@pi-archimedes/subagent 2.10.4 → 2.11.1

package/src/spawn.test.ts

@@ -1,18 +1,46 @@
 import { describe, it, expect, vi, afterEach } from "vitest";
 import * as net from "node:net";
-import { getBus, Events } from "@pi-archimedes/core/bus";
-import { startAskSocketServer } from "./spawn.js";
+import { EventEmitter } from "node:events";
+import type { ChildProcess } from "node:child_process";
+import { Events } from "@pi-archimedes/core/events";
+import type { AgentConfig } from "./agents.js";
+
+// The child's argv is a contract with the `pi` CLI, and CLI strings are invisible
+// to tsc — these tests are the only guard on what the child actually receives.
+// `node:child_process` is mocked so no real pi process is spawned.
+const spawnMock = vi.hoisted(() => vi.fn());
+vi.mock("node:child_process", () => ({ spawn: spawnMock }));
+
+const { startAskSocketServer, spawnSubagent } = await import("./spawn.js");
 
 // startAskSocketServer is tested directly (not via spawnSubagent, which would
-// spawn a real `pi` process). The real bus is used — subscriptions are
-// unsubscribed in afterEach so they don't leak into other test files in the
-// same worker (the bus is a globalThis singleton).
+// spawn a real `pi` process). Each test gets its OWN bus stand-in — the host
+// handle is passed in rather than reached for, so there is no process-wide
+// singleton to leak between tests any more.
+
+/** Stands in for the host's `createEventBus()` (same emit/on/unsubscribe shape). */
+function fakeBus() {
+  const listeners = new Map<string, Array<(data: unknown) => void>>();
+  return {
+    emit(channel: string, data: unknown): void {
+      for (const handler of [...(listeners.get(channel) ?? [])]) handler(data);
+    },
+    on(channel: string, handler: (data: unknown) => void): () => void {
+      const subs = listeners.get(channel) ?? [];
+      subs.push(handler);
+      listeners.set(channel, subs);
+      return () => {
+        const current = listeners.get(channel) ?? [];
+        const idx = current.indexOf(handler);
+        if (idx !== -1) current.splice(idx, 1);
+      };
+    },
+  };
+}
 
 const cleanups: Array<() => void> = [];
-const unsubs: Array<() => void> = [];
 
 afterEach(() => {
-  unsubs.splice(0).forEach((u) => u());
   cleanups.splice(0).forEach((c) => c());
 });
 
@@ -20,6 +48,83 @@ function track(fn: () => void): void {
   cleanups.push(fn);
 }
 
