@selesai/code 0.13.3 → 0.13.4

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to `@selesai/code` will be documented in this file.
 
+## [0.13.4] - 2026-08-31
+
+### Added
+- **Bundled `pi-subagents` 0.60.0.** `subagent({ action: "list", capabilities: true })` returns a compact prompt-free capability catalog (`details.catalog`: agent name, description, source, runner, tools/model/execution/output/extensions snapshot, executable and restriction status), and `list` results stay human text. Forked children now stamp an OpenAI-compatible `prompt_cache_key` (`pi-fork:<sha256>`) on provider requests for prompt-cache reuse; timeout recovery evidence (report status, changed tracked files, dirty-worktree classification) is projected into async status and `subagent_wait` completions; `runs.lanes` lane plans (stages, phase, label, structured output) are emitted and rendered as workflow-graph stages; `runs.host` rejects per-step `cwd` with a hint; watchdog repo signatures skip untracked scans for home-root and entry-less repos; single-output snapshots propagate non-ENOENT stat errors; background processes use `windowsHide` and detached-only-on-unix.
+- **Bundled `pi-web-agent` 1.10.0.** Search backends: You.com (`YDC_API_KEY`), Exa (`EXA_API_KEY`), Tavily (`TAVILY_API_KEY`) in addition to DuckDuckGo, SearXNG and Brave; search fanout across configured providers with dedupe/agreement ranking (`backends.search.fanout` with `off`/`on`/`auto` modes and provider selection); keyless Tavily fallback when DuckDuckGo is bot-blocked (disable with `PI_WEB_AGENT_DISABLE_KEYLESS_FALLBACK=1`); DuckDuckGo hardened against bot-walls (browser headers + one retry); GitHub/PDF/YouTube direct readers wired into the fetch path; canonical URL normalization (tracking-param stripping); the model tool result now carries the full synthesized findings/sources/caveats regardless of terminal presentation.
+- **GLM-5.3 models in the default catalog.** Added `glm-5.3` (GLM-5.3) to the bundled `tokenin` provider and upgraded `glm-5.3-flash` to text+image input with a full `thinkingLevelMap`.
+
+### Changed
+- **Cost reconciliation keys every streamed response id.** Streamed bodies repeat the response id across chunks and carry tool-call ids (`call_*`), so the fetch wrapper now keys the billed cost by every id found and `message_end` consumes only the one matching the finalized message's `responseId`; a duplicate capture (retry) is marked ambiguous instead of assigning either bill.
+- **Bundled `pi-intercom` 0.12.1.** During a turn triggered by an inbound ask, a non-`reply` `send` to a different target is refused so guessed parent/root CWD cannot receive an accidental reply; the `toolVisibility` setting and `after-first-use` reveal path were removed (the generic `intercom` tool stays in the active tool set for prompt-cache stability; obsolete `toolVisibility` config keys are ignored).
+
 ## [0.13.3] - 2026-08-31
 
 ### Added

package/dist/defaults/models.json

@@ -224,7 +224,23 @@
           "id": "glm-5.3-flash",
           "name": "GLM-5.3 Flash",
           "reasoning": true,
-          "input": ["text"],
+          "input": ["text", "image"],
+          "contextWindow": 1000000,
+          "maxTokens": 64000,
+          "thinkingLevelMap": {
+            "minimal": null,
+            "low": "low",
+            "medium": null,
+            "high": "high",
+            "xhigh": null,
+            "max": "max"
+          }
+        },
+        {
+          "id": "glm-5.3",
+          "name": "GLM-5.3",
+          "reasoning": true,
+          "input": ["text", "image"],
           "contextWindow": 1000000,
           "maxTokens": 64000,
           "thinkingLevelMap": {

package/dist/extensions/cost-reconcile.test.ts

@@ -180,17 +180,36 @@ describe("live assistant usage reconciliation", () => {
 		expect(result.message.usage.cost.total).toBe(0);
 	});
 
-	it("falls back when a captured body has multiple candidate response ids", async () => {
-		const responseId = "live-ambiguous-response-3";
-		installFetch(
-			`data: {"id":"${responseId}","usage":{"cost":0.0123},"tool_calls":[{"id":"tool-ambiguous-3"}]}\n\n`,
-		);
+	it("reconciles a tool-call stream: keys cost by every id, message_end consumes the matching one", async () => {
+		const responseId = "live-toolcall-3";
+		const body =
+			`data: {"id":"${responseId}","choices":[{"delta":{"tool_calls":[{"id":"call_abc123","function":{"name":"bash","arguments":""}}]}}]}\n\n` +
+			`data: {"id":"${responseId}","usage":{"cost":0.0123}}\n\n` +
+			"data: [DONE]\n\n";
+		installFetch(body);
 		const { appendEntry, handlers } = createHarness();
 		await startSession(handlers);
 
