sessionManager = SessionManager.inMemory(options.agent.cwd);
 	seedChildSessionManager(sessionManager, options, model);
-	const sessionOptions: Record<string, unknown> = {
-		cwd: options.agent.cwd,
-		agentDir,
+	const created = await coreSupport.createAgentSessionFromServices({
+		services,
+		sessionManager,
 		model,
 		thinkingLevel: resolved.thinkingLevel,
-		resourceLoader,
-		settingsManager,
-		sessionManager,
 		tools: options.tools,
 		noTools: options.tools?.length === 0 ? "all" : undefined,
-	};
-	if (modelRuntime) sessionOptions.modelRuntime = modelRuntime;
-	else sessionOptions.modelRegistry = options.modelRegistry;
-	const created = await createAgentSession(
-		sessionOptions as NonNullable<Parameters<typeof createAgentSession>[0]>,
-	);
+	});
 	const session = created.session;
 	if (options.tools !== undefined) {
 		const active = session.getActiveToolNames();
@@ -397,25 +400,31 @@ export async function createSdkChildSession(
 	};
 }
 
-async function createChildModelRuntime(
-	modelRegistry: ModelRegistry,
-	model: Model<Api>,
-	agentDir: string,
-): Promise<ChildModelRuntime | undefined> {
+async function loadCoreSessionSupport(): Promise<CoreSessionSupport | undefined> {
 	const codingAgentModule = (await import(
 		"@earendil-works/pi-coding-agent"
 	)) as unknown as CodingAgentRuntimeModule;
-	if (!codingAgentModule.ModelRuntime) return undefined;
+	if (
+		!codingAgentModule.createAgentSessionFromServices ||
+		!codingAgentModule.createAgentSessionServices ||
+		!codingAgentModule.resolveCliModel
+	) {
+		return undefined;
+	}
+	return {
+		createAgentSessionFromServices: codingAgentModule.createAgentSessionFromServices,
+		createAgentSessionServices: codingAgentModule.createAgentSessionServices,
+		resolveCliModel: codingAgentModule.resolveCliModel,
+	};
+}
 
-	const modelRuntime = await codingAgentModule.ModelRuntime.create({
-		authPath: join(agentDir, "auth.json"),
-		modelsPath: join(agentDir, "models.json"),
-	});
-	const registeredProviders = modelRegistry as unknown as RegisteredProviderRegistry;
-	copyRegisteredProviders(registeredProviders, modelRuntime);
+async function transferChildModelAuth(
+	modelRegistry: ModelRegistry,
+	model: Model<Api>,
+	modelRuntime: ModelRuntime,
+): Promise<void> {
 	const auth = await modelRegistry.getApiKeyAndHeaders(model);
 	if (auth.ok && auth.apiKey) await modelRuntime.setRuntimeApiKey(model.provider, auth.apiKey);
-	return modelRuntime;
 }
 
 export function copyRegisteredProviders(
@@ -433,20 +442,33 @@ export function copyRegisteredProviders(
 	}
 }
 
-export async function resolveChildModel(options: ChildSessionCreateOptions): Promise<{
+export async function resolveChildModel(
+	options: ChildSessionCreateOptions,
+	support?: CoreModelSupport,
+): Promise<{
 	model: Model<Api>;
 	thinkingLevel: SubagentThinkingLevel;
 }> {
+	if (!support) throw unsupportedInProcessCoreError();
 	let model = options.parentRuntime.model;
 	let modelThinkingLevel: SubagentThinkingLevel | undefined;
-	if (options.agentConfig.model) {
-		const parsed = parseModelRequest(options.agentConfig.model);
-		model = resolveConfiguredModel(parsed.model, options.modelRegistry);
-		modelThinkingLevel = parsed.thinkingLevel;
+	if (options.agentConfig.model !== undefined) {
+		const requested = options.agentConfig.model.trim();
+		if (!requested) throw new Error("In-process subagent model cannot be empty");
+		const resolved = support.resolveCliModel({
+			cliModel: requested,
+			modelRuntime: support.modelRuntime,
+		});
+		if (resolved.error) throw new Error(resolved.error);
+		if (!resolved.model)
+			throw new Error(`Unable to resolve in-process subagent model ${requested}`);
+		model = resolved.model;
+		modelThinkingLevel = resolved.thinkingLevel;
 	}
 	if (!model) model = options.modelRegistry.getAvailable()[0];
 	if (!model)
 		throw new Error("No model with configured authentication is available for in-process subagent");
+	model = support.modelRuntime.getModel(model.provider, model.id) ?? model;
 	return {
 		model,
 		thinkingLevel:
@@ -457,68 +479,42 @@ export async function resolveChildModel(options: ChildSessionCreateOptions): Pro
 	};
 }
 
