@selesai/code 0.13.12 → 0.13.14

package/dist/extensions/pi-subagents/test/unit/herdr-inspector.test.ts

@@ -252,10 +252,23 @@ describe("Herdr inspector", () => {
 			assert.match(dashboard, /decision-1: Choose UX/);
 			assert.match(dashboard, /closing it does not stop the run/i);
 
-			assert.match(submitInspectorControl({ asyncDir, runId: "run-123", refreshMs: 1_500 }, "steer keep going"), /Steering queued for run run-123\. Message: "keep going"/);
+			assert.match(submitInspectorControl({ asyncDir, runId: "run-123", refreshMs: 1_500 }, "steer keep going"), /Steering queued for run run-123\.\n\nMessage sent:\n```text\nkeep going\n```/);
 			assert.deepEqual(consumeSteerRequests(asyncDir).map((request) => ({ message: request.message, targetIndex: request.targetIndex, source: request.source })), [
 				{ message: "keep going", targetIndex: 0, source: "herdr-inspector" },
 			]);
+			assert.match(submitInspectorControl({ asyncDir, runId: "run-123", index: 0, refreshMs: 1_500 }, "keep going without a prefix"), /Steering queued for run run-123/);
+			assert.deepEqual(consumeSteerRequests(asyncDir).map((request) => ({ message: request.message, targetIndex: request.targetIndex, source: request.source })), [
+				{ message: "keep going without a prefix", targetIndex: 0, source: "herdr-inspector" },
+			]);
+			fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({ ...status, mode: "parallel", steps: [...status.steps!, { agent: "reviewer", status: "running" }] }), "utf-8");
+			const aggregateDashboard = formatInspectorDashboard({ status: { ...status, mode: "parallel", steps: [...status.steps!, { agent: "reviewer", status: "running" }] }, asyncDir });
+			assert.match(aggregateDashboard, /Controls: steer <message> \| stop \| status/);
+			assert.doesNotMatch(aggregateDashboard, /type guidance/);
+			assert.throws(() => submitInspectorControl({ asyncDir, runId: "run-123", refreshMs: 1_500 }, "ambiguous plain guidance"), /Plain guidance requires a child-specific inspector/);
+			assert.match(submitInspectorControl({ asyncDir, runId: "run-123", refreshMs: 1_500 }, "steer broadcast guidance"), /Steering queued for run run-123/);
+			assert.deepEqual(consumeSteerRequests(asyncDir).map((request) => ({ message: request.message, targetIndexes: request.targetIndexes, source: request.source })), [
+				{ message: "broadcast guidance", targetIndexes: [0, 1], source: "herdr-inspector" },
+			]);
 			assert.match(submitInspectorControl({ asyncDir, runId: "run-123", refreshMs: 1_500 }, "stop"), /Stop requested/);
 			assert.equal(consumeStopRequest(asyncDir), true);
 			assert.throws(() => submitInspectorControl({ asyncDir, runId: "run-123", refreshMs: 1_500 }, "reply decision-1 yes"), /parent Pi session/);
@@ -369,6 +382,8 @@ describe("Herdr inspector", () => {
 
 	it("fails closed when an idle-only project pane close sees active work", async () => {
 		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-herdr-project-pane-busy-"));
+		const previousPiBinary = process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV];
+		process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV] = path.join(root, "pi-bin");
 		try {
 			const projectRoot = fs.realpathSync(root);
 			const calls: string[][] = [];
@@ -394,12 +409,16 @@ describe("Herdr inspector", () => {
 			assert.equal(calls.some((args) => args.join(" ") === "pane close w1:p11"), false);
 			assert.equal(readHerdrProjectPaneBinding(root)?.paneId, "w1:p11");
 		} finally {
+			if (previousPiBinary === undefined) delete process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV];
+			else process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV] = previousPiBinary;
 			fs.rmSync(root, { recursive: true, force: true });
 		}
 	});
 
 	it("preserves legacy model-facing recovery for transient and opaque pane inspection results", async () => {
 		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-herdr-project-pane-legacy-"));
+		const previousPiBinary = process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV];
+		process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV] = path.join(root, "pi-bin");
 		try {
 			let splitCount = 0;
 			let getMode: "valid" | "timeout" | "opaque" = "valid";
@@ -436,6 +455,8 @@ describe("Herdr inspector", () => {
 			assert.match(text(closed), /INVALID_PANE_RESPONSE/);
 			assert.equal(readHerdrProjectPaneBinding(root)?.paneId, "w1:p32");
 		} finally {
+			if (previousPiBinary === undefined) delete process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV];
+			else process.env[SELESAI_SUBAGENT_SELESAI_BINARY_ENV] = previousPiBinary;
 			fs.rmSync(root, { recursive: true, force: true });
 		}
 	});

package/dist/extensions/pi-subagents/test/unit/index-child-registration.test.ts

@@ -485,7 +485,7 @@ describe("subagent extension child mode", () => {
 		}
 	});
 
