@oh-my-pi/pi-coding-agent 16.1.23 → 16.2.0

package/src/ssh/file-transfer.ts

@@ -0,0 +1,209 @@
+/**
+ * Byte-preserving remote file I/O over the shared SSH ControlMaster connection.
+ *
+ * Unlike `executeSSH` (which truncates/sanitizes through an OutputSink) and
+ * `runSshCaptureSync` (which `.trim()`s output), these helpers move raw bytes so
+ * `ssh://` reads/writes round-trip exactly — leading/trailing whitespace, tabs,
+ * and final newlines are preserved.
+ */
+import { ptree } from "@oh-my-pi/pi-utils";
+import { buildRemoteCommand, ensureConnection, ensureHostInfo, type SSHConnectionTarget } from "./connection-manager";
+import { quotePosixPath } from "./utils";
+
+/** Per-operation timeout for remote transfers (matches the ssh tool's grep window). */
+const DEFAULT_TIMEOUT_MS = 30_000;
+
+/**
+ * Ensure the ControlMaster connection and restrict transfers to remotes whose
+ * *login* shell runs our POSIX snippets directly. OpenSSH hands each command to
+ * `$SHELL -c`, so the login shell must be POSIX: Windows (cmd/powershell) can't
+ * drive `head`/`cat`/`mv`, and csh/tcsh apply `!` history expansion to the
+ * command line. `ensureHostInfo` classifies those (and fish) as a non-sh shell,
+ * so accept only sh, bash, and zsh; anything else is refused here.
+ */
+async function ensurePosixRemote(target: SSHConnectionTarget): Promise<void> {
+	await ensureConnection(target);
+	const info = await ensureHostInfo(target);
+	if (info.os === "windows") {
+		throw new Error(
+			`ssh://: ${target.name} is a Windows host; ssh:// supports POSIX remotes only (head/cat/mv) — use the ssh tool for Windows hosts`,
+		);
+	}
+	if (info.shell !== "sh" && info.shell !== "bash" && info.shell !== "zsh") {
+		throw new Error(
+			`ssh://: ${target.name} uses a non-POSIX login shell (${info.shell}); ssh:// read/write needs sh, bash, or zsh — use the ssh tool for this host`,
+		);
+	}
+}
+
+export interface RemoteFileReadOptions {
+	/** Maximum bytes to materialize; the helper fetches one extra byte to detect truncation. */
+	maxBytes: number;
+	signal?: AbortSignal;
+	timeoutMs?: number;
+}
+
+export interface RemoteFileReadResult {
+	/** Raw file bytes, capped at `maxBytes`. */
+	bytes: Uint8Array;
+	/** True when the remote file was larger than `maxBytes` (`bytes` is the prefix). */
+	truncated: boolean;
+}
+
+export interface RemoteFileWriteOptions {
+	signal?: AbortSignal;
+	timeoutMs?: number;
+}
+
+/**
+ * Read a remote file's raw bytes. Fetches `maxBytes + 1` so the caller can
+ * distinguish an exactly-`maxBytes` file from a larger (truncated) one.
+ *
+ * Throws `ptree.NonZeroExitError` (carrying the remote stderr tail) when the
+ * file is missing/unreadable or the host is unreachable.
+ */
+export async function readRemoteFile(
+	target: SSHConnectionTarget,
+	remotePath: string,
+	opts: RemoteFileReadOptions,
+): Promise<RemoteFileReadResult> {
+	await ensurePosixRemote(target);
+	const command = `head -c ${opts.maxBytes + 1} ${quotePosixPath(remotePath)}`;
+	const args = await buildRemoteCommand(target, command);
+	using child = ptree.spawn(["ssh", ...args], {
+		signal: ptree.combineSignals(opts.signal, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+	});
+	// Drain stdout before awaiting exit so a full pipe can't deadlock the child.
+	const raw = await child.bytes();