+// ── spawnSubagent argv ──────────────────────────────────────────────────────
+
+/** A minimal spawn target: the argv assertions never touch the process. */
+function fakeSpawnResult(): ChildProcess {
+  const child = new EventEmitter() as ChildProcess & { pid: number };
+  Object.assign(child, { pid: 4242, killed: false, kill: () => true });
+  return child;
+}
+
+/** Run spawnSubagent against the mocked spawn and return the argv it received. */
+function argvFor(agent: Partial<AgentConfig> | undefined): string[] {
+  spawnMock.mockReset();
+  spawnMock.mockReturnValue(fakeSpawnResult());
+  const events = fakeBus();
+  const socket = startAskSocketServer(agent?.name ?? "general", events);
+  track(socket.cleanup);
+  spawnSubagent({
+    task: "do the thing",
+    model: undefined,
+    activeModel: undefined,
+    cwd: "/tmp",
+    signal: undefined,
+    events,
+    agent: agent
+      ? { name: agent.name ?? "general", description: "d", systemPrompt: "p", source: "user", filePath: "/tmp/a.md", ...agent }
+      : undefined,
+  });
+  const call = spawnMock.mock.calls[0] as [string, string[]] | undefined;
+  if (!call) throw new Error("spawn was not called");
+  return call[1];
+}
+
+describe("spawnSubagent tool allowlist (closed set, ADR 0028)", () => {
+  afterEach(() => {
+    spawnMock.mockReset();
+  });
+
+  it("a non-empty tools allowlist also passes --no-mcp, so the list stays closed", () => {
+    const argv = argvFor({ tools: ["read", "bash"] });
+    expect(argv).toContain("--tools");
+    expect(argv[argv.indexOf("--tools") + 1]).toBe("read,bash");
+    expect(argv).toContain("--no-mcp");
+  });
+
+  it("mcp: true is the only way the allowlist stops being closed", () => {
+    const argv = argvFor({ tools: ["read", "bash"], mcp: true });
+    expect(argv).toContain("--tools");
+    expect(argv).not.toContain("--no-mcp");
+  });
+
+  it("an empty tools list changes neither the tool set nor MCP", () => {
+    const argv = argvFor({ tools: [] });
+    expect(argv).not.toContain("--tools");
+    expect(argv).not.toContain("--no-mcp");
+  });
+
+  it("mcp: true without an allowlist passes neither flag (nothing to close)", () => {
+    const argv = argvFor({ mcp: true });
+    expect(argv).not.toContain("--tools");
+    expect(argv).not.toContain("--no-mcp");
+  });
+
+  it("the recursion guard survives the closed allowlist", () => {
+    const argv = argvFor({ tools: ["read"] });
+    const excludeIdx = argv.indexOf("--exclude-tools");
+    expect(excludeIdx).toBeGreaterThan(-1);
+    expect(argv[excludeIdx + 1]).toContain("subagent");
+  });
+
+  it("an agent with no config at all gets neither --tools nor --no-mcp", () => {
+    const argv = argvFor(undefined);
+    expect(argv).not.toContain("--tools");
+    expect(argv).not.toContain("--no-mcp");
+    expect(argv).toContain("--exclude-tools");
+  });
+});
+
 function connectClient(socketPath: string): Promise<net.Socket> {
   return new Promise((resolve, reject) => {
     const client = net.connect(socketPath, () => resolve(client));
@@ -40,12 +145,13 @@ function writeAskRequest(client: net.Socket, requestId: string, toolCallId?: str
 
 describe("startAskSocketServer", () => {
   it("a child ask_request carrying toolCallId → the bus ASK_REQUEST carries the same toolCallId", async () => {
-    const { socketPath, cleanup } = startAskSocketServer("test-agent");
+    const events = fakeBus();
+    const { socketPath, cleanup } = startAskSocketServer("test-agent", events);
     track(cleanup);
     await new Promise((r) => setTimeout(r, 50)); // let the server listen
 
     const requests: unknown[] = [];
-    unsubs.push(getBus().on(Events.ASK_REQUEST, (p) => requests.push(p)));
+    events.on(Events.ASK_REQUEST, (p) => requests.push(p));
 
     const client = await connectClient(socketPath);
     writeAskRequest(client, "req-1", "tool-9");
@@ -57,9 +163,9 @@ describe("startAskSocketServer", () => {
     expect(req.toolCallId).toBe("tool-9");
     expect(req.questions).toEqual([{ id: "q1", question: "Which?", options: [{ label: "A" }] }]);
 
-    // Deliver the response (drains pending) before closing so no ASK_CANCEL
-    // leaks onto the global bus queue for the next test
-    getBus().emit(Events.ASK_RESPONSE, {
+    // Deliver the response (drains pending) before closing so no ASK_CANCEL is
+    // signalled for a request that was already answered.
+    events.emit(Events.ASK_RESPONSE, {
       requestId: "req-1",
       cancelled: false,
       results: [{ id: "q1", selectedOptions: ["A"] }],
@@ -69,15 +175,60 @@ describe("startAskSocketServer", () => {
     await new Promise((r) => setTimeout(r, 50)); // close handler ran (no-op)
   });
 
