@selesai/code 0.13.31 → 0.13.33

package/dist/extensions/pi-subagents/test/unit/child-tool-plan-permission-system.test.ts

@@ -11,6 +11,7 @@ import * as path from "node:path";
 import { afterEach, describe, it } from "node:test";
 import { buildInProcessChildLaunch, type BuildInProcessChildLaunchInput } from "../../src/runs/shared/child-launch.ts";
 import {
+	CAPABILITY_GATEWAY_EXTENSION_PATH,
 	resolvePermissionSystemExtension,
 	resolvePiLaunchToolPlan,
 } from "../../src/runs/shared/child-tool-plan.ts";
@@ -19,6 +20,7 @@ const originalEnv = {
 	HOME: process.env.HOME,
 	USERPROFILE: process.env.USERPROFILE,
 	SELESAI_CODING_AGENT_DIR: process.env.SELESAI_CODING_AGENT_DIR,
+	SELESAI_CAPABILITY_GATEWAY: process.env.SELESAI_CAPABILITY_GATEWAY,
 };
 const tempRoots: string[] = [];
 
@@ -33,6 +35,7 @@ function createFixture() {
 	process.env.HOME = home;
 	process.env.USERPROFILE = home;
 	process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+	delete process.env.SELESAI_CAPABILITY_GATEWAY;
 	process.chdir(projectDir);
 	return { root, agentDir, projectDir };
 }
@@ -397,3 +400,98 @@ describe("child launch <active_agent> tag injection", () => {
 		);
 	});
 });
+
+describe("capability gateway child runtime policy", () => {
+	const gatewayTools = ["capability_catalog", "capability_discover", "capability_skill_show"];
+
+	for (const host of ["parent", "runner"] as const) {
+		it(`adds only gateway controls for extension-permitted ${host} children`, () => {
+			const { agentDir } = createFixture();
+			process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+
+			const launch = buildInProcessChildLaunch(childLaunch({ host, tools: ["read", "web_explore"] }));
+			assert.equal(launch.toolPlan.capabilityGatewayEnabled, true);
+			assert.ok(launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			assert.deepEqual(launch.session.tools, ["read", "web_explore", ...gatewayTools]);
+			assert.ok(gatewayTools.every((tool) => launch.toolPlan.requiredChildTools.includes(tool)));
+			if (host === "runner") {
+				assert.equal(launch.session.ambientExtensions, true);
+				assert.ok(launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			} else {
+				assert.equal(launch.session.ambientExtensions, false);
+				assert.equal(launch.session.processEnv, undefined);
+			}
+		});
+	}
+
+	it("keeps omitted tools unrestricted without synthesizing an explicit allowlist", () => {
+		const { agentDir } = createFixture();
+		process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+		const launch = buildInProcessChildLaunch(childLaunch({ host: "runner" }));
+		assert.equal(launch.toolPlan.capabilityGatewayEnabled, true);
+		assert.equal(launch.session.tools, undefined);
+		assert.ok(launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+	});
+
+	for (const host of ["parent", "runner"] as const) {
+		it(`skips gateway for ${host} children with an explicit empty tool set`, () => {
+			const { agentDir } = createFixture();
+			process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+
+			const launch = buildInProcessChildLaunch(childLaunch({ host, tools: [] }));
+			assert.equal(launch.toolPlan.capabilityGatewayEnabled, false);
+			assert.deepEqual(launch.session.tools, []);
+			assert.ok(!launch.toolPlan.extensionArgs.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			assert.ok(!launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+		});
+	}
+
+	it("does not widen a capability ceiling and honors explicit extension policy", () => {
+		const { agentDir, projectDir } = createFixture();
+		process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+		const limited = resolvePiLaunchToolPlan({
+			tools: ["read", "web_explore"],
+			capabilityCeiling: { version: 1, allowedTools: ["read", "web_explore"], denyExtensions: false, sources: ["test"] },
+		});
+		assert.equal(limited.capabilityGatewayEnabled, false);
+		assert.deepEqual(limited.effectiveToolAllowlist, ["read", "web_explore"]);
+		assert.ok(!limited.extensionArgs.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+
+		const explicitBlock = resolvePiLaunchToolPlan({
+			tools: ["read"],
+			extensions: [path.join(projectDir, "other-extension.ts")],
+		});
+		assert.equal(explicitBlock.capabilityGatewayEnabled, false);
+		assert.ok(!explicitBlock.extensionArgs.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+
+		const explicitOptIn = resolvePiLaunchToolPlan({
+			tools: ["read"],
+			extensions: [],
+			subagentOnlyExtensions: [path.dirname(CAPABILITY_GATEWAY_EXTENSION_PATH)],
+		});
+		assert.equal(explicitOptIn.capabilityGatewayEnabled, true);
+		assert.ok(explicitOptIn.extensionArgs.includes(path.dirname(CAPABILITY_GATEWAY_EXTENSION_PATH)));
+		assert.ok(explicitOptIn.effectiveToolAllowlist.includes("capability_discover"));
+	});
+
+	for (const host of ["parent", "runner"] as const) {
+		it(`does not load or authorize the gateway for ${host} children with denyExtensions`, () => {
+			const { agentDir } = createFixture();
+			process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+
+			const launch = buildInProcessChildLaunch(childLaunch({
+				host,
+				tools: ["read"],
+				subagentOnlyExtensions: [CAPABILITY_GATEWAY_EXTENSION_PATH],
+				capabilityCeiling: { version: 1, allowedTools: ["read"], denyExtensions: true, sources: ["test"] },
+			}));
+			assert.equal(launch.toolPlan.capabilityGatewayEnabled, false);
+			assert.deepEqual(launch.session.tools, ["read"]);
+			assert.ok(!launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			assert.ok(!launch.toolPlan.requiredChildTools.some((tool) => tool.startsWith("capability_")));
+			if (host === "runner") {
+				assert.equal(launch.session.ambientExtensions, false);
+			}
+		});
+	}
+});

