@selesai/code 0.13.16 → 0.13.19

package/dist/extensions/pi-subagents/src/runs/shared/readonly-session-evidence.ts

@@ -0,0 +1,307 @@
+/** Internal, opt-in factory evidence. No runner enables continuation through this module. */
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import type { AgentSession, SessionEntry, SessionHeader } from "@selesai/code";
+import type { ChildSession, ChildSessionLaunch, PiCodingAgentModule } from "./child-session.ts";
+import { captureReadonlyChildDrain, isReadonlyChildHookProfile, isReadonlyChildSessionReporting, observeReadonlyChildHookDrain } from "./child-hooks.ts";
+
+type Runtime = Awaited<ReturnType<PiCodingAgentModule["ModelRuntime"]["create"]>>;
+type Model = NonNullable<AgentSession["model"]>;
+
+export interface SettledReadonlyEvidence {
+	readonly sessionFile: string;
+	readonly sessionId: string;
+	readonly leafId: string;
+	readonly provider: string;
+	readonly model: string;
+	readonly api: string;
+	readonly status: 429;
+	/** Complete active context, not the host's attempt-only event projection. */
+	readonly contextJson: string;
+	readonly completedToolResults: number;
+	readonly fileDigest: string;
+}
+
+const requested = new WeakMap<ChildSessionLaunch, SettledReadonlyEvidence | null>();
+const receipts = new WeakMap<ChildSession, SettledReadonlyEvidence>();
+// Opaque configured-provider continuity, never an implementation-origin attestation.
+const providers = new WeakMap<SettledReadonlyEvidence, object>();
+
+/** Internal integration seam: opt in before factory creation. Ordinary launches do no evidence I/O. */
+export function requestReadonlySessionEvidence(launch: ChildSessionLaunch, expected?: SettledReadonlyEvidence): void {
+	requested.set(launch, expected ?? null);
+}
+
+/** Only the default factory can produce a receipt; duck-typed fake child properties are ignored. */
+export function getReadonlySessionEvidence(child: ChildSession): SettledReadonlyEvidence | undefined {
+	return receipts.get(child);
+}
+
+function digest(bytes: string): string {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+
+function absent(file: string): boolean {
+	try { lstatSync(file); return false; }
+	catch (error) { return (error as NodeJS.ErrnoException).code === "ENOENT"; }
+}
+
+function sameStored(disk: unknown, live: unknown): boolean {
+	// The SDK keeps optional undefined fields in memory which JSONL intentionally omits.
+	return isDeepStrictEqual(disk, JSON.parse(JSON.stringify(live)));
+}
+
+/** Must run before opening a retained file. Never repairs, truncates, or creates it. */
+export function validateReadonlySessionCheckpoint(evidence: SettledReadonlyEvidence): boolean {
+	if (!providers.has(evidence)) return false;
+	try { return digest(readFileSync(evidence.sessionFile, "utf8")) === evidence.fileDigest; }
+	catch { return false; }
+}
+
+function readHistory(file: string): { header: SessionHeader; entries: SessionEntry[]; bytes: string } {
+	const bytes = readFileSync(file, "utf8");
+	if (!bytes.endsWith("\n")) throw new Error("Incomplete session file");
+	const rows = bytes.slice(0, -1).split("\n").map((line) => JSON.parse(line));
+	const [header, ...entries] = rows;
+	if (header?.type !== "session" || header.version !== 3 || typeof header.id !== "string" || !header.id || typeof header.cwd !== "string" || !entries.length) throw new Error("Unsupported session header");
+	const ids = new Set<string>();
+	for (const entry of entries) {
+		if (!entry || typeof entry.id !== "string" || !entry.id || ids.has(entry.id) || typeof entry.type !== "string" || typeof entry.timestamp !== "string" || (entry.parentId !== null && !ids.has(entry.parentId))) throw new Error("Broken session chain");
+		ids.add(entry.id);
+	}
+	return { header, entries, bytes };
+}
+
+function activeMessages(branch: SessionEntry[]): AgentSession["messages"] {
+	const messages = branch.flatMap((entry) => {
+		if (entry.type === "message") return [entry.message];
+		// Compaction/branch summaries and custom context need their own proof; do not reconstruct them.
+		if (!["model_change", "thinking_level_change", "session_info", "label"].includes(entry.type)) throw new Error("Unsupported active context");
+		return [];
+	});
+	// Snapshot the persisted representation, not mutable SDK message references.
