@selesai/code 0.13.0 → 0.13.2

package/dist/extensions/pi-subagents/test/unit/pi-args.test.ts

@@ -5,11 +5,16 @@ import * as path from "node:path";
 import { afterEach, describe, it } from "node:test";
 import { discoverAgents } from "../../src/agents/agents.ts";
 import { computeMcpServerHash } from "../../src/runs/shared/mcp-direct-tool-allowlist.ts";
+import {
+	MCP_RUNTIME_SNAPSHOT_EVENT,
+	MCP_RUNTIME_SNAPSHOT_VERSION,
+	type McpRuntimeSnapshotHost,
+} from "../../src/runs/shared/mcp-direct-tool-allowlist.ts";
 import {
 	TOOL_BUDGET_ENV,
 	TOOL_BUDGET_ZERO_AUTH_ENV,
 } from "../../src/runs/shared/tool-budget.ts";
-import { WAIT_TOOL_ENABLED_ENV } from "../../src/runs/background/wait-config.ts";
+import { WAIT_TOOL_DEFAULT_TIMEOUT_MS_ENV, WAIT_TOOL_ENABLED_ENV } from "../../src/runs/background/wait-config.ts";
 import { SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../src/shared/utils.ts";
 import {
 	CHILD_TOOL_DIAGNOSTIC_PATH_ENV,
@@ -320,6 +325,31 @@ describe("buildPiArgs session wiring", () => {
 		assert.equal(env[SUBAGENT_PARENT_SESSION_ENV], "direct-parent");
 	});
 
+	it("passes the child display session name through as PI_SUBAGENT_SESSION_NAME", () => {
+		const { env } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			sessionName: "worker: Fix the flaky test",
+		});
+
+		assert.equal(env.PI_SUBAGENT_SESSION_NAME, "worker: Fix the flaky test");
+	});
+
+	it("omits PI_SUBAGENT_SESSION_NAME when no session name is provided", () => {
+		const { env } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+		});
+
+		assert.equal(env.PI_SUBAGENT_SESSION_NAME, undefined);
+	});
+
 	it("falls back to inherited parent session env for permission forwarding", () => {
 		process.env.SELESAI_SUBAGENT_PARENT_SESSION = "inherited-parent";
 		const { env } = buildPiArgs({
@@ -356,6 +386,17 @@ describe("buildPiArgs session wiring", () => {
 			}).env[WAIT_TOOL_ENABLED_ENV],
 			"true",
 		);
+		assert.equal(
+			buildPiArgs({
+				baseArgs: [],
+				task: "test",
+				sessionEnabled: false,
+				inheritProjectContext: true,
+				inheritSkills: true,
+				waitToolDefaultTimeoutMs: 12_000,
+			}).env[WAIT_TOOL_DEFAULT_TIMEOUT_MS_ENV],
+			"12000",
+		);
 	});
 
 	it("passes child watchdog config only when explicitly provided", () => {
@@ -662,6 +703,7 @@ describe("buildPiArgs system prompt mode wiring", () => {
 			task: "hello",
 			sessionEnabled: false,
 			inheritProjectContext: false,
+			inheritGlobalContext: false,
 			inheritSkills: true,
 		});
 
@@ -678,9 +720,23 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		assert.ok(args.includes("--no-context-files"));
 		assert.equal(env.SELESAI_SUBAGENT_CHILD, "1");
 		assert.equal(env.SELESAI_SUBAGENT_INHERIT_PROJECT_CONTEXT, "0");
+		assert.equal(env.SELESAI_SUBAGENT_INHERIT_GLOBAL_CONTEXT, "0");
 		assert.equal(env.SELESAI_SUBAGENT_INHERIT_SKILLS, "1");
 	});
 
+	it("propagates the global context inheritance flag through env", () => {
+		const { env } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: true,
+			inheritGlobalContext: true,
+			inheritSkills: true,
+		});
+		assert.equal(env.SELESAI_SUBAGENT_INHERIT_PROJECT_CONTEXT, "1");
+		assert.equal(env.SELESAI_SUBAGENT_INHERIT_GLOBAL_CONTEXT, "1");
+	});
+
 	it("keeps context file loading enabled when project context is inherited", () => {
 		const { args } = buildPiArgs({
 			baseArgs: ["-p"],
@@ -1112,6 +1168,201 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		assert.equal(args[args.indexOf("--tools") + 1], "read,github_search_repositories");
 	});
 
