@selesai/code 0.13.15 → 0.13.18

package/dist/extensions/pi-subagents/src/runs/shared/tool-availability.ts

@@ -1,10 +1,3 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-export const REQUIRED_CHILD_TOOLS_ENV = "SELESAI_SUBAGENT_REQUIRED_TOOLS";
-export const MCP_DIRECT_CHILD_TOOLS_ENV = "SELESAI_SUBAGENT_MCP_DIRECT_TOOLS";
-export const CHILD_TOOL_DIAGNOSTIC_PATH_ENV = "SELESAI_SUBAGENT_TOOL_DIAGNOSTIC_PATH";
-
 export interface ChildToolDiagnostic {
 	agent?: string;
 	required: string[];
@@ -13,53 +6,25 @@ export interface ChildToolDiagnostic {
 	missingMcpDirectTools?: string[];
 }
 
-export function writeChildToolDiagnostic(
-	filePath: string,
-	required: string[],
-	available: string[],
-	agent?: string,
-	mcpDirectTools?: string[],
-): ChildToolDiagnostic | undefined {
-	const availableNames = new Set(available);
-	const missing = required.filter((name) => !availableNames.has(name));
-	if (missing.length === 0) {
-		fs.rmSync(filePath, { force: true });
-		return undefined;
-	}
-
-	const missingMcpDirectTools = mcpDirectTools?.length
-		? missing.filter((name) => mcpDirectTools.includes(name))
-		: [];
-	const diagnostic: ChildToolDiagnostic = {
-		agent,
-		required,
-		available,
-		missing,
-		...(missingMcpDirectTools.length > 0 ? { missingMcpDirectTools } : {}),
-	};
-	fs.mkdirSync(path.dirname(filePath), { recursive: true });
-	fs.writeFileSync(filePath, JSON.stringify(diagnostic), { mode: 0o600 });
-	return diagnostic;
-}
-
-export function readChildToolDiagnostic(filePath: string | undefined): ChildToolDiagnostic | undefined {
-	if (!filePath || !fs.existsSync(filePath)) return undefined;
-	const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8")) as Partial<ChildToolDiagnostic>;
-	const stringArray = (value: unknown): value is string[] => Array.isArray(value) && value.every((entry) => typeof entry === "string" && entry.length > 0);
-	if (!stringArray(parsed.required) || !stringArray(parsed.available) || !stringArray(parsed.missing) || (parsed.agent !== undefined && typeof parsed.agent !== "string") || (parsed.missingMcpDirectTools !== undefined && !stringArray(parsed.missingMcpDirectTools))) {
-		throw new Error(`Malformed child tool diagnostic at '${filePath}'.`);
-	}
-	return {
-		...(parsed.agent ? { agent: parsed.agent } : {}),
-		required: parsed.required,
-		available: parsed.available,
-		missing: parsed.missing,
-		...(parsed.missingMcpDirectTools ? { missingMcpDirectTools: parsed.missingMcpDirectTools } : {}),
-	};
-}
-
-export function formatChildToolDiagnostic(diagnostic: ChildToolDiagnostic): string {
+/**
+ * Explain missing child tools. Foreground children run inside the parent
+ * process and never load the parent's ambient extensions, so tools an ambient
+ * extension registers (MCP tools, provider tools) only exist for background
+ * children; the diagnostic says so instead of reporting a generic gap.
+ */
+export function formatChildToolDiagnostic(diagnostic: ChildToolDiagnostic, options: { host?: "parent" | "runner" } = {}): string {
 	const subject = diagnostic.agent ? `Agent '${diagnostic.agent}'` : "Subagent";
+	if (options.host === "parent") {
+		return [
+			`${subject} ran as a foreground child, which never loads the parent's ambient extensions, and these child tools were unavailable: ${diagnostic.missing.join(", ")}.`,
+			"The `tools` field is a strict allowlist; it does not load extension code.",
+			...(diagnostic.missingMcpDirectTools?.length
+				? [`MCP direct tools missing from the child registry: ${diagnostic.missingMcpDirectTools.join(", ")}.`]
+				: []),
+			"Agents that need MCP tools (`mcpDirectTools`, or MCP tools from an ambient adapter such as pi-mcp-adapter) or models from a provider extension must run as background children (`async: true`), which load the ambient extensions.",
+			"For extension tools a foreground child can load, add the provider path to `subagentOnlyExtensions` (child-only), `extensions`, or as a path-like entry in `tools`, while keeping each registered tool name in `tools`.",
+		].join("\n");
+	}
 	return [
 		`${subject} requested unavailable child tools: ${diagnostic.missing.join(", ")}.`,
 		"The `tools` field is a strict allowlist; it does not load extension code.",
@@ -70,12 +35,3 @@ export function formatChildToolDiagnostic(diagnostic: ChildToolDiagnostic): stri
 		"For MCP tools, verify the MCP adapter configuration and selected tool names. For builtin tools, verify the name against the installed Pi version.",
 	].join("\n");
 }
-
-export function readChildToolDiagnosticError(filePath: string | undefined): string | undefined {
-	try {
-		const diagnostic = readChildToolDiagnostic(filePath);
-		return diagnostic ? formatChildToolDiagnostic(diagnostic) : undefined;
-	} catch (error) {
-		return `Failed to read child tool availability diagnostic: ${error instanceof Error ? error.message : String(error)}`;
-	}
-}