+	return JSON.parse(JSON.stringify(messages));
+}
+
+function completedResults(messages: AgentSession["messages"]): number {
+	const pending = new Map<string, string>();
+	const seen = new Set<string>();
+	let completed = 0;
+	for (const message of messages) {
+		if (message.role === "toolResult") {
+			if (typeof message.toolCallId !== "string" || !pending.has(message.toolCallId) || pending.get(message.toolCallId) !== message.toolName || !Array.isArray(message.content)) throw new Error("Unmatched tool result");
+			pending.delete(message.toolCallId);
+			if (!message.isError && message.content.length) completed++;
+		} else {
+			if (pending.size) throw new Error("Unresolved tool call");
+			if (message.role === "assistant") {
+				if (!Array.isArray(message.content)) throw new Error("Invalid assistant content");
+				for (const block of message.content) {
+					if (block.type !== "toolCall") continue;
+					if (!block.id || typeof block.id !== "string" || seen.has(block.id) || !["read", "ls"].includes(block.name)) throw new Error("Uncertified tool call");
+					seen.add(block.id);
+					pending.set(block.id, block.name);
+				}
+			} else if (message.role !== "user") throw new Error("Unsupported context message");
+		}
+	}
+	if (pending.size) throw new Error("Unresolved tool call");
+	return completed;
+}
+
+function eligibleLaunch(launch: ChildSessionLaunch): boolean {
+	const r = launch.runtime;
+	return launch.ambientExtensions === false && !launch.extensionPaths.length
+		&& isReadonlyChildSessionReporting(launch)
+		&& (!launch.hooks.length || (launch.storage.kind === "file" && isReadonlyChildHookProfile(launch.hooks, r)))
+		&& launch.tools !== undefined && launch.tools.every((tool) => tool === "read" || tool === "ls")
+		&& !r.toolBudget && !r.permissions && !r.childWatchdog && !r.watchdogStatus && !r.structuredOutput
+		&& !r.waitTool.enabled && !r.fanoutChild && !r.fast && !r.nestedRoute && !r.nestedParent && !r.runFanoutBudget
+		&& !r.supervisorChannelDir && !r.mcpDirectTools?.length;
+}
+
+export interface ReadonlyEvidenceObserver {
+	start(): void;
+	settled(): void;
+	invalidate(): void;
+	beforeShutdown(): void;
+	finish(child: ChildSession): void;
+}
+
+/** Called only on the explicit opt-in path, before SessionManager.open can permissively repair input. */
+export function prepareReadonlySessionEvidence(launch: ChildSessionLaunch): { loadingHooks(enabled: boolean): void; beforeOpen(): void; opened(manager: AgentSession["sessionManager"]): void; observe(pi: PiCodingAgentModule, runtime: Runtime, session: AgentSession): ReadonlyEvidenceObserver | undefined } | undefined {
+	if (!requested.has(launch)) return undefined;
+	const expected = requested.get(launch);
+	requested.delete(launch);
+	const deny = (): undefined => {
+		if (expected) throw new Error("Unsupported read-only continuation session");
+		return undefined;
+	};
+	const checkExpected = (): void => {
+		if (expected && (launch.storage.kind !== "file" || resolve(launch.storage.sessionFile) !== expected.sessionFile || !validateReadonlySessionCheckpoint(expected))) throw new Error("Read-only continuation checkpoint changed");
+	};
+	checkExpected();
+	if (!eligibleLaunch(launch) || launch.storage.kind !== "file") return deny();
+	const file = resolve(launch.storage.sessionFile);
+	// Only an initially absent *assigned exact file* may use SDK initialization.
+	// Empty files, dangling symlinks, inaccessible and corrupt inputs are not fresh.
+	let fresh = !expected && absent(file);
+	let initialHeader: SessionHeader | undefined;
+	try { if (!fresh) initialHeader = readHistory(file).header; }
+	catch { return deny(); }
+	const beforeOpen = (): void => {
+		checkExpected();
+		if (fresh) fresh = absent(file);
+	};
+	const opened = (manager: AgentSession["sessionManager"]): void => {
+		if (fresh && manager.getSessionFile() === file && manager.getEntries().length === 0 && manager.getLeafId() === null) {
+			// Capture the real SDK-generated identity immediately after open, before hooks.
+			initialHeader = JSON.parse(JSON.stringify(manager.getHeader()));
+		}
+	};
+	const observe = (pi: PiCodingAgentModule, runtime: Runtime, session: AgentSession): ReadonlyEvidenceObserver | undefined => {
+		const drainSettled = captureReadonlyChildDrain(launch.hooks);
