@selesai/code 0.13.31 → 0.13.33

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to `@selesai/code` will be documented in this file.
 
+## [0.13.33] - 2026-09-26
+
+### Added
+- **Subagent cost is exposed through extension RPC.** `cost` joins the versioned `subagents:rpc:v1` method list and returns the same parent-plus-child accounting `/subagent-cost` renders; `ping` advertises the report version. It is read-only, but it walks the current session branch and existing run artifacts, so callers should request it on turn boundaries rather than on a timer.
+- **Async workflow status reports terminal proof.** `subagent({ action: "status" })` details now include `workflowTerminalProof`, the shared child-exit evidence for workflow runs.
+- **Native children can use the scoped capability gateway.** A child launch loads the gateway when extension policy permits it, exposing `capability_catalog`, `capability_discover`, and `capability_skill_show` for tools in that child's effective registry. The gateway never installs or provides a missing tool provider, and `SELESAI_CAPABILITY_GATEWAY=0` still disables it.
+
+### Changed
+- **The packaged `worker` agent starts from fresh context.** `worker` now declares `defaultContext: fresh` and `acceptanceRole: writer`; an explicit `context: "fork"` still wins.
+
+### Fixed
+- **Capability gateway controls no longer count as mutation capability.** A read-only child that receives `capability_catalog`, `capability_discover`, and `capability_skill_show` is still rejected for an implementation task with no mutation-capable tools, so the gateway does not disarm the implementation guard.
+- **Structured output rejections keep their evidence.** Foreground and background runs now report the bounded rejection diagnostic — schema and validator failures summarized, submitted values redacted — instead of a generic missing-call error, and background results mark `structuredOutputFailed`.
+- **`subagent_supervisor` requires fanout authorization.** A child that declares the supervisor reply tool without `subagent` in its effective tools allowlist (or `allowNestedSubagents`) now fails the launch instead of silently receiving the tool.
+- **Git routing environment is stripped from child processes.** Background runners and external CLI default launches no longer inherit `GIT_DIR`, `GIT_WORK_TREE`, `GIT_INDEX_FILE`, and Git's other local environment variables, so a child's Git commands stay in its own working directory.
+
+## [0.13.32] - 2026-09-24
+
+### Fixed
+- **Cached provider model catalogs are no longer discarded when `Last-Modified` is missing.** Models such as `openai-codex/gpt-6-sol` and `openai-codex/gpt-6-luna` remain available after a catalog refresh when the cached catalog is newer than the bundled metadata.
+
 ## [0.13.31] - 2026-09-23
 
 ### Changed

package/dist/core/remote-catalog-provider.js

@@ -30,7 +30,11 @@ function parseCatalog(providerId, value) {
 function remoteModels(entry, localGeneratedAt) {
     if (!entry)
         return [];
-    if (localGeneratedAt !== undefined && (entry.lastModified === undefined || entry.lastModified <= localGeneratedAt)) {
+    // Some catalog responses (and the 404/501 fallback) have no usable
+    // Last-Modified value. Use the completed check time instead so a cached
+    // catalog is not discarded merely because that header was absent.
+    const remoteGeneratedAt = entry.lastModified && entry.lastModified > 0 ? entry.lastModified : entry.checkedAt;
+    if (localGeneratedAt !== undefined && (remoteGeneratedAt === undefined || remoteGeneratedAt <= localGeneratedAt)) {
         return [];
     }
     return entry.models;

package/dist/core/remote-catalog-provider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/remote-catalog-provider.test.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { withRemoteCatalog } from "./remote-catalog-provider.js";
+const cachedModel = {
+    id: "gpt-6-sol",
+    provider: "openai-codex",
+};
+function refreshContext(stored) {
+    return {
+        stored,
+        allowNetwork: false,
+        signal: new AbortController().signal,
+        publish: async ({ update }) => {
+            update?.();
+            return true;
+        },
+    };
+}
+describe("remote model catalog cache", () => {
+    it("keeps a newer cached catalog when Last-Modified is unavailable", async () => {
+        const localGeneratedAt = 100;
+        const provider = {
+            id: "openai-codex",
+            getModels: () => [],
+        };
+        const wrapped = withRemoteCatalog(provider, "https://example.test", localGeneratedAt);
+        await wrapped.refreshModels?.(refreshContext({ models: [cachedModel], checkedAt: localGeneratedAt + 1, lastModified: 0 }));
+        expect(wrapped.getModels().map((model) => model.id)).toEqual(["gpt-6-sol"]);
+    });
+});

package/dist/extensions/capability-gateway/index.ts

@@ -94,14 +94,19 @@ function catalogEntries(pi: ExtensionAPI): CatalogEntry[] {
 }
 
 const EMBEDDED_SKILL_BLOCK = /<skill\s+name="([^"]+)"[^>]*>[\s\S]*?<\/skill>/gi;
+const GITHUB_OR_OPEN_SOURCE_QUERY = /\b(?:github|open[\s-]*source)\b/i;
 
 function routePrompt(prompt: string, entries: CatalogEntry[]): ReturnType<typeof route> {
 	const loadedSkills = new Set([...prompt.matchAll(EMBEDDED_SKILL_BLOCK)].map((match) => match[1]!.toLowerCase()));
 	const query = prompt.replace(EMBEDDED_SKILL_BLOCK, " ");
-	return route(
-		query,
-		entries.filter((entry) => entry.kind !== "skill" || !loadedSkills.has(entry.name.toLowerCase())),
-	);
+	const candidates = entries.filter((entry) => entry.kind !== "skill" || !loadedSkills.has(entry.name.toLowerCase()));
+	if (GITHUB_OR_OPEN_SOURCE_QUERY.test(query)) {
+		const grepAppSearch = candidates.find(
+			(entry) => entry.kind === "tool" && entry.eligible && entry.name === "grep_app_search",
+		);
+		if (grepAppSearch) return { action: "activate", entry: grepAppSearch };
+	}
+	return route(query, candidates);
 }
 