+	await child.exitedCleanly;
+	const truncated = raw.length > opts.maxBytes;
+	return { bytes: truncated ? raw.subarray(0, opts.maxBytes) : raw, truncated };
+}
+
+/**
+ * Write `content` to a remote file byte-exact. Stdin is always staged first into
+ * a uniquely named temp in the destination directory (so the remote never blocks
+ * on an unread pipe and a dropped connection lands in the temp, never the
+ * destination). The destination then dictates the commit:
+ *  - a directory — or a symlink to one, since the `-d` test follows links — is
+ *    refused (a plain `mv tmp dir` would move the temp INTO it).
+ *  - an existing non-symlink regular file is rewritten IN PLACE from the staged
+ *    temp, preserving its inode and therefore its ordinary permission bits (a
+ *    `0600` secret stays `0600` on overwrite), ACLs, xattrs, and hardlinks. The
+ *    setuid/setgid bits may be cleared by the write (per POSIX). This commit is
+ *    not fully atomic — a remote-side failure during the local temp->dest copy
+ *    (e.g. the disk filling) can truncate the destination — but the slow network
+ *    transfer has already landed in the temp, and the temp is removed on failure.
+ *    It also needs write permission on the file itself (a read-only file is
+ *    refused, not silently replaced).
+ *  - an existing special file (FIFO/socket/device) is refused, not replaced.
+ *  - anything else (a new path, a symlink to a non-directory, a dangling symlink)
+ *    is committed with an atomic rename, which REPLACES a symlink with a regular
+ *    file rather than writing through it (resolving the link target is not
+ *    portable across the macOS/Linux hosts this stack supports).
+ * Throws `ptree.NonZeroExitError` when the remote path is unwritable or the host
+ * is unreachable.
+ */
+export async function writeRemoteFile(
+	target: SSHConnectionTarget,
+	remotePath: string,
+	content: Uint8Array,
+	opts: RemoteFileWriteOptions,
+): Promise<void> {
+	await ensurePosixRemote(target);
+	if (remotePath.endsWith("/")) {
+		throw new Error("ssh://: destination is a directory path (trailing '/'); ssh:// write requires a file path");
+	}
+	const dest = quotePosixPath(remotePath);
+	const tmp = quotePosixPath(`${remotePath}.omp-tmp.${crypto.randomUUID()}`);
+	// Stage stdin into the temp first (so the remote never blocks on an unread
+	// pipe and a dropped connection lands in the temp, never the destination).
+	// An EXIT trap removes the staged temp on every exit path (staging failure,
+	// in-place success, refuse branches, or a failed rename). Commit by
+	// destination kind: a directory (or symlink to one; `-d` follows links) is
+	// refused; an existing non-symlink regular file is rewritten IN PLACE
+	// (preserving inode, permission bits, ACLs, xattrs, hardlinks; setuid/setgid
+	// may clear); an existing special file (FIFO/socket/device) is refused;
+	// anything else (a new path or a symlink to a non-directory) uses temp+rename,
+	// replacing such a symlink rather than writing through it.
+	const command =
+		`t=${tmp}; trap 'rm -f -- "$t"' 0; ` +
+		`mkdir -p -- "$(dirname "$t")" && ` +
+		`cat > "$t" && { ` +
+		`if [ -d ${dest} ]; then echo 'ssh://: destination is a directory' >&2; exit 1; ` +
+		`elif [ -f ${dest} ] && [ ! -L ${dest} ]; then cat "$t" > ${dest} || exit 1; ` +