+		// A deliberately tested capability floor, not an attestation of installed code origin.
+		if (!initialHeader || pi.VERSION !== "0.85.1" || !session.model || !session.agent.streamFunction) return deny();
+		const header = initialHeader;
+		const model = { ...session.model };
+		const provider = runtime.getProvider(model.provider);
+		if (expected && provider !== providers.get(expected)) return deny();
+		// Coverage is namespace/API plus the observed POST topology below, not builtin provider origin.
+		const supported = (m: Model): boolean => m.provider === "baseten" && m.api === "openai-completions"
+			&& runtime.getProvider(m.provider) === provider
+			&& !runtime.getRegisteredNativeProvider(m.provider) && !runtime.getRegisteredProviderConfig(m.provider);
+		const allowed = launch.tools!.filter((name) => !launch.excludeTools?.includes(name)).sort();
+		const toolsMatch = (): boolean => {
+			const tools = session.getAllTools();
+			return isDeepStrictEqual(session.getActiveToolNames().sort(), allowed)
+				&& isDeepStrictEqual(tools.map((tool) => tool.name).sort(), allowed)
+				&& tools.every((tool) => tool.sourceInfo?.source === "builtin");
+		};
+		const idle = (): boolean => session.isIdle && !session.isRetrying && !session.agent.hasQueuedMessages()
+			&& session.agent.state.pendingToolCalls.size === 0 && !session.hasPendingBashMessages;
+		const continuity = (): boolean => eligibleLaunch(launch) && toolsMatch() && session.model !== undefined
+			&& session.model.id === model.id && session.model.provider === model.provider && session.model.api === model.api && supported(session.model);
+		const history = () => {
+			const disk = readHistory(file);
+			const manager = session.sessionManager;
+			const leaf = manager.getLeafId();
+			if (session.sessionFile !== file || session.sessionId !== header.id || !leaf || leaf !== disk.entries.at(-1)?.id
+				|| !isDeepStrictEqual(disk.header, header) || !sameStored(disk.header, manager.getHeader())
+				|| !sameStored(disk.entries, manager.getEntries())) throw new Error("Session checkpoint mismatch");
+			// The disk chain and live entries already agree; use the SDK's raw branch walk.
+			const messages = activeMessages(manager.getBranch());
+			if (!sameStored(messages, session.messages)) throw new Error("Incomplete active context");
+			return { ...disk, messages, leaf, completed: completedResults(messages) };
+		};
+		const startingHistory = () => {
+			// SDK defers persistence until its first assistant response. This exception
+			// is for the empty source baseline only; settlement always reads strict disk history.
+			if (fresh && absent(file)) {
+				const manager = session.sessionManager;
+				if (session.sessionFile !== file || session.sessionId !== header.id || !sameStored(header, manager.getHeader())
+					|| session.messages.length
+					|| manager.getEntries().some((entry) => !["model_change", "thinking_level_change", "session_info", "label"].includes(entry.type))) throw new Error("Fresh session initialization changed");
+				return { messages: [] as AgentSession["messages"], completed: 0 };
+			}
+			return history();
+		};
+		if (!provider || !eligibleLaunch(launch) || !supported(model) || !toolsMatch() || !idle()) return deny();
+		try {
+			const restored = startingHistory();
+			if (expected && (model.provider !== expected.provider || JSON.stringify(restored.messages) !== expected.contextJson)) throw new Error("Restored continuation context changed");
+		} catch (error) {
+			if (expected) throw error;
+			return undefined;
+		}
+		let invalid = false;
+		let phase: "new" | "running" | "settled" = "new";
+		let owner: ChildSession | undefined;
+		let baseline = 0;
+		let before: AgentSession["messages"] = [];
+		let inFlight = 0;
+		type Invocation = { status?: number; pending: number; ambiguous: boolean; result?: Awaited<ReturnType<Awaited<ReturnType<typeof session.agent.streamFunction>>["result"]>> };
+		let latest: Invocation | undefined;
+		const original = session.agent.streamFunction;
+		const wrapped: typeof original = async (m, context, options) => {
+			const invocation: Invocation = { pending: 0, ambiguous: false };
+			latest = invocation;
+			if (inFlight++ || phase !== "running" || !eligibleLaunch(launch) || !supported(m) || m.id !== model.id || !toolsMatch()) invalid = true;
