@oh-my-pi/pi-coding-agent 17.1.8 → 17.2.1

package/src/slash-commands/helpers/security.ts

@@ -0,0 +1,451 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { prompt } from "@oh-my-pi/pi-utils";
+import { parseInternalUrl } from "../../internal-urls/parse";
+import { SecurityProtocolHandler } from "../../internal-urls/security-protocol";
+import validationRequestPrompt from "../../prompts/security/validate-request.md" with { type: "text" };
+import { selectSecurityAccount } from "../../security/auth";
+import { CodexSecurityCloudClient, pullCodexSecurityCloudResults } from "../../security/cloud";
+import type { SecurityDispositionStatus } from "../../security/contracts";
+import type { SecurityPreflightInput } from "../../security/coordinator";
+import { getSecurityCoordinator } from "../../security/coordinator";
+import { importCodexSecurityBundle, importSarifFile } from "../../security/importers";
+import type { SecurityTargetRequest } from "../../security/preflight";
+import { SecurityStore, writeSecurityFileAtomic } from "../../security/store";
+import { shortenPath } from "../../tools/render-utils";
+import { parseCommandArgs } from "../../utils/command-args";
+import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types";
+import { commandConsumed, errorMessage, parseSubcommand, usage } from "./parse";
+
+interface SecurityPlanCliOptions {
+	target: SecurityTargetRequest;
+	knowledgeBasePaths: string[];
+	outputRoot?: string;
+	archiveExisting?: boolean;
+	credentialId?: number;
+}
+
+const DISPOSITIONS: ReadonlySet<SecurityDispositionStatus> = new Set([
+	"open",
+	"false_positive",
+	"accepted_risk",
+	"fixed",
+	"wont_fix",
+]);
+
+function coordinatorFor(runtime: SlashCommandRuntime) {
+	return getSecurityCoordinator({
+		cwd: runtime.cwd,
+		settings: runtime.settings,
+		authStorage: runtime.session.modelRegistry.authStorage,
+		modelRegistry: runtime.session.modelRegistry,
+		activeModel: runtime.session.model,
+		sessionId: runtime.session.sessionId,
+		agentId: runtime.session.getAgentId(),
+		asyncJobManager: runtime.session.asyncJobManager,
+	});
+}
+
+function requireToken(tokens: readonly string[], index: number, flag: string): string {
+	const value = tokens[index];
+	if (!value || value.startsWith("--")) throw new Error(`${flag} requires a value`);
+	return value;
+}
+
+function parsePositiveCredential(value: string): number {
+	const credentialId = Number(value);
+	if (!Number.isSafeInteger(credentialId) || credentialId < 1) throw new Error(`Invalid credential id: ${value}`);
+	return credentialId;
+}
+
+function parsePlanOptions(rest: string): SecurityPlanCliOptions {
+	const tokens = parseCommandArgs(rest);
+	const includePaths: string[] = [];
+	const excludePaths: string[] = [];
+	const knowledgeBasePaths: string[] = [];
+	let kind: SecurityTargetRequest["kind"] = "repository";
+	let baseRevision: string | undefined;
+	let headRevision: string | undefined;
+	let outputRoot: string | undefined;
+	let archiveExisting = false;
+	let credentialId: number | undefined;
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		switch (token) {
+			case "--path":
+				includePaths.push(requireToken(tokens, ++index, token));
+				// `--path` scopes the target; it never overrides an explicit --diff/--working-tree selection.
+				if (kind === "repository") kind = "scoped_path";
+				break;
+			case "--exclude":
+				excludePaths.push(requireToken(tokens, ++index, token));
+				break;
+			case "--working-tree":
+				kind = "working_tree";
+				break;
+			case "--diff":
+				kind = "ref_diff";
+				baseRevision = requireToken(tokens, ++index, token);
+				headRevision = requireToken(tokens, ++index, token);
+				break;
+			case "--knowledge-base":
+				knowledgeBasePaths.push(requireToken(tokens, ++index, token));
+				break;
+			case "--output":
+				outputRoot = requireToken(tokens, ++index, token);
+				break;
+			case "--archive-existing":
+				archiveExisting = true;
+				break;
+			case "--credential":
+				credentialId = parsePositiveCredential(requireToken(tokens, ++index, token));
+				break;
+			default:
+				throw new Error(`Unknown security plan option: ${token}`);
+		}
+	}
+	const common = { includePaths, excludePaths };
+	const target: SecurityTargetRequest =
+		kind === "ref_diff"
+			? {
+					kind,
+					baseRevision: baseRevision ?? "",