+		`elif [ -e ${dest} ] && [ ! -L ${dest} ]; then echo 'ssh://: destination is a special file (not a regular file)' >&2; exit 1; ` +
+		`else mv "$t" ${dest}; fi; ` +
+		`}`;
+	const args = await buildRemoteCommand(target, command, { allowStdin: true });
+	using child = ptree.spawn(["ssh", ...args], {
+		stdin: content,
+		signal: ptree.combineSignals(opts.signal, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+	});
+	await child.exitedCleanly;
+}
+
+/** Classification of a remote path, used by the read handler's directory dispatch. */
+export type RemotePathKind = "file" | "directory" | "other" | "missing";
+
+/**
+ * Classify a remote path with POSIX `test` (portable across Linux/BSD/macOS):
+ * `directory`, regular `file`, `other` (special file), or `missing`.
+ */
+export async function statRemotePath(
+	target: SSHConnectionTarget,
+	remotePath: string,
+	opts: { signal?: AbortSignal; timeoutMs?: number } = {},
+): Promise<RemotePathKind> {
+	await ensurePosixRemote(target);
+	const p = quotePosixPath(remotePath);
+	const command = `if [ -d ${p} ]; then echo directory; elif [ -f ${p} ]; then echo file; elif [ -e ${p} ]; then echo other; else echo missing; fi`;
+	const args = await buildRemoteCommand(target, command);
+	using child = ptree.spawn(["ssh", ...args], {
+		signal: ptree.combineSignals(opts.signal, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+	});
+	const out = new TextDecoder().decode(await child.bytes()).trim();
+	await child.exitedCleanly;
+	return out === "directory" || out === "file" || out === "other" ? out : "missing";
+}
+
+/** A single entry in a remote directory listing. */
+export interface RemoteDirEntry {
+	/** Entry name (no path component), trailing `/` stripped. */
+	name: string;
+	/** True when the entry is a directory. */
+	isDirectory: boolean;
+}
+
+/**
+ * List a remote directory one level deep with `ls -1Ap` (one per line; all
+ * entries incl. dotfiles but not `.`/`..`; trailing `/` marks directories).
+ * Plain `ls` (no `| head`) so a permission/race failure surfaces as a non-zero
+ * exit instead of being masked as an empty listing. Entries are returned in
+ * full, sorted directories-first then by name to mirror the local
+ * directory-resource contract, so the read tool can paginate the listing.
+ */
+export async function listRemoteDir(
+	target: SSHConnectionTarget,
+	remotePath: string,
+	opts: { signal?: AbortSignal; timeoutMs?: number } = {},
+): Promise<RemoteDirEntry[]> {
+	await ensurePosixRemote(target);
+	const command = `LC_ALL=C ls -1Ap -- ${quotePosixPath(remotePath)}`;
+	const args = await buildRemoteCommand(target, command);
+	using child = ptree.spawn(["ssh", ...args], {
+		signal: ptree.combineSignals(opts.signal, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+	});
+	const text = new TextDecoder().decode(await child.bytes());
+	await child.exitedCleanly;
+	const entries = text
+		.split("\n")
+		.filter(line => line.length > 0)
+		.map(line => {
+			const isDirectory = line.endsWith("/");
+			return { name: isDirectory ? line.slice(0, -1) : line, isDirectory };
+		});
+	// JS sort is the order contract (mirrors buildDirectoryResource): dirs first, then by name.
+	entries.sort((a, b) => Number(b.isDirectory) - Number(a.isDirectory) || a.name.localeCompare(b.name));
+	return entries;
+}