-	it("registers bg_wait and its compatibility alias and honors waitTool disabled config", () => {
+	it("registers bg_wait and honors waitTool disabled config", () => {
 		const agentDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-wait-tool-config-"));
 		try {
 			const configDir = path.join(agentDir, "extensions", "subagent");
@@ -496,13 +496,11 @@ describe("subagent extension child mode", () => {
 				import registerSubagentExtension from "./index.ts";
 				const events = { on() { return () => {}; }, emit() {} };
 				let bgWaitTool;
-				let subagentWaitTool;
 				let legacyWaitRegistered = false;
 				const fakePi = new Proxy({
 					events,
 					registerTool(tool) {
 						if (tool.name === "bg_wait") bgWaitTool = tool;
-						if (tool.name === "subagent_wait") subagentWaitTool = tool;
 						if (tool.name === "wait") legacyWaitRegistered = true;
 					},
 					registerCommand() {},
@@ -517,11 +515,9 @@ describe("subagent extension child mode", () => {
 					},
 				});
 				registerSubagentExtension(fakePi);
-				if (!bgWaitTool || !subagentWaitTool) throw new Error("bg_wait and subagent_wait tools not registered");
+				if (!bgWaitTool) throw new Error("bg_wait tool not registered");
 				if (legacyWaitRegistered) throw new Error("legacy wait tool must not be registered");
 				const result = await bgWaitTool.execute("bg-wait-disabled", {}, new AbortController().signal, undefined, {});
-				const aliasResult = await subagentWaitTool.execute("subagent-wait-disabled", {}, new AbortController().signal, undefined, {});
-				if (aliasResult.content[0].text !== result.content[0].text) throw new Error("subagent_wait alias behavior differs from bg_wait");
 				process.stdout.write(JSON.stringify(result.content[0].text));
 			`;
 

package/dist/extensions/pi-subagents/test/unit/notify.test.ts

@@ -709,6 +709,20 @@ describe("completion formatting helpers", () => {
 		assert.equal(details.agent, "unknown");
 		assert.equal(details.status, "completed");
 	});
+
+	it("surfaces direct structured output when the completion has no text output", () => {
+		const details = buildCompletionDetails({
+			id: "structured-run",
+			agent: "delegate",
+			success: true,
+			summary: "delegate:\n(no output)",
+			results: [{ agent: "delegate", output: "", structuredOutput: { payload: { ok: true } }, success: true }],
+		});
+
+		assert.match(details.resultPreview, /Structured output:/);
+		assert.match(details.resultPreview, /"ok": true/);
+		assert.match(formatSingleCompletion(details), /"ok": true/);
+	});
 });
 