package/dist/extensions/pi-subagents/src/runs/shared/tool-budget.ts

@@ -1,8 +1,6 @@
 import type { ResolvedToolBudget, ToolBudgetConfig, ToolBudgetState } from "../../shared/types.ts";
 
 export const DEFAULT_TOOL_BUDGET_BLOCK = ["read", "grep", "find", "ls"] as const;
-export const TOOL_BUDGET_ENV = "SELESAI_SUBAGENT_TOOL_BUDGET";
-export const TOOL_BUDGET_ZERO_AUTH_ENV = "SELESAI_SUBAGENT_TOOL_BUDGET_ZERO_AUTH";
 
 export function normalizeToolBudgetBlock(block: ToolBudgetConfig["block"] | undefined): "*" | string[] {
 	if (block === "*") return "*";
@@ -66,15 +64,3 @@ export function toolBudgetSoftNudge(budget: ResolvedToolBudget, toolCount: numbe
 export function toolBudgetBlockedMessage(budget: ResolvedToolBudget, toolName: string, toolCount: number): string {
 	return `Tool budget hard limit reached after ${toolCount} tool call${toolCount === 1 ? "" : "s"} (hard ${budget.hard}). The '${toolName}' tool is blocked so you can finalize from the context you already have.`;
 }
-
-export function encodeToolBudgetEnv(budget: ResolvedToolBudget | undefined): string | undefined {
-	return budget ? JSON.stringify(budget) : undefined;
-}
-
-export function decodeToolBudgetEnv(value: string | undefined, options: { allowZero?: boolean } = {}): ResolvedToolBudget | undefined {
-	if (!value?.trim()) return undefined;
-	const parsed = JSON.parse(value) as unknown;
-	const normalized = validateToolBudgetConfig(parsed, TOOL_BUDGET_ENV, options.allowZero ? { minimumHard: 0 } : undefined);
-	if (normalized.error) throw new Error(normalized.error);
-	return normalized.budget;
-}

package/dist/extensions/pi-subagents/src/runs/shared/worktree-cleanup-plan.ts

@@ -13,7 +13,9 @@ import type {
 	ParallelHandoffGroup,
 	ParallelHandoffManifest,
 } from "../../shared/types.ts";
+import { getAgentDir } from "../../shared/utils.ts";
 import { isTerminalParallelHandoffChildStatus } from "./parallel-handoff.ts";
+import { MACHINE_DIFF_OPTIONS, validateWorktreePatchRepresentsCurrentWorktree } from "./worktree.ts";
 