 		const response = await globalThis.fetch("https://gateway.example/v1/chat/completions");
 		await response.text();
 		const message = assistantMessage(responseId);
+		const result = await handlers.get("message_end")!({ message }, {});
+		expect(result.message.usage.cost.total).toBe(0.0123);
+		expect(appendEntry).toHaveBeenCalledWith(
+			"cost-reconcile",
+			expect.objectContaining({ provider: "openrouter", responseId, cost: 0.0123, source: "payload" }),
+		);
+	});
+
+	it("does not apply a captured cost to a message whose id was not in the body", async () => {
+		const body = `data: {"id":"other-response","usage":{"cost":0.0123}}\n\ndata: [DONE]\n\n`;
+		installFetch(body);
+		const { appendEntry, handlers } = createHarness();
+		await startSession(handlers);
+
+		const response = await globalThis.fetch("https://gateway.example/v1/chat/completions");
+		await response.text();
+		const message = assistantMessage("unrelated-message");
 		expect(await handlers.get("message_end")!({ message }, {})).toBeUndefined();
 		expect(message.usage.cost.total).toBe(0.75);
 		expect(appendEntry).not.toHaveBeenCalled();

package/dist/extensions/cost-reconcile.ts

@@ -16,8 +16,11 @@
  * finishes capture before the provider SDK finalizes its assistant message, so
  * `message_end` can replace `usage.cost.total` before session persistence.
  *
- * Providers whose payloads carry no cost retain their rate-card estimate.
- * Reconciled entries remain persisted for zentui and existing-session
+ * Streamed bodies repeat the response id across chunks and also carry
+ * tool-call ids (`call_*`), so the billed cost is keyed by every id found and
+ * `message_end` consumes only the one matching the finalized message's
+ * `responseId`. Providers whose payloads carry no cost retain their rate-card
+ * estimate. Reconciled entries remain persisted for zentui and existing-session
  * compatibility.
  */
 
@@ -146,11 +149,15 @@ export default function costReconcileExtension(pi: ExtensionAPI): void {
 		// LiteLLM's header is the amount the gateway billed; prefer it over any
 		// cost the upstream payload reports.
 		const effectiveCost = headerCost ?? cost;
-		// A cost must identify exactly one response. Applying it to every `id` in
-		// a body can mistake nested tool/message ids for the assistant response.
-		if (effectiveCost === undefined || ids.length !== 1) return;
-		const responseId = ids[0]!;
-		processCaptured.set(responseId, processCaptured.has(responseId) ? null : effectiveCost);
+		if (effectiveCost === undefined || ids.length === 0) return;
+		// A streamed response repeats its own id across chunks while tool-call
+		// ids (`call_*`) appear once, so a body legitimately carries several ids.
+		// Key the billed cost by every id; message_end consumes only the one
+		// matching the finalized message's responseId. A duplicate capture of the
+		// same id (retry) is marked ambiguous rather than assigning either bill.
+		for (const responseId of ids) {
+			processCaptured.set(responseId, processCaptured.has(responseId) ? null : effectiveCost);
+		}
 		if (processCaptured.size > 500) {
 			for (const key of [...processCaptured.keys()].slice(0, processCaptured.size - 500))
 				processCaptured.delete(key);

package/dist/extensions/pi-intercom/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.12.1] - 2026-08-29
+
+### Highlights
+- Replies to inbound asks are now harder to send to the wrong local session by mistake.
+- The `intercom` tool now stays in the active tool set, which avoids a late-session prompt-cache reset when intercom first becomes useful.
+- Existing configs that still mention `toolVisibility` keep loading; the old setting is simply ignored.
+
+### Fixed
+- Refuse non-reply `send` calls to a different target during a turn triggered by an inbound ask, preventing CWD hierarchy or roster guesses from misdirecting replies. Thanks to [@yceachan](https://github.com/yceachan) for issue #117.
+
+### Removed
+- Removed `toolVisibility` and the `after-first-use` reveal path. The generic `intercom` schema and prompt snippet now stay stable for provider prompt caches, and existing `toolVisibility` config keys are ignored. Thanks to [@XWIlluDelu](https://github.com/XWIlluDelu) for issue #118.
+
 ## [0.12.0] - 2026-08-22
 
 ### Highlights

package/dist/extensions/pi-intercom/README.md

@@ -218,7 +218,7 @@ This matters because the agent receiving the message doesn't need to reconstruct
 