package/dist/extensions/pi-subagents/test/unit/child-tool-plan.test.ts

@@ -19,6 +19,17 @@ function runtimeSnapshotHost(serverName: string): McpRuntimeSnapshotHost {
 }
 
 describe("child tool plan", () => {
+	it("requires fanout authorization for the child supervisor reply tool", () => {
+		assert.throws(() => resolvePiLaunchToolPlan({ tools: ["read", "subagent_supervisor"] }), /subagent_supervisor.*requires fanout authorization/);
+		assert.throws(() => resolvePiLaunchToolPlan({ tools: ["read", "subagent", "subagent_supervisor"], excludeTools: ["subagent"] }), /subagent_supervisor.*requires fanout authorization/);
+		assert.throws(() => resolvePiLaunchToolPlan({
+			tools: ["read", "subagent", "subagent_supervisor"],
+			capabilityCeiling: { version: 1, allowedTools: ["read", "subagent_supervisor"], sources: ["test"] },
+		}), /subagent_supervisor.*requires fanout authorization/);
+		assert.equal(resolvePiLaunchToolPlan({ tools: ["read", "subagent", "subagent_supervisor"] }).fanoutAuthorized, true);
+		assert.equal(resolvePiLaunchToolPlan({ tools: ["read", "subagent_supervisor"], allowNestedSubagents: true }).fanoutAuthorized, true);
+	});
+
 	it("fails a launch that selects MCP tools from the adapter's runtime snapshot", () => {
 		const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-runtime-mcp-"));
 		try {

package/dist/extensions/pi-subagents/test/unit/completion-guard.test.ts

@@ -7,6 +7,7 @@ import {
 	evaluateCompletionMutationGuard,
 	expectsImplementationMutation,
 	hasMutationToolCall,
+	hasMutationToolCapability,
 	validateImplementationToolContract,
 } from "../../src/runs/shared/completion-guard.ts";
 import { isMutatingTool } from "../../src/runs/shared/long-running-guard.ts";
@@ -500,6 +501,17 @@ test("edit and write tool calls count as mutation attempts", () => {
 	assert.equal(hasMutationToolCall([assistantToolCall("write", { path: "a.ts" })]), true);
 });
 
+test("capability gateway controls never count as mutation capability", () => {
+	const gatewayTools = ["capability_catalog", "capability_discover", "capability_skill_show"];
+	assert.equal(hasMutationToolCapability(["read", "grep", ...gatewayTools], undefined), false);
+	assert.equal(validateImplementationToolContract({
+		agent: "worker",
+		task: "Implement the requested source fix.",
+		tools: ["read", "grep", "find", "ls", "contact_supervisor", ...gatewayTools],
+	}), "Agent 'worker' was given an implementation task, but its tool allowlist has no mutation-capable tools. Add bash, edit, write, or another mutation-capable tool to the agent, or use a read-only task/agent.");
+	assert.equal(hasMutationToolCapability(["read", "web_explore"], undefined), true);
+});
+
 test("declared extension mutation tools count without weakening unknown tools", () => {
 	const messages = [assistantToolCall("replace", { remove_from: "Liv" })];
 	assert.equal(hasMutationToolCall(messages), false);

package/dist/extensions/pi-subagents/test/unit/external-cli-runner.test.ts

@@ -43,6 +43,31 @@ describe("external CLI runner", () => {
 		}
 	});
 