-function parseModelRequest(value: string): {
-	model: string;
-	thinkingLevel?: SubagentThinkingLevel;
-} {
-	const requested = value.trim();
-	const separator = requested.lastIndexOf(":");
-	if (separator > 0) {
-		const suffix = requested.slice(separator + 1);
-		if (isThinkingLevel(suffix)) {
-			return { model: requested.slice(0, separator), thinkingLevel: suffix };
-		}
-	}
-	return { model: requested };
-}
-
-function resolveConfiguredModel(value: string, modelRegistry: ModelRegistry): Model<Api> {
-	const requested = value.trim();
-	if (!requested) throw new Error("In-process subagent model cannot be empty");
-	const slash = requested.indexOf("/");
-	if (slash > 0) {
-		const exact = modelRegistry.find(requested.slice(0, slash), requested.slice(slash + 1));
-		if (exact) return exact;
-	}
-	const lowered = requested.toLowerCase();
-	const exactMatches = modelRegistry
-		.getAll()
-		.filter((model) => model.id.toLowerCase() === lowered || model.name.toLowerCase() === lowered);
-	if (exactMatches.length === 1) return exactMatches[0];
-	const partialMatches = modelRegistry
-		.getAll()
-		.filter(
-			(model) =>
-				model.id.toLowerCase().includes(lowered) || model.name.toLowerCase().includes(lowered),
-		);
-	if (partialMatches.length === 1) return partialMatches[0];
-	const displayedMatches = partialMatches
-		.slice(0, 8)
-		.map((model) => `${model.provider}/${model.id}`);
-	const remaining = partialMatches.length - displayedMatches.length;
-	const suffix =
-		displayedMatches.length > 0
-			? `; matches: ${displayedMatches.join(", ")}${remaining > 0 ? `, and ${remaining} more` : ""}`
-			: "";
-	throw new Error(`Unable to resolve in-process subagent model ${requested}${suffix}`);
+function unsupportedInProcessCoreError(): Error {
+	return new Error(
+		'In-process subagents require Pi core createAgentSessionServices, createAgentSessionFromServices, and resolveCliModel support; set stateful.transport to "subprocess".',
+	);
 }
 
-export async function createInProcessResourceLoader(
+async function prepareInProcessServices(
 	cwd: string,
 	agentDir: string,
 	agentSystemPrompt: string,
-	projectTrusted = false,
-): Promise<{ loader: DefaultResourceLoader; settingsManager: SettingsManager }> {
+	projectTrusted: boolean,
+): Promise<{ services: AgentSessionServices; support: CoreSessionSupport }> {
+	assertPiPromptSourcesAreReadableFiles(cwd, agentDir, projectTrusted, ["SYSTEM.md"]);
 	const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
-	const loader = new DefaultResourceLoader({
+	const support = await loadCoreSessionSupport();
+	if (!support) throw unsupportedInProcessCoreError();
+	const services = await support.createAgentSessionServices({
 		cwd,
 		agentDir,
 		settingsManager,
-		noExtensions: true,
-		appendSystemPrompt: agentSystemPrompt.trim() ? [agentSystemPrompt] : [],
+		resourceLoaderOptions: {
+			noExtensions: true,
+			appendSystemPrompt: agentSystemPrompt.trim() ? [agentSystemPrompt] : [],
+		},
 	});
-	await loader.reload();
-	return { loader, settingsManager };
+	return { services, support };
+}
+
+export async function createInProcessServices(
+	cwd: string,
+	agentDir: string,
+	agentSystemPrompt: string,
+	projectTrusted = false,
+): Promise<AgentSessionServices> {
+	return (await prepareInProcessServices(cwd, agentDir, agentSystemPrompt, projectTrusted))
+		.services;
 }
 
 export function seedChildSessionManager(

package/src/inspect.ts

@@ -1,6 +1,10 @@
 import * as path from "node:path";
 import { StringEnum } from "@earendil-works/pi-ai";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+	CONFIG_DIR_NAME,
+	type ExtensionAPI,
+	type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
 import { type Static, Type } from "typebox";
 import {
 	type AgentConfig,
@@ -270,7 +274,9 @@ function projectAgent(
 		scope: agent.source === "project" ? "project" : "user",
 		path:
 			agent.source === "project"
-				? safeTerminalLine(path.posix.join(".pi", "agents", path.basename(agent.filePath)))
+				? safeTerminalLine(
+						path.posix.join(CONFIG_DIR_NAME, "agents", path.basename(agent.filePath)),
+					)
 				: safeDisplayPath(agent.filePath, ctx.cwd),
 		model: agent.model ? boundedPrivateText(agent.model, 256) : undefined,
 		thinkingLevel: agent.thinkingLevel,