+			if (expected && (!continuity() || session.agent.streamFunction !== wrapped)) invalid = true;
+			// The repository's older agent-core types omit this documented 0.85.1 request option.
+			const transport = (options as (typeof options & { fetch?: typeof fetch }))?.fetch ?? globalThis.fetch;
+			const observedFetch: typeof fetch = async (...args) => {
+				invocation.status = undefined; // Starting even a rejected retry invalidates any earlier 429.
+				if (invocation.pending++ || invocation.result) invocation.ambiguous = true;
+				try {
+					try {
+						const [input, init] = args;
+						const url = new URL(input instanceof Request ? input.url : String(input));
+						// Only the tested completions POST topology. Radius /messages and auxiliary requests deny.
+						if (init?.method !== "POST" || !url.pathname.endsWith("/chat/completions") || typeof init.body !== "string") invocation.ambiguous = true;
+					} catch { invocation.ambiguous = true; }
+					const response = await transport(...args);
+					invocation.status = response.status;
+					return response;
+				} catch (error) {
+					invocation.status = undefined;
+					throw error;
+				} finally { invocation.pending--; }
+			};
+			try {
+				// Guarded continuations must veto known changes before entering configured SDK dispatch.
+				if (expected && invalid) throw new Error("Read-only continuation changed before dispatch");
+				const stream = await original.call(session.agent, m, context, { ...options, fetch: observedFetch });
+				// Observe result without consuming or replacing the event stream.
+				void stream.result().then((result) => {
+					invocation.result = result;
+					inFlight--;
+				}, () => { invalid = true; inFlight--; });
+				return stream;
+			} catch (error) { invalid = true; inFlight--; throw error; }
+		};
+		session.agent.streamFunction = wrapped;
+		return {
+			start() {
+				if (owner) receipts.delete(owner);
+				if (phase !== "new" || !idle()) invalid = true;
+				if (expected && (!continuity() || session.agent.streamFunction !== wrapped)) invalid = true;
+				phase = "running";
+				latest = undefined;
+				try {
+					const h = startingHistory(); baseline = h.completed; before = h.messages;
+					if (expected && JSON.stringify(h.messages) !== expected.contextJson) invalid = true;
+				} catch { invalid = true; }
+				if (expected && invalid) throw new Error("Read-only continuation changed before prompt");
+			},
+			settled() { phase = "settled"; },
+			invalidate() { invalid = true; if (owner) receipts.delete(owner); },
+			beforeShutdown() {
+				// Only the identity-certified prompt runtime may finalize owned acknowledgements.
+				if (!launch.hooks.length || !continuity()) invalid = true;
+			},
+			finish(child) {
+				owner = child;
+				if (!drainSettled()) return;
+				if (invalid || child.detached || child.shutDown || phase !== "settled" || inFlight || !eligibleLaunch(launch) || !idle() || !supported(model) || !toolsMatch() || session.agent.streamFunction !== wrapped
+					|| session.model?.id !== model.id || session.model.provider !== model.provider || session.model.api !== model.api) return;
+				const invocation = latest;
+				const terminal = invocation?.result;
+				if (!invocation || invocation.ambiguous || invocation.pending || invocation.status !== 429 || terminal?.stopReason !== "error"
+					|| terminal.content.length || terminal.provider !== model.provider || terminal.model !== model.id || terminal.api !== model.api) return;
+				try {
+					const h = history();
+					if (h.completed <= baseline || !isDeepStrictEqual(h.messages.slice(0, before.length), before) || !sameStored(h.messages.at(-1), terminal)) return;
+					const receipt: SettledReadonlyEvidence = Object.freeze({ sessionFile: file, sessionId: session.sessionId, leafId: h.leaf,
+						provider: model.provider, model: model.id, api: model.api, status: 429, contextJson: JSON.stringify(h.messages),
+						completedToolResults: h.completed, fileDigest: digest(h.bytes) });
+					providers.set(receipt, provider);
+					receipts.set(child, receipt);
+				} catch { /* Strict checkpoint failures only deny evidence; never repair storage. */ }
+			},
+		};
+	};
+	return { beforeOpen, opened, observe, loadingHooks: (enabled) => observeReadonlyChildHookDrain(launch.hooks, enabled, file) };
+}