 ### `send` vs `ask`
 
-`send` is fire-and-forget — the tool returns immediately after delivery. When the destination has exactly one pending inbound ask, `send` infers that it is the answer, attaches the ask's `replyTo`, and reports `Reply sent to <target> (inferred from pending ask)`. With zero or multiple matching asks, it remains an ordinary unthreaded send. An inferred answer still uses the `confirmSend` dialog when configured; only a caller-supplied `replyTo` skips confirmation.
+`send` is fire-and-forget — the tool returns immediately after delivery. When the destination has exactly one pending inbound ask, `send` infers that it is the answer, attaches the ask's `replyTo`, and reports `Reply sent to <target> (inferred from pending ask)`. During a turn triggered by an inbound ask, `send` refuses a different non-reply target instead of treating CWD, roster position, or project hierarchy as reply authority. With zero or multiple matching asks, it remains an ordinary unthreaded send. An inferred answer still uses the `confirmSend` dialog when configured; only a caller-supplied `replyTo` skips confirmation.
 
 `ask` requires a currently connected recipient, then blocks until it responds (10-minute timeout by default; set `PI_INTERCOM_ASK_TIMEOUT_MS` to a positive millisecond value to change it). If the target is disconnected, `ask` fails immediately; use `send` when queued, non-blocking mailbox delivery is appropriate. The reply comes back as the tool result, so the agent continues in the same turn with full context. No confirmation dialog — if you're asking and waiting, the intent is clear.
 
@@ -366,7 +366,7 @@ Only registered in sessions where `pi-subagents` supplied the required child bri
 
 **`list`** — Returns the current session plus other active intercom-connected sessions with name, short ID, working directory, model, and live status. Status is derived automatically from Selesai lifecycle events: `idle`, `thinking`, or `tool:<name>`.
 
-**`send`** — Sends a message to the specified session and returns immediately after delivery. If the destination has exactly one pending inbound ask, `send` infers the message is its answer and returns `Reply sent to <target> (inferred from pending ask)`; zero or multiple matches remain unthreaded sends. Set `confirmSend: true` to confirm ordinary and inferred sends. A caller-supplied `replyTo` skips confirmation. `to` alone resolves globally across all live sessions. `cwd` alone targets the sole live peer in that directory. `to` plus `cwd` requires that peer to be in the directory. With `openProjectPaneIfMissing: true`, pi-intercom opens a visible Herdr project pane, starts Selesai there, waits for that session to register, then delivers the message through normal intercom routing.
+**`send`** — Sends a message to the specified session and returns immediately after delivery. If the destination has exactly one pending inbound ask, `send` infers the message is its answer and returns `Reply sent to <target> (inferred from pending ask)`. During a turn triggered by an inbound ask, a non-reply `send` to a different target is rejected so a guessed parent/root CWD cannot receive an accidental reply. Zero or multiple pending-ask matches remain unthreaded sends outside the active ask turn. Set `confirmSend: true` to confirm ordinary and inferred sends. A caller-supplied `replyTo` skips confirmation. `to` alone resolves globally across all live sessions. `cwd` alone targets the sole live peer in that directory. `to` plus `cwd` requires that peer to be in the directory. With `openProjectPaneIfMissing: true`, pi-intercom opens a visible Herdr project pane, starts Selesai there, waits for that session to register, then delivers the message through normal intercom routing.
 
 **`ask`** — Requires a currently connected recipient, sends a message, and waits for the recipient to reply (10-minute timeout by default; configurable with `PI_INTERCOM_ASK_TIMEOUT_MS`). A disconnected target fails immediately rather than queueing a blocking request. The reply is returned as the tool result. No confirmation dialog. Only one pending `ask` is allowed per session at a time. Use this when the agent needs the answer to continue working. The same `to`, `cwd`, and `openProjectPaneIfMissing` targeting rules apply.
 
@@ -397,7 +397,6 @@ Create `~/.selesai/agent/intercom/config.json`:
   "brokerArgs": ["--no-install", "tsx"],
   "confirmSend": false,
   "inboundTrigger": "always",
-  "toolVisibility": "always",
   "enabled": true,
   "replyHint": true,
   "status": "researching"
@@ -410,12 +409,12 @@ Create `~/.selesai/agent/intercom/config.json`:
 | `brokerArgs` | `["--no-install", "tsx"]` | Advanced trusted arguments passed to custom `brokerCommand` before the broker script path |
 | `confirmSend` | false | Show a confirmation dialog before ordinary or inferred sends from an interactive session with UI; caller-supplied `replyTo` skips it |
 | `inboundTrigger` | `"always"` | Auto-trigger policy for inbound broker messages: `"always"`, `"replies"`, or `"never"`. Local in-process subagent relay events still trigger the addressed session. |
-| `toolVisibility` | `"always"` | When the generic `intercom` tool enters the active model tool set: `"always"` or `"after-first-use"`. Lazy visibility reveals it after an inbound broker message, a successful overlay send, or loading the bundled skill. It does not hide the child-only `contact_supervisor` tool. |
 | `enabled` | true | Enable/disable intercom entirely |
 | `replyHint` | true | Include reply instruction in incoming messages |
 | `status` | — | Optional custom status suffix shown after the automatic lifecycle status, for example `thinking · researching` |
 
 If `config.json` cannot be parsed or contains an invalid value, pi-intercom logs the error and fails closed for inbound broker auto-triggering by using `inboundTrigger: "never"` until the config is fixed.
+Obsolete `toolVisibility` values are ignored; the generic `intercom` tool remains stable in the active tool set for prompt-cache friendliness.
 