+	it("strips inherited Git routing vars but honors an explicit environment allowlist", async () => {
+		const dir = tempDir();
+		const inherited = { GIT_DIR: "/outer/repo/.git", GIT_AUTHOR_NAME: "Kept Author" };
+		const previous = Object.fromEntries(Object.keys(inherited).map((key) => [key, process.env[key]]));
+		Object.assign(process.env, inherited);
+		const script = "process.stdout.write(JSON.stringify({gitDir:process.env.GIT_DIR??null,author:process.env.GIT_AUTHOR_NAME??null}))";
+		try {
+			const defaultEnv = await runExternalCli({ command: process.execPath, args: ["-e", script], cwd: dir, prompt: "x", asyncDir: dir, stepIndex: 1 });
+			assert.equal(defaultEnv.exitCode, 0);
+			assert.deepEqual(JSON.parse(defaultEnv.output), { gitDir: null, author: "Kept Author" });
+
+			const explicitEnv = await runExternalCli({
+				command: process.execPath, args: ["-e", script], cwd: dir, prompt: "x", asyncDir: dir, stepIndex: 2,
+				environment: { allowlist: ["GIT_DIR"] },
+			});
+			assert.equal(explicitEnv.exitCode, 0);
+			assert.deepEqual(JSON.parse(explicitEnv.output), { gitDir: "/outer/repo/.git", author: null });
+		} finally {
+			for (const [key, value] of Object.entries(previous)) {
+				if (value === undefined) delete process.env[key];
+				else process.env[key] = value;
+			}
+		}
+	});
+
 	it("delivers the combined prompt only through stdin and preserves argv", async () => {
 		const dir = tempDir();
 		const prompt = buildExternalCliPrompt("Follow exactly.", "Review $HOME; echo nope");

package/dist/extensions/pi-subagents/test/unit/git-environment.test.ts

@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { omitGitRoutingEnv } from "../../src/runs/shared/git-environment.ts";
+
+const GIT_ROUTING_ENV = {
+	GIT_ALTERNATE_OBJECT_DIRECTORIES: "/repo/objects",
+	GIT_COMMON_DIR: "/repo/common",
+	GIT_CONFIG: "/repo/config",
+	GIT_CONFIG_COUNT: "1",
+	GIT_CONFIG_KEY_0: "core.worktree",
+	GIT_CONFIG_PARAMETERS: "'core.worktree=/repo'",
+	GIT_CONFIG_VALUE_0: "/repo",
+	GIT_DIR: "/repo/.git",
+	GIT_GRAFT_FILE: "/repo/grafts",
+	GIT_IMPLICIT_WORK_TREE: "1",
+	GIT_INDEX_FILE: "/repo/index",
+	GIT_NAMESPACE: "tenant",
+	GIT_NO_REPLACE_OBJECTS: "1",
+	GIT_OBJECT_DIRECTORY: "/repo/object-dir",
+	GIT_PREFIX: "src/",
+	GIT_REPLACE_REF_BASE: "refs/replace/",
+	GIT_SHALLOW_FILE: "/repo/shallow",
+	GIT_WORK_TREE: "/repo",
+};
+
+describe("omitGitRoutingEnv", () => {
+	it("removes inherited repository routing and keeps unrelated values", () => {
+		assert.deepEqual(omitGitRoutingEnv({ ...GIT_ROUTING_ENV, KEEP_ME: "yes" }), { KEEP_ME: "yes" });
+	});
+
+	it("removes every indexed Git config entry", () => {
+		assert.deepEqual(omitGitRoutingEnv({ GIT_CONFIG_KEY_17: "user.name", GIT_CONFIG_VALUE_17: "Test", KEEP_ME: "yes" }), { KEEP_ME: "yes" });
+	});
+
+	it("matches names case-insensitively, as Windows and Git for Windows do", () => {
+		assert.deepEqual(omitGitRoutingEnv({ git_dir: "/repo/.git", Git_Work_Tree: "/repo", git_config_key_0: "core.bare", KEEP_ME: "yes" }), { KEEP_ME: "yes" });
+	});
+});