package/src/limits.ts

@@ -1,6 +1,8 @@
-export const DEFAULT_MAX_OUTPUT_BYTES = 50 * 1024;
+import { DEFAULT_MAX_BYTES } from "@earendil-works/pi-coding-agent";
+
+export const DEFAULT_MAX_OUTPUT_BYTES = DEFAULT_MAX_BYTES;
 export const DEFAULT_MAX_STDERR_BYTES = 16 * 1024;
-export const DEFAULT_MAX_CONTEXT_BYTES = 50 * 1024;
+export const DEFAULT_MAX_CONTEXT_BYTES = DEFAULT_MAX_BYTES;
 export const MAX_SUBAGENT_TIMEOUT_MS = 2_147_483_647;
 export const DEFAULT_MAX_MESSAGES = 200;
 export const TRUNCATION_MARKER = "\n… [truncated by pi-subagents]";

package/src/prompt-source-safety.ts

@@ -0,0 +1,48 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { CONFIG_DIR_NAME } from "@earendil-works/pi-coding-agent";
+
+export type PiPromptFileName = "SYSTEM.md" | "APPEND_SYSTEM.md";
+
+/**
+ * Prevent Pi's synchronous prompt loader from opening a selected directory, FIFO, socket, device,
+ * or unreadable source. Candidate order mirrors core only as a preflight guard; core still resolves
+ * and loads the prompt after this check.
+ */
+export function assertPiPromptSourcesAreReadableFiles(
+	cwd: string,
+	agentDir: string,
+	projectTrusted: boolean,
+	fileNames: readonly PiPromptFileName[],
+): void {
+	for (const fileName of fileNames) {
+		const candidates = [
+			...(projectTrusted ? [path.join(cwd, CONFIG_DIR_NAME, fileName)] : []),
+			path.join(agentDir, fileName),
+		];
+		for (const candidate of candidates) {
+			const status = promptSourceStatus(candidate);
+			if (status === "missing") continue;
+			if (status === "invalid") {
+				throw new Error(`Pi ${fileName} prompt source must be a readable regular file`);
+			}
+			break;
+		}
+	}
+}
+
+function promptSourceStatus(filePath: string): "missing" | "regular" | "invalid" {
+	let descriptor: number | undefined;
+	try {
+		descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+		return fs.fstatSync(descriptor).isFile() ? "regular" : "invalid";
+	} catch (error) {
+		const code =
+			error && typeof error === "object" && "code" in error
+				? (error as { code?: unknown }).code
+				: undefined;
+		return code === "ENOENT" || code === "ENOTDIR" ? "missing" : "invalid";
+	} finally {
+		if (descriptor !== undefined) fs.closeSync(descriptor);
+	}
+}

package/src/safe-text.ts

@@ -1,10 +1,10 @@
 import * as os from "node:os";
 import * as path from "node:path";
-import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { DEFAULT_MAX_LINES, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { redactPrivateText } from "./context.js";
 import { DEFAULT_MAX_OUTPUT_BYTES, TRUNCATION_MARKER, truncateUtf8 } from "./limits.js";
 
-export const DEFAULT_MAX_OUTPUT_LINES = 2_000;
+export const DEFAULT_MAX_OUTPUT_LINES = DEFAULT_MAX_LINES;
 
 export function safeTerminalText(value: string): string {
 	return (

package/src/subagents.ts

@@ -12,7 +12,11 @@
  * Uses JSON mode to capture structured output from subagents.
  */
 
-import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-agent";
+import {
+	CONFIG_DIR_NAME,
+	type ExtensionAPI,
+	type ToolDefinition,
+} from "@earendil-works/pi-coding-agent";
 import {
 	type ConsultationCwdPolicy,
 	type ConsultResourcePolicy,
@@ -137,7 +141,7 @@ function registerBlockingSubagent(
 			"Modes: single (agent + task), parallel (tasks array), chain (sequential with {previous} placeholder).",
 			"Parallel mode may include an aggregator fan-in step that receives all task outputs. Use subagent_consult instead for one synchronous child that must be executor-constrained to read-only tools.",
 			'Default agent scope is "user" (from ~/.pi/agent/agents).',
-			'To enable project-local agents in .pi/agents, pass agentScope: "both" (or "project") as a top-level argument for that call.',
+			`To enable project-local agents in ${CONFIG_DIR_NAME}/agents, pass agentScope: "both" (or "project") as a top-level argument for that call.`,
 			`Working-directory target policy: ${getSettings()?.cwdPolicy?.delegation ?? DEFAULT_DELEGATION_CWD_POLICY}. This controls launch targets and protected project resources, not filesystem access or sandboxing.`,
 		].join(" ");
 	const definition: ToolDefinition<typeof SubagentParams, SubagentDetails> = {