+	it("hands runtime MCP snapshots to child launches for server and server/tool selectors", () => {
+		const fixture = createMcpFixture();
+		const serverName = "runtime-github";
+		const definition = { command: "runtime-github", args: ["--stdio"] };
+		writeJson(path.join(fixture.agentDir, "mcp.json"), { mcpServers: {} });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				[serverName]: {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "search_repositories" }, { name: "create_issue" }],
+				},
+			},
+		});
+		const requestedNames: string[] = [];
+		const runtimeSnapshotHost: McpRuntimeSnapshotHost = {
+			events: {
+				emit(event, request) {
+					assert.equal(event, MCP_RUNTIME_SNAPSHOT_EVENT);
+					assert.equal(request.version, MCP_RUNTIME_SNAPSHOT_VERSION);
+					requestedNames.push(request.name);
+					request.result = {
+						ok: true,
+						snapshot: {
+							name: request.name,
+							definition: structuredClone(definition),
+							runtime: true,
+							persisted: false,
+						},
+					};
+				},
+			},
+		};
+		const serverLaunch = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: [serverName],
+			systemPrompt: "system",
+			runtimeSnapshotHost,
+		});
+		const toolLaunch = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: [`${serverName}/search_repositories`],
+			runtimeSnapshotHost,
+		});
+		assert.deepEqual(requestedNames, [serverName, serverName]);
+		assert.equal(serverLaunch.args[serverLaunch.args.indexOf("--tools") + 1], "read,runtime_github_search_repositories,runtime_github_create_issue");
+		assert.equal(toolLaunch.args[toolLaunch.args.indexOf("--tools") + 1], "read,runtime_github_search_repositories");
+		assert.ok(serverLaunch.args.indexOf("--mcp-config") < serverLaunch.args.indexOf("Task: hello"));
+		for (const launch of [serverLaunch, toolLaunch]) {
+			const configPath = launch.args[launch.args.indexOf("--mcp-config") + 1];
+			assert.ok(configPath);
+			assert.equal(path.dirname(configPath), launch.tempDir);
+			assert.deepEqual(JSON.parse(fs.readFileSync(configPath, "utf-8")), {
+				mcpServers: { [serverName]: definition },
+			});
+		}
+		assert.deepEqual(
+			[serverLaunch.env.MCP_DIRECT_TOOLS, toolLaunch.env.MCP_DIRECT_TOOLS],
+			[serverName, `${serverName}/search_repositories`],
+		);
+		assert.deepEqual(JSON.parse(serverLaunch.env[MCP_DIRECT_CHILD_TOOLS_ENV]!), [
+			"runtime_github_search_repositories",
+			"runtime_github_create_issue",
+		]);
+		assert.deepEqual(JSON.parse(toolLaunch.env[MCP_DIRECT_CHILD_TOOLS_ENV]!), [
+			"runtime_github_search_repositories",
+		]);
+	});
+
+	it("fails closed when a selected runtime MCP server has no snapshot", () => {
+		const fixture = createMcpFixture();
+		const serverName = "runtime-missing";
+		const definition = { command: "runtime-missing", args: ["--stdio"] };
+		writeJson(path.join(fixture.agentDir, "mcp.json"), { mcpServers: {} });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				[serverName]: {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "search" }],
+				},
+			},
+		});
+		const runtimeSnapshotHost: McpRuntimeSnapshotHost = {
+			events: {
+				emit(_event, request) {
+					request.result = { ok: false, error: new Error("runtime server is unavailable") };
+				},
+			},
+		};
+		assert.throws(() => buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: [serverName],
+			runtimeSnapshotHost,
+		}), /Unresolved MCP direct-tool selectors: runtime-missing\./);
+	});
+
+	it("fails closed on malformed selected runtime MCP server fields", () => {
+		const fixture = createMcpFixture();
+		const serverName = "runtime-filtered";
+		const definition = { command: "runtime-filtered", includeTools: "safe_only" } as unknown as Parameters<typeof computeMcpServerHash>[0];
+		writeJson(path.join(fixture.agentDir, "mcp.json"), { mcpServers: {} });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				[serverName]: {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "safe_only" }, { name: "dangerous" }],
+				},
+			},
+		});
+		const runtimeSnapshotHost: McpRuntimeSnapshotHost = {
+			events: {
+				emit(_event, request) {
+					request.result = { ok: true, snapshot: { name: request.name, definition, runtime: true, persisted: false } };
+				},
+			},
+		};
+
+		assert.throws(() => buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: [serverName],
+			runtimeSnapshotHost,
+		}), /Unresolved MCP direct-tool selectors: runtime-filtered\./);
+	});
+
+	it("does not serialize runtime MCP servers denied by a capability ceiling", () => {
+		const fixture = createMcpFixture();
+		const definitions = {
+			"runtime-a": { command: "runtime-a", args: ["--stdio"] },
+			"runtime-b": { command: "runtime-b", args: ["--stdio"] },
+		};
+		writeJson(path.join(fixture.agentDir, "mcp.json"), { mcpServers: {} });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"runtime-a": { configHash: computeMcpServerHash(definitions["runtime-a"]), cachedAt: Date.now(), tools: [{ name: "search" }] },
+				"runtime-b": { configHash: computeMcpServerHash(definitions["runtime-b"]), cachedAt: Date.now(), tools: [{ name: "secret" }] },
+			},
+		});
+		const runtimeSnapshotHost: McpRuntimeSnapshotHost = {
+			events: {
+				emit(_event, request) {
+					const definition = definitions[request.name as keyof typeof definitions];
+					if (!definition) {
+						request.result = { ok: false, error: new Error(`unknown runtime server ${request.name}`) };
+						return;
+					}
+					request.result = { ok: true, snapshot: { name: request.name, definition, runtime: true, persisted: false } };
+				},
+			},
+		};
+		const launch = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["runtime-a", "runtime-b"],
+			capabilityCeiling: { version: 1, allowedTools: ["read", "runtime_a_search"], denyExtensions: false, sources: ["test"] },
+			runtimeSnapshotHost,
+		});
+		assert.equal(launch.args[launch.args.indexOf("--tools") + 1], "read,runtime_a_search");
+		const configPath = launch.args[launch.args.indexOf("--mcp-config") + 1];
+		assert.ok(configPath);
+		assert.deepEqual(JSON.parse(fs.readFileSync(configPath, "utf-8")), {
+			mcpServers: { "runtime-a": definitions["runtime-a"] },
+		});
+		assert.deepEqual(JSON.parse(launch.env[MCP_DIRECT_CHILD_TOOLS_ENV]!), ["runtime_a_search"]);
+	});
+
 	it("emits --no-tools for explicit empty tool allowlists", () => {
 		for (const requireReadTool of [false, true]) {
 			const { args, env } = buildPiArgs({
@@ -1153,7 +1404,7 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		}
 	});
 