 function formatCatalog(entries: CatalogEntry[]): string {

package/dist/extensions/capability-gateway/integration.test.ts

@@ -19,6 +19,7 @@ import { allowNetwork } from "../../../test/test-network-env.ts";
 const EXTENSIONS_DIR = fileURLToPath(new URL("../../", import.meta.url));
 const GATEWAY_DIR = fileURLToPath(new URL(".", import.meta.url));
 const GREP_APP_DIR = fileURLToPath(new URL("../grep-app", import.meta.url));
+const WEB_AGENT_DIR = fileURLToPath(new URL("../pi-web-agent", import.meta.url));
 const GRAFT_DIR = fileURLToPath(new URL("../pi-graft", import.meta.url));
 const INLINE_SKILLS_FILE = fileURLToPath(new URL("../inline-skills.ts", import.meta.url));
 
@@ -37,6 +38,8 @@ interface HarnessOptions {
 	jev?: Record<string, unknown>;
 	/** Make the gateway's telemetry channel throw on every emit. */
 	telemetryDown?: boolean;
+	/** SDK-level child tool allowlist. */
+	tools?: string[];
 }
 
 /** A bus that fails only on the gateway's own telemetry channel. */
@@ -129,6 +132,7 @@ async function createGatewaySession(options: HarnessOptions): Promise<Harness> {
 		resourceLoader: loader,
 		sessionManager: SessionManager.create(cwd, join(home, "sessions")),
 		settingsManager,
+		...(options.tools !== undefined ? { tools: options.tools } : {}),
 	});
 	const session = created.session;
 	await session.bindExtensions({});
@@ -243,6 +247,39 @@ describe("capability gateway integration", () => {
 		expect(draw({})).toContain("(all)");
 	});
 
+	it("limits child discovery and activation to the SDK-filtered tool registry", async () => {
+		const h = await createGatewaySession({
+			enabled: true,
+			extensions: [GATEWAY_DIR, GREP_APP_DIR],
+			tools: ["capability_catalog", "capability_discover", "grep_app_search"],
+		});
+		harnesses.push(h);
+		const registeredNames = h.session.getAllTools().map((tool) => tool.name);
+		expect(registeredNames).toContain("grep_app_search");
+		expect(registeredNames).not.toContain("grep_app_fetch");
+
+		const catalog = h.session.getToolDefinition("capability_catalog");
+		const catalogResult = await catalog!.execute("call-catalog", { query: "grep_app" }, undefined, undefined, {} as never);
+		expect(String(catalogResult.content[0]!.text)).toContain("grep_app_search");
+		expect(String(catalogResult.content[0]!.text)).not.toContain("grep_app_fetch");
+
+		const discover = h.session.getToolDefinition("capability_discover");
+		const allowed = await discover!.execute("call-allowed", { name: "grep_app_search" }, undefined, undefined, {} as never);
+		expect(String(allowed.content[0]!.text)).toContain("Activated");
+		expect(h.session.getActiveToolNames()).toContain("grep_app_search");
+
+		const denied = await discover!.execute("call-denied", { name: "grep_app_fetch" }, undefined, undefined, {} as never);
+		expect(String(denied.content[0]!.text)).not.toContain("Activated");
+		expect(h.session.getActiveToolNames()).not.toContain("grep_app_fetch");
+	});
+
+	it("exposes no gateway controls to an explicitly empty child tool allowlist", async () => {
+		const h = await createGatewaySession({ enabled: true, extensions: [GATEWAY_DIR], tools: [] });
+		harnesses.push(h);
+		expect(h.session.getAllTools().map((tool) => tool.name)).not.toContain("capability_catalog");
+		expect(h.session.getActiveToolNames()).not.toContain("capability_discover");
+	});
+
 	it("activates a discovered tool for the run and resets after agent_settled", async () => {
 		const h = await createGatewaySession({ enabled: true });
 		harnesses.push(h);
@@ -337,9 +374,9 @@ describe("capability gateway integration", () => {
 // ---------------------------------------------------------------------------
 
 describe("capability gateway Jev routing", () => {
-	// "...github..." only weakly suggests both grep-app tools: the deterministic router returns a
-	// two-candidate hint, which is the only Jev trigger.
-	const HINT_PROMPT = "look at this github repo";
+	// "search fetch" weakly suggests both grep-app tools: the deterministic router returns a
+	// two-candidate hint, which is the only Jev trigger. GitHub/open-source mentions route directly.
+	const HINT_PROMPT = "search fetch";
 	// No tool name, alias, or summary token matches: the router has no lexical signal and Jev
 	// must never be consulted.
 	const NO_SIGNAL_PROMPT = "continue where we left off last time";
@@ -393,6 +430,35 @@ describe("capability gateway Jev routing", () => {
 		return h.telemetry.filter((event) => event.event === "route");
 	}
 