 export const WORKTREE_CLEANUP_PLAN_VERSION = 1 as const;
 export const WORKTREE_CLEANUP_PLAN_TTL_MS = 30 * 60 * 1000;
@@ -244,11 +246,24 @@ function resolveRepoRoot(repo: string): string {
 }
 
 function resolveCleanupBaseDir(repoRoot: string, configuredBaseDir: string | undefined): string {
-	const raw = configuredBaseDir ?? process.env.SELESAI_SUBAGENTS_WORKTREE_DIR ?? os.tmpdir();
-	const trimmed = raw.trim();
-	if (!trimmed) throw new Error("worktree base directory cannot be empty");
-	const expanded = trimmed.startsWith("~/") ? path.join(os.homedir(), trimmed.slice(2)) : trimmed;
-	return path.resolve(path.isAbsolute(expanded) ? expanded : path.resolve(repoRoot, expanded));
+	const raw = configuredBaseDir ?? process.env.SELESAI_SUBAGENTS_WORKTREE_DIR;
+	let dedicatedRoot: string;
+	if (raw === undefined || (configuredBaseDir === undefined && !raw.trim())) {
+		dedicatedRoot = path.join(path.dirname(repoRoot), "worktrees");
+	} else {
+		const trimmed = raw.trim();
+		if (!trimmed) throw new Error("worktree base directory cannot be empty");
+		const expanded = trimmed.startsWith("~/") ? path.join(os.homedir(), trimmed.slice(2)) : trimmed;
+		dedicatedRoot = path.isAbsolute(expanded) ? expanded : path.resolve(repoRoot, expanded);
+	}
+	return path.resolve(path.join(dedicatedRoot, path.basename(repoRoot)));
+}
+
+function cleanupContainmentInvalid(repoRoot: string, projectDir: string): boolean {
+	const extensionsDir = path.join(getAgentDir(), "extensions");
+	return samePath(projectDir, repoRoot)
+		|| pathInside(repoRoot, projectDir, true)
+		|| pathInside(extensionsDir, projectDir);
 }
 
 export function parseGitWorktreeList(raw: string): GitWorktreeRecord[] {
@@ -558,7 +573,7 @@ function resolveBranchTip(repoRoot: string, branch: string): { value?: string; e
 	return { value: result.stdout.trim() };
 }
 
-function isPatchCaptured(record: ManifestMetadataRecord, worktreePath: string): { path?: string; error?: string } {
+function isPatchCaptured(record: ManifestMetadataRecord, worktreePath: string, baseCommit: string): { path?: string; error?: string } {
 	const patchPath = metadataPatchPath(record);
 	if (!patchPath || record.child.patch?.error !== undefined || record.child.patch?.changed !== true) return {};
 	const inspection = inspectPath(patchPath);
@@ -573,12 +588,15 @@ function isPatchCaptured(record: ManifestMetadataRecord, worktreePath: string):
 	if (!patchStat.isFile()) return { error: "captured handoff patch is not a file" };
 	if (pathInside(worktreePath, inspection.realpath)) return { error: "durable handoff patch lives inside the worktree" };
 	if (patchStat.size <= 0) return { error: "captured handoff patch is empty" };
+	const validationError = validateWorktreePatchRepresentsCurrentWorktree(worktreePath, baseCommit, patchPath);
+	if (validationError) return { error: `captured handoff patch failed validation: ${validationError}` };
 	return { path: patchPath };
 }
 