-	it("fails closed with --no-tools when MCP-only names cannot be resolved", () => {
+	it("fails closed with a deterministic diagnostic when MCP selectors cannot be resolved", () => {
 		for (const requireReadTool of [false, true]) {
 			const fixture = createMcpFixture();
 			writeJson(path.join(fixture.agentDir, "mcp.json"), {
@@ -1162,7 +1413,7 @@ describe("buildPiArgs system prompt mode wiring", () => {
 				},
 			});
 
-			const { args, env } = buildPiArgs({
+			assert.throws(() => buildPiArgs({
 				baseArgs: ["-p"],
 				task: "hello",
 				sessionEnabled: false,
@@ -1170,11 +1421,7 @@ describe("buildPiArgs system prompt mode wiring", () => {
 				inheritSkills: false,
 				requireReadTool,
 				mcpDirectTools: ["chrome-devtools"],
-			});
-
-			assert.ok(args.includes("--no-tools"));
-			assert.equal(args.includes("--tools"), false);
-			assert.equal(env.MCP_DIRECT_TOOLS, "chrome-devtools");
+			}), /Unresolved MCP direct-tool selectors: chrome-devtools\./);
 		}
 	});
 
@@ -1254,14 +1501,14 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		);
 	});
 
-	it("falls back to explicit builtins when direct MCP cache or config is missing or invalid", () => {
+	it("fails closed when direct MCP cache or config is missing or invalid", () => {
 		const missingFixture = createMcpFixture();
 		writeJson(path.join(missingFixture.agentDir, "mcp.json"), {
 			mcpServers: {
 				"chrome-devtools": { command: "npx", args: ["chrome-devtools-mcp"] },
 			},
 		});
-		const missingCache = buildPiArgs({
+		assert.throws(() => buildPiArgs({
 			baseArgs: ["-p"],
 			task: "hello",
 			sessionEnabled: false,
@@ -1269,17 +1516,13 @@ describe("buildPiArgs system prompt mode wiring", () => {
 			inheritSkills: false,
 			tools: ["read", "bash"],
 			mcpDirectTools: ["chrome-devtools"],
-		});
-		assert.equal(
-			missingCache.args[missingCache.args.indexOf("--tools") + 1],
-			"read,bash",
-		);
+		}), /Unresolved MCP direct-tool selectors: chrome-devtools\./);
 
 		const invalidFixture = createMcpFixture();
 		writeMcpFixture(invalidFixture, {
 			cachedAt: Date.now() - 8 * 24 * 60 * 60 * 1000,
 		});
-		const staleCache = buildPiArgs({
+		assert.throws(() => buildPiArgs({
 			baseArgs: ["-p"],
 			task: "hello",
 			sessionEnabled: false,
@@ -1287,17 +1530,73 @@ describe("buildPiArgs system prompt mode wiring", () => {
 			inheritSkills: false,
 			tools: ["read", "bash"],
 			mcpDirectTools: ["chrome-devtools"],
+		}), /Unresolved MCP direct-tool selectors: chrome-devtools\./);
+	});
+
+	it("rejects malformed MCP server and metadata entry fields at their load boundaries", () => {
+		const malformedConfig = createMcpFixture();
+		writeJson(path.join(malformedConfig.agentDir, "mcp.json"), {
+			mcpServers: {
+				"unsafe-server": { command: "unsafe-server", env: { TOKEN: 42 } },
+			},
 		});
-		assert.equal(
-			staleCache.args[staleCache.args.indexOf("--tools") + 1],
-			"read,bash",
-		);
+		assert.throws(() => buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["unsafe-server"],
+		}), /Unresolved MCP direct-tool selectors: unsafe-server\./);
+
+		const malformedCache = createMcpFixture();
+		const definition = { command: "cached-server" };
+		writeJson(path.join(malformedCache.agentDir, "mcp.json"), { mcpServers: { "cached-server": definition } });
+		writeJson(path.join(malformedCache.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"cached-server": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: 42 }],
+				},
+			},
+		});
+		assert.throws(() => buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["cached-server"],
+		}), /Unresolved MCP direct-tool selectors: cached-server\./);
+	});
+
+	it("preserves MCP configuration errors during direct-tool resolution", () => {
+		const fixture = createMcpFixture();
+		writeJson(path.join(fixture.agentDir, "mcp.json"), {
+			mcpServers: {
+				"remote-mcp": { url: "https://example.test/${MISSING_MCP_TOKEN}" },
+			},
+		});
+		assert.throws(() => buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["remote-mcp"],
+		}), /Missing environment variable in MCP server URL: MISSING_MCP_TOKEN/);
 	});
 
 	it("resolves project MCP config from the child cwd and expands SELESAI_CODING_AGENT_DIR", () => {
 		const fixture = createMcpFixture();
 		process.env.SELESAI_CODING_AGENT_DIR = "~/.selesai/agent";
 		process.chdir(fixture.root);
+		fs.mkdirSync(path.join(fixture.projectDir, ".selesai"));
 		writeMcpFixture(fixture, {
 			serverName: "project-mcp",
 			configPath: path.join(fixture.projectDir, ".mcp.json"),
@@ -1318,6 +1617,230 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		assert.equal(args[args.indexOf("--tools") + 1], "read,project_mcp_inspect");
 	});
 