+	it("routes only GitHub/open-source mentions to grep.app; other web searches stay on web_explore", async () => {
+		allowNetwork();
+		const { fetchMock } = stubJev("none", 1);
+		const h = await createGatewaySession({
+			enabled: true,
+			extensions: [GATEWAY_DIR, GREP_APP_DIR, WEB_AGENT_DIR],
+			jev: jevSettings(),
+		});
+		harnesses.push(h);
+
+		for (const prompt of [
+			"search GitHub code",
+			"find open-source implementations",
+			"find open source implementations",
+			"find opensource examples",
+		]) {
+			await route(h, prompt);
+			expect(h.session.getActiveToolNames()).toContain("grep_app_search");
+			expect(h.session.getActiveToolNames()).not.toContain("web_explore");
+			expect(fetchMock).not.toHaveBeenCalled();
+			await h.session.extensionRunner.emit({ type: "agent_settled" });
+		}
+
+		await route(h, "web search for release notes");
+		expect(h.session.getActiveToolNames()).toContain("web_explore");
+		expect(h.session.getActiveToolNames()).not.toContain("grep_app_search");
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
 	// Telemetry may carry route metadata and canonical tool names, never prompt
 	// text, conversation turns, credentials, raw Jev output, or tool arguments.
 	const TELEMETRY_KEYS = new Set([

package/dist/extensions/pi-subagents/agents/worker.md

@@ -2,12 +2,13 @@
 name: worker
 description: Implementation agent for normal tasks and approved oracle handoffs
 aliases: developer, coder, implementer, develop
+acceptanceRole: writer
 thinking: high
 systemPromptMode: replace
 inheritProjectContext: true
 inheritSkills: false
 tools: read, grep, find, ls, bash, edit, write, contact_supervisor
-defaultContext: fork
+defaultContext: fresh
 output: implementation.md
 defaultReads: context.md, research.md, plan.md, implementation.md, review.md
 defaultProgress: true
@@ -17,7 +18,7 @@ You are `worker`: the implementation subagent.
 
 You are the single writer thread. Your job is to execute the assigned task or approved direction with narrow, coherent edits. The main agent and user remain the decision authority.
 
-Use the provided tools directly. First read the inherited context, supplied files, plan, task paths, and named seams. Then implement carefully and minimally. Use broad search only to verify or expand from that starting point.
+Use the provided tools directly. First read the provided context, supplied files, plan, task paths, and named seams. Then implement carefully and minimally. Use broad search only to verify or expand from that starting point.
 
 The builtin worker uses a strict tool allowlist. It does not inherit ambient extension tools from the parent session. To use an extension tool, configure a custom agent with the tool name explicitly listed in `tools` and load its provider through `extensions` or `subagentOnlyExtensions`.
 

package/dist/extensions/pi-subagents/docs/agents.md

@@ -198,6 +198,8 @@ fallbackModels:
 
 Field notes:
 
+Native children expose the capability gateway only when extension policy permits it. The gateway catalogs and activates only tools visible in that child's effective registry; it does not install or provide a missing tool provider.
+
 | Field | Notes |
 |-------|-------|
 | `package` | Optional package identifier. A file with `name: scout` and `package: code-analysis` registers as `code-analysis.scout`; serialization keeps `name` and `package` separate. |

package/dist/extensions/pi-subagents/docs/extension-api.md

@@ -114,7 +114,7 @@ pi.events.emit("subagents:rpc:v1:request", {
 });
 ```
 
-The RPC methods are `ping`, `status`, `manage`, `spawn`, `steer`, `interrupt`, `stop`, and `resume`. `status`, `manage`, `steer`, `interrupt`, and `resume` reuse normal package-owned actions.
+The RPC methods are `ping`, `status`, `manage`, `spawn`, `steer`, `interrupt`, `stop`, `resume`, and `cost`. `status`, `manage`, `steer`, `interrupt`, and `resume` reuse normal package-owned actions.
 
 Method notes:
 
@@ -124,6 +124,7 @@ Method notes:
 - `resume` requires a run target and non-empty `message`. It delegates to the existing revival path, which validates current-session ownership, persisted session/recovery metadata, stopped/live state, capability ceilings, and the exclusive session lease before returning the new async run details. Callers may request a `file-only` output path for the revived result without overriding its model, tools, or budgets. `ping.capabilities.resume` advertises this seam.
 - `stop` targets current-session top-level async runs through the stop control channel and records a `stopped` lifecycle instead of reporting a timeout.
 - `status` keeps targeted and rich requests on the executor-backed path. A request with no `id`, `runId`, `dir`, `index`, `view`, or `lines` may use the restored in-memory projections and a short summary; when the live state is missing, stale, session-mismatched, or not restored, it falls back to normal executor status. Status `view`, `lines`, and `index` are forwarded for targeted transcript/fleet requests. Successful replies retain `text`, `details`, `fleet`, and `asyncSnapshot`; the short summary intentionally omits canonical filesystem details, wait subscriptions, and budget annotations.
+- `cost` returns the same parent-plus-child accounting `/subagent-cost` renders, as `{ version: 1, parent, children, childTotal, total, unresolvedAsyncChildren }`. Usage objects contain `input`, `output`, `cacheRead`, `cacheWrite`, `cost`, and `turns`; child rows add `label` plus `agent`, `runId`, or `sessionFile` when known. It is read-only and walks the current session branch and existing artifacts, so request it at a turn boundary rather than on a timer. A non-zero `unresolvedAsyncChildren` means `childTotal` is a lower bound. `ping.capabilities.cost` advertises `{ version: 1 }`.
 
 Capability advertisements on `ping`:
 
@@ -136,6 +137,7 @@ Capability advertisements on `ping`:
 - `resume` — the revival seam described above.
 - `statusProjection: { version: 1, untargeted: "in-memory-when-ready", targeted: "executor" }` — untargeted status may use restored bounded projections; targeted or rich status remains executor-backed.
 - `fleetStatus: { version: 1 }` — successful `status` replies additionally include `data.fleet`.
+- `cost: { version: 1 }` — the `cost` method is available with the report shape described above.
 
 Structured delegation progress updates carry `runId` as soon as foreground execution allocates it, so a caller can retain the package-owned revival target even if its own tool turn is interrupted before the terminal response. Foreground `details.results[]` rows also include a numeric `index` that is unique within the run and stable across partial progress snapshots and the final result; use `(runId, index)` instead of row position to correlate single, counted parallel, and chain children.
 

package/dist/extensions/pi-subagents/docs/observability.md

@@ -27,6 +27,8 @@ subagent({ action: "status", id: "..." })      // one run
 
 Or ask naturally: "Show me the current async runs."
 
+Use `/subagent-cost` for combined parent-plus-child usage. Other extensions can request the same versioned data through the in-process RPC `cost` method instead of scraping slash-command text; it is read-only and should be called at a turn boundary, not polled. `unresolvedAsyncChildren` counts children whose usage metadata could not be read, so a non-zero count means the child total is a lower bound. See [extension-api.md](extension-api.md#in-process-event-bus-rpc).
+
 The under-editor async widget gives a short view while work runs. Its expand key follows your Pi keybinding:
 