+					headRevision: headRevision ?? "",
+					...common,
+				}
+			: kind === "working_tree"
+				? { kind, ...common }
+				: kind === "scoped_path"
+					? { kind, ...common }
+					: { kind: "repository", ...common };
+	return { target, knowledgeBasePaths, outputRoot, archiveExisting, credentialId };
+}
+
+async function preflight(runtime: SlashCommandRuntime, rest: string) {
+	const options = parsePlanOptions(rest);
+	const input: SecurityPreflightInput = {
+		target: options.target,
+		knowledgeBasePaths: options.knowledgeBasePaths,
+		outputRoot: options.outputRoot,
+		archiveExisting: options.archiveExisting,
+		credentialId: options.credentialId,
+		model: runtime.session.model,
+	};
+	return coordinatorFor(runtime).preflight(input);
+}
+
+function scanIdFromInput(value: string): string {
+	const trimmed = value.trim();
+	const match = trimmed.match(/^security:\/\/scans\/([^/]+)/);
+	return match?.[1] ?? trimmed;
+}
+
+function findingTarget(value: string): { uri: string; scanId: string; findingId: string } {
+	const trimmed = value.trim();
+	const uriMatch = trimmed.match(/^security:\/\/scans\/([^/]+)\/findings\/([^/]+)$/);
+	if (uriMatch) return { uri: trimmed, scanId: uriMatch[1]!, findingId: uriMatch[2]! };
+	const [scanId, findingId] = parseCommandArgs(trimmed);
+	if (!scanId || !findingId) throw new Error("validate requires a finding URI or <scan-id> <finding-id>");
+	return { uri: `security://scans/${scanId}/findings/${findingId}`, scanId, findingId };
+}
+
+async function showResource(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const raw = rest.trim();
+	if (!raw) throw new Error("show requires a scan id or security:// URI");
+	const uri = raw.startsWith("security://") ? raw : `security://scans/${scanIdFromInput(raw)}`;
+	const handler = new SecurityProtocolHandler(undefined, () => true);
+	const resource = await handler.resolve(parseInternalUrl(uri), { cwd: runtime.cwd });
+	await runtime.output(resource.content);
+}
+
+async function importResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const [source] = parseCommandArgs(rest);
+	if (!source) throw new Error("import requires a SARIF file or Codex Security bundle directory");
+	const store = await SecurityStore.openForCwd(runtime.cwd);
+	const absolute = path.resolve(runtime.cwd, source);
+	const stats = await fs.stat(absolute);
+	const bundle = stats.isDirectory()
+		? await importCodexSecurityBundle(absolute, { repositoryRoot: store.repositoryRoot })
+		: await importSarifFile(absolute, { repositoryRoot: store.repositoryRoot });
+	await store.putBundle(bundle);
+	await runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);
+}
+
+async function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const tokens = parseCommandArgs(rest);
+	const scanId = tokens[0];
+	if (!scanId) throw new Error("export requires <scan-id> --output <path> [--format bundle|sarif|report]");
+	let outputPath: string | undefined;
+	let format: "bundle" | "sarif" | "report" = "bundle";
+	for (let index = 1; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
+		else if (token === "--format") {
+			const value = requireToken(tokens, ++index, token);
+			if (value !== "bundle" && value !== "sarif" && value !== "report") {
+				throw new Error(`Unknown export format: ${value}`);
+			}
+			format = value;
+		} else throw new Error(`Unknown export option: ${token}`);
+	}
+	if (!outputPath) throw new Error("export requires --output <path>");
+	const store = await SecurityStore.openForCwd(runtime.cwd);
+	const bundle = await store.getBundle(scanIdFromInput(scanId));
+	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
+	let content: string;
+	if (format === "sarif") {
+		if (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);
+		content = `${JSON.stringify(bundle.sarif, null, 2)}\n`;
+	} else if (format === "report") {
+		if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
+		content = bundle.report;
+	} else {
+		content = `${JSON.stringify(bundle, null, 2)}\n`;
+	}
+	const absolute = path.resolve(runtime.cwd, outputPath);
+	await writeSecurityFileAtomic(absolute, content, { hardenParent: false });
+	await runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);
+}
+
+interface CloudCliOptions {
+	credentialId?: number;
+	configurationId?: string;
+	repositoryId?: string;