package/src/ssh/utils.ts

@@ -4,5 +4,29 @@ export function sanitizeHostName(name: string): string {
 }
 
 export function buildSshTarget(username: string | undefined, host: string): string {
+	// SSH treats a destination starting with "-" as an option, so a host/user of
+	// `-oProxyCommand=...` becomes local command execution. Reject before this
+	// string reaches any `ssh` argv (this is the single render chokepoint for
+	// every connection, transfer, and sshfs mount).
+	if (host.startsWith("-")) {
+		throw new Error(
+			`Invalid SSH host "${host}": an SSH destination must not begin with "-" (argument-injection guard)`,
+		);
+	}
+	if (username?.startsWith("-")) {
+		throw new Error(
+			`Invalid SSH username "${username}": an SSH username must not begin with "-" (argument-injection guard)`,
+		);
+	}
 	return username ? `${username}@${host}` : host;
 }
+
+/**
+ * Single-quote a path for a POSIX remote shell, escaping embedded single quotes.
+ * Mirrors the private `quoteRemotePath` in `tools/ssh.ts`; shared here for the
+ * `ssh://` file-transfer helpers.
+ */
+export function quotePosixPath(value: string): string {
+	if (value.length === 0) return "''";
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}

package/src/system-prompt.ts

@@ -16,6 +16,7 @@ import { type ContextFile, loadCapability, type SystemPrompt as SystemPromptFile
 import { expandAtImports } from "./discovery/at-imports";
 import { loadSkills, type Skill } from "./extensibility/skills";
 import { hasObsidian } from "./internal-urls/vault-protocol";
+import activeRepoContextTemplate from "./prompts/system/active-repo-context.md" with { type: "text" };
 import customSystemPromptTemplate from "./prompts/system/custom-system-prompt.md" with { type: "text" };
 import defaultPersonality from "./prompts/system/personalities/default.md" with { type: "text" };
 import friendlyPersonality from "./prompts/system/personalities/friendly.md" with { type: "text" };
@@ -23,6 +24,8 @@ import pragmaticPersonality from "./prompts/system/personalities/pragmatic.md" w
 import projectPromptTemplate from "./prompts/system/project-prompt.md" with { type: "text" };
 import systemPromptTemplate from "./prompts/system/system-prompt.md" with { type: "text" };
 import { shortenPath } from "./tools/render-utils";
+import { type ActiveRepoContext, resolveActiveRepoContext } from "./utils/active-repo-context";
+import { normalizePromptPath } from "./utils/prompt-path";
 import { AGENTS_MD_LIMIT, buildWorkspaceTree, type WorkspaceTree } from "./workspace-tree";
 
 /** Bundled personality specs, keyed by the `personality` setting value. */
@@ -90,6 +93,15 @@ function firstNonEmpty(...values: (string | undefined | null)[]): string | null
 	return null;
 }
 
+function renderActiveRepoContextPrompt(activeRepoContext: ActiveRepoContext | null): string {
+	if (!activeRepoContext) return "";
+	return prompt
+		.render(activeRepoContextTemplate, {
+			relativeRepoRoot: normalizePromptPath(activeRepoContext.relativeRepoRoot),
+		})
+		.trim();
+}
+
 function parseWmicTable(output: string, header: string): string | null {
 	const lines = output
 		.split("\n")
@@ -425,6 +437,8 @@ export interface BuildSystemPromptOptions {
 	includeWorkspaceTree?: boolean;
 	/** Whether Mermaid fenced blocks render as terminal ASCII diagrams. Default: true */
 	renderMermaid?: boolean;
+	/** Pre-resolved nested active repo context. Undefined resolves from cwd. */
+	activeRepoContext?: ActiveRepoContext | null;
 }
 
 /** Result of building provider-facing system prompt messages. */
@@ -467,6 +481,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		personality = "default",
 		includeWorkspaceTree = false,
 		renderMermaid = true,
+		activeRepoContext: providedActiveRepoContext,
 	} = options;
 	const inlineToolDescriptors = providedInlineToolDescriptors ?? false;
 	const resolvedCwd = cwd ?? getProjectDir();
@@ -484,6 +499,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 			totalLines: 0,
 			agentsMdFiles: [],
 		} satisfies WorkspaceTree,
+		activeRepoContext: null as ActiveRepoContext | null,
 	};
 
 	const deadline = Bun.sleep(SYSTEM_PROMPT_PREP_TIMEOUT_MS).then(() => "__timeout__" as const);
@@ -546,34 +562,42 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 			: skillsSettings?.enabled !== false
 				? loadSkills({ ...skillsSettings, cwd: resolvedCwd }).then(result => result.skills)
 				: Promise.resolve([]);
+	const activeRepoContextPromise =
+		providedActiveRepoContext !== undefined
+			? Promise.resolve(providedActiveRepoContext)
+			: logger.time("resolveActiveRepoContext", () => resolveActiveRepoContext(resolvedCwd));
 