+  /**
+   * The ask round-trip, over the handle: the child's socket request goes out on
+   * the bus, the answer comes back on the SAME handle, and the server writes it
+   * back down the socket. Before this migration both halves went through the
+   * suite's `globalThis` bus; the transport changed, the socket contract did not.
+   */
+  it("round-trip: ask_request in → ASK_REQUEST out on the handle → ASK_RESPONSE in → ask_response back down the socket", async () => {
+    const events = fakeBus();
+    const { socketPath, cleanup } = startAskSocketServer("test-agent", events);
+    track(cleanup);
+    await new Promise((r) => setTimeout(r, 50));
+
+    const frames: unknown[] = [];
+    const requests: unknown[] = [];
+    events.on(Events.ASK_REQUEST, (p) => requests.push(p));
+
+    const client = await connectClient(socketPath);
+    client.on("data", (chunk) => {
+      for (const line of chunk.toString("utf-8").split("\n")) {
+        if (line.trim()) frames.push(JSON.parse(line));
+      }
+    });
+
+    writeAskRequest(client, "req-rt", "tool-rt");
+    await vi.waitFor(() => expect(requests.length).toBe(1));
+
+    events.emit(Events.ASK_RESPONSE, {
+      requestId: "req-rt",
+      cancelled: false,
+      results: [{ id: "q1", selectedOptions: ["A"], customInput: undefined }],
+    });
+
+    await vi.waitFor(() => expect(frames.length).toBe(1));
+    expect(frames[0]).toEqual({
+      type: "ask_response",
+      requestId: "req-rt",
+      cancelled: false,
+      results: [{ id: "q1", selectedOptions: ["A"] }],
+    });
+
+    client.destroy();
+    await new Promise((r) => setTimeout(r, 50));
+  });
+
   it("closing the child socket → ASK_CANCEL for the pending requestId + source", async () => {
-    const { socketPath, cleanup } = startAskSocketServer("test-agent");
+    const events = fakeBus();
+    const { socketPath, cleanup } = startAskSocketServer("test-agent", events);
     track(cleanup);
     await new Promise((r) => setTimeout(r, 50)); // let the server listen
 
     const cancels: unknown[] = [];
-    unsubs.push(getBus().on(Events.ASK_CANCEL, (p) => cancels.push(p)));
+    events.on(Events.ASK_CANCEL, (p) => cancels.push(p));
     const requests: unknown[] = [];
-    unsubs.push(getBus().on(Events.ASK_REQUEST, (p) => requests.push(p)));
+    events.on(Events.ASK_REQUEST, (p) => requests.push(p));
 
     const client = await connectClient(socketPath);
     writeAskRequest(client, "req-2");
@@ -91,21 +242,22 @@ describe("startAskSocketServer", () => {
   });
 
   it("no ASK_CANCEL once the response has already been delivered (pending drained)", async () => {
-    const { socketPath, cleanup } = startAskSocketServer("test-agent");
+    const events = fakeBus();
+    const { socketPath, cleanup } = startAskSocketServer("test-agent", events);
     track(cleanup);
     await new Promise((r) => setTimeout(r, 50)); // let the server listen
 
     const cancels: unknown[] = [];
-    unsubs.push(getBus().on(Events.ASK_CANCEL, (p) => cancels.push(p)));
+    events.on(Events.ASK_CANCEL, (p) => cancels.push(p));
     const requests: unknown[] = [];
-    unsubs.push(getBus().on(Events.ASK_REQUEST, (p) => requests.push(p)));
+    events.on(Events.ASK_REQUEST, (p) => requests.push(p));
 
     const client = await connectClient(socketPath);
     writeAskRequest(client, "req-3");
     await vi.waitFor(() => expect(requests.length).toBe(1));
 