package/dist/extensions/pi-subagents/test/unit/preflight.test.ts

@@ -857,7 +857,9 @@ Project prompt.
 		assert.equal(result.ok, true);
 		if (!result.ok) return;
 		assert.deepEqual(result.contract.tools.excludeTools, ["write", "unknown_tool"]);
-		assert.deepEqual(result.contract.tools.effectiveAllowlist, ["read"]);
+		// An explicit tool surface also gets the scoped capability gateway tools, which
+		// this launch does not exclude (see the capability-gateway child policy tests).
+		assert.deepEqual(result.contract.tools.effectiveAllowlist, ["read", "capability_catalog", "capability_discover", "capability_skill_show"]);
 		assert.match(result.contract.launchContractDigest, /^[a-f0-9]{64}$/);
 	});
 

package/dist/extensions/pi-subagents/test/unit/rpc.test.ts

@@ -5,6 +5,7 @@ import * as path from "node:path";
 import { describe, it } from "node:test";
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
 import { consumeStopRequestPayload, stopRequestPath, stopRequestsDir } from "../../src/runs/background/control-channel.ts";
+import { getArtifactPaths, getArtifactsDir } from "../../src/shared/artifacts.ts";
 import {
 	SUBAGENT_RPC_PROTOCOL_VERSION,
 	SUBAGENT_RPC_READY_EVENT,
@@ -13,7 +14,7 @@ import {
 	subagentRpcReplyEvent,
 	type SubagentRpcReplyEnvelope,
 } from "../../src/extension/rpc.ts";
-import { SUBAGENT_CHILD_STATUS_EVENT, type Details, type SubagentChildStatusEvent, type SubagentState } from "../../src/shared/types.ts";
+import { DIRS, SUBAGENT_CHILD_STATUS_EVENT, type Details, type SubagentChildStatusEvent, type SubagentState } from "../../src/shared/types.ts";
 
 class FakeEvents {
 	readonly emitted: Array<{ event: string; data: unknown }> = [];
@@ -117,6 +118,8 @@ describe("subagent extension RPC bridge", () => {
 			(reply as { data: { capabilities?: { statusProjection?: unknown } } }).data.capabilities?.statusProjection,
 			{ version: 1, untargeted: "in-memory-when-ready", targeted: "executor" },
 		);
+		assert.deepEqual((reply as { data: { capabilities?: { cost?: unknown } } }).data.capabilities?.cost, { version: 1 });
+		assert.ok((reply as { data: { methods?: string[] } }).data.methods?.includes("cost"));
 