 function buildManagedEntry(input: {
 	repoRoot: string;
 	baseDir: string;
+	containmentInvalid: boolean;
 	targetHead: string;
 	rootPath: string;
 	git: GitWorktreeRecord;
@@ -605,7 +623,9 @@ function buildManagedEntry(input: {
 	if (pathInspection.missing) return blockedEntry(entry, "stale", "unknown", "worktree path is missing from disk");
 	if (pathInspection.symlink) return blockedEntry(entry, "unknown", "unknown", "worktree path is a symlink; cleanup requires a real directory");
 	if (!pathInspection.directory || !pathInspection.realpath) return blockedEntry(entry, "unknown", "unknown", "worktree path is not a directory");
-	if (!pathInside(baseDir, pathInspection.realpath, true)) return blockedEntry(entry, "ineligible", "keep", `worktree real path is outside configured base directory '${baseDir}'`);
+	const extensionsDir = path.join(getAgentDir(), "extensions");
+	if (pathInside(extensionsDir, pathInspection.realpath)) return blockedEntry(entry, "ineligible", "keep", `worktree real path is inside Pi extensions directory '${extensionsDir}'`);
+	if (input.containmentInvalid || !pathInside(baseDir, pathInspection.realpath, true)) return blockedEntry(entry, "ineligible", "keep", `worktree real path is outside configured base directory '${baseDir}'`);
 
 	if (rootPath === comparablePath(pathInspection.realpath)) return blockedEntry(entry, "ineligible", "keep", "worktree is the repository root");
 	if (!git.branch) return blockedEntry(entry, "unknown", "unknown", "detached worktrees have no metadata-recorded branch");
@@ -648,14 +668,14 @@ function buildManagedEntry(input: {
 	entry.preconditions.statusDigest = status.digest;
 	if (status.output && status.output.trim()) return blockedEntry(entry, "dirty", "keep", "worktree has uncommitted or untracked changes");
 
-	const diff = runGit(worktreePath, ["diff", "--quiet", resolvedBase.value, "--"]);
+	const diff = runGit(worktreePath, ["diff", "--quiet", ...MACHINE_DIFF_OPTIONS, resolvedBase.value, "--"]);
 	if (diff.status !== 0 && diff.status !== 1) return blockedEntry(entry, "unknown", "unknown", `git diff safety check failed: ${gitFailure(diff, "git diff")}`);
 	const ancestor = runGit(repoRoot, ["merge-base", "--is-ancestor", git.head, targetHead]);
 	if (ancestor.status !== 0 && ancestor.status !== 1) return blockedEntry(entry, "unknown", "unknown", `local merge safety check failed: ${gitFailure(ancestor, "git merge-base --is-ancestor")}`);
 	const branchTipIsAncestor = ancestor.status === 0;
 	let divergenceSafe = diff.status === 0;
 	if (!divergenceSafe) {
-		const captured = isPatchCaptured(record, worktreePath);
+		const captured = isPatchCaptured(record, worktreePath, resolvedBase.value);
 		if (captured.error) return blockedEntry(entry, "ineligible", "keep", captured.error);
 		if (captured.path) {
 			entry.patchPath = captured.path;
@@ -725,6 +745,7 @@ export function buildWorktreeCleanupPlan(input: BuildWorktreeCleanupPlanInput):
 	const now = input.now ?? Date.now();
 	if (!Number.isFinite(now)) throw new Error("worktree cleanup plan timestamp must be finite");
 	const baseDir = resolveCleanupBaseDir(repoRoot, input.worktreeBaseDir);
+	const containmentInvalid = cleanupContainmentInvalid(repoRoot, baseDir);
 	const gitRecords = listGitWorktrees(repoRoot);
 	const targetHead = runGitChecked(repoRoot, ["rev-parse", "HEAD"]);
 	const rootPath = comparablePath(repoRoot);
@@ -749,6 +770,7 @@ export function buildWorktreeCleanupPlan(input: BuildWorktreeCleanupPlanInput):
 		else entries.push(buildManagedEntry({
 			repoRoot,
 			baseDir,
+			containmentInvalid,
 			targetHead,
 			rootPath,
 			git,