+	repositoryUrl?: string;
+	environmentId?: string;
+	lookbackDays?: number | "all";
+}
+
+function parseCloudOptions(rest: string, subcommand: string): CloudCliOptions {
+	const tokens = parseCommandArgs(rest);
+	const options: CloudCliOptions = {};
+	let positionalConsumed = false;
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		switch (token) {
+			case "--credential":
+				options.credentialId = parsePositiveCredential(requireToken(tokens, ++index, token));
+				break;
+			case "--repo-id":
+				options.repositoryId = requireToken(tokens, ++index, token);
+				break;
+			case "--repo-url":
+				options.repositoryUrl = requireToken(tokens, ++index, token);
+				break;
+			case "--environment":
+				options.environmentId = requireToken(tokens, ++index, token);
+				break;
+			case "--lookback": {
+				const value = requireToken(tokens, ++index, token);
+				if (value === "all") {
+					options.lookbackDays = value;
+					break;
+				}
+				const days = Number(value);
+				if (!Number.isSafeInteger(days) || days < 1) throw new Error(`Invalid lookback: ${value}`);
+				options.lookbackDays = days;
+				break;
+			}
+			default:
+				if (!token.startsWith("--") && !positionalConsumed && (subcommand === "status" || subcommand === "pull")) {
+					options.configurationId = token;
+					positionalConsumed = true;
+					break;
+				}
+				throw new Error(`Unknown security cloud option: ${token}`);
+		}
+	}
+	return options;
+}
+
+function cloudClientFor(runtime: SlashCommandRuntime, credentialId?: number): CodexSecurityCloudClient {
+	const authStorage = runtime.session.modelRegistry.authStorage;
+	const account = selectSecurityAccount(authStorage, "openai-codex", credentialId, runtime.session.sessionId);
+	return new CodexSecurityCloudClient({ authStorage, account });
+}
+
+async function handleCloudCommand(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const { verb, rest: optionsText } = parseSubcommand(rest);
+	const subcommand = verb || "scans";
+	const options = parseCloudOptions(optionsText, subcommand);
+	const client = cloudClientFor(runtime, options.credentialId);
+	switch (subcommand) {
+		case "scans": {
+			const configurations = await client.listAllConfigurations();
+			await runtime.output(
+				configurations.length === 0
+					? "No Codex Security cloud scan configurations are available for this account."
+					: configurations
+							.map(item =>
+								[
+									item.id,
+									item.state ?? "unknown",
+									item.currentStep ?? "unknown",
+									`repo=${item.repositoryId}`,
+									`environment=${item.environmentId}`,
+									item.repositoryUrl,
+									item.remainingScans === undefined ? "" : `${item.remainingScans} scan(s) remaining`,
+								]
+									.filter(Boolean)
+									.join(" "),
+							)
+							.join("\n"),
+			);
+			return;
+		}
+		case "start": {
+			if (!options.repositoryId || !options.repositoryUrl || !options.environmentId) {
+				throw new Error("cloud start requires --repo-id, --repo-url, and --environment");
+			}
+			const configuration = await client.startScan({
+				repositoryId: options.repositoryId,
+				repositoryUrl: options.repositoryUrl,
+				environmentId: options.environmentId,
+				lookbackDays: options.lookbackDays,
+			});
+			await runtime.output(
+				`Codex Security cloud scan ${configuration.id} started for ${configuration.repositoryUrl}. This consumes cloud scan allowance.`,
+			);
+			return;
+		}
+		case "status": {
+			if (!options.configurationId) throw new Error("cloud status requires a configuration id");
+			await runtime.output(JSON.stringify(await client.getStats(options.configurationId), null, 2));
+			return;
+		}
+		case "pull": {
+			if (!options.configurationId) throw new Error("cloud pull requires a configuration id");
+			const store = await SecurityStore.openForCwd(runtime.cwd);
+			const bundle = await pullCodexSecurityCloudResults({
+				client,
+				configurationId: options.configurationId,
+				store,
+			});
+			await runtime.output(
+				`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
+			);
+			return;
+		}
+		default:
+			throw new Error("Usage: /security cloud <scans|start|status|pull>");
+	}
+}
+
+async function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);
+	if (!scanId || !findingId || !status) {