 		bridge.dispose();
 	});
@@ -1147,4 +1150,105 @@ describe("subagent extension RPC bridge", () => {
 			fs.rmSync(root, { recursive: true, force: true });
 		}
 	});
+
+	it("answers cost with structured parent-plus-child accounting from the session branch", async () => {
+		const events = new FakeEvents();
+		const childUsage = { input: 8, output: 3, cacheRead: 5, cacheWrite: 0, cost: 0.25, turns: 1 };
+		const branch = [
+			{ type: "message", message: { role: "assistant", usage: { input: 15, output: 3, cacheRead: 30, cacheWrite: 0, cost: { total: 0.25 } } } },
+			{ type: "message", message: { role: "toolResult", toolName: "subagent", details: { mode: "single", results: [{ agent: "reviewer", runId: "run-a", usage: childUsage, sessionFile: "/sessions/child-a.jsonl" }] } } },
+			{ type: "message", message: { role: "toolResult", toolName: "bg_wait", details: { mode: "single", results: [], completions: [{ mode: "single", runId: "run-a", results: [{ agent: "reviewer", runId: "run-a", usage: childUsage }] }] } } },
+		];
+		const bridge = registerSubagentRpcBridge({
+			events,
+			getContext: () => ({
+				cwd: "/repo",
+				sessionManager: { getSessionId: () => "session-123", getSessionFile: () => "/sessions/parent.jsonl", getBranch: () => branch },
+			}) as any,
+			execute: async () => assert.fail("cost should not call executor"),
+			state: { baseCwd: "/repo" } as SubagentState,
+		});
+
+		const reply = await request(events, "cost-1", "cost");
+		assert.equal(reply.success, true);
+		assert.equal(reply.method, "cost");
+		const data = (reply as { data: { version: number; parent: Record<string, number>; children: Array<{ agent?: string; runId?: string }>; childTotal: Record<string, number>; total: Record<string, number>; unresolvedAsyncChildren: number } }).data;
+		assert.equal(data.version, 1);
+		assert.deepEqual(data.parent, { input: 15, output: 3, cacheRead: 30, cacheWrite: 0, cost: 0.25, turns: 1 });
+		assert.equal(data.children.length, 1, "run identity deduplicates the bg_wait completion");
+		assert.equal(data.children[0]?.agent, "reviewer");
+		assert.equal(data.children[0]?.runId, "run-a");
+		assert.deepEqual(data.childTotal, childUsage);
+		assert.deepEqual(data.total, { input: 23, output: 6, cacheRead: 35, cacheWrite: 0, cost: 0.5, turns: 2 });
+		assert.equal(data.unresolvedAsyncChildren, 0);
+
+		const rejected = await request(events, "cost-2", "cost", "not-an-object");
+		assert.equal(rejected.success, false);
+		assert.equal((rejected as { error: { code: string } }).error.code, "invalid_params");
+		bridge.dispose();
+	});
+
+	it("answers cost with receipt-recovered async usage and an unresolved lower bound", async () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-rpc-cost-async-"));
+		const workflowRunId = `workflow-rpc-cost-${process.pid}-${Date.now()}`;
+		const recoveredRunId = `child-rpc-cost-${process.pid}-${Date.now()}`;
+		const unresolvedRunId = `child-rpc-cost-missing-${process.pid}-${Date.now()}`;
+		const unresolvedWorkflowRunId = `workflow-rpc-cost-missing-${process.pid}-${Date.now()}`;
+		const asyncDir = path.join(DIRS.async, workflowRunId);
+		try {
+			const sessionFile = path.join(root, "sessions", "parent.jsonl");
+			const artifactsDir = getArtifactsDir(sessionFile, root, "session");
+			const metadataPath = getArtifactPaths(artifactsDir, recoveredRunId, "reviewer", 0).metadataPath;
+			fs.mkdirSync(path.dirname(sessionFile), { recursive: true });
+			fs.writeFileSync(sessionFile, "", "utf-8");
+			fs.mkdirSync(asyncDir, { recursive: true });
+			fs.mkdirSync(path.dirname(metadataPath), { recursive: true });
+			fs.writeFileSync(path.join(asyncDir, "workflow-receipt.json"), JSON.stringify({
+				version: 1, workflowRunId, state: "complete", createdAt: Date.now(),
+				entries: {
+					recovered: { key: "recovered", agent: "reviewer", latestRunId: recoveredRunId, continuation: { runIds: [recoveredRunId] }, resumability: { state: "resumable" } },
+					unresolved: { key: "unresolved", agent: "worker", latestRunId: unresolvedRunId, continuation: { runIds: [unresolvedRunId] }, resumability: { state: "resumable" } },
+					nestedWorkflow: { key: "nestedWorkflow", latestRunId: unresolvedWorkflowRunId, continuation: { runIds: [unresolvedWorkflowRunId] }, resumability: { state: "resumable" } },
+				},
+			}, null, 2), "utf-8");
+			const recoveredUsage = { input: 20, output: 4, cacheRead: 80, cacheWrite: 0, cost: 0.5, turns: 2 };
+			fs.writeFileSync(metadataPath, JSON.stringify({ runId: recoveredRunId, agent: "reviewer", usage: recoveredUsage }), "utf-8");
+
+			const events = new FakeEvents();
+			const bridge = registerSubagentRpcBridge({
+				events,
+				getContext: () => ({
+					cwd: root,
+					sessionManager: {
+						getSessionId: () => "session-async-cost",
+						getSessionFile: () => sessionFile,
+						getBranch: () => [{ type: "message", message: { role: "toolResult", toolName: "subagent", details: { mode: "workflow", runId: workflowRunId, results: [] } } }],
+					},
+				}) as any,
+				execute: async () => assert.fail("cost should not call executor"),
+				state: { baseCwd: root, artifactDirPreference: "session" } as SubagentState,
+			});
+
+			const reply = await request(events, "cost-async", "cost");
+			assert.equal(reply.success, true);
+			const data = (reply as { data: { children: Array<{ agent?: string; runId?: string }>; childTotal: Record<string, number>; total: Record<string, number>; unresolvedAsyncChildren: number } }).data;
+			assert.deepEqual(data.children.map(({ agent, runId }) => ({ agent, runId })), [{ agent: "reviewer", runId: recoveredRunId }]);
+			assert.deepEqual(data.childTotal, recoveredUsage);
+			assert.deepEqual(data.total, recoveredUsage, "totals remain a lower bound when metadata is unavailable");
+			assert.equal(data.unresolvedAsyncChildren, 2);
+			bridge.dispose();
+		} finally {
+			fs.rmSync(asyncDir, { recursive: true, force: true });
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
+	it("cost requires an active session context like every non-ping method", async () => {
+		const events = new FakeEvents();
+		const bridge = registerSubagentRpcBridge({ events, getContext: () => null, execute: async () => assert.fail("cost should not call executor") });
+		const reply = await request(events, "cost-3", "cost");
+		assert.equal(reply.success, false);
+		assert.equal((reply as { error: { code: string } }).error.code, "no_active_session");
+		bridge.dispose();
+	});
 });