+	it("resolves direct MCP tools from Pi package manifests", () => {
+		const fixture = createMcpFixture();
+		const packageRoot = path.join(fixture.agentDir, "npm", "node_modules", "@acme", "tools");
+		const definition = { command: "node", args: ["package-mcp"] };
+		writeJson(path.join(fixture.agentDir, "settings.json"), { packages: ["npm:@acme/tools@1.0.0"] });
+		writeJson(path.join(packageRoot, "package.json"), { name: "@acme/tools", pi: { mcp: "./mcp.json" } });
+		writeJson(path.join(packageRoot, "mcp.json"), { mcpServers: { wiki: definition } });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"acme_tools__wiki": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "read_wiki_structure" }],
+				},
+			},
+		});
+
+		const { args } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["acme_tools__wiki/read_wiki_structure"],
+			cwd: fixture.projectDir,
+		});
+
+		assert.equal(args[args.indexOf("--tools") + 1], "read,acme_tools__wiki_read_wiki_structure");
+	});
+
+	it("fails closed on malformed MCP server fields from Pi package manifests", () => {
+		const fixture = createMcpFixture();
+		const packageRoot = path.join(fixture.agentDir, "npm", "node_modules", "@acme", "tools");
+		const malformedFields: Record<string, unknown> = { includeTools: "read_wiki_structure" };
+		const definition = { command: "node", args: ["package-mcp"], ...malformedFields };
+		writeJson(path.join(fixture.agentDir, "settings.json"), { packages: ["npm:@acme/tools@1.0.0"] });
+		writeJson(path.join(packageRoot, "package.json"), { name: "@acme/tools", pi: { mcp: "./mcp.json" } });
+		writeJson(path.join(packageRoot, "mcp.json"), { mcpServers: { wiki: definition } });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"acme_tools__wiki": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "read_wiki_structure" }, { name: "delete_wiki" }],
+				},
+			},
+		});
+
+		assert.throws(() => buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["acme_tools__wiki"],
+			cwd: fixture.projectDir,
+		}), /Unresolved MCP direct-tool selectors: acme_tools__wiki\./);
+	});
+
+	it("resolves direct MCP tools from the git-root package when child cwd has an incidental .pi directory", () => {
+		const fixture = createMcpFixture();
+		const nestedCwd = path.join(fixture.projectDir, "packages", "app");
+		const packageRoot = path.join(fixture.projectDir, ".selesai", "npm", "node_modules", "@acme", "tools");
+		const definition = { command: "node", args: ["package-mcp"] };
+		fs.mkdirSync(nestedCwd, { recursive: true });
+		fs.mkdirSync(path.join(nestedCwd, ".selesai"));
+		fs.mkdirSync(path.join(fixture.projectDir, ".git"));
+		writeJson(path.join(fixture.projectDir, ".selesai", "settings.json"), {
+			packages: ["npm:@acme/tools@1.0.0"],
+			subagents: { projectRootResolution: "git-root" },
+		});
+		writeJson(path.join(packageRoot, "package.json"), { name: "@acme/tools", pi: { mcp: "./mcp.json" } });
+		writeJson(path.join(packageRoot, "mcp.json"), { mcpServers: { wiki: definition } });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"acme_tools__wiki": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "read_wiki_structure" }],
+				},
+			},
+		});
+
+		const { args } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["acme_tools__wiki/read_wiki_structure"],
+			cwd: nestedCwd,
+		});
+
+		assert.equal(args[args.indexOf("--tools") + 1], "read,acme_tools__wiki_read_wiki_structure");
+	});
+
+	it("resolves direct MCP tools from pinned Git package manifests", () => {
+		const fixture = createMcpFixture();
+		const packageRoot = path.join(fixture.agentDir, "git", "github.com", "acme", "tools");
+		const definition = { command: "node", args: ["git-package-mcp"] };
+		writeJson(path.join(fixture.agentDir, "settings.json"), { packages: ["git:https://github.com/acme/tools.git#main"] });