+		throw new Error("disposition requires <scan-id> <finding-id> <status> [rationale]");
+	}
+	if (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);
+	const rationale = rationaleParts.join(" ").trim();
+	if (status !== "open" && !rationale) throw new Error(`${status} requires a rationale`);
+	const store = await SecurityStore.openForCwd(runtime.cwd);
+	const finding = await store.updateDisposition(scanId, findingId, {
+		status: status as SecurityDispositionStatus,
+		rationale: rationale || undefined,
+		updatedAt: new Date().toISOString(),
+		actor: "operator",
+	});
+	await runtime.output(`Finding ${finding.id} disposition is now ${finding.disposition.status}.`);
+}
+
+export async function handleSecurityCommand(
+	command: ParsedSlashCommand,
+	runtime: SlashCommandRuntime,
+): Promise<SlashCommandResult> {
+	if (!runtime.settings.get("security.enabled")) {
+		return usage("Security is disabled. Enable security.enabled before using /security.", runtime);
+	}
+	const { verb, rest } = parseSubcommand(command.args);
+	try {
+		switch (verb || "scans") {
+			case "plan": {
+				const plan = await preflight(runtime, rest);
+				await runtime.output(`Security plan ${plan.id} is ready. Fingerprint: ${plan.fingerprint}.`);
+				return commandConsumed();
+			}
+			case "scan": {
+				const coordinator = coordinatorFor(runtime);
+				const planId = rest.trim().startsWith("secplan_") ? rest.trim() : (await preflight(runtime, rest)).id;
+				const operation = await coordinator.start({ planId });
+				await runtime.output(`Security scan ${operation.scanId} started as ${operation.operationId}.`);
+				return commandConsumed();
+			}
+			case "status": {
+				const coordinator = coordinatorFor(runtime);
+				const operationId = rest.trim();
+				if (operationId) {
+					const operation = await coordinator.status(operationId);
+					if (!operation) throw new Error(`Unknown security operation: ${operationId}`);
+					await runtime.output(JSON.stringify(operation, null, 2));
+				} else {
+					await runtime.output(JSON.stringify(await coordinator.listOperations(), null, 2));
+				}
+				return commandConsumed();
+			}
+			case "cancel": {
+				const operationId = rest.trim();
+				if (!operationId) throw new Error("cancel requires an operation id");
+				await runtime.output(
+					(await coordinatorFor(runtime).cancel(operationId))
+						? `Cancellation requested for ${operationId}.`
+						: `No cancellable security operation ${operationId}.`,
+				);
+				return commandConsumed();
+			}
+			case "scans": {
+				const scans = await (await SecurityStore.openForCwd(runtime.cwd)).listScans();
+				await runtime.output(
+					scans.length === 0
+						? "No security scans are stored for this project."
+						: scans
+								.map(scan => `${scan.id} ${scan.status} ${scan.findingCount} finding(s) ${scan.producer.name}`)
+								.join("\n"),
+				);
+				return commandConsumed();
+			}
+			case "show":
+				await showResource(runtime, rest);
+				return commandConsumed();
+			case "import":
+				await importResults(runtime, rest);
+				return commandConsumed();
+			case "export":
+				await exportResults(runtime, rest);
+				return commandConsumed();
+			case "validate": {
+				const target = findingTarget(rest);
+				return {
+					prompt: prompt
+						.render(validationRequestPrompt, {
+							findingUri: target.uri,
+							scanId: target.scanId,
+							findingId: target.findingId,
+						})
+						.trim(),
+				};
+			}
+			case "compare": {
+				const [beforeScanId, afterScanId] = parseCommandArgs(rest);
+				if (!beforeScanId || !afterScanId) throw new Error("compare requires <before-scan-id> <after-scan-id>");
+				const report = await (await SecurityStore.openForCwd(runtime.cwd)).compare(beforeScanId, afterScanId);
+				await runtime.output(JSON.stringify(report, null, 2));
+				return commandConsumed();
+			}
+			case "cloud":
+				await handleCloudCommand(runtime, rest);
+				return commandConsumed();
+			case "disposition":
+				await updateDisposition(runtime, rest);
+				return commandConsumed();
+			default:
+				return usage(
+					"Usage: /security <plan|scan|status|cancel|scans|cloud|show|import|export|validate|compare|disposition>",
+					runtime,
+				);
+		}
+	} catch (error) {
+		await runtime.output(`Security: ${errorMessage(error)}`);
+		return commandConsumed();
+	}
+}