 Custom broker commands are trusted local configuration: anyone who can edit this config can choose the executable used for future broker auto-spawns. For example, if you have Bun installed and want it to start the broker directly, use:
 
@@ -542,7 +541,7 @@ Runtime files live at `~/.selesai/agent/intercom/` by default, or `$SELESAI_CODI
 - `broker.port.json` — Dynamic localhost TCP endpoint, only when Windows TCP transport is explicitly enabled
 - `config.json` — User configuration
 
-Supported `config.json` keys include `stableId` for restart-stable addressing, `status` for a custom status suffix, `inboundTrigger` (`always`, `replies`, or `never`), `toolVisibility` (`always` or `after-first-use`), `replyHint`, `confirmSend`, and advanced broker launch overrides.
+Supported `config.json` keys include `stableId` for restart-stable addressing, `status` for a custom status suffix, `inboundTrigger` (`always`, `replies`, or `never`), `replyHint`, `confirmSend`, and advanced broker launch overrides.
 
 ## Design Decisions
 

package/dist/extensions/pi-intercom/config.test.ts

@@ -60,24 +60,13 @@ test("loadConfig accepts inboundTrigger replies policy", async () => {
   }
 });
 
-test("loadConfig defaults intercom tool visibility to always", async () => {
-  const root = mkdtempSync(join(tmpdir(), "pi-intercom-config-"));
-  try {
-    await withAgentDir(root, () => {
-      assert.equal(loadConfig().toolVisibility, "always");
-    });
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("loadConfig accepts lazy intercom tool visibility", async () => {
+test("loadConfig ignores obsolete toolVisibility values", async () => {
   const root = mkdtempSync(join(tmpdir(), "pi-intercom-config-"));
   try {
     mkdirSync(join(root, "intercom"), { recursive: true });
-    writeFileSync(join(root, "intercom", "config.json"), JSON.stringify({ toolVisibility: "after-first-use" }));
+    writeFileSync(join(root, "intercom", "config.json"), JSON.stringify({ toolVisibility: "lazy", replyHint: false }));
     await withAgentDir(root, () => {
-      assert.equal(loadConfig().toolVisibility, "after-first-use");
+      assert.equal(loadConfig().replyHint, false);
     });
   } finally {
     rmSync(root, { recursive: true, force: true });
@@ -97,23 +86,6 @@ test("loadConfig accepts a restart-stable intercom id", async () => {
   }
 });
 
-test("loadConfig rejects invalid toolVisibility values", async () => {
-  const root = mkdtempSync(join(tmpdir(), "pi-intercom-config-"));
-  try {
-    mkdirSync(join(root, "intercom"), { recursive: true });
-    writeFileSync(join(root, "intercom", "config.json"), JSON.stringify({ toolVisibility: "lazy" }));
-
-    await withAgentDir(root, () => {
-      assert.throws(
-        () => loadConfig(),
-        /Failed to load intercom config.*"toolVisibility" must be "always" or "after-first-use"/,
-      );
-    });
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
 test("loadConfig rejects invalid inboundTrigger values", async () => {
   const root = mkdtempSync(join(tmpdir(), "pi-intercom-config-"));
   try {

package/dist/extensions/pi-intercom/config.ts

@@ -24,7 +24,6 @@ export function getIntercomScopeId(env: NodeJS.ProcessEnv = process.env): string
 }
 
 export type InboundTriggerPolicy = "always" | "replies" | "never";
-export type IntercomToolVisibility = "always" | "after-first-use";
 
 export interface IntercomConfig {
   /** Broker command used to spawn the broker process (e.g. "npx" or "bun") */
@@ -39,9 +38,6 @@ export interface IntercomConfig {
   /** Controls whether inbound broker messages may automatically trigger a model turn */
   inboundTrigger: InboundTriggerPolicy;
 
-  /** Controls when the intercom tool enters the active model tool set */
-  toolVisibility: IntercomToolVisibility;
-
   /** Optional custom status suffix shown after automatic lifecycle status */
   status?: string;
 