 describe("scheduled completions", () => {
@@ -748,4 +762,55 @@ describe("scheduled completions", () => {
 		assert.equal(parsed?.scheduleOrigin, undefined);
 		assert.equal(parsed?.resultPreview, "Workflow completed with 1 child run(s).");
 	});
-});
+});
+
+describe("watchdog blockers in completion notices", () => {
+	it("collects child blockers into details and round-trips them through the notice text", () => {
+		const details = buildCompletionDetails({
+			id: "run-1",
+			agent: "workflow",
+			mode: "workflow",
+			runId: "run-1",
+			success: false,
+			summary: "worker:\nPatched billing.",
+			exitCode: 1,
+			results: [
+				{
+					runId: "child-1",
+					agent: "worker",
+					success: false,
+					watchdog: {
+						phase: "idle",
+						seq: 3,
+						lastUpdate: 1,
+						warnings: [
+							{ severity: "blocker", category: "test-gap", summary: "Claims tests passed without running them", evidence: "e", recommendedAction: "r", addressed: false, stalemate: false },
+							{ severity: "concern", category: "other", summary: "Concern is not listed", evidence: "e", recommendedAction: "r", addressed: true, stalemate: false },
+							{ severity: "blocker", category: "scope-drift", summary: "Kept editing after being told to stop", evidence: "e", recommendedAction: "r", addressed: false, stalemate: true },
+						],
+					},
+				},
+				{ runId: "child-2", agent: "reviewer", success: true, output: "clean" },
+			],
+			sessionId: "session-1",
+		});
+
+		assert.deepEqual(details.watchdogBlockers, [
+			{ agent: "worker", summary: "Claims tests passed without running them", addressed: false, stalemate: false },
+			{ agent: "worker", summary: "Kept editing after being told to stop", addressed: false, stalemate: true },
+		]);
+
+		const content = formatSingleCompletion(details);
+		assert.match(content, /\nWatchdog blockers:\n- worker: Claims tests passed without running them \(unaddressed\)\n- worker: Kept editing after being told to stop \(stalemate\)\n/);
+		const parsed = parseSubagentNotifyContent(content);
+		assert.deepEqual(parsed?.watchdogBlockers, details.watchdogBlockers);
+		assert.match(parsed?.resultPreview ?? "", /^worker:\nPatched billing\./);
+		assert.doesNotMatch(parsed?.resultPreview ?? "", /Watchdog blockers/);
+		assert.equal(parsed?.workflowRunId, "run-1");
+
+		const grouped = formatGroupedCompletion([details, { agent: "scout", status: "completed", resultPreview: "ok" }]);
+		assert.match(grouped, /Watchdog blockers:\n- worker: Claims tests passed without running them \(unaddressed\)/);
+		assert.equal(grouped.split("Watchdog blockers:").length, 2);
+
+	});
+});

package/dist/extensions/pi-subagents/test/unit/pi-args-permission-system.test.ts

@@ -56,7 +56,7 @@ afterEach(() => {
 function readPromptFile(result: { tempDir?: string }): string {
 	assert.ok(result.tempDir, "expected a temp dir from buildPiArgs");
 	const files = fs.readdirSync(result.tempDir);
-	const promptFile = files.find((f: string) => f.endsWith(".md"));
+	const promptFile = files.find((f: string) => f.endsWith(".md") && f !== "task.md");
 	assert.ok(promptFile, "expected a prompt.md file");
 	return fs.readFileSync(path.join(result.tempDir, promptFile), "utf-8");
 }

package/dist/extensions/pi-subagents/test/unit/pi-args.test.ts

@@ -16,6 +16,8 @@ import {
 } from "../../src/runs/shared/tool-budget.ts";
 import { WAIT_TOOL_DEFAULT_TIMEOUT_MS_ENV, WAIT_TOOL_ENABLED_ENV } from "../../src/runs/background/wait-config.ts";
 import { SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../src/shared/utils.ts";
+import { STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE_ENV, STRUCTURED_OUTPUT_ACCEPTANCE_REQUIRED_ENV } from "../../src/runs/shared/structured-output.ts";
+
 import {
 	CHILD_TOOL_DIAGNOSTIC_PATH_ENV,
 	MCP_DIRECT_CHILD_TOOLS_ENV,
@@ -46,6 +48,7 @@ import {
 	buildPiArgs,
 	projectLaunchResolvedChildExtensions,
 	resolvePiLaunchToolPlan,
+	shouldDeliverTaskViaFile,
 } from "../../src/runs/shared/pi-args.ts";
 