package/dist/extensions/pi-subagents/src/runs/shared/run-fanout-budget.ts

@@ -9,17 +9,16 @@ import {
 	type RunFanoutRejection,
 } from "../../shared/types.ts";
 
-export const RUN_FANOUT_BUDGET_ENV = "SELESAI_SUBAGENT_RUN_FANOUT_BUDGET";
 const RUN_FANOUT_ROOT = path.join(TEMP_ROOT_DIR, "run-fanout-budgets");
 
-interface ManifestV1 {
+interface FanoutBudgetManifest {
 	version: 1;
 	rootRunId: string;
 	limit: number;
 	createdAt: number;
 }
 
-interface ClaimV1 {
+interface FanoutBudgetClaim {
 	version: 1;
 	claimId: string;
 	path: string;
@@ -42,16 +41,16 @@ function safeRootRunId(rootRunId: string): string {
 	return rootRunId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 120) || randomUUID();
 }
 
-function parseManifest(value: unknown): ManifestV1 | undefined {
+function parseManifest(value: unknown): FanoutBudgetManifest | undefined {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
-	const manifest = value as Partial<ManifestV1>;
+	const manifest = value as Partial<FanoutBudgetManifest>;
 	if (manifest.version !== 1 || typeof manifest.rootRunId !== "string" || !manifest.rootRunId
 		|| !Number.isInteger(manifest.limit) || (manifest.limit ?? 0) <= 0
 		|| typeof manifest.createdAt !== "number" || !Number.isFinite(manifest.createdAt)) return undefined;
-	return manifest as ManifestV1;
+	return manifest as FanoutBudgetManifest;
 }
 
-function readManifest(directory: string): ManifestV1 {
+function readManifest(directory: string): FanoutBudgetManifest {
 	let parsed: unknown;
 	try {
 		parsed = JSON.parse(fs.readFileSync(path.join(directory, "manifest.json"), "utf-8"));
@@ -85,7 +84,7 @@ export function createRunFanoutBudget(rootRunId: string, limit: number): RunFano
 	do directory = path.join(RUN_FANOUT_ROOT, `${safeRootRunId(rootRunId)}-${randomUUID()}`);
 	while (fs.existsSync(directory));
 	fs.mkdirSync(path.join(directory, "claims"), { recursive: true, mode: 0o700 });
-	const manifest: ManifestV1 = { version: 1, rootRunId, limit, createdAt: Date.now() };
+	const manifest: FanoutBudgetManifest = { version: 1, rootRunId, limit, createdAt: Date.now() };
 	fs.writeFileSync(path.join(directory, "manifest.json"), `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: "wx" });
 	return { version: 1, rootRunId, directory, limit };
 }
@@ -124,18 +123,6 @@ export function readRunFanoutBudgetDescriptor(asyncDir: string | undefined): Run
 	}
 }
 