package/dist/extensions/pi-subagents/test/unit/run-status.test.ts

@@ -1630,4 +1630,40 @@ describe("async run status inspection", () => {
 			fs.rmSync(root, { recursive: true, force: true });
 		}
 	});
+
+	it("returns a workflow terminal proof after every async child exits", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-run-status-workflow-terminal-"));
+		try {
+			const asyncRoot = path.join(root, "runs");
+			const asyncDir = path.join(asyncRoot, "workflow-parent");
+			const childDir = path.join(asyncRoot, "child-run");
+			fs.mkdirSync(asyncDir, { recursive: true });
+			fs.mkdirSync(childDir);
+			const childProof = {
+				version: 1, state: "observed", runId: "child-run", runnerProcessInstanceId: "runner-1", observedAt: 300,
+				instances: [{ kind: "runner", processInstanceId: "runner-1", closeObservedAt: 300, exitCode: 0, signal: null }],
+			};
+			fs.writeFileSync(path.join(childDir, "process-terminal.json"), JSON.stringify(childProof));
+			fs.writeFileSync(path.join(childDir, "status.json"), JSON.stringify({
+				runId: "child-run", mode: "single", state: "complete", startedAt: 100, lastUpdate: 300,
+				processTerminal: { version: 1, state: "pending", runId: "child-run", runnerProcessInstanceId: "runner-1" },
+			}));
+			fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({
+				runId: "workflow-parent", mode: "workflow", state: "complete", startedAt: 100, lastUpdate: 200, endedAt: 250,
+				steps: [{ agent: "worker", workflowKey: "main", runId: "child-run", async: true, status: "completed" }],
+				workflowChildren: {
+					version: 1, parentToolCallId: "tool-call", workflowRunId: "workflow-parent", inventoryComplete: true,
+					workflowState: "completed", children: [{ childId: "main", runId: "child-run", state: "completed" }],
+				},
+			}, null, 2), "utf-8");
+
+			const result = inspectSubagentStatus({ id: "workflow-parent" }, { asyncDirRoot: asyncRoot, resultsDir: path.join(root, "results") });
+			assert.deepEqual(result.details.workflowTerminalProof, {
+				version: 1, kind: "workflow", runId: "workflow-parent", state: "observed", dispatchClosed: true,
+				observedAt: 300, children: [childProof],
+			});
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
 });

package/dist/extensions/pi-subagents/test/unit/structured-output-rejection.test.ts