 const originalEnv = {
@@ -457,7 +460,6 @@ describe("buildPiArgs session wiring", () => {
 			inheritProjectContext: false,
 			inheritSkills: false,
 			childWatchdog: {
-				enabled: true,
 				runId: "run-1",
 				agent: "worker",
 				childIndex: 2,
@@ -465,15 +467,13 @@ describe("buildPiArgs session wiring", () => {
 				agentEndTimeoutMs: 500,
 				maxWarnings: 1,
 				lsp: { enabled: false, timeoutMs: 50, maxFiles: 2, maxDiagnostics: 3 },
-				autoFollowBlockers: true,
-				autoFollowMaxAttempts: 3,
 				stalemateRepeats: 2,
+				cadence: { everyNTools: null },
 			},
 		});
 		const encoded = withWatchdog.env[CHILD_WATCHDOG_CONFIG_ENV];
 		assert.equal(typeof encoded, "string");
 		assert.deepEqual(JSON.parse(encoded ?? "{}"), {
-			enabled: true,
 			runId: "run-1",
 			agent: "worker",
 			childIndex: 2,
@@ -481,10 +481,67 @@ describe("buildPiArgs session wiring", () => {
 			agentEndTimeoutMs: 500,
 			maxWarnings: 1,
 			lsp: { enabled: false, timeoutMs: 50, maxFiles: 2, maxDiagnostics: 3 },
-			autoFollowBlockers: true,
-			autoFollowMaxAttempts: 3,
 			stalemateRepeats: 2,
+			cadence: { everyNTools: null },
+		});
+	});
+});
+
+describe("excludeTools resolution", () => {
+	it("filters excluded names from explicit allowlists and runtime-injected tools", () => {
+		const plan = resolvePiLaunchToolPlan({
+			tools: ["read", "write"],
+			excludeTools: ["write", "structured_output"],
+			structuredOutput: true,
+		});
+		assert.deepEqual(plan.declaredBuiltinTools, ["read", "write"]);
+		assert.deepEqual(plan.excludeTools, ["write", "structured_output"]);
+		assert.deepEqual(plan.effectiveToolAllowlist, ["read"]);
+		assert.deepEqual(plan.internalTools, []);
+		assert.deepEqual(plan.requiredChildTools, ["read"]);
+
+		const built = buildPiArgs({
+			baseArgs: [],
+			task: "hello",
+			sessionEnabled: true,
+			inheritProjectContext: true,
+			inheritSkills: true,
+			tools: ["read", "write"],
+			excludeTools: ["write"],
+		});
+		assert.deepEqual(built.args.slice(0, 2), ["--tools", "read"]);
+		assert.equal(built.args.includes("--exclude-tools"), false);
+	});
+
+	it("forwards exclusions to Pi without inventing an ambient allowlist", () => {
+		const built = buildPiArgs({
+			baseArgs: [],
+			task: "hello",
+			sessionEnabled: true,
+			inheritProjectContext: true,
+			inheritSkills: true,
+			excludeTools: ["write", "unknown_tool"],
+		});
+		assert.deepEqual(built.args.slice(0, 2), ["--exclude-tools", "write,unknown_tool"]);
+		assert.equal(built.args.includes("--tools"), false);
+		assert.equal(built.args.includes("--no-tools"), false);
+	});
+
+	it("keeps empty tool sets all-off and makes excluded nested fanout unavailable", () => {
+		const empty = buildPiArgs({
+			baseArgs: [],
+			task: "hello",
+			sessionEnabled: true,
+			inheritProjectContext: true,
+			inheritSkills: true,
+			tools: [],
+			excludeTools: ["write"],
 		});
+		assert.equal(empty.args.includes("--no-tools"), true);
+		assert.equal(empty.args.includes("--exclude-tools"), false);
+
+		const plan = resolvePiLaunchToolPlan({ allowNestedSubagents: true, excludeTools: ["subagent"] });
+		assert.equal(plan.fanoutAuthorized, false);
 	});
 });
 
@@ -634,7 +691,7 @@ describe("buildPiArgs task delivery", () => {
 		return ref ? ref.slice(1) : undefined;
 	}
 
-	it("delivers short tasks inline by default", () => {
+	it("delivers short tasks through the platform default", () => {
 		const { args } = buildPiArgs({
 			baseArgs: ["-p"],
 			task: "hello",
@@ -643,8 +700,13 @@ describe("buildPiArgs task delivery", () => {
 			inheritSkills: false,
 		});
 
-		assert.ok(args.includes("Task: hello"));
-		assert.equal(taskFileFromArgs(args), undefined);
+		if (process.platform === "darwin") {
+			assert.ok(taskFileFromArgs(args), "expected an @task.md argv reference on macOS");
+			assert.ok(!args.includes("Task: hello"));
+		} else {
+			assert.ok(args.includes("Task: hello"));
+			assert.equal(taskFileFromArgs(args), undefined);
+		}
 	});
 
 	it("delivers tasks over the argv limit via a temp file by default", () => {
@@ -681,6 +743,7 @@ describe("buildPiArgs task delivery", () => {
 