 ```text

package/dist/extensions/pi-subagents/docs/tool-reference.md

@@ -90,7 +90,7 @@ The complete plain-JSON inventory is validated before the first launch (maximum
 | `action` | string | - | Offline workflow `validate`, agent management (including `guide`, `children.list`, and `refine`/`refine.show`/`refine.rollback`), lane evidence (`lane.status`, `lane.recordMerge`, `lane.recordSupersession`), mission (`mission.create/list/show/update/resolve-decision/attach-run/close`), Herdr inspector (`inspector.open/status/close`), Herdr project pane (`project.open/status/close`), status/control, plan-only `worktree.cleanup`, schedule, watchdog, or doctor action. |
 | `topic` | `overview \| workflows \| agents \| missions \| observability \| tool-reference \| configuration \| models \| watchdog \| extension-api` | `overview` | Packaged guide topic for `action: "guide"`. |
 | `config` | object/string | - | Agent config for management create/update. |
-| `context` | `fresh \| fork` | global or per-agent default, else `fresh` | Explicit `fresh` or `fork` overrides every workflow child. When omitted, [`defaultSubagentContext`](configuration.md#defaultsubagentcontext) wins over each agent's `defaultContext`; `"fork"` creates a real branched session when the parent session file and current leaf exist, otherwise it falls back to `fresh`. Packaged `worker`, `oracle`, and `advisor` default to `fork`. |
+| `context` | `fresh \| fork` | global or per-agent default, else `fresh` | Explicit `fresh` or `fork` overrides every workflow child. When omitted, [`defaultSubagentContext`](configuration.md#defaultsubagentcontext) wins over each agent's `defaultContext`; `"fork"` creates a real branched session when the parent session file and current leaf exist, otherwise it falls back to `fresh`. Packaged `worker` defaults to `fresh`; `oracle` and `advisor` default to `fork`. |
 | `missionId` | string | - | Attach a workflow to an existing project mission instead of creating its default enclosing mission. |
 | `mission` | object/false | auto-create | Override the default enclosing mission with `{ title \| summary, objective?, goal?, budget?, labels? }`. Set exactly one non-empty `title` or `summary`; `objective` and `labels` are optional. `goal` may only be `true`, requires `budget.tokens`, and enables continuation notices. Pass `false` for an intentionally ephemeral workflow with no mission for it or its children and no `state` global. Explicit mission persistence failures are strict. |
 | `handoffPath` | string | - | Aggregate handoff manifest for `action: "worktree.discard"` or lane evidence actions, or optional explicit metadata for `action: "worktree.cleanup"`. |
@@ -134,7 +134,7 @@ Explicit `context: "fork"` fails fast when the parent session is not persisted,
 
 When the inherited transcript contains signed Anthropic `thinking` / `redacted_thinking` blocks, `pi-subagents` strips those provider-private blocks from the forked child session. It forces thinking `off` only when the child's effective primary or fallback model resolves through the model registry to the Anthropic provider or `anthropic-messages` API; unresolved models are treated conservatively. The result reports every affected child, including on failed runs. Use `context: "fresh"` when an Anthropic child needs thinking. Explicit `context: "fork"` never silently downgrades to `fresh`.
 
-In workflow runs that omit `context`, each `runs.run` child follows the global `defaultSubagentContext` when set, then its own `defaultContext`. Without the global setting, a fresh-default scout can run fresh beside a fork-default worker. If the parent session file or current leaf is not available yet, implicit fork-default children run fresh. Pass explicit `context: "fork"` or `context: "fresh"` when you intentionally want one context for every child.
+In workflow runs that omit `context`, each `runs.run` child follows the global `defaultSubagentContext` when set, then its own `defaultContext`. Without the global setting, a fresh-default worker can run fresh beside a fork-default oracle. If the parent session file or current leaf is not available yet, implicit fork-default children run fresh. Pass explicit `context: "fork"` or `context: "fresh"` when you intentionally want one context for every child.
 