-	const [resolvedCustomPrompt, resolvedAppendPrompt, systemPromptCustomization, contextFiles, skills, workspaceTree] =
-		await Promise.all([
-			withDeadline(
-				"customPrompt",
-				providedResolvedCustomPrompt !== undefined
-					? Promise.resolve(providedResolvedCustomPrompt)
-					: resolvePromptInput(customPrompt, "system prompt"),
-				prepDefaults.resolvedCustomPrompt,
-			),
-			withDeadline(
-				"appendSystemPrompt",
-				providedResolvedAppendPrompt !== undefined
-					? Promise.resolve(providedResolvedAppendPrompt)
-					: resolvePromptInput(appendSystemPrompt, "append system prompt"),
-				prepDefaults.resolvedAppendPrompt,
-			),
-			withDeadline(
-				"loadSystemPromptFiles",
-				systemPromptCustomizationPromise,
-				prepDefaults.systemPromptCustomization,
-			),
-			withDeadline("loadProjectContextFiles", contextFilesPromise, prepDefaults.contextFiles).then(
-				dedupeExactContextFiles,
-			),
-			withDeadline("loadSkills", skillsPromise, prepDefaults.skills),
-			withDeadline("buildWorkspaceTree", workspaceTreePromise, prepDefaults.workspaceTree),
-		]);
+	const [
+		resolvedCustomPrompt,
+		resolvedAppendPrompt,
+		systemPromptCustomization,
+		contextFiles,
+		skills,
+		workspaceTree,
+		activeRepoContext,
+	] = await Promise.all([
+		withDeadline(
+			"customPrompt",
+			providedResolvedCustomPrompt !== undefined
+				? Promise.resolve(providedResolvedCustomPrompt)
+				: resolvePromptInput(customPrompt, "system prompt"),
+			prepDefaults.resolvedCustomPrompt,
+		),
+		withDeadline(
+			"appendSystemPrompt",
+			providedResolvedAppendPrompt !== undefined
+				? Promise.resolve(providedResolvedAppendPrompt)
+				: resolvePromptInput(appendSystemPrompt, "append system prompt"),
+			prepDefaults.resolvedAppendPrompt,
+		),
+		withDeadline("loadSystemPromptFiles", systemPromptCustomizationPromise, prepDefaults.systemPromptCustomization),
+		withDeadline("loadProjectContextFiles", contextFilesPromise, prepDefaults.contextFiles).then(
+			dedupeExactContextFiles,
+		),
+		withDeadline("loadSkills", skillsPromise, prepDefaults.skills),
+		withDeadline("buildWorkspaceTree", workspaceTreePromise, prepDefaults.workspaceTree),
+		withDeadline("resolveActiveRepoContext", activeRepoContextPromise, prepDefaults.activeRepoContext),
+	]);
 	const agentsMdFiles = Array.from(new Set(workspaceTree.agentsMdFiles)).sort().slice(0, AGENTS_MD_LIMIT);
 
 	if (timedOut.length > 0) {
@@ -598,7 +622,8 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 
 	const date = new Date().toISOString().slice(0, 10);
 	const dateTime = date;
-	const promptCwd = shortenPath(resolvedCwd.replace(/\\/g, "/"));
+	const promptCwd = shortenPath(normalizePromptPath(resolvedCwd));
+	const activeRepoContextPrompt = renderActiveRepoContextPrompt(activeRepoContext);
 
 	// Build tool metadata for system prompt rendering.
 	// Priority: explicit list > tools map > conservative SDK fallback.
@@ -697,6 +722,9 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 	if (projectPrompt) {
 		systemPrompt.push(projectPrompt);
 	}
+	if (activeRepoContextPrompt) {
+		systemPrompt.push(activeRepoContextPrompt);
+	}
 
 	return { systemPrompt };
 }

package/src/task/executor.ts

@@ -421,6 +421,12 @@ export interface ExecutorOptions {
 	 * passes its own `getAgentId()`).
 	 */
 	parentAgentId?: string;
+	/**
+	 * Keep the finished subagent addressable in the registry for IRC/revival.
+	 * Defaults to true. Eval bridge agents are programmatic one-shot helpers and
+	 * set this false so disposal unregisters them instead of leaving idle peers.
+	 */
+	keepAlive?: boolean;
 }
 