 	it("falls back to auto when SELESAI_SUBAGENT_TASK_DELIVERY is invalid", () => {
 		process.env.SELESAI_SUBAGENT_TASK_DELIVERY = "carrier-pigeon";
+
 		const { args } = buildPiArgs({
 			baseArgs: ["-p"],
 			task: longTask,
@@ -706,6 +769,13 @@ describe("buildPiArgs task delivery", () => {
 		assert.ok(taskFileFromArgs(args), "expected an @task.md argv reference");
 		assert.ok(!args.includes("Task: hello"));
 	});
+
+	it("selects file delivery for macOS or over-limit tasks", () => {
+		assert.equal(shouldDeliverTaskViaFile("short", "auto", "darwin"), true);
+		assert.equal(shouldDeliverTaskViaFile("short", "auto", "linux"), false);
+		assert.equal(shouldDeliverTaskViaFile("short", "auto", "win32"), false);
+		assert.equal(shouldDeliverTaskViaFile("x".repeat(8001), "auto", "linux"), true);
+	});
 });
 
 describe("buildPiArgs system prompt mode wiring", () => {
@@ -974,6 +1044,27 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		assert.equal(env[CHILD_TOOL_DIAGNOSTIC_PATH_ENV], toolDiagnosticPath);
 	});
 
+	it("clears inherited tool diagnostics for nested zero-tool children", () => {
+		const inheritedDiagnosticPath = "/tmp/parent-tool-diagnostic.json";
+		const { env, toolDiagnosticPath } = buildPiArgs({
+			baseArgs: ["-p"],
+			task: "repair retained output",
+			sessionEnabled: false,
+			inheritProjectContext: false,
+			inheritSkills: false,
+			tools: [],
+		});
+		const spawnEnv = {
+			[REQUIRED_CHILD_TOOLS_ENV]: JSON.stringify(["read", "bash"]),
+			[CHILD_TOOL_DIAGNOSTIC_PATH_ENV]: inheritedDiagnosticPath,
+			...env,
+		};
+
+		assert.equal(toolDiagnosticPath, undefined);
+		assert.equal(spawnEnv[REQUIRED_CHILD_TOOLS_ENV], undefined);
+		assert.equal(spawnEnv[CHILD_TOOL_DIAGNOSTIC_PATH_ENV], undefined);
+	});
+
 	it("strips the legacy supervisor pairing from requirements", () => {
 		const { args, env } = buildPiArgs({
 			baseArgs: ["-p"],
@@ -1042,6 +1133,8 @@ describe("buildPiArgs system prompt mode wiring", () => {
 				schema: { type: "object", properties: {}, additionalProperties: false },
 				schemaPath: "/tmp/schema.json",
 				outputPath: "/tmp/output.json",
+				acceptanceReportPath: "/tmp/acceptance.json",
+				acceptanceReportRequired: true,
 			},
 		});
 
@@ -1054,6 +1147,18 @@ describe("buildPiArgs system prompt mode wiring", () => {
 			"fixture_search",
 			"structured_output",
 		]);
+		assert.equal(env[STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE_ENV], "/tmp/acceptance.json");
+		assert.equal(env[STRUCTURED_OUTPUT_ACCEPTANCE_REQUIRED_ENV], "1");
+	});
+
+	it("clears inherited acceptance capture for launches without outputSchema", () => {
+		const { env } = buildPiArgs({
+			baseArgs: ["-p"], task: "hello", sessionEnabled: false,
+			inheritProjectContext: false, inheritSkills: false,
+		});
+
+		assert.equal(env[STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE_ENV], undefined);
+		assert.equal(env[STRUCTURED_OUTPUT_ACCEPTANCE_REQUIRED_ENV], undefined);
 	});
 
 	it("forwards the Pi package root to child processes for host peer resolution", () => {
@@ -1267,7 +1372,8 @@ describe("buildPiArgs system prompt mode wiring", () => {
 		assert.deepEqual(requestedNames, [serverName, serverName]);
 		assert.equal(serverLaunch.args[serverLaunch.args.indexOf("--tools") + 1], "read,runtime-github_search_repositories,runtime-github_create_issue");
 		assert.equal(toolLaunch.args[toolLaunch.args.indexOf("--tools") + 1], "read,runtime-github_search_repositories");
-		assert.ok(serverLaunch.args.indexOf("--mcp-config") < serverLaunch.args.indexOf("Task: hello"));
+		const serverTaskArgIndex = serverLaunch.args.findIndex((arg) => arg === "Task: hello" || arg.endsWith("task.md"));
+		assert.ok(serverLaunch.args.indexOf("--mcp-config") < serverTaskArgIndex);
 		for (const launch of [serverLaunch, toolLaunch]) {
 			const configPath = launch.args[launch.args.indexOf("--mcp-config") + 1];
 			assert.ok(configPath);