-export function encodeRunFanoutBudgetDescriptor(descriptor: RunFanoutBudgetDescriptor): string {
-	return Buffer.from(JSON.stringify(validateRunFanoutBudgetDescriptor(descriptor)), "utf-8").toString("base64url");
-}
-
-export function decodeRunFanoutBudgetDescriptor(encoded: string | undefined): RunFanoutBudgetDescriptor | undefined {
-	if (!encoded) return undefined;
-	try {
-		return validateRunFanoutBudgetDescriptor(JSON.parse(Buffer.from(encoded, "base64url").toString("utf-8")));
-	} catch (error) {
-		throw new Error(`Invalid inherited run fan-out budget: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
 
 interface AdmissionLockOwner {
 	pid: number;
@@ -243,7 +230,7 @@ function commitRunFanoutBatch<T>(descriptor: RunFanoutBudgetDescriptor, paths: s
 						const fd = fs.openSync(slotPath, "wx", 0o600);
 						created.push(slotPath);
 						try {
-							const claim: ClaimV1 = { version: 1, claimId: randomUUID(), path: claimPath, claimedAt: Date.now() };
+							const claim: FanoutBudgetClaim = { version: 1, claimId: randomUUID(), path: claimPath, claimedAt: Date.now() };
 							fs.writeFileSync(fd, `${JSON.stringify(claim)}\n`, "utf-8");
 						} finally { fs.closeSync(fd); }
 						break;

package/dist/extensions/pi-subagents/src/runs/shared/runtime-acknowledged-extensions.ts

@@ -1,13 +1,8 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import type { RuntimeAcknowledgedChildExtensionsV1 } from "../../shared/types.ts";
+import type { RuntimeAcknowledgedChildExtensions } from "../../shared/types.ts";
 
 export const RUNTIME_EXTENSION_ACK_EVENT = "subagent:acknowledge-extension";
-export const RUNTIME_EXTENSION_ACK_PATH_ENV = "SELESAI_SUBAGENT_RUNTIME_ACKNOWLEDGED_EXTENSIONS";
 export const MAX_RUNTIME_ACKNOWLEDGED_EXTENSION_IDS = 32;
 export const MAX_RUNTIME_ACKNOWLEDGED_EXTENSION_ID_LENGTH = 128;
-// Generous bound for a valid capture (32 ids x 128 chars plus envelope); larger files are child misbehavior.
-export const MAX_RUNTIME_ACKNOWLEDGED_EXTENSION_FILE_BYTES = 64 * 1024;
 
 export function isRuntimeAcknowledgedExtensionId(value: unknown): value is string {
 	return typeof value === "string"
@@ -19,7 +14,7 @@ export function isRuntimeAcknowledgedExtensionId(value: unknown): value is strin
 		&& !value.includes("\\");
 }
 
-export function projectRuntimeAcknowledgedExtensions(ids: Iterable<unknown>): RuntimeAcknowledgedChildExtensionsV1 | undefined {
+export function projectRuntimeAcknowledgedExtensions(ids: Iterable<unknown>): RuntimeAcknowledgedChildExtensions | undefined {
 	const unique: string[] = [];
 	const seen = new Set<string>();
 	for (const id of ids) {
@@ -36,7 +31,7 @@ export function projectRuntimeAcknowledgedExtensions(ids: Iterable<unknown>): Ru
 	};
 }
 
-export function sanitizeRuntimeAcknowledgedExtensions(value: unknown): RuntimeAcknowledgedChildExtensionsV1 | undefined {
+export function sanitizeRuntimeAcknowledgedExtensions(value: unknown): RuntimeAcknowledgedChildExtensions | undefined {
 	if (!value || typeof value !== "object") return undefined;
 	const raw = value as Record<string, unknown>;
 	if (raw.version !== 1 || raw.source !== "child-runtime" || !Array.isArray(raw.ids)) return undefined;
@@ -47,25 +42,3 @@ export function sanitizeRuntimeAcknowledgedExtensions(value: unknown): RuntimeAc
 		: 0;
 	return { ...projected, omitted: projected.omitted + omitted };
 }
-
-export function readRuntimeAcknowledgedExtensions(filePath: string | undefined): RuntimeAcknowledgedChildExtensionsV1 | undefined {
-	if (!filePath) return undefined;
-	try {
-		if (fs.statSync(filePath).size > MAX_RUNTIME_ACKNOWLEDGED_EXTENSION_FILE_BYTES) return undefined;
-		const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8")) as unknown;
-		return sanitizeRuntimeAcknowledgedExtensions(parsed);
-	} catch {
-		return undefined;
-	}
-}
-
-export function writeRuntimeAcknowledgedExtensions(filePath: string, ids: Iterable<unknown>): void {
-	const projection = projectRuntimeAcknowledgedExtensions(ids);
-	try {
-		fs.mkdirSync(path.dirname(filePath), { recursive: true });
-		if (projection) fs.writeFileSync(filePath, JSON.stringify(projection), { mode: 0o600 });
-		else fs.rmSync(filePath, { force: true });
-	} catch {
-		// Runtime acknowledgement is best-effort observability only.
-	}
-}