@@ -0,0 +1,67 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { Message } from "@earendil-works/pi-ai";
+import {
+	formatStructuredOutputRejectionError,
+	INVALID_STRUCTURED_OUTPUT_SCHEMA_ERROR,
+	MAX_STRUCTURED_OUTPUT_REJECTION_ERROR_BYTES,
+	STRUCTURED_OUTPUT_REJECTION_ERROR,
+	STRUCTURED_OUTPUT_VALIDATOR_UNAVAILABLE_ERROR,
+} from "../../src/runs/shared/structured-output.ts";
+
+function messages(...values: unknown[]): Message[] {
+	return values as Message[];
+}
+
+describe("structured output rejection evidence", () => {
+	it("uses the latest failed result and correlates results without names by toolCallId", () => {
+		const result = formatStructuredOutputRejectionError(messages(
+			{ role: "assistant", content: [{ type: "toolCall", id: "structured-1", name: "structured_output", arguments: { value: {} } }] },
+			{ role: "toolResult", toolCallId: "structured-1", isError: true, content: [{ type: "text", text: "Structured output validation failed: first: is required" }] },
+			{ role: "toolResult", toolName: "structured_output", toolCallId: "structured-2", isError: true, content: [{ type: "text", text: "Structured output validation failed: second: is required" }] },
+		));
+
+		assert.equal(result, "Structured output validation failed: second: is required");
+	});
+
+	it("ignores unrelated failures and returns a truthful fallback", () => {
+		const result = formatStructuredOutputRejectionError(messages(
+			{ role: "toolResult", toolName: "read", isError: true, content: [{ type: "text", text: "EISDIR" }] },
+		));
+
+		assert.equal(result, STRUCTURED_OUTPUT_REJECTION_ERROR);
+	});
+
+	it("does not expose schema compiler diagnostics", () => {
+		const sentinel = "PRIVATE_SCHEMA_SENTINEL";
+		const result = formatStructuredOutputRejectionError(messages(
+			{ role: "toolResult", toolName: "structured_output", isError: true, content: [{ type: "text", text: `Structured output validation failed: invalid outputSchema: Invalid regular expression: /${sentinel}_[invalid/u` }] },
+		));
+
+		assert.equal(result, INVALID_STRUCTURED_OUTPUT_SCHEMA_ERROR);
+		assert.equal(result.includes(sentinel), false);
+	});
+
+	it("categorizes unavailable validation without exposing setup details", () => {
+		const sentinel = "PRIVATE_SETUP_SENTINEL";
+		const result = formatStructuredOutputRejectionError(messages(
+			{ role: "toolResult", toolName: "structured_output", isError: true, content: [{ type: "text", text: `Cannot load typebox/compile for structured output validation (direct import failed: ${sentinel} at /private/compiler.ts)` }] },
+		));
+
+		assert.equal(result, STRUCTURED_OUTPUT_VALIDATOR_UNAVAILABLE_ERROR);
+		assert.equal(result.includes(sentinel), false);
+	});
+
+	it("redacts payload and stack details and clamps complete UTF-8 characters", () => {
+		const secret = "do-not-leak";
+		const oversized = `Structured output validation failed: ${"界".repeat(2_000)}\nsubmitted value: ${secret}\n    at /private/project/file.ts:1:1`;
+		const result = formatStructuredOutputRejectionError(messages(
+			{ role: "toolResult", toolName: "structured_output", isError: true, content: [{ type: "text", text: oversized }] },
+		));
+
+		assert.ok(Buffer.byteLength(result, "utf8") <= MAX_STRUCTURED_OUTPUT_REJECTION_ERROR_BYTES);
+		assert.equal(result.includes("�"), false);
+		assert.equal(result.includes(secret), false);
+		assert.equal(result.includes("/private/project"), false);
+	});
+});