+		writeJson(path.join(packageRoot, "package.json"), { name: "@acme/tools", pi: { mcp: "./mcp.json" } });
+		writeJson(path.join(packageRoot, "mcp.json"), { mcpServers: { wiki: definition } });
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"acme_tools__wiki": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "read_wiki_structure" }],
+				},
+			},
+		});
+
+		const { args } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["acme_tools__wiki/read_wiki_structure"],
+			cwd: fixture.projectDir,
+		});
+
+		assert.equal(args[args.indexOf("--tools") + 1], "read,acme_tools__wiki_read_wiki_structure");
+	});
+
+	it("resolves direct MCP tools from Agent Plugin MCP config", () => {
+		const fixture = createMcpFixture();
+		const pluginRoot = path.join(fixture.projectDir, "plugins", "acme-tools");
+		const definition = { url: "https://example.test/mcp", headers: { "X-Tenant": "public" } };
+		fs.mkdirSync(path.join(fixture.projectDir, ".selesai"));
+		writeJson(path.join(pluginRoot, "plugin.json"), {
+			$schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+			name: "acme.tools",
+		});
+		writeJson(path.join(pluginRoot, "mcp.json"), {
+			$schema: "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+			mcpServers: { wiki: { type: "streamable-http", ...definition } },
+		});
+		writeJson(path.join(fixture.projectDir, ".mcp.json"), {
+			settings: { agentPluginPaths: ["./plugins/acme-tools"] },
+			mcpServers: {},
+		});
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"acme_tools__wiki": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "read_wiki_structure" }],
+				},
+			},
+		});
+
+		const { args } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["acme_tools__wiki/read_wiki_structure"],
+			cwd: fixture.projectDir,
+		});
+
+		assert.equal(args[args.indexOf("--tools") + 1], "read,acme_tools__wiki_read_wiki_structure");
+	});
+
+	it("resolves root Agent Plugin MCP tools when child cwd is nested", () => {
+		const fixture = createMcpFixture();
+		const nestedCwd = path.join(fixture.projectDir, "packages", "app");
+		const pluginRoot = path.join(fixture.projectDir, "plugins", "acme-tools");
+		const definition = { url: "https://example.test/mcp", headers: { "X-Tenant": "public" } };
+		fs.mkdirSync(nestedCwd, { recursive: true });
+		fs.mkdirSync(path.join(nestedCwd, ".selesai"));
+		fs.mkdirSync(path.join(fixture.projectDir, ".git"));
+		writeJson(path.join(fixture.projectDir, ".selesai", "settings.json"), {
+			subagents: { projectRootResolution: "git-root" },
+		});
+		writeJson(path.join(pluginRoot, "plugin.json"), {
+			$schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+			name: "acme.tools",
+		});
+		writeJson(path.join(pluginRoot, "mcp.json"), {
+			$schema: "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+			mcpServers: { wiki: { type: "streamable-http", ...definition } },
+		});
+		writeJson(path.join(fixture.projectDir, ".mcp.json"), {
+			settings: { agentPluginPaths: ["./plugins/acme-tools"] },
+			mcpServers: {},
+		});
+		writeJson(path.join(fixture.agentDir, "mcp-cache.json"), {
+			version: 1,
+			servers: {
+				"acme_tools__wiki": {
+					configHash: computeMcpServerHash(definition),
+					cachedAt: Date.now(),
+					tools: [{ name: "read_wiki_structure" }],
+				},
+			},
+		});
+
+		const { args } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: ["read"],
+			mcpDirectTools: ["acme_tools__wiki/read_wiki_structure"],
+			cwd: nestedCwd,
+		});
+
+		assert.equal(args[args.indexOf("--tools") + 1], "read,acme_tools__wiki_read_wiki_structure");
+	});
+
 	it("keeps tool extension paths when explicit extensions are allowlisted", () => {
 		const fixture = createMcpFixture();
 		writeMcpFixture(fixture, { tools: [{ name: "take_screenshot" }] });
@@ -1372,7 +1895,7 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		assert.ok(extensionArgs.includes("./child-tool.ts"));
 	});
 