@@ -64,7 +60,6 @@ const defaults: IntercomConfig = {
   brokerArgs: ["--no-install", "tsx"],
   confirmSend: false,
   inboundTrigger: "always",
-  toolVisibility: "always",
   enabled: true,
   replyHint: true,
 };
@@ -135,16 +130,6 @@ export function loadConfig(): IntercomConfig {
       config.inboundTrigger = parsedConfig.inboundTrigger;
     }
 
-    if (Object.hasOwn(parsedConfig, "toolVisibility")) {
-      if (
-        parsedConfig.toolVisibility !== "always"
-        && parsedConfig.toolVisibility !== "after-first-use"
-      ) {
-        throw new Error(`"toolVisibility" must be "always" or "after-first-use"`);
-      }
-      config.toolVisibility = parsedConfig.toolVisibility;
-    }
-
     if (Object.hasOwn(parsedConfig, "replyHint")) {
       if (typeof parsedConfig.replyHint !== "boolean") {
         throw new Error(`"replyHint" must be a boolean`);

package/dist/extensions/pi-intercom/index.ts

@@ -27,15 +27,12 @@ import {
   type IntercomOutboxResultV1,
 } from "./extension-api.ts";
 import { ReplyTracker } from "./reply-tracker.ts";
-import { realpathSync } from "node:fs";
 import { resolve as resolvePath } from "node:path";
-import { fileURLToPath } from "node:url";
 import { sameCwd } from "./cwd.ts";
 import { formatContextUsage } from "./format-context.ts";
 import { openProjectPane, resolveTargetInCwd, waitForProjectSession, type ProjectPaneLaunch } from "./project-agent.ts";
 
 const INTERCOM_TOOL_NAME = "intercom";
-const INTERCOM_SKILL_PATH = realpathSync(fileURLToPath(new URL("./skills/pi-intercom/SKILL.md", import.meta.url)));
 const SUBAGENT_CONTROL_INTERCOM_EVENT = "subagent:control-intercom";
 const SUBAGENT_RESULT_INTERCOM_EVENT = "subagent:result-intercom";
 const SUBAGENT_RESULT_INTERCOM_DELIVERY_EVENT = "subagent:result-intercom-delivery";
@@ -116,18 +113,6 @@ function getErrorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-function isIntercomSkillRead(input: unknown, cwd: string): boolean {
-  if (!input || typeof input !== "object") return false;
-  const inputPath = Reflect.get(input, "path");
-  if (typeof inputPath !== "string") return false;
-  const normalizedPath = inputPath.startsWith("@") ? inputPath.slice(1) : inputPath;
-  try {
-    return realpathSync(resolvePath(cwd, normalizedPath)) === INTERCOM_SKILL_PATH;
-  } catch {
-    return false;
-  }
-}
-
 function deliveryDetails(result: SendResult): Record<string, unknown> {
   return {
     messageId: result.id,
@@ -622,23 +607,7 @@ export default function piIntercomExtension(pi: ExtensionAPI) {
   let runtimeGeneration = 0;
   let agentRunning = false;
   const activeTools = new Map<string, string>();
-  let intercomToolHiddenByPolicy = false;
   const replyTracker = new ReplyTracker();
-  function hideIntercomTool(): void {
-    if (config.toolVisibility !== "after-first-use") return;
-    const activeToolNames = pi.getActiveTools();
-    if (!activeToolNames.includes(INTERCOM_TOOL_NAME)) return;
-    pi.setActiveTools(activeToolNames.filter((name) => name !== INTERCOM_TOOL_NAME));
-    intercomToolHiddenByPolicy = true;
-  }
-  function activateIntercomTool(): void {
-    if (!intercomToolHiddenByPolicy) return;
-    const activeToolNames = pi.getActiveTools();
-    if (!activeToolNames.includes(INTERCOM_TOOL_NAME)) {
-      pi.setActiveTools([...activeToolNames, INTERCOM_TOOL_NAME]);
-    }
-    intercomToolHiddenByPolicy = false;
-  }
 
   const seenInboundMessages = new Map<string, number>();
   const latestOutboundReceipts = new Map<string, { status: MessageReceiptStatus; timestamp: number; detail?: string }>();
@@ -1221,7 +1190,6 @@ export default function piIntercomExtension(pi: ExtensionAPI) {
     );
   }
   function sendIncomingBrokerMessage(entry: InboundMessageEntry, delivery: "trigger" | "steer", generation = runtimeGeneration): void {
-    activateIntercomTool();
     sendIncomingMessage(entry, delivery, generation);
   }
   function handleIncomingMessage(ctx: ExtensionContext, from: SessionInfo, message: Message): void {
@@ -1572,7 +1540,6 @@ export default function piIntercomExtension(pi: ExtensionAPI) {
     });
   }
   function startSessionRuntime(ctx: ExtensionContext): void {
-    hideIntercomTool();
     const previousClient = client;
     failPendingOutboxRequests(runtimeGeneration, "session_ended", "Session replaced");
     shuttingDown = false;
@@ -1819,17 +1786,7 @@ export default function piIntercomExtension(pi: ExtensionAPI) {
     return new InlineMessageComponent(details.from, details.message, theme, details.replyCommand, details.bodyText, !options.expanded);
   });
 