 function parseStringifiedJson(value: unknown): unknown {
@@ -854,6 +860,8 @@ interface SubagentRunMonitor {
 	/** Whether the (attempted) abort counts as a cancelled run rather than an internal failure. */
 	isAbortedRun(): boolean;
 	requestAbort(reason: AbortReason): void;
+	abortActiveSession(): Promise<void>;
+	waitForActiveSessionAbort(): Promise<void>;
 	resolveSignalAbortReason(): string;
 	resolveAbortReasonText(): string;
 	setActiveSession(session: AgentSession | null): void;
@@ -923,6 +931,22 @@ function createSubagentRunMonitor(args: RunMonitorArgs): SubagentRunMonitor {
 	let budgetSteerSent = false;
 	let budgetLimitExceeded = false;
 	let lastAssistantSalvageText: string | undefined;
+	let activeSessionAbortPromise: Promise<void> | undefined;
+
+	const abortActiveSession = (): Promise<void> => {
+		const session = activeSession;
+		if (!session) return Promise.resolve();
+		activeSessionAbortPromise ??= session.abort().catch(error => {
+			logger.debug("Subagent session abort cleanup failed", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+		});
+		return activeSessionAbortPromise;
+	};
+
+	const waitForActiveSessionAbort = async (): Promise<void> => {
+		if (activeSessionAbortPromise) await activeSessionAbortPromise;
+	};
 
 	const requestAbort = (reason: AbortReason) => {
 		if (reason === "timeout") {
@@ -941,9 +965,7 @@ function createSubagentRunMonitor(args: RunMonitorArgs): SubagentRunMonitor {
 		abortSent = true;
 		abortReason = reason;
 		abortController.abort();
-		if (activeSession) {
-			void activeSession.abort();
-		}
+		void abortActiveSession();
 	};
 
 	// Handle abort signal
@@ -1423,6 +1445,8 @@ function createSubagentRunMonitor(args: RunMonitorArgs): SubagentRunMonitor {
 		isAbortedRun: () =>
 			abortReason === "signal" || runtimeLimitExceeded || budgetLimitExceeded || abortReason === undefined,
 		requestAbort,
+		abortActiveSession,
+		waitForActiveSessionAbort,
 		resolveSignalAbortReason,
 		resolveAbortReasonText,
 		setActiveSession: session => {
@@ -1752,6 +1776,59 @@ async function finalizeRunResult(args: FinalizeRunArgs): Promise<SingleResult> {
 	};
 }
 
+export async function finalizeSubagentLifecycle(args: {
+	id: string;
+	session: AgentSession;
+	aborted: boolean;
+	keepAlive: boolean;
+	isolated: boolean;
+	agentIdleTtlMs: number;
+	reviveSession: (() => Promise<AgentSession>) | null;
+}): Promise<void> {
+	const registry = AgentRegistry.global();
+	const disposeSession = async (): Promise<void> => {
+		try {
+			await untilAborted(AbortSignal.timeout(5000), () => args.session.dispose());
+		} catch {
+			// Ignore cleanup errors
+		}
+	};
+
+	if (args.aborted) {
+		// Hard abort (caller signal / wall-clock / budget): terminal teardown.
+		registry.setStatus(args.id, "aborted");
+		await disposeSession();
+		return;
+	}
+
+	if (!args.keepAlive) {
+		// One-shot helper: dispose and unregister. No IRC, no revival.
+		await disposeSession();
+		registry.unregister(args.id);
+		return;
+	}
+
+	if (args.isolated) {
+		// Isolated run: the worktree is merged + cleaned after the run, so
+		// the session is not resumable. Park the ref WITHOUT adopting — the
+		// transcript stays reachable (history://), but ensureLive will throw.
+		// Status must flip to "parked" before dispose so the sdk dispose
+		// wrapper skips unregister.
+		registry.setStatus(args.id, "parked");
+		await disposeSession();
+		registry.detachSession(args.id);
+		return;
+	}
+
+	// Keep-alive: finished and failed subagents both stay interrogable.
+	// The lifecycle manager owns idle-TTL parking + revival from here on.
+	registry.setStatus(args.id, "idle");
+	AgentLifecycleManager.global().adopt(args.id, {
+		idleTtlMs: args.agentIdleTtlMs,
+		revive: args.reviveSession ?? undefined,
+	});
+}
+
 /**
  * Run a single agent in-process.
  */
@@ -2211,7 +2288,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			abortSignal.addEventListener(
 				"abort",
 				() => {
-					void session.abort();
+					void monitor.abortActiveSession();
 				},
 				{ once: true, signal: sessionAbortController.signal },
 			);
@@ -2219,7 +2296,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			// the awaited setup above, the listener registration races the dispatch
 			// and may not observe the already-fired abort event. Mirror it manually.
 			if (abortSignal.aborted) {
-				void session.abort();
+				void monitor.abortActiveSession();
 			}
 