package/dist/extensions/pi-subagents/src/runs/shared/worktree-setup-command.ts

@@ -0,0 +1,190 @@
+import { spawn } from "node:child_process";
+import { createOwnedProcessTreeController } from "../background/owned-process-tree.ts";
+import type { ProcessTreeTerminal } from "../../shared/types.ts";
+
+export interface SetupCommandOptions {
+	cwd?: string;
+	env?: NodeJS.ProcessEnv;
+	input?: string;
+	/** Worktrunk uses 128 KiB; Git and hooks use spawnSync's 1 MiB default. */
+	maxBuffer?: number;
+	signal?: AbortSignal;
+	deadlineAt?: number;
+	/** Only the existing configured setup-hook timeout, not a new Git budget. */
+	hookTimeoutMs?: number;
+	/** Read-only probes may define negative answers as completed commands. */
+	acceptedExitCodes?: readonly number[];
+	onSpawn?: (process: { pid: number; processGroupId?: number }) => void;
+}
+
+export interface SetupCommandResult {
+	stdout: string;
+	stderr: string;
+	status: number | null;
+	signal: NodeJS.Signals | null;
+	error?: Error;
+	pid?: number;
+	processGroupId?: number;
+	/** Absent on normal completion: trusted command completion is NOT tree proof. */
+	processTree?: ProcessTreeTerminal;
+	outputIncomplete: boolean;
+}
+
+function commandError(message: string, code: string): NodeJS.ErrnoException {
+	return Object.assign(new Error(message), { code });
+}
+
+/**
+ * Setup I/O only. Commands must await their descendants before reporting success.
+ * Exit 0 + natural close + complete output still requires caller JSON/path validation.
+ * Invalid output is NOT accepted completion: retain unknown ownership, never signal
+ * this completed command's PID later. Callers own compensation and admission.
+ */
+export async function runSetupCommand(
+	command: string,
+	args: string[],
+	options: SetupCommandOptions,
+): Promise<SetupCommandResult> {
+	const result: SetupCommandResult = {
+		stdout: "", stderr: "", status: null, signal: null, outputIncomplete: false,
+	};
+	const maxBuffer = options.maxBuffer ?? 1024 * 1024;
+	if (!Number.isSafeInteger(maxBuffer) || maxBuffer <= 0) throw new Error("Invalid setup command maxBuffer");
+	if (options.deadlineAt !== undefined && !Number.isFinite(options.deadlineAt)) throw new Error("Invalid setup deadline");
+	if (options.hookTimeoutMs !== undefined && (!Number.isSafeInteger(options.hookTimeoutMs) || options.hookTimeoutMs <= 0)) {
+		throw new Error("Invalid setup hook timeout");
+	}
+	const cancellation = (): Error | undefined => {
+		if (options.signal?.aborted) return commandError("Worktree setup aborted", "ABORT_ERR");
+		if (options.deadlineAt !== undefined && Date.now() >= options.deadlineAt) {
+			return commandError("Worktree setup deadline exceeded", "ETIMEDOUT");
+		}
+		return undefined;
+	};
+	result.error = cancellation();
+	if (result.error) return result;
+
+	let child;
+	try {
+		child = spawn(command, args, {
+			cwd: options.cwd,
+			env: options.env ? { ...process.env, ...options.env } : process.env,
+			stdio: "pipe", shell: false, windowsHide: true,
+			// Isolated owned POSIX group, never unref'd or fire-and-forget.
+			detached: process.platform !== "win32",
+		});
+	} catch (error) {
+		result.error = error instanceof Error ? error : new Error(String(error));
+		return result;
+	}
+	result.pid = child.pid;
+	if (child.pid !== undefined && process.platform !== "win32") result.processGroupId = child.pid;
+	const tree = child.pid === undefined ? undefined : createOwnedProcessTreeController(child.pid);
+	let termination: Promise<ProcessTreeTerminal> | undefined;
+	let directSettled = false;
+	const releaseUnknownIO = () => {
+		if (!directSettled || result.processTree?.state !== "unknown") return;
+		result.error ??= commandError("Worktree setup process tree settlement is unverified", "PROCESS_TREE_UNVERIFIED");