 ### Workflow steering
 

package/dist/extensions/pi-subagents/docs/workflows.md

@@ -10,7 +10,7 @@ Use orchestration as parent-agent guidance, not as a runtime workflow mode. For
 clarify → scout → worker → fresh reviewers → worker
 ```
 
-Packaged `worker`, `oracle`, and `advisor` default to forked context when a launch omits `context`. If the parent has no persisted session file or current leaf yet, that implicit default falls back to `fresh`. Pass `context: "fresh"` when you intentionally want a fresh child run, or `context: "fork"` when fork must remain strict.
+Packaged `worker` defaults to fresh context; `oracle` and `advisor` default to forked context when a launch omits `context`. An implicit fork preference falls back to `fresh` when the parent has no persisted session file or current leaf. Pass `context: "fork"` when you intentionally want a worker to reuse the parent thread, or when fork must remain strict.
 
 Child-safety boundaries are enforced at runtime:
 

package/dist/extensions/pi-subagents/src/extension/rpc.ts

@@ -23,6 +23,7 @@ import { sanitizeDisplayText, truncateDisplayText } from "../shared/display-text
 import { readStatus } from "../shared/utils.ts";
 import { SubagentParams } from "./schemas.ts";
 import { normalizePublicSubagentExecution } from "./public-execution.ts";
+import { collectSubagentCost, SUBAGENT_COST_REPORT_VERSION } from "../slash/subagent-cost.ts";
 import { ASYNC_STATUS_SNAPSHOT_KIND, ASYNC_STATUS_SNAPSHOT_VERSION, buildAsyncStatusSnapshotForState } from "../runs/background/async-status-snapshot.ts";
 import { isStoppableAsyncStatusStep, resolveAsyncStatusChild, stopStoppableAsyncStatusChildren, type ResolvedAsyncStatusChild } from "../runs/shared/child-identity.ts";
 
@@ -31,7 +32,7 @@ export const SUBAGENT_RPC_REQUEST_EVENT = "subagents:rpc:v1:request";
 export const SUBAGENT_RPC_READY_EVENT = "subagents:rpc:v1:ready";
 export const SUBAGENT_RPC_REPLY_EVENT_PREFIX = "subagents:rpc:v1:reply:";
 
-export const SUBAGENT_RPC_METHODS = ["ping", "status", "manage", "spawn", "steer", "interrupt", "stop", "resume"] as const;
+export const SUBAGENT_RPC_METHODS = ["ping", "status", "manage", "spawn", "steer", "interrupt", "stop", "resume", "cost"] as const;
 export type SubagentRpcMethod = typeof SUBAGENT_RPC_METHODS[number];
 
 export interface SubagentRpcRequestEnvelope {
@@ -456,6 +457,7 @@ function pingData(ctx: ExtensionContext | null) {
 			launchResolvedExtensions: { version: 1, source: "launch-resolved" },
 			runtimeAcknowledgedExtensions: { version: 1, source: "child-runtime", event: "subagent:acknowledge-extension" },
 			processTerminalProof: { version: 1, lifecycleArtifactVersion: SUBAGENT_LIFECYCLE_ARTIFACT_VERSION },
+			cost: { version: SUBAGENT_COST_REPORT_VERSION },
 		},
 		events: {
 			ready: SUBAGENT_RPC_READY_EVENT,
@@ -761,6 +763,13 @@ async function handleRequest(
 	if (request.method === "resume") {
 		return executeChecked(options, ctx, request.requestId, request.method, resumeParams(request.params));
 	}
+	if (request.method === "cost") {
+		// The same parent-plus-child accounting `/subagent-cost` renders, as data.
+		// Read-only: it walks the current session branch and existing artifacts,
+		// so callers should request it on their own turn boundaries, not on a timer.
+		if (request.params !== undefined && !isRecord(request.params)) throw new SubagentRpcError("invalid_params", "RPC cost params must be an object when provided.");
+		return collectSubagentCost(ctx, options.state ?? { baseCwd: ctx.cwd });
+	}
 	throw new SubagentRpcError("unsupported_method", `Unsupported subagent RPC method: ${String(request.method)}`);
 }
 

package/dist/extensions/pi-subagents/src/runs/background/active-async-capacity.ts

@@ -6,6 +6,7 @@ import { TEMP_ROOT_DIR, type ActiveAsyncCapacitySnapshot, type AsyncStatus } fro
 import { readStatus } from "../../shared/utils.ts";
 import { checkPidLiveness, type PidLiveness } from "./stale-run-reconciler.ts";
 import { readProcessTerminal } from "./process-terminal.ts";
+import { isTerminalAsyncState as terminalState, readWorkflowChildProcessEvidence } from "./workflow-terminal-proof.ts";
 
 export const ACTIVE_ASYNC_CAPACITY_DIR = path.join(TEMP_ROOT_DIR, "session-active-async-capacity");
 export const DEFAULT_ABANDONED_SLOT_RELEASE_AFTER_MS = 20 * 60 * 1000;
@@ -209,10 +210,6 @@ function appendAbandonedReleaseEvent(asyncDir: string, owner: ActiveAsyncCapacit
 	}
 }
 
-function terminalState(state: AsyncStatus["state"]): boolean {
-	return state !== "queued" && state !== "running" && state !== "paused";
-}
-
 function runnerReleaseVerdict(owner: ActiveAsyncCapacityOwner, status: AsyncStatus | null, options: CapacityOptions): ActiveAsyncCapacityReleaseVerdict {
 	if (!status) return { state: "retained", reason: "status file is missing or unreadable" };
 	if (!owner.runnerProcessInstanceId) return { state: "retained", reason: "runner process identity has not been recorded" };
@@ -269,23 +266,8 @@ function workflowReleaseVerdict(owner: ActiveAsyncCapacityOwner, status: AsyncSt
 	if (status.mode !== "workflow") return { state: "retained", reason: `status mode is ${status.mode}, not workflow` };
 	if (!terminalState(status.state)) return { state: "retained", reason: `workflow is still ${status.state}` };
 	if (liveWorkflowRunIds.has(owner.runId)) return { state: "retained", reason: "workflow controller is still live" };
-	for (const step of status.steps ?? []) {