-  pi.on("input", (event) => {
-    if (/^\/skill: pi-intercom(?:\s|$)/u.test(event.text.trimStart())) {
-      activateIntercomTool();
-    }
-  });
-
-  pi.on("tool_result", (event, ctx) => {
-    if (event.toolName === "read" && event.isError !== true && isIntercomSkillRead(event.input, ctx.cwd)) {
-      activateIntercomTool();
-      return;
-    }
+  pi.on("tool_result", (event) => {
     if (event.toolName !== "intercom" && event.toolName !== "contact_supervisor") {
       return;
     }
@@ -2181,7 +2138,6 @@ Usage:
     }),
 
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-      activateIntercomTool();
       let connectedClient: IntercomClient;
       try {
         connectedClient = await ensureConnected("tool");
@@ -2350,6 +2306,14 @@ Usage:
                 details: { error: true },
               };
             }
+            const activeReplyMismatch = replyTo ? null : replyTracker.findActiveReplyTargetMismatch(sendTo);
+            if (activeReplyMismatch) {
+              const senderLabel = activeReplyMismatch.from.name || activeReplyMismatch.from.id;
+              return {
+                content: [{ type: "text", text: `This turn is responding to an intercom ask from "${senderLabel}". Use intercom({ action: "reply", message: "..." }) or set replyTo: "${activeReplyMismatch.message.id}". Refusing non-reply send to "${targetDisplay}" to avoid a misdirected reply.` }],
+                details: { error: true, replyTo: activeReplyMismatch.message.id },
+              };
+            }
             const inferredAsk = replyTo ? null : replyTracker.findUniquePendingAskFrom(sendTo);
             const effectiveReplyTo = replyTo ?? inferredAsk?.message.id;
             if (confirmSend && !(cwd && openProjectPaneIfMissing)) {
@@ -2761,7 +2725,6 @@ Usage:
     ).catch(() => undefined);
 
     if (result?.sent && result.messageId && result.text && getLiveContext(ctx, overlayGeneration)) {
-      activateIntercomTool();
       pi.appendEntry("intercom_sent", {
         to: selectedSession.name || selectedSession.id,
         message: { text: result.text },

package/dist/extensions/pi-intercom/intercom.integration.test.ts

@@ -1672,59 +1672,7 @@ test("intercom tool result hook marks failed details as errors", async () => {
   assert.deepEqual(okResults.filter(Boolean), []);
 });
 
-test("lazy tool visibility reveals intercom on bundled skill use only", { concurrency: false }, async () => {
-  const { default: piIntercomExtension } = await import("./index.ts");
-
-  await withIntercomConfig({ toolVisibility: "after-first-use" }, () => withChildOrchestratorEnv({
-    orchestratorTarget: "orchestrator",
-    runId: "78f659a3",
-    agent: "worker",
-    index: "0",
-  }, async () => {
-    const harness = createExtensionHarness("lazy-skill-worker", { activeTools: ["read", "bash"] });
-    piIntercomExtension(harness.pi as never);
-
-    try {
-      await harness.emitLifecycle("session_start");
-      assert.deepEqual(harness.getActiveTools(), ["read", "bash", "contact_supervisor"]);
-
-      harness.pi.events.emit("subagent:control-intercom", {
-        to: "session-child-test",
-        message: "Local relay traffic should not reveal the generic tool.",
-      });
-      assert.equal(harness.sentMessages.at(-1)?.activeTools.includes("intercom"), false);
-      assert.equal(harness.getActiveTools().includes("intercom"), false);
-
-      await harness.emitLifecycle("tool_result", {
-        toolName: "read",
-        input: { path: path.join(repoDir, "README.md") },
-        isError: false,
-      });
-      await harness.emitLifecycle("tool_result", {
-        toolName: "read",
-        input: { path: path.join(repoDir, "skills", "pi-intercom", "SKILL.md") },
-        isError: true,
-      });
-      assert.equal(harness.getActiveTools().includes("intercom"), false);
-
-      await harness.emitLifecycle("tool_result", {
-        toolName: "read",
-        input: { path: path.join(repoDir, "skills", "pi-intercom", "SKILL.md") },
-        isError: false,
-      });
-      assert.deepEqual(harness.getActiveTools(), ["read", "bash", "contact_supervisor", "intercom"]);
-
-      await harness.emitLifecycle("session_start");
-      assert.equal(harness.getActiveTools().includes("intercom"), false);
-      await harness.emitLifecycle("input", { text: "  /skill: pi-intercom", source: "user" });
-      assert.equal(harness.getActiveTools().includes("intercom"), true);
-    } finally {
-      await harness.emitLifecycle("session_shutdown");
-    }
-  }));
-});
-
-test("lazy tool visibility reveals intercom before broker injection and after an overlay send", { concurrency: false }, async () => {
+test("obsolete toolVisibility config never hides or reveals the intercom tool", { concurrency: false }, async () => {
   const { default: piIntercomExtension } = await import("./index.ts");
 