package/dist/extensions/pi-subagents/test/unit/pi-spawn.test.ts

@@ -8,6 +8,7 @@ import {
 	resolvePiCliScript,
 	type SelesaiSpawnDeps,
 } from "../../src/runs/shared/pi-spawn.ts";
+import { SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../src/shared/utils.ts";
 
 function makeDeps(input: {
 	platform?: NodeJS.Platform;
@@ -73,6 +74,33 @@ describe("getPiSpawnCommand", () => {
 		assert.deepEqual(result, { command: "selesai", args });
 	});
 
+	for (const extension of ["js", "mjs", "cjs"] as const) {
+		it(`runs a Windows ${extension} SELESAI_SUBAGENT_SELESAI_BINARY override through Node`, () => {
+			const piBinary = `C:\\Program Files\\pi\\bin\\pi-cli.${extension}`;
+			const args = ["--mode", "json", "Task: check output"];
+			const result = getPiSpawnCommand(args, {
+				platform: "win32",
+				execPath: "C:\\Program Files\\nodejs\\node.exe",
+				env: { SELESAI_SUBAGENT_SELESAI_BINARY: piBinary },
+			});
+			assert.deepEqual(result, {
+				command: "C:\\Program Files\\nodejs\\node.exe",
+				args: [piBinary, ...args],
+			});
+		});
+	}
+
+	it("keeps a JavaScript SELESAI_SUBAGENT_SELESAI_BINARY override direct on POSIX", () => {
+		const piBinary = "/opt/pi/bin/pi-cli.mjs";
+		const args = ["--mode", "json", "Task: check output"];
+		const result = getPiSpawnCommand(args, {
+			platform: "darwin",
+			execPath: "/usr/local/bin/node",
+			env: { SELESAI_SUBAGENT_SELESAI_BINARY: piBinary },
+		});
+		assert.deepEqual(result, { command: piBinary, args });
+	});
+
 	for (const [platform, execPath] of [
 		["darwin", "/opt/selesai/selesai"],
 		["linux", "/opt/selesai/selesai"],
@@ -89,7 +117,8 @@ describe("getPiSpawnCommand", () => {
 				execPath,
 				argv1: "/missing/host.js",
 				packageJsonPath,
-				packageJsonContent: JSON.stringify({ bin: { selesai: "dist/cli.js" } }),
+				packageJsonContent: JSON.stringify({ name: "@selesai/code", bin: { selesai: "dist/cli.js" } }),
+
 				existing: [packageJsonPath, cliPath],
 			});
 			const args = ["--mode", "json", "-p", "Task: review diff"];
@@ -141,7 +170,8 @@ describe("getPiSpawnCommand", () => {
 			execPath: "/usr/local/bin/node",
 			argv1: "/opt/selesai/subagent-runner.ts",
 			packageJsonPath,
-			packageJsonContent: JSON.stringify({ bin: { selesai: "dist/cli/index.js" } }),
+			packageJsonContent: JSON.stringify({ name: "@selesai/code", bin: { selesai: "dist/cli/index.js" } }),
+
 			existing: [packageJsonPath, cliPath],
 		});
 		const args = ["-p", "Task: hello"];
@@ -152,7 +182,103 @@ describe("getPiSpawnCommand", () => {
 		});
 	});
 