package/dist/extensions/pi-subagents/test/unit/workflow-terminal-proof.test.ts

@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, it } from "node:test";
+import type { AsyncStatus, ProcessTerminal, WorkflowChildSummary } from "../../src/shared/types.ts";
+import { readWorkflowTerminalProof } from "../../src/runs/background/workflow-terminal-proof.ts";
+
+type Steps = NonNullable<AsyncStatus["steps"]>;
+
+function summary(overrides: Partial<WorkflowChildSummary> = {}): WorkflowChildSummary {
+	return {
+		version: 1,
+		parentToolCallId: "parent-tool-call",
+		workflowRunId: "workflow-run",
+		inventoryComplete: true,
+		workflowState: "completed",
+		children: [{ childId: "main", runId: "child-run", state: "completed" }],
+		...overrides,
+	};
+}
+
+const asyncChild = [{ agent: "worker", workflowKey: "main", runId: "child-run", async: true, status: "completed" }] as Steps;
+
+function observedChild(): ProcessTerminal {
+	return {
+		version: 1,
+		state: "observed",
+		runId: "child-run",
+		runnerProcessInstanceId: "runner-1",
+		observedAt: 1_234,
+		instances: [{ kind: "runner", processInstanceId: "runner-1", closeObservedAt: 1_234, exitCode: 0, signal: null }],
+	};
+}
+
+function withFixture(run: (dirs: { root: string; asyncDir: string; writeChild: (status: object, proof?: ProcessTerminal) => void }) => void): void {
+	const root = fs.mkdtempSync(path.join(os.tmpdir(), "workflow-terminal-proof-"));
+	const asyncDir = path.join(root, "workflow-run");
+	fs.mkdirSync(asyncDir, { recursive: true });
+	const writeChild = (status: object, proof?: ProcessTerminal) => {
+		const childDir = path.join(root, "child-run");
+		fs.mkdirSync(childDir, { recursive: true });
+		fs.writeFileSync(path.join(childDir, "status.json"), JSON.stringify({ runId: "child-run", mode: "single", startedAt: 1, lastUpdate: 2, ...status }));
+		if (proof) fs.writeFileSync(path.join(childDir, "process-terminal.json"), JSON.stringify(proof));
+	};
+	try {
+		run({ root, asyncDir, writeChild });
+	} finally {
+		fs.rmSync(root, { recursive: true, force: true });
+	}
+}
+
+const runnerIdentity = { version: 1, runId: "child-run", runnerProcessInstanceId: "runner-1" };
+
+describe("readWorkflowTerminalProof", () => {
+	it("keeps an open inventory pending", () => withFixture(({ asyncDir }) => {
+		assert.deepEqual(readWorkflowTerminalProof(asyncDir, asyncChild, summary({ inventoryComplete: false, workflowState: "running" }), 0, 2_000), {
+			version: 1, kind: "workflow", runId: "workflow-run", state: "pending", dispatchClosed: false, reason: "Workflow dispatch is still open.",
+		});
+	}));
+
+	it("keeps closed dispatch pending until the child's exit is observed", () => withFixture(({ asyncDir, writeChild }) => {
+		writeChild({ state: "complete", processTerminal: { ...runnerIdentity, state: "pending" } });
+		assert.deepEqual(readWorkflowTerminalProof(asyncDir, asyncChild, summary(), 0, 2_000), {
+			version: 1, kind: "workflow", runId: "workflow-run", state: "pending", dispatchClosed: true,
+			reason: "async workflow child main process-terminal proof is missing",
+		});
+	}));
+
+	it("returns observed after every async child has writer-exit evidence", () => withFixture(({ asyncDir, writeChild }) => {
+		const proof = observedChild();
+		writeChild({ state: "complete", processTerminal: { ...runnerIdentity, state: "pending" } }, proof);
+		assert.deepEqual(readWorkflowTerminalProof(asyncDir, asyncChild, summary({ workflowState: "stopped" }), 0, 1_000), {
+			version: 1, kind: "workflow", runId: "workflow-run", state: "observed", dispatchClosed: true, observedAt: 1_234, children: [proof],
+		});
+	}));
+
+	it("accepts a child whose runner failed before starting", () => withFixture(({ asyncDir, writeChild }) => {
+		const notStarted = { ...runnerIdentity, state: "not-started" } as ProcessTerminal;
+		writeChild({ state: "failed", error: "runner failed to start", processTerminal: notStarted });
+		assert.deepEqual(readWorkflowTerminalProof(asyncDir, asyncChild, summary({ workflowState: "failed" }), 0, 2_000), {
+			version: 1, kind: "workflow", runId: "workflow-run", state: "observed", dispatchClosed: true, observedAt: 2_000, children: [notStarted],
+		});
+	}));
+
+	it("needs no process evidence for synchronous children that run inside the host", () => withFixture(({ asyncDir }) => {
+		const syncChild = [{ agent: "worker", workflowKey: "main", async: false, status: "completed" }] as Steps;
+		assert.deepEqual(readWorkflowTerminalProof(asyncDir, syncChild, summary({ children: [{ childId: "main", state: "completed" }] }), 0, 2_000), {
+			version: 1, kind: "workflow", runId: "workflow-run", state: "observed", dispatchClosed: true, observedAt: 2_000, children: [],
+		});
+	}));
+
+	it("reports host commands as unknown", () => withFixture(({ asyncDir }) => {
+		assert.deepEqual(readWorkflowTerminalProof(asyncDir, [], summary({ children: [] }), 1, 2_000), {
+			version: 1, kind: "workflow", runId: "workflow-run", state: "unknown", dispatchClosed: true, reason: "Workflow host commands have no process-terminal proof.",
+		});
+	}));
+});

package/dist/extensions/pi-web-agent/src/extension.ts

@@ -104,7 +104,8 @@ export default function extension(pi: ExtensionAPI) {
   pi.on('before_agent_start', async (event) => ({
     systemPrompt:
       `${event.systemPrompt}\n\n` +
-      'For web research questions that require finding and comparing sources, use web_explore. ' +
+      'For requests explicitly mentioning GitHub or open source, use grep_app_search instead of web_explore. ' +
+      'For all other web research questions that require finding and comparing sources, use web_explore. ' +
       'web_explore handles search, fetch, source ranking, and headless escalation internally. ' +
       'If more web evidence is needed after web_explore, call web_explore again with a narrower query; do not use shell/network commands such as curl, Invoke-WebRequest, npm view/search/pack, or direct HTTP URLs for web research.'
   }));