   await withIntercomConfig({ toolVisibility: "after-first-use" }, async () => {
@@ -1754,14 +1702,14 @@ test("lazy tool visibility reveals intercom before broker injection and after an
       piIntercomExtension(inboundHarness.pi as never);
       await overlayHarness.emitLifecycle("session_start");
       await inboundHarness.emitLifecycle("session_start");
-      assert.equal(overlayHarness.getActiveTools().includes("intercom"), false);
-      assert.equal(inboundHarness.getActiveTools().includes("intercom"), false);
+      assert.equal(overlayHarness.getActiveTools().includes("intercom"), true);
+      assert.equal(inboundHarness.getActiveTools().includes("intercom"), true);
 
       selectedSession = await waitForSessionByName(planner, "planner");
       const inboundSession = await waitForSessionByName(planner, "lazy-inbound-worker");
       const delivered = await planner.send(inboundSession.id, {
-        messageId: "lazy-inbound-message",
-        text: "Reveal intercom before injecting this message.",
+        messageId: "stable-inbound-message",
+        text: "Keep intercom active before injecting this message.",
       });
       assert.equal(delivered.delivered, true);
       const deadline = Date.now() + 1000;
@@ -1770,6 +1718,13 @@ test("lazy tool visibility reveals intercom before broker injection and after an
       }
       assert.equal(inboundHarness.sentMessages[0]?.activeTools.includes("intercom"), true);
 
+      await inboundHarness.emitLifecycle("tool_result", {
+        toolName: "read",
+        input: { path: path.join(repoDir, "skills", "pi-intercom", "SKILL.md") },
+        isError: false,
+      });
+      assert.equal(inboundHarness.getActiveTools().includes("intercom"), true);
+
       await overlayHarness.commands.get("intercom")!("", overlayHarness.ctx);
       assert.equal(overlayStep, 2);
       assert.equal(overlayHarness.getActiveTools().includes("intercom"), true);
@@ -3148,6 +3103,43 @@ test("intercom reply sends attachments", { concurrency: false }, async () => {
   }
 });
 
+test("intercom send refuses a different target during an active inbound ask turn", { concurrency: false }, async () => {
+  const { planner, orchestrator, cleanup } = await setupClients();
+  const { default: piIntercomExtension } = await import("./index.ts");
+  const harness = createExtensionHarness("cwd-reply-worker");
+
+  try {
+    piIntercomExtension(harness.pi as never);
+    await harness.emitLifecycle("session_start");
+    const worker = await waitForSessionByName(planner, "cwd-reply-worker");
+
+    assert.equal((await planner.send(worker.id, {
+      messageId: "cwd-hierarchy-ask",
+      text: "Please answer me, not the repo-root session.",
+      expectsReply: true,
+    })).delivered, true);
+    const deadline = Date.now() + 1000;
+    while (harness.sentMessages.length === 0 && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+    await harness.emitLifecycle("turn_start");
+
+    const intercomTool = harness.tools.find((tool) => tool.name === "intercom")!;
+    const result = await intercomTool.execute("misdirected-send", {
+      action: "send",
+      to: "orchestrator",
+      message: "This was meant as the ask answer.",
+    }, new AbortController().signal, undefined, harness.ctx);
+
+    assert.equal(result.details?.error, true);
+    assert.equal(result.details?.replyTo, "cwd-hierarchy-ask");
+    assert.match(result.content[0]?.text ?? "", /Refusing non-reply send to "orchestrator"/);
+  } finally {
+    await harness.emitLifecycle("session_shutdown");
+    await cleanup();
+  }
+});
+
 test("intercom reply targets one of multiple pending asks by short session ID", { concurrency: false }, async () => {
   const { planner, orchestrator, cleanup } = await setupClients();
   const { default: piIntercomExtension } = await import("./index.ts");

package/dist/extensions/pi-intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-intercom",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "license": "MIT",
   "type": "module",
   "main": "index.ts",

package/dist/extensions/pi-intercom/reply-tracker.test.ts

@@ -93,6 +93,26 @@ test("explicit to overrides the current turn context", () => {
   assert.throws(() => tracker.resolveReplyTarget({ to: "missing" }, 1003), /No pending ask from/);
 });
 