+	it("fails closed until the Windows CLI script becomes available", () => {
+		const packageJsonPath = "/opt/pi/package.json";
+		const cliPath = path.resolve(
+			path.dirname(packageJsonPath),
+			"dist/cli/index.js",
+		);
+		let cliAvailable = false;
+		const deps = makeDeps({
+			platform: "win32",
+			execPath: "C:\\Program Files\\nodejs\\node.exe",
+			argv1: "/opt/pi-web/dist/server.js",
+			packageJsonPath,
+			packageJsonContent: JSON.stringify({ name: "@selesai/code", bin: { selesai: "dist/cli/index.js" } }),
+			existing: [packageJsonPath],
+		});
+		deps.existsSync = (filePath) =>
+			filePath === packageJsonPath || (cliAvailable && filePath === cliPath);
+		const args = ["-p", "Task: hello"];
+
+		assert.throws(
+			() => getPiSpawnCommand(args, deps),
+			/Could not resolve the Pi CLI on Windows/,
+		);
+		cliAvailable = true;
+		assert.deepEqual(getPiSpawnCommand(args, deps), {
+			command: "C:\\Program Files\\nodejs\\node.exe",
+			args: [cliPath, ...args],
+		});
+	});
+
+	it("resolves the Windows CLI from the forwarded package-root env for wrapper hosts", () => {
+		const packageJsonPath = "/opt/pi/package.json";
+		const cliPath = path.resolve(
+			path.dirname(packageJsonPath),
+			"dist/cli/index.js",
+		);
+		const args = ["-p", "Task: hello"];
+		const result = getPiSpawnCommand(args, {
+			platform: "win32",
+			execPath: "C:\\Program Files\\nodejs\\node.exe",
+			argv1: "/opt/pi-web/dist/server.js",
+			env: { [SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV]: "/opt/pi" },
+			existsSync: (filePath) => filePath === packageJsonPath || filePath === cliPath,
+			readFileSync: () => JSON.stringify({
+				name: "@selesai/code",
+				bin: { selesai: "dist/cli/index.js" },
+			}),
+		});
+
+		assert.deepEqual(result, {
+			command: "C:\\Program Files\\nodejs\\node.exe",
+			args: [cliPath, ...args],
+		});
+	});
+
+	it("skips an unverified forwarded package-root env before resolving a verified Pi package", () => {
+		const tempDir = fs.mkdtempSync(
+			path.join(os.tmpdir(), "pi-spawn-unverified-env-root-"),
+		);
+		try {
+			const wrongRoot = path.join(tempDir, "not-selesai");
+			const wrongCli = path.join(wrongRoot, "bin", "evil.js");
+			const selesaiRoot = path.join(tempDir, "node_modules", "@selesai", "code");
+			const selesaiEntry = path.join(selesaiRoot, "dist", "index.js");
+			const selesaiCli = path.join(selesaiRoot, "dist", "cli.js");
+			fs.mkdirSync(path.dirname(wrongCli), { recursive: true });
+			fs.mkdirSync(path.dirname(selesaiCli), { recursive: true });
+			fs.writeFileSync(wrongCli, "console.log('evil');\n");
+			fs.writeFileSync(path.join(wrongRoot, "package.json"), JSON.stringify({ name: "not-selesai", bin: { selesai: "bin/evil.js" } }));
+			fs.writeFileSync(selesaiEntry, "export {};\n");
+			fs.writeFileSync(selesaiCli, "#!/usr/bin/env node\n");
+			fs.writeFileSync(path.join(selesaiRoot, "package.json"), JSON.stringify({ name: "@selesai/code", bin: { selesai: "dist/cli.js" } }));
+
+			const result = getPiSpawnCommand(["-p", "Task: hello"], {
+				platform: "win32",
+				execPath: "C:\\Program Files\\nodejs\\node.exe",
+				argv1: "/opt/pi-web/dist/server.js",
+				// The Selesai host repo root is itself named @selesai/code, so
+				// resolvePiPackageRoot() would find it before the temp verified
+				// package; pin the verified temp package to keep the test
+				// deterministic while still exercising the unverified env root.
+				piPackageRoot: selesaiRoot,
+				env: { [SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV]: wrongRoot },
+				resolvePackageEntry: () => selesaiEntry,
+			});
+
+			assert.deepEqual(result, {
+				command: "C:\\Program Files\\nodejs\\node.exe",
+				args: [selesaiCli, "-p", "Task: hello"],
+			});
+		} finally {
+			fs.rmSync(tempDir, { recursive: true, force: true });
+		}
+	});
+
 	it("falls back to plain selesai command on POSIX when CLI script cannot be resolved", () => {
+
 		const args = ["--mode", "json", "Task: check output"];
 		const result = getPiSpawnCommand(args, {
 			platform: "darwin",
@@ -281,7 +407,8 @@ describe("getPiSpawnCommand", () => {
 			execPath: "/usr/local/bin/node",
 			argv1: "/opt/selesai/subagent-runner.ts",
 			packageJsonPath,
-			packageJsonContent: JSON.stringify({ bin: { selesai: "dist/cli/index.js" } }),
+			packageJsonContent: JSON.stringify({ name: "@selesai/code", bin: { selesai: "dist/cli/index.js" } }),
+
 			existing: [packageJsonPath, cliPath],
 		});
 		const result = getPiSpawnCommand(["-p", "Task: hello"], deps);
@@ -289,16 +416,6 @@ describe("getPiSpawnCommand", () => {
 		assert.equal(result.args[0], cliPath);
 	});
 