     // Deliver the response (drains pending) before the socket closes
-    getBus().emit(Events.ASK_RESPONSE, {
+    events.emit(Events.ASK_RESPONSE, {
       requestId: "req-3",
       cancelled: false,
       results: [{ id: "q1", selectedOptions: ["A"] }],
@@ -117,3 +269,36 @@ describe("startAskSocketServer", () => {
     expect(cancels.length).toBe(0);
   });
 });
+
+// ── thinking level (pi warns and drops; we must not feed it one) ───────────
+
+describe("spawnSubagent thinking level", () => {
+  afterEach(() => {
+    spawnMock.mockReset();
+  });
+
+  it("passes a level pi accepts through to --thinking", () => {
+    const argv = argvFor({ thinking: "xhigh" });
+    const at = argv.indexOf("--thinking");
+    expect(at).toBeGreaterThan(-1);
+    expect(argv[at + 1]).toBe("xhigh");
+  });
+
+  it("does not pass a level pi would warn about and drop", () => {
+    // `--thinking ultra` is a `warning` diagnostic and a dropped flag in pi's
+    // own parser (dist/cli/args.js), so the child ran at the default thinking
+    // level while its config said otherwise — and in `--mode json` that warning
+    // is stderr, which the stream reader only shows for a failed run. Passing
+    // nothing is the same outcome, said out loud at dispatch instead.
+    const argv = argvFor({ thinking: "ultra" });
+    expect(argv).not.toContain("--thinking");
+  });
+
+  it("is case-sensitive, exactly like pi's list", () => {
+    expect(argvFor({ thinking: "Medium" })).not.toContain("--thinking");
+  });
+
+  it("passes no --thinking when the config sets none", () => {
+    expect(argvFor({})).not.toContain("--thinking");
+  });
+});

package/src/spawn.ts

@@ -4,7 +4,9 @@ import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { randomUUID } from "node:crypto";
-import { getBus, Events } from "@pi-archimedes/core/bus";
+import type { EventBus } from "@earendil-works/pi-coding-agent";
+import { Events, emitOn } from "@pi-archimedes/core/events";
+import { resolveThinkingLevel } from "./thinking-validation.js";
 import type { AgentConfig } from "./agents.js";
 
 export interface SpawnOptions {
@@ -14,6 +16,8 @@ export interface SpawnOptions {
   cwd: string | undefined;
   signal: AbortSignal | undefined;
   agent: AgentConfig | undefined;
+  /** The parent's host handle (`pi.events`) — see `startAskSocketServer`. */
+  events: EventBus;
 }
 
 /**
@@ -73,25 +77,32 @@ function resolvePiBinary(): string {
 }
 
 /**
- * Start a Unix socket server that bridges the child's ask tool to the parent bus.
+ * Start a Unix socket server that bridges the child's ask tool to the parent's
+ * event handle.
  *
  * The child's ask tool (in packages/ask) connects to PI_SUBAGENT_SOCKET and sends:
  *   { type: "ask_request", requestId, questions, toolCallId } as a JSON line
  * and waits for:
  *   { type: "ask_response", requestId, cancelled, results } as a JSON line
  *
- * We forward the request onto the bus (ASK_REQUEST, carrying toolCallId), the
+ * We forward the request onto the handle (ASK_REQUEST, carrying toolCallId), the
  * ask package (or the bridge, in bridge mode) answers it, then emits
- * ASK_RESPONSE on the bus, and we write it back to the socket connection.
+ * ASK_RESPONSE on the same handle, and we write it back to the socket connection.
  *
  * When the socket closes (child exit, or the child's own 5-min timeout →
  * socket.end()) we signal the bridge via ASK_CANCEL for any still-pending ask.
  * We do NOT emit ASK_RESPONSE ourselves — the bridge is the sole emitter
  * (no double-decrement of its refcount).
  *
+ * @param events the parent's `pi.events`, injected: this is a plain function, not
+ *               an extension, so the handle has to come from the caller that has
+ *               one. The subscription it opens is closed by the returned
+ *               `cleanup()` — a per-spawn subscription with a per-spawn
+ *               teardown, which is why it cannot accumulate across runs.
+ *
  * Returns the socket path and a cleanup function.
  */
-export function startAskSocketServer(agentName: string): { socketPath: string; cleanup: () => void } {
+export function startAskSocketServer(agentName: string, events: EventBus): { socketPath: string; cleanup: () => void } {
   // Use named pipes on Windows, Unix domain sockets elsewhere.
   // Linux socket path limit is 108 chars — keep it short.
   const id = randomUUID().slice(0, 8);
@@ -103,8 +114,8 @@ export function startAskSocketServer(agentName: string): { socketPath: string; c
   // Map of pending ask requests: requestId → write-back callback
   const pending = new Map<string, (response: unknown) => void>();
 