+		result.outputIncomplete = true;
+		// Only local I/O is released; unknown descendant ownership remains retained.
+		child.stdin.destroy();
+		child.stdout.destroy();
+		child.stderr.destroy();
+	};
+	const terminate = () => {
+		if (termination || !tree) return;
+		if (directSettled) {
+			result.processTree = {
+				state: "unknown", reason: "verification-failed",
+				diagnostic: "Command exited before termination began; no longer safe to signal its recorded PID.",
+			};
+			releaseUnknownIO();
+			return;
+		}
+		termination = tree.terminate().then((proof) => {
+			result.processTree = proof;
+			releaseUnknownIO();
+			return proof;
+		});
+	};
+	const fail = (error: Error) => {
+		result.error ??= error;
+		terminate();
+	};
+	const onAbort = () => fail(commandError("Worktree setup aborted", "ABORT_ERR"));
+	const stdout: Buffer[] = [];
+	const stderr: Buffer[] = [];
+	let capturedBytes = 0;
+	const capture = (chunks: Buffer[], chunk: Buffer) => {
+		const remaining = maxBuffer - capturedBytes;
+		if (remaining > 0) {
+			const saved = Buffer.from(chunk.subarray(0, remaining));
+			chunks.push(saved);
+			capturedBytes += saved.length;
+		}
+		if (chunk.length > remaining) {
+			result.outputIncomplete = true;
+			fail(commandError("Worktree setup command output exceeds maxBuffer", "ENOBUFS"));
+		}
+	};
+	const onStdout = (chunk: Buffer) => capture(stdout, chunk);
+	const onStderr = (chunk: Buffer) => capture(stderr, chunk);
+	child.stdout.on("data", onStdout);
+	child.stderr.on("data", onStderr);
+	child.stdin.on("error", fail);
+	const close = new Promise<void>((resolve) => child.once("close", () => resolve()));
+	const directExit = new Promise<void>((resolve) => {
+		child.once("exit", (status, signal) => {
+			directSettled = true;
+			result.status = status;
+			result.signal = signal;
+			if (status === null || !(options.acceptedExitCodes ?? [0]).includes(status)) terminate();
+			releaseUnknownIO();
+			resolve();
+		});
+		child.once("error", (error) => {
+			fail(error);
+			// A failed spawn has no direct process to await. Other errors do not prove exit.
+			if (child.pid === undefined) {
+				directSettled = true;
+				resolve();
+			}
+		});
+	});
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const deadlineAt = Math.min(options.deadlineAt ?? Infinity,
+		options.hookTimeoutMs === undefined ? Infinity : Date.now() + options.hookTimeoutMs);
+	const armDeadline = () => {
+		if (deadlineAt === Infinity) return;
+		const remaining = deadlineAt - Date.now();
+		if (remaining <= 0) fail(commandError("Worktree setup command timed out", "ETIMEDOUT"));
+		else timer = setTimeout(armDeadline, Math.min(remaining, 2 ** 31 - 1));
+	};
+	options.signal?.addEventListener("abort", onAbort, { once: true });
+	try {
+		armDeadline();
+		if (options.signal?.aborted) onAbort();
+		if (child.pid !== undefined) {
+			try { options.onSpawn?.({ pid: child.pid, processGroupId: result.processGroupId }); }
+			catch (error) { fail(error instanceof Error ? error : new Error(String(error))); }
+		}
+		child.stdin.end(options.input);
+		await directExit;
+		if (termination) result.processTree = await termination;
+		releaseUnknownIO();
+		await close;
+		// Abort/overflow may arrive while draining stdio after direct exit.
+		if (termination) result.processTree = await termination;
+		const cancelled = cancellation();
+		if (cancelled) fail(cancelled);
+		result.stdout = Buffer.concat(stdout).toString("utf8");
+		result.stderr = Buffer.concat(stderr).toString("utf8");
+		return result;
+	} finally {
+		if (timer) clearTimeout(timer);
+		options.signal?.removeEventListener("abort", onAbort);
+		child.stdout.removeListener("data", onStdout);
+		child.stderr.removeListener("data", onStderr);
+		child.stdin.removeListener("error", fail);
+	}
+}