package/src/system-prompt.ts

@@ -528,6 +528,8 @@ export interface BuildSystemPromptOptions {
 	workspaceTree?: WorkspaceTree | Promise<WorkspaceTree>;
 	/** Whether the local memory://root summary is active. */
 	memoryRootEnabled?: boolean;
+	/** Whether the read-only security:// resource namespace is active. */
+	securityEnabled?: boolean;
 	/** Active model identifier (e.g. "anthropic/claude-opus-4") used by prompt policy and optionally surfaced. */
 	model?: string;
 	/** Whether to surface `model` in the workstation block. Model-specific prompt policy still uses it. Default: true. */
@@ -540,8 +542,8 @@ export interface BuildSystemPromptOptions {
 	renderMermaid?: boolean;
 	/** Pre-resolved nested active repo context. Undefined resolves from cwd. */
 	activeRepoContext?: ActiveRepoContext | null;
-	/** Tools mounted under `xd://`; renders the protocol section when non-empty. */
-	xdevTools?: Array<{ name: string; summary: string }>;
+	/** Tools mounted under `xd://`; renders the protocol section when non-empty. `dynamic` marks external devices whose summary is third-party metadata. */
+	xdevTools?: Array<{ name: string; summary: string; dynamic?: boolean }>;
 	/** Full docs + JSON schema for every `xd://`-mounted tool, inlined into the protocol section so no discovery `read` is needed. */
 	xdevDocs?: string;
 	/** Whether Auto-QA grievance reporting is enabled; renders the `xd://report_issue` note. */
@@ -585,6 +587,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		secretsEnabled = false,
 		workspaceTree: providedWorkspaceTree,
 		memoryRootEnabled = false,
+		securityEnabled = false,
 		model,
 		includeModelInPrompt = true,
 		personality = "default",
@@ -866,10 +869,12 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		taskIrcEnabled,
 		secretsEnabled,
 		hasMemoryRoot: memoryRootEnabled,
+		securityEnabled,
 		hasObsidian: hasObsidian(),
 		includeWorkspaceTree,
 		renderMermaid,
 		xdevTools,
+		hasDynamicXdevTools: xdevTools.some(mounted => mounted.dynamic === true),
 		xdevDocs,
 		autoQaEnabled,
 	};

package/src/task/agents.ts

@@ -12,6 +12,7 @@ import agentFrontmatterTemplate from "../prompts/agents/frontmatter.md" with { t
 import librarianMd from "../prompts/agents/librarian.md" with { type: "text" };
 import reviewerMd from "../prompts/agents/reviewer.md" with { type: "text" };
 import scoutMd from "../prompts/agents/scout.md" with { type: "text" };
+import securityReviewerMd from "../prompts/agents/security-reviewer.md" with { type: "text" };
 import taskMd from "../prompts/agents/task.md" with { type: "text" };
 import { AUTO_THINKING } from "../thinking";
 