-		const label = step.workflowKey ?? step.agent;
-		if (typeof step.async !== "boolean") return { state: "retained", reason: `workflow child ${label} is missing async classification` };
-		if (!step.async) continue;
-		if (!step.runId) return { state: "retained", reason: `async workflow child ${label} is missing run id` };
-		const childDir = path.join(path.dirname(owner.asyncDir), step.runId);
-		if (!fs.existsSync(childDir)) return { state: "retained", reason: `async workflow child ${label} directory is missing` };
-		const childStatus = readStatus(childDir);
-		if (!childStatus) return { state: "retained", reason: `async workflow child ${label} status is missing or unreadable` };
-		if (!terminalState(childStatus.state)) return { state: "retained", reason: `async workflow child ${label} is still ${childStatus.state}` };
-		if (!childStatus.processTerminal?.runnerProcessInstanceId) return { state: "retained", reason: `async workflow child ${label} has no runner process identity` };
-		const proof = readProcessTerminal(childDir, {
-			runId: step.runId,
-			runnerProcessInstanceId: childStatus.processTerminal.runnerProcessInstanceId,
-		});
-		if (proof?.state !== "observed" || proof.runId !== step.runId) return { state: "retained", reason: `async workflow child ${label} process-terminal proof is ${proof?.state ?? "missing"}` };
-	}
+	const evidence = readWorkflowChildProcessEvidence(owner.asyncDir, status.steps);
+	if (evidence.state !== "observed") return { state: "retained", reason: evidence.reason };
 	return { state: "releasable", reason: "workflow is terminal, controller is gone, and async children have observed proof" };
 }
 

package/dist/extensions/pi-subagents/src/runs/background/async-execution.ts

@@ -83,6 +83,7 @@ import { assertAgentAllowedByCapabilityCeiling, intersectSubagentCapabilityCeili
 import { agentDefinitionDigest, launchBindingDigest } from "../../shared/launch-contract.ts";
 import { resolvePermissionRules, type PermissionConfig } from "../shared/permissions.ts";
 import { normalizeExtensionBindings, omitExtensionBindingsEnv, type ExtensionBindings } from "../shared/extension-bindings.ts";
+import { omitGitRoutingEnv } from "../shared/git-environment.ts";
 import { assertWorkflowLaneKey, normalizeWorkflowLaneMetadata } from "../shared/lane-metadata.ts";
 
 const require = createRequire(import.meta.url);
@@ -595,7 +596,7 @@ function spawnRunner(cfg: object, suffix: string, cwd: string, initialStatus: Om
 			...backgroundProcessOptions(),
 			stdio: ["ignore", stdoutFd ?? "ignore", stderrFd ?? "ignore"],
 			env: {
-				...omitExtensionBindingsEnv(process.env),
+				...omitGitRoutingEnv(omitExtensionBindingsEnv(process.env)),
 				[SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV]: piPackageRoot,
 				[JITI_ALIAS_ENV]: JSON.stringify(hostPeerAliases.aliases),
 			},

package/dist/extensions/pi-subagents/src/runs/background/run-child-session.ts

@@ -124,6 +124,7 @@ export interface RunChildSessionResult {
 	observedMutationAttempt?: boolean;
 	structuredOutputToolInvoked?: boolean;
 	structuredOutputMessageStartIndex?: number;
+	structuredOutputFailed?: boolean;
 	watchdog?: ChildWatchdogStateSnapshot;
 	sessionFile?: string;
 	currentTool?: string;

package/dist/extensions/pi-subagents/src/runs/background/run-status.ts

@@ -16,6 +16,7 @@ import { resolveSubagentIntercomTarget } from "../../intercom/intercom-bridge.ts
 import { normalizeExternalCliRunnerStatus } from "../shared/external-cli-contract.ts";
 import { resolveSubagentResultStatus } from "../../intercom/result-intercom.ts";
 import { readProcessTerminal, sanitizeProcessTerminal } from "./process-terminal.ts";
+import { readWorkflowTerminalProof } from "./workflow-terminal-proof.ts";
 import { formatWaitSubscriptions } from "./wait-subscriptions.ts";
 import { resolveAsyncRunLocation } from "./async-resume.ts";
 import { resolveSubagentRunId } from "./run-id-resolver.ts";
@@ -704,7 +705,10 @@ export function inspectSubagentStatus(params: RunStatusParams, deps: RunStatusDe
 
 			const workflowChildren = parseWorkflowChildSummary(status.workflowChildren);
 			if (workflowChildren && workflowChildren.workflowRunId !== status.runId) throw new Error("workflowChildren.workflowRunId does not match async status runId.");
-			return { content: [{ type: "text", text: lines.join("\n") }], details: { mode: "single", results: [], ...(status.workflowReceiptPath ? { workflowReceiptPath: status.workflowReceiptPath } : {}), ...(status.preflight ? { preflight: status.preflight } : {}), ...(status.workflow?.preflightWarnings?.length ? { preflightWarnings: status.workflow.preflightWarnings } : {}), ...(workflowChildren ? { workflowChildren } : {}), ...(runFanoutBudget ? { runFanoutBudget } : {}), ...(processTerminal ? { lifecycleStatus: { processTerminal } } : {}) } };
+			const workflowTerminalProof = workflowChildren
+				? readWorkflowTerminalProof(asyncDir, status.steps, workflowChildren, validHostStepNodes(status.workflowGraph).length, status.endedAt ?? status.lastUpdate ?? status.startedAt)
+				: undefined;
+			return { content: [{ type: "text", text: lines.join("\n") }], details: { mode: "single", results: [], ...(status.workflowReceiptPath ? { workflowReceiptPath: status.workflowReceiptPath } : {}), ...(status.preflight ? { preflight: status.preflight } : {}), ...(status.workflow?.preflightWarnings?.length ? { preflightWarnings: status.workflow.preflightWarnings } : {}), ...(workflowChildren ? { workflowChildren } : {}), ...(workflowTerminalProof ? { workflowTerminalProof } : {}), ...(runFanoutBudget ? { runFanoutBudget } : {}), ...(processTerminal ? { lifecycleStatus: { processTerminal } } : {}) } };
