@selesai/code 0.13.32 → 0.13.33

package/dist/extensions/pi-subagents/src/slash/subagent-cost.ts

@@ -0,0 +1,280 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { ExtensionContext } from "@selesai/code";
+import { getArtifactPaths, getArtifactsDir } from "../shared/artifacts.ts";
+import { formatTokens } from "../shared/formatters.ts";
+import { DIRS, SLASH_RESULT_TYPE, type Details, type SingleResult, type SubagentState, type Usage } from "../shared/types.ts";
+import { readStatus } from "../shared/utils.ts";
+import { readWorkflowReceipt } from "../workflows/workflow-receipt.ts";
+import { resolveSlashMessageDetails } from "./slash-live-state.ts";
+
+/** Structured parent-plus-child accounting for one session; the source of `/subagent-cost` and the RPC `cost` method. */
+export interface SubagentCostReport {
+	version: 1;
+	parent: Usage;
+	children: SubagentCostChild[];
+	childTotal: Usage;
+	total: Usage;
+	/** Async children whose usage metadata could not be resolved; the child total is a lower bound when this is non-zero. */
+	unresolvedAsyncChildren: number;
+}
+
+export interface SubagentCostChild {
+	label: string;
+	agent?: string;
+	runId?: string;
+	usage: Usage;
+	sessionFile?: string;
+}
+
+export const SUBAGENT_COST_REPORT_VERSION = 1 as const;
+
+function emptyUsage(): Usage {
+	return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, turns: 0 };
+}
+
+function addUsage(target: Usage, source: Usage): void {
+	target.input += source.input;
+	target.output += source.output;
+	target.cacheRead += source.cacheRead;
+	target.cacheWrite += source.cacheWrite;
+	target.cost += source.cost;
+	target.turns += source.turns;
+}
+
+function usageHasValue(usage: Usage): boolean {
+	return usage.input !== 0 || usage.output !== 0 || usage.cacheRead !== 0 || usage.cacheWrite !== 0 || usage.cost !== 0 || usage.turns !== 0;
+}
+
+function nonNegativeNumber(value: unknown): number | undefined {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+
+function usageFromValue(value: unknown, turnsOverride?: number): Usage | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const record = value as Record<string, unknown>;
+	const costValue = typeof record.cost === "object" && record.cost !== null && !Array.isArray(record.cost)
+		? (record.cost as Record<string, unknown>).total
+		: record.cost;
+	const turnsValue = turnsOverride ?? record.turns;
+	const usage = {
+		input: nonNegativeNumber(record.input) ?? 0,
+		output: nonNegativeNumber(record.output) ?? 0,
+		cacheRead: nonNegativeNumber(record.cacheRead) ?? 0,
+		cacheWrite: nonNegativeNumber(record.cacheWrite) ?? 0,
+		cost: nonNegativeNumber(costValue) ?? 0,
+		turns: nonNegativeNumber(turnsValue) ?? 0,
+	};
+	return Number.isSafeInteger(usage.turns) ? usage : undefined;
+}
+
+function assistantUsageFromMessage(message: unknown): Usage | undefined {
+	if (!message || typeof message !== "object") return undefined;
+	const msg = message as { role?: unknown; usage?: unknown };
+	return msg.role === "assistant" ? usageFromValue(msg.usage, 1) : undefined;
+}
+
+function compactionUsageFromEntry(entry: unknown): Usage | undefined {
+	if (!entry || typeof entry !== "object") return undefined;
+	const record = entry as { type?: unknown; usage?: unknown };
+	return record.type === "compaction" ? usageFromValue(record.usage, 0) : undefined;
+}
+
+const MAX_USAGE_METADATA_BYTES = 2 * 1024 * 1024;
+
+function readUsageMetadata(metadataPath: string): Record<string, unknown> | undefined {
+	let fd: number | undefined;
+	try {
+		fd = fs.openSync(metadataPath, "r");
+		const stat = fs.fstatSync(fd);
+		if (!stat.isFile() || stat.size > MAX_USAGE_METADATA_BYTES) return undefined;
+		const buffer = Buffer.allocUnsafe(stat.size);
+		let offset = 0;
+		while (offset < buffer.length) {
+			const bytesRead = fs.readSync(fd, buffer, offset, buffer.length - offset, null);
+			if (bytesRead <= 0) return undefined;
+			offset += bytesRead;
+		}
+		const value: unknown = JSON.parse(buffer.toString("utf-8"));
+		return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+	} finally {
+		if (fd !== undefined) fs.closeSync