-  // Listen for ASK_RESPONSE from the bus and route back to the waiting socket conn
-  const unsubResponse = getBus().on(Events.ASK_RESPONSE, (payload: unknown) => {
+  // Listen for ASK_RESPONSE on the handle and route back to the waiting socket conn
+  const unsubResponse = events.on(Events.ASK_RESPONSE, (payload: unknown) => {
     const data = payload as {
       requestId: string;
       cancelled: boolean;
@@ -152,9 +163,9 @@ export function startAskSocketServer(agentName: string): { socketPath: string; c
               }
             });
             socketRequestIds.add(msg.requestId);
-            // Forward to bus — the ask package (or the bridge, in bridge mode)
+            // Forward onto the handle — the ask package (or the bridge, in bridge mode)
             // answers it; toolCallId rides along for Client correlation
-            getBus().emit(Events.ASK_REQUEST, {
+            emitOn(events, Events.ASK_REQUEST, {
               source: `subagent:${agentName}`,
               requestId: msg.requestId,
               questions: msg.questions,
@@ -174,7 +185,7 @@ export function startAskSocketServer(agentName: string): { socketPath: string; c
     socket.on("close", () => {
       for (const rid of socketRequestIds) {
         if (pending.has(rid)) {
-          getBus().emit(Events.ASK_CANCEL, { requestId: rid, source: `subagent:${agentName}` });
+          emitOn(events, Events.ASK_CANCEL, { requestId: rid, source: `subagent:${agentName}` });
           pending.delete(rid);
         }
       }
@@ -208,7 +219,7 @@ export function spawnSubagent(options: SpawnOptions): ChildProcess {
   const agentName = options.agent?.name ?? "general";
 
   // Start ask bridge socket before spawning so the env var is ready
-  const { socketPath, cleanup: cleanupSocket } = startAskSocketServer(agentName);
+  const { socketPath, cleanup: cleanupSocket } = startAskSocketServer(agentName, options.events);
 
   // Build CLI args
   const args: string[] = ["--mode", "json", "--no-session", "-p"];
@@ -219,14 +230,35 @@ export function spawnSubagent(options: SpawnOptions): ChildProcess {
     args.push("--model", model);
   }
 
-  // Thinking level from agent config
-  if (options.agent?.thinking) {
-    args.push("--thinking", options.agent.thinking);
+  // Thinking level from agent config. An unknown level is NOT passed on: pi
+  // warns and drops the flag itself, which leaves the child on the default
+  // level with the explanation in a stderr nobody reads for a successful run.
+  // `index.ts` reports the same drop where the user can see it.
+  const thinking = resolveThinkingLevel(options.agent?.thinking);
+  if (thinking.level !== undefined) {
+    args.push("--thinking", thinking.level);
   }
 
-  // Tool allowlist from agent config
-  if (options.agent?.tools && options.agent.tools.length > 0) {
-    args.push("--tools", options.agent.tools.join(","));
+  // Tool allowlist from agent config.
+  //
+  // pi 1.0.4 changed what a non-empty `--tools` does to MCP tools. It no longer
+  // filters them: unless the list is empty or names an `mcp__` entry, they stay
+  // REGISTERED — reachable through codemode and `tool_search` — even though they
+  // are not *declared* to the model (`agent-session.js`: `_allowlistFiltersMcp`
+  // false → `_isAllowedTool` keeps them, `_isActivatable` withholds the
+  // declaration unless `tool_search` can load them). So the child's tool box is
+  // wider than the three names in the config, which is the hole ADR 0028 closed:
+  // `--no-mcp` stops the servers connecting at all, so there is nothing to reach.
+  // A config that wants the servers asks with `mcp: true` — verified against a
+  // live 1.2.0 child: with `--tools read` it sees exactly `read` either way, so
+  // the opt-in's observable effect today is registration, not a declared list
+  // (see ADR 0028's verification note for the open follow-up).
+  const tools = options.agent?.tools ?? [];
+  if (tools.length > 0) {
+    args.push("--tools", tools.join(","));
+    if (options.agent?.mcp !== true) {
+      args.push("--no-mcp");
+    }
   }
 
   // Always exclude the subagent tool itself to prevent infinite recursion