 		}
 	}
 

package/dist/extensions/pi-subagents/src/runs/background/subagent-runner.ts

@@ -105,7 +105,7 @@ import { SUBAGENT_CHILD_ENV } from "../shared/child-runtime-config.ts";
 import { deriveChildSessionName } from "../../shared/child-session-name.ts";
 import { alignForkedSessionCwd } from "../../shared/fork-session-cwd.ts";
 import { outputEntryFromAsyncResult, resolveOutputReferences } from "../shared/chain-outputs.ts";
-import { clearStructuredOutputCaptures, createStructuredOutputFileCapture, createStructuredOutputRuntime, MISSING_STRUCTURED_OUTPUT_CALL_ERROR, readStructuredOutput, readStructuredOutputAcceptanceReport } from "../shared/structured-output.ts";
+import { clearStructuredOutputCaptures, createStructuredOutputFileCapture, createStructuredOutputRuntime, formatStructuredOutputRejectionError, MISSING_STRUCTURED_OUTPUT_CALL_ERROR, readStructuredOutput, readStructuredOutputAcceptanceReport } from "../shared/structured-output.ts";
 import { formatMidToolExitError, isOrdinaryToolForMidToolExit, isUnexplainedProcessSignal } from "../shared/process-signal.ts";
 import { formatChildToolDiagnostic } from "../shared/tool-availability.ts";
 import { buildTimeoutRecoverySummary, collectTrackedMutationEvidence, snapshotTrackedMutations } from "../shared/mutation-evidence.ts";
@@ -285,6 +285,7 @@ interface StepResult {
 	review?: import("../../shared/types.ts").ReviewProjection;
 	effects?: import("../../shared/types.ts").EffectsProjection;
 	structuredOutput?: unknown;
+	structuredOutputFailed?: boolean;
 	structuredOutputPath?: string;
 	structuredOutputSchemaPath?: string;
 	acceptance?: import("../../shared/types.ts").AcceptanceLedger;
@@ -1221,7 +1222,8 @@ export async function runSingleStepInner(
 					schemaPath: effectiveStructuredOutput.schemaPath,
 					outputPath: effectiveStructuredOutput.outputPath,
 				});
-				if (structured.error) structuredError = structured.error;
+				if (structured.error === MISSING_STRUCTURED_OUTPUT_CALL_ERROR) structuredError = formatStructuredOutputRejectionError(run.messages);
+				else if (structured.error) structuredError = structured.error;
 				else {
 					structuredOutput = structured.value;
 					const acceptanceReport = readStructuredOutputAcceptanceReport(effectiveStructuredOutput);
@@ -1343,7 +1345,7 @@ export async function runSingleStepInner(
 			afterCompactionSettlement: run.afterCompactionSettlement === true,
 		});
 		const fileMutationEffect = completionEvidence.fileMutation ?? (missingRequiredOutputAfterMutation ? { status: "observed" as const, expected: completionEvidence.mutationExpected, attempted: true, evidence: mutationEvidence } : undefined);
-		finalResult = { ...run, exitCode: effectiveExitCode, model: candidate ?? run.model, error, structuredOutput, runtimeAcknowledgedExtensions, ...(step.agentContract ? { agentContract: step.agentContract } : {}), ...(fileMutationEffect || settlementDiagnostic ? { effects: { ...(fileMutationEffect ? { fileMutation: fileMutationEffect } : {}), ...(settlementDiagnostic ? { settlementDiagnostic } : {}) } } : {}) } as RunChildSessionResult;
+		finalResult = { ...run, exitCode: effectiveExitCode, model: candidate ?? run.model, error, structuredOutput, structuredOutputFailed: structuredError ? true : undefined, runtimeAcknowledgedExtensions, ...(step.agentContract ? { agentContract: step.agentContract } : {}), ...(fileMutationEffect || settlementDiagnostic ? { effects: { ...(fileMutationEffect ? { fileMutation: fileMutationEffect } : {}), ...(settlementDiagnostic ? { settlementDiagnostic } : {}) } } : {}) } as RunChildSessionResult;
 		const abortRecovery = !attempt.success ? planAbortRecovery({
 			messages: run.messages,
 			error,
@@ -1603,6 +1605,7 @@ export async function runSingleStepInner(
 		completionGuardTriggered: completionGuardTriggeredFinal,
 		...((finalResult as (RunChildSessionResult & { effects?: import("../../shared/types.ts").EffectsProjection }) | undefined)?.effects ? { effects: (finalResult as RunChildSessionResult & { effects?: import("../../shared/types.ts").EffectsProjection }).effects } : {}),
 		structuredOutput: timedOutAfterAcceptance || stoppedAfterAcceptance ? undefined : (finalResult as (RunChildSessionResult & { structuredOutput?: unknown }) | undefined)?.structuredOutput,
+		structuredOutputFailed: timedOutAfterAcceptance || stoppedAfterAcceptance ? undefined : finalResult?.structuredOutputFailed,
 		structuredOutputPath: timedOutAfterAcceptance || stoppedAfterAcceptance ? undefined : effectiveStructuredOutput?.outputPath,
 		structuredOutputSchemaPath: timedOutAfterAcceptance || stoppedAfterAcceptance ? undefined : effectiveStructuredOutput?.schemaPath,
 		acceptance: effectiveAcceptance,
@@ -3788,6 +3791,7 @@ export async function runSubagent(
 					review: pr.review,
 					timeoutRecovery: pr.timeoutRecovery,
 					structuredOutput: pr.structuredOutput,
+					structuredOutputFailed: pr.structuredOutputFailed,
 					structuredOutputPath: pr.structuredOutputPath,
 					structuredOutputSchemaPath: pr.structuredOutputSchemaPath,
 					acceptance: pr.acceptance,
@@ -4245,6 +4249,7 @@ export async function runSubagent(
 							review: pr.review,
 							timeoutRecovery: pr.timeoutRecovery,