@@ -44,6 +45,7 @@ const EMBEDDED_AGENT_DEFS: EmbeddedAgentDef[] = [
 	{ fileName: "scout.md", template: scoutMd },
 	{ fileName: "designer.md", template: designerMd },
 	{ fileName: "reviewer.md", template: reviewerMd },
+	{ fileName: "security-reviewer.md", template: securityReviewerMd },
 	{ fileName: "librarian.md", template: librarianMd },
 	{
 		fileName: "task.md",

package/src/task/executor.ts

@@ -87,8 +87,10 @@ const MCP_CALL_TIMEOUT_MS = 60_000;
  * agent is driven to one forced final `yield` so partial findings come back
  * as a real report; only if it still refuses to yield within
  * {@link BUDGET_STOP_GRACE_REQUESTS} more requests is the run hard-aborted.
- * The `default` key applies to agents without an explicit entry and can be
- * overridden via the `task.softRequestBudget` setting (0 disables the guard).
+ * Entries are ceilings, not fixed values: the `default` key applies to agents
+ * without an explicit entry, and the `task.softRequestBudget` setting can only
+ * lower an agent's budget, never raise it above its bundled entry (0 disables
+ * the guard entirely).
  */
 export const SOFT_REQUEST_BUDGET: Record<string, number> = {
 	scout: 100,
@@ -96,6 +98,18 @@ export const SOFT_REQUEST_BUDGET: Record<string, number> = {
 	default: 200,
 };
 
+/**
+ * Resolves the effective soft request budget for an agent. The configured
+ * `task.softRequestBudget` and the agent's bundled entry are both upper
+ * bounds, so the tighter one wins; a configured budget of 0 disables the
+ * guard regardless of the bundled entry.
+ */
+export function resolveSoftRequestBudget(agentName: string, configuredBudget: number): number {
+	const normalized = Math.max(0, Math.trunc(configuredBudget));
+	if (normalized === 0) return 0;
+	return Math.min(normalized, SOFT_REQUEST_BUDGET[agentName] ?? normalized);
+}
+
 /** Extra requests allowed after a budget stop for the forced yield to land before the run is hard-aborted. */
 export const BUDGET_STOP_GRACE_REQUESTS = 5;
 
@@ -292,6 +306,8 @@ export interface ExecutorOptions {
 	cwd: string;
 	/** Additional workspace directories to seed on the subagent session (multi-root). */
 	additionalDirectories?: string[];
+	/** Exact provider credential resolver inherited from the parent session. */
+	getApiKey?: CreateAgentSessionOptions["getApiKey"];
 	worktree?: string;
 	agent: AgentDefinition;
 	task: string;
@@ -2446,8 +2462,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 		0,
 		Math.trunc(Number(settings.get("task.softRequestBudget") ?? SOFT_REQUEST_BUDGET.default) || 0),
 	);
-	const softRequestBudget =
-		configuredDefaultBudget === 0 ? 0 : (SOFT_REQUEST_BUDGET[agent.name] ?? configuredDefaultBudget);
+	const softRequestBudget = resolveSoftRequestBudget(agent.name, configuredDefaultBudget);
 	const softRequestBudgetNotice = settings.get("task.softRequestBudgetNotice") ?? false;
 	const parentDepth = options.taskDepth ?? 0;
 	const childDepth = parentDepth + 1;
@@ -2770,6 +2785,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				additionalDirectories: worktree !== undefined ? undefined : options.additionalDirectories,
 				authStorage,
 				modelRegistry,
+				getApiKey: options.getApiKey,
 				settings: subagentSettings,
 				model,
 				modelPattern: model || modelOverride === undefined ? undefined : modelPatterns,

package/src/task/render.ts

@@ -49,6 +49,13 @@ interface TaskRenderContext {
 	 * commit-eligible rows do not repaint after entering native scrollback.
 	 */
 	frozen?: boolean;
+	/**
+	 * Wall clock for time-derived rows (current-tool elapsed, retry countdown).
+	 * The component freezes it once the block settles or any of its rows enter
+	 * native scrollback, so identical-input rebuilds stay byte-identical with
+	 * committed history. Absent: render with the live clock.
+	 */
+	nowMs?: number;
 }
 type TaskRenderOptions = RenderResultOptions & { renderContext?: TaskRenderContext };
 