-	it("authorizes child fanout only from exact declared builtin subagent", () => {
+	it("authorizes child fanout from an exact declared builtin subagent", () => {
 		const { args, env } = buildPiArgs({
 			baseArgs: ["-p"],
 			task: "hello",
@@ -1410,6 +1933,36 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		);
 	});
 
+	it("authorizes explicit nested fanout without creating a tool allowlist", () => {
+		const inherited = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			allowNestedSubagents: true,
+		});
+		const extensionArgs = inherited.args.filter((arg, index) => inherited.args[index - 1] === "--extension");
+		assert.ok(!inherited.args.includes("--tools"));
+		assert.ok(!inherited.args.includes("--no-tools"));
+		assert.ok(!inherited.args.includes("--no-extensions"));
+		assert.equal(inherited.env[SUBAGENT_FANOUT_CHILD_ENV], "1");
+		assert.ok(extensionArgs.some((arg) => arg.endsWith(path.join("src", "extension", "fanout-child.ts"))));
+
+		const ceilingDenied = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "hello",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			allowNestedSubagents: true,
+			capabilityCeiling: { version: 1, allowedTools: ["read"], denyExtensions: false, sources: ["test"] },
+		});
+		const deniedExtensions = ceilingDenied.args.filter((arg, index) => ceilingDenied.args[index - 1] === "--extension");
+		assert.equal(ceilingDenied.env[SUBAGENT_FANOUT_CHILD_ENV], "0");
+		assert.ok(!deniedExtensions.some((arg) => arg.endsWith(path.join("src", "extension", "fanout-child.ts"))));
+	});
+
 	it("clears all fanout routing env values for non-fanout children", () => {
 		const { args, env } = buildPiArgs({
 			baseArgs: ["-p"],