-	it("falls back to selesai when Windows CLI script cannot be resolved", () => {
-		const deps = makeDeps({
-			platform: "win32",
-			argv1: "/opt/selesai/subagent-runner.ts",
-			existing: [],
-		});
-		const args = ["-p", "Task: hello"];
-		const result = getPiSpawnCommand(args, deps);
-		assert.deepEqual(result, { command: "selesai", args });
-	});
 
 	it("walks from package main entry to resolve package bin", () => {
 		const tempDir = fs.mkdtempSync(
@@ -334,8 +451,8 @@ describe("getPiSpawnCommand", () => {
 	});
 });
 
-describe("getPiSpawnCommand with selesaiPackageRoot", () => {
-	it("resolves CLI script via selesaiPackageRoot when argv1 is not runnable", () => {
+describe("getPiSpawnCommand with piPackageRoot", () => {
+	it("resolves CLI script via piPackageRoot when argv1 is not runnable", () => {
 		const packageJsonPath = "/opt/selesai/package.json";
 		const cliPath = path.resolve(
 			path.dirname(packageJsonPath),
@@ -346,10 +463,11 @@ describe("getPiSpawnCommand with selesaiPackageRoot", () => {
 			execPath: "/usr/local/bin/node",
 			argv1: "/opt/selesai/subagent-runner.ts",
 			packageJsonPath,
-			packageJsonContent: JSON.stringify({ bin: { selesai: "dist/cli/index.js" } }),
+			packageJsonContent: JSON.stringify({ name: "@selesai/code", bin: { selesai: "dist/cli/index.js" } }),
+
 			existing: [packageJsonPath, cliPath],
 		});
-		deps.selesaiPackageRoot = "/opt/pi";
+		deps.piPackageRoot = "/opt/pi";
 		const result = getPiSpawnCommand(["-p", "Task: hello"], deps);
 		assert.equal(result.command, "/usr/local/bin/node");
 		assert.equal(result.args[0], cliPath);
@@ -367,7 +485,7 @@ describe("resolvePiCliScript", () => {
 			platform: "win32",
 			argv1: "/opt/selesai/subagent-runner.ts",
 			packageJsonPath,
-			packageJsonContent: JSON.stringify({ bin: "dist/cli/index.mjs" }),
+			packageJsonContent: JSON.stringify({ name: "@selesai/code", bin: "dist/cli/index.mjs" }),
 			existing: [packageJsonPath, cliPath],
 		});
 		assert.equal(resolvePiCliScript(deps), cliPath);

package/dist/extensions/pi-subagents/test/unit/preflight.test.ts

@@ -804,6 +804,26 @@ Project prompt.
 		assert.ok(result.contract.tools.extensionArgs.includes("/tmp/subagent-only.ts"));
 	});
 
+	it("projects per-agent tool exclusions and binds them into launch identity", async () => {
+		const cwd = path.join(tempDir, "exclude-tools-repo");
+		fs.mkdirSync(cwd, { recursive: true });
+		writeAgent(path.join(cwd, ".selesai", "agents", "worker.md"), `---
+name: worker
+description: Project worker
+tools: read, write
+excludeTools: write, unknown_tool
+---
+Project prompt.
+`);
+
+		const result = await resolveSubagentLaunchContract({ agent: "worker", cwd, task: "Inspect" });
+		assert.equal(result.ok, true);
+		if (!result.ok) return;
+		assert.deepEqual(result.contract.tools.excludeTools, ["write", "unknown_tool"]);
+		assert.deepEqual(result.contract.tools.effectiveAllowlist, ["read"]);
+		assert.match(result.contract.launchContractDigest, /^[a-f0-9]{64}$/);
+	});
+
 	it("falls back implicit default fork to fresh when the parent session is not forkable", async () => {
 		const cwd = path.join(tempDir, "repo-implicit-fork");
 		fs.mkdirSync(cwd, { recursive: true });