+test("active ask context flags non-reply sends to a different target", () => {
+  const tracker = new ReplyTracker();
+  const current = tracker.recordIncomingMessage(createSession("planner-id", "planner"), createMessage("ask-1", "Need a reply"), 1000);
+  tracker.queueTurnContext(current);
+  tracker.beginTurn(1001);
+
+  assert.equal(tracker.findActiveReplyTargetMismatch("planner-id", 1002), null);
+  assert.equal(tracker.findActiveReplyTargetMismatch("planner", 1002)?.message.id, "ask-1");
+  assert.equal(tracker.findActiveReplyTargetMismatch("repo-root", 1002)?.message.id, "ask-1");
+});
+
+test("active ask context does not trust sender names as destination identity", () => {
+  const tracker = new ReplyTracker();
+  const current = tracker.recordIncomingMessage(createSession("asker-session", "root-session"), createMessage("ask-1", "Need a reply"), 1000);
+  tracker.queueTurnContext(current);
+  tracker.beginTurn(1001);
+
+  assert.equal(tracker.findActiveReplyTargetMismatch("root-session", 1002)?.message.id, "ask-1");
+});
+
 test("replyTo resolves the exact pending ask", () => {
   const tracker = new ReplyTracker();
   tracker.recordIncomingMessage(createSession("planner-id", "planner"), createMessage("ask-1", "First"), 1000);

package/dist/extensions/pi-intercom/reply-tracker.ts

@@ -121,6 +121,14 @@ export class ReplyTracker {
     return candidates.length === 1 ? candidates[0]! : null;
   }
 
+  findActiveReplyTargetMismatch(to: string, now = Date.now()): IntercomContext | null {
+    this.pruneExpired(now);
+    if (!this.currentTurnContext?.message.expectsReply) {
+      return null;
+    }
+    return this.currentTurnContext.from.id === to ? null : this.currentTurnContext;
+  }
+
   markReplied(replyTo: string): void {
     this.dismissPendingAsk(replyTo);
   }

package/dist/extensions/pi-subagents/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [0.60.0] - 2026-08-31
+
+### Highlights
+- Ask for the runtime delegation catalog as clean rows: `subagent({ action: "list", capabilities: true })` returns compact, prompt-free capability rows and machine metadata.
+- Timeout recovery is explainable: async status and `subagent_wait` completions report the missing/written report and changed tracked files for timed-out children with dirty worktrees.
+- Forked children reuse prompt caches: fork-context launches stamp an OpenAI-compatible `prompt_cache_key` on provider requests.
+- `runs.lanes` plans show up as workflow-graph stages in status and TUI views.
+- Watchdog and single-output evidence are cheaper and kinder: home-root/entry-less repos skip untracked scans, and stat errors propagate instead of being swallowed.
+
+### Added
+- Add `capabilities` option to management `list`: returns executable/restricted status, restriction sources, aliases, runner (pi / external-cli / external-job with capabilities), tools (ambient, mcp-direct, mutation), model (value/fallbacks/thinking), execution (defaultAsync, timeoutMs), output, and extensions snapshot per agent, plus total restricted count and capability-ceiling sources, as versioned `details.agentCapabilities` (`details.catalog`).
+- Emit `lanePlan` metadata from `runs.lanes` (stages, phase, label, agent, output name, structured flag) and render workflow-graph stage nodes in async status and TUI views.
+- Stamp `prompt_cache_key` (`pi-fork:<sha256>`) on supported provider requests for fork-context children via `before_provider_request`.
+- Project timeout-recovery evidence (termination, changed files, report status, dirty-worktree reason) into async status steps and `subagent_wait` completion output.
+
+### Changed
+- `runs.host` rejects per-step `cwd` with an actionable hint (use outer request cwd or a trusted `cd` in the command).
+- Watchdog repo-change signatures skip `--untracked-files=all` for home-repo roots and repositories with no tracked entries, keeping status probes cheap and bounded.
+- Single-output snapshots propagate non-ENOENT stat errors instead of treating every failure as "file missing".
+- Background spawns use `windowsHide` consistently and `detached` only on non-Windows.
+- `workflowScript` guidance documents the portability rules (no nested async helpers) and `runs.host` cwd semantics.
+
+### Fixed
+- "Running" spinners in the TUI advance on wall-clock time instead of only on model activity.
+- Noisy repeated single-step status rows are suppressed in workflow status rendering.
+- Timeout recovery summaries no longer claim a written report when the required output is missing.
+
 ## [0.59.0] - 2026-08-28
 
 ### Highlights