@@ -888,6 +895,7 @@ function renderAgentProgress(
 	frozen = false,
 	seenNestedTasks?: WeakSet<object>,
 	nestedDepth = 0,
+	nowMs = Date.now(),
 ): string[] {
 	const lines: string[] = [];
 
@@ -964,7 +972,7 @@ function renderAgentProgress(
 				toolLine += `: ${theme.fg("dim", previewLine(sanitizeText(toolDetail), 40))}`;
 			}
 			if (progress.currentToolStartMs) {
-				const elapsed = Date.now() - progress.currentToolStartMs;
+				const elapsed = nowMs - progress.currentToolStartMs;
 				if (elapsed > 5000) {
 					toolLine += `${theme.sep.dot}${theme.fg("warning", formatDuration(elapsed))}`;
 				}
@@ -986,7 +994,7 @@ function renderAgentProgress(
 	// long until the next attempt. Without this, the parent UI would just
 	// keep spinning while a child sleeps on a 3-hour provider rate-limit.
 	if (progress.retryState && progress.status === "running") {
-		const remainingMs = Math.max(0, progress.retryState.startedAtMs + progress.retryState.delayMs - Date.now());
+		const remainingMs = Math.max(0, progress.retryState.startedAtMs + progress.retryState.delayMs - nowMs);
 		const waitLabel = remainingMs > 0 ? `in ${formatDuration(remainingMs)}` : "now";
 		const summary =
 			`retrying ${progress.retryState.attempt}/${progress.retryState.maxAttempts} ${waitLabel}: ` +
@@ -1079,6 +1087,7 @@ function renderAgentProgress(
 			frozen,
 			seenNestedTasks,
 			nestedDepth,
+			nowMs,
 		);
 		for (const line of nestedLines) {
 			lines.push(`${continuePrefix}${line}`);
@@ -1560,6 +1569,7 @@ export function renderResult(
 	return framedBlock(theme, width => {
 		const { expanded, isPartial, spinnerFrame } = options;
 		const frozen = options.renderContext?.frozen === true;
+		const nowMs = options.renderContext?.nowMs ?? Date.now();
 		const lines: string[] = [];
 
 		// Result rows win once any exist; progress rows for spawns without a
@@ -1577,7 +1587,9 @@ export function renderResult(
 				lines.push(formatHiddenProgressLine(ordered.slice(0, ordered.length - visible.length), theme));
 			}
 			for (const progress of visible) {
-				lines.push(...renderAgentProgress(progress, "", "  ", expanded, theme, spinnerFrame, frozen));
+				lines.push(
+					...renderAgentProgress(progress, "", "  ", expanded, theme, spinnerFrame, frozen, undefined, 0, nowMs),
+				);
 			}
 		} else if (details.results && details.results.length > 0) {
 			const ordered = orderResultsForDisplay(details.results);
@@ -1602,7 +1614,9 @@ export function renderResult(
 					)
 				: [];
 			for (const progress of supplementalProgress) {
-				lines.push(...renderAgentProgress(progress, "", "  ", expanded, theme, spinnerFrame, frozen));
+				lines.push(
+					...renderAgentProgress(progress, "", "  ", expanded, theme, spinnerFrame, frozen, undefined, 0, nowMs),
+				);
 			}
 
 			const summaryParts: string[] = [];
@@ -1742,6 +1756,7 @@ function renderNestedTaskTree(
 	frozen = false,
 	seen: WeakSet<object> = new WeakSet<object>(),
 	depth = 0,
+	nowMs = Date.now(),
 ): string[] {
 	const lines: string[] = [];
 	for (const details of detailsList) {
@@ -1788,6 +1803,7 @@ function renderNestedTaskTree(
 						frozen,
 						seen,
 						depth + 1,
+						nowMs,
 					),
 				);
 			});