 							structuredOutput: pr.structuredOutput,
+							structuredOutputFailed: pr.structuredOutputFailed,
 						structuredOutputPath: pr.structuredOutputPath,
 						structuredOutputSchemaPath: pr.structuredOutputSchemaPath,
 						acceptance: pr.acceptance,
@@ -4539,6 +4544,7 @@ export async function runSubagent(
 				review: singleResult.review,
 				timeoutRecovery: singleResult.timeoutRecovery,
 				structuredOutput: singleResult.structuredOutput,
+				structuredOutputFailed: singleResult.structuredOutputFailed,
 				structuredOutputPath: singleResult.structuredOutputPath,
 				structuredOutputSchemaPath: singleResult.structuredOutputSchemaPath,
 				acceptance: singleResult.acceptance,
@@ -4923,6 +4929,7 @@ export async function runSubagent(
 				review: r.review,
 				effects: r.effects,
 				structuredOutput: r.structuredOutput,
+				structuredOutputFailed: r.structuredOutputFailed,
 				structuredOutputPath: r.structuredOutputPath,
 				structuredOutputSchemaPath: r.structuredOutputSchemaPath,
 				acceptance: r.acceptance,

package/dist/extensions/pi-subagents/src/runs/background/workflow-terminal-proof.ts

@@ -0,0 +1,67 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { AsyncStatus, ProcessTerminal, WorkflowChildSummary, WorkflowTerminalProof } from "../../shared/types.ts";
+import { readStatus } from "../../shared/utils.ts";
+import { readProcessTerminal } from "./process-terminal.ts";
+
+const TERMINAL_WORKFLOW_STATES = new Set<WorkflowChildSummary["workflowState"]>(["completed", "failed", "stopped"]);
+
+export function isTerminalAsyncState(state: AsyncStatus["state"]): boolean {
+	return state !== "queued" && state !== "running" && state !== "paused";
+}
+
+export type WorkflowChildProcessEvidence =
+	| { state: "observed"; children: ProcessTerminal[] }
+	| { state: "pending" | "unknown"; reason: string };
+
+/**
+ * Process evidence for a workflow's async children. Status proofs and capacity
+ * release both use this so they cannot disagree about the same workflow.
+ * Synchronous children run inside the workflow host and have no process of their own.
+ */
+export function readWorkflowChildProcessEvidence(workflowAsyncDir: string, steps: AsyncStatus["steps"]): WorkflowChildProcessEvidence {
+	const children: ProcessTerminal[] = [];
+	for (const step of steps ?? []) {
+		const label = step.workflowKey ?? step.agent;
+		if (typeof step.async !== "boolean") return { state: "unknown", reason: `workflow child ${label} is missing async classification` };
+		if (!step.async) continue;
+		if (!step.runId || path.basename(step.runId) !== step.runId) return { state: "unknown", reason: `async workflow child ${label} is missing run id` };
+		const childDir = path.join(path.dirname(workflowAsyncDir), step.runId);
+		if (!fs.existsSync(childDir)) return { state: "unknown", reason: `async workflow child ${label} directory is missing` };
+		const childStatus = readStatus(childDir);
+		if (!childStatus) return { state: "unknown", reason: `async workflow child ${label} status is missing or unreadable` };
+		if (!isTerminalAsyncState(childStatus.state)) return { state: "pending", reason: `async workflow child ${label} is still ${childStatus.state}` };
+		const recorded = childStatus.processTerminal;
+		if (!recorded?.runnerProcessInstanceId) return { state: "unknown", reason: `async workflow child ${label} has no runner process identity` };
+		// A runner startup failure records `not-started` in status and never writes a process-terminal sidecar.
+		if (recorded.state === "not-started" && recorded.runId === step.runId && typeof childStatus.error === "string" && childStatus.error) {
+			children.push(recorded);
+			continue;
+		}
+		const proof = readProcessTerminal(childDir, { runId: step.runId, runnerProcessInstanceId: recorded.runnerProcessInstanceId });
+		if (proof?.state !== "observed" || proof.runId !== step.runId) {
+			return { state: !proof || proof.state === "pending" ? "pending" : "unknown", reason: `async workflow child ${label} process-terminal proof is ${proof?.state ?? "missing"}` };
+		}
+		children.push(proof);
+	}
+	return { state: "observed", children };
+}
+
+function unresolved(runId: string, state: "pending" | "unknown", dispatchClosed: boolean, reason: string): WorkflowTerminalProof {
+	return { version: 1, kind: "workflow", runId, state, dispatchClosed, reason };
+}
+
+/** A persistent workflow host is terminal only after dispatch closes and every async child has process evidence. */
+export function readWorkflowTerminalProof(asyncDir: string, steps: AsyncStatus["steps"], summary: WorkflowChildSummary, hostCommandCount: number, closedAt: number): WorkflowTerminalProof {
+	const runId = summary.workflowRunId;
+	if (!summary.inventoryComplete || !TERMINAL_WORKFLOW_STATES.has(summary.workflowState)) {
+		return unresolved(runId, "pending", false, "Workflow dispatch is still open.");
+	}
+	if (hostCommandCount > 0) {
+		return unresolved(runId, "unknown", true, "Workflow host commands have no process-terminal proof.");
+	}
+	const evidence = readWorkflowChildProcessEvidence(asyncDir, steps);
+	if (evidence.state !== "observed") return unresolved(runId, evidence.state, true, evidence.reason);
+	const observedAt = Math.max(closedAt, ...evidence.children.map((child) => child.state === "observed" ? child.observedAt : 0));
+	return { version: 1, kind: "workflow", runId, state: "observed", dispatchClosed: true, observedAt, children: evidence.children };
+}