package/dist/extensions/pi-subagents/src/runs/shared/structured-output.ts

@@ -7,10 +7,6 @@ import { SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../shared/utils.ts";
 import type { JsonSchemaObject } from "../../shared/types.ts";
 import type { ResolvedAcceptanceReportMode } from "./acceptance.ts";
 
-export const STRUCTURED_OUTPUT_SCHEMA_ENV = "SELESAI_SUBAGENT_STRUCTURED_OUTPUT_SCHEMA";
-export const STRUCTURED_OUTPUT_CAPTURE_ENV = "SELESAI_SUBAGENT_STRUCTURED_OUTPUT_CAPTURE";
-export const STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE_ENV = "SELESAI_SUBAGENT_STRUCTURED_OUTPUT_ACCEPTANCE_CAPTURE";
-export const STRUCTURED_OUTPUT_ACCEPTANCE_REQUIRED_ENV = "SELESAI_SUBAGENT_STRUCTURED_OUTPUT_ACCEPTANCE_REQUIRED";
 export const MISSING_STRUCTURED_OUTPUT_CALL_ERROR = "Missing structured_output call; this step has outputSchema and must finish by calling structured_output.";
 export const MISSING_STRUCTURED_ACCEPTANCE_REPORT_ERROR = "Missing acceptanceReport in structured_output call; acceptance.report is \"on\".";
 
@@ -200,6 +196,23 @@ export function readStructuredOutputAcceptanceReport(runtime: StructuredOutputRu
 	}
 }
 
+/**
+ * Capture callback that persists the structured output (and acceptance report)
+ * to the runtime's files, for hosts that read the value back from disk.
+ */
+export function createStructuredOutputFileCapture(runtime: StructuredOutputRuntime): (value: unknown, acceptanceReport: unknown | undefined) => void {
+	return (value, acceptanceReport) => {
+		fs.mkdirSync(path.dirname(runtime.outputPath), { recursive: true });
+		if (runtime.acceptanceReportPath && acceptanceReport !== undefined) {
+			fs.mkdirSync(path.dirname(runtime.acceptanceReportPath), { recursive: true });
+			fs.writeFileSync(runtime.acceptanceReportPath, JSON.stringify(acceptanceReport), { mode: 0o600 });
+		} else if (runtime.acceptanceReportPath && fs.existsSync(runtime.acceptanceReportPath)) {
+			fs.unlinkSync(runtime.acceptanceReportPath);
+		}
+		fs.writeFileSync(runtime.outputPath, JSON.stringify(value), { mode: 0o600 });
+	};
+}
+
 export function clearStructuredOutputCaptures(runtime: StructuredOutputRuntime): string | undefined {
 	let cleanupError: string | undefined;
 	for (const filePath of [runtime.outputPath, runtime.acceptanceReportPath]) {

package/dist/extensions/pi-subagents/src/runs/shared/subagent-control.ts

@@ -138,6 +138,7 @@ export function buildControlEvent(input: {
 	tokens?: number;
 	toolCount?: number;
 	currentTool?: string;
+	toolCallId?: string;
 	currentToolDurationMs?: number;
 	currentPath?: string;
 	elapsedMs?: number;
@@ -170,6 +171,7 @@ export function buildControlEvent(input: {
 		...(input.tokens !== undefined ? { tokens: input.tokens } : {}),
 		...(input.toolCount !== undefined ? { toolCount: input.toolCount } : {}),
 		...(input.currentTool ? { currentTool: input.currentTool } : {}),
+		...(input.toolCallId ? { toolCallId: input.toolCallId } : {}),
 		...(input.currentToolDurationMs !== undefined ? { currentToolDurationMs: input.currentToolDurationMs } : {}),
 		...(input.currentPath ? { currentPath: input.currentPath } : {}),
 		...(elapsedMs !== undefined ? { elapsedMs } : {}),