 			const pendingExtensionMessages: Array<Promise<unknown>> = [];
@@ -2325,6 +2402,11 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				providerSemaphoreAcquired = false;
 			}
 			sessionAbortController.abort();
+			try {
+				await untilAborted(AbortSignal.timeout(5000), () => monitor.waitForActiveSessionAbort());
+			} catch {
+				// Ignore abort cleanup timeouts/errors; terminal disposal below is still best-effort.
+			}
 			if (unsubscribe) {
 				try {
 					unsubscribe();
@@ -2336,37 +2418,15 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			const session = monitor.takeActiveSession();
 			if (session) {
 				monitor.captureSalvage(session);
-				const registry = AgentRegistry.global();
-				if (aborted) {
-					// Hard abort (caller signal / wall-clock / budget): terminal teardown.
-					registry.setStatus(id, "aborted");
-					try {
-						await untilAborted(AbortSignal.timeout(5000), () => session.dispose());
-					} catch {
-						// Ignore cleanup errors
-					}
-				} else if (worktree !== undefined) {
-					// Isolated run: the worktree is merged + cleaned after the run, so
-					// the session is not resumable. Park the ref WITHOUT adopting — the
-					// transcript stays reachable (history://), but ensureLive will throw.
-					// Status must flip to "parked" before dispose so the sdk dispose
-					// wrapper skips unregister.
-					registry.setStatus(id, "parked");
-					try {
-						await untilAborted(AbortSignal.timeout(5000), () => session.dispose());
-					} catch {
-						// Ignore cleanup errors
-					}
-					registry.detachSession(id);
-				} else {
-					// Keep-alive: finished and failed subagents both stay interrogable.
-					// The lifecycle manager owns idle-TTL parking + revival from here on.
-					registry.setStatus(id, "idle");
-					AgentLifecycleManager.global().adopt(id, {
-						idleTtlMs: agentIdleTtlMs,
-						revive: reviveSession ?? undefined,
-					});
-				}
+				await finalizeSubagentLifecycle({
+					id,
+					session,
+					aborted,
+					keepAlive: options.keepAlive !== false,
+					isolated: worktree !== undefined,
+					agentIdleTtlMs,
+					reviveSession,
+				});
 			}
 		}
 

package/src/task/index.ts

@@ -136,8 +136,8 @@ export {
 // Fail-safe: any unknown tool makes the agent not read-only.
 export const READ_ONLY_TOOL_NAMES: ReadonlySet<string> = new Set([
 	"read",
-	"search",
-	"find",
+	"grep",
+	"glob",
 	"web_search",
 	"ast_grep",
 	"yield",
@@ -1076,7 +1076,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		}
 
 		const planModeState = this.session.getPlanModeState?.();
-		const planModeBaseTools = ["read", "search", "find", "lsp", "web_search"];
+		const planModeBaseTools = ["read", "grep", "glob", "lsp", "web_search"];
 		const planModeTools = [
 			...planModeBaseTools,
 			...(agent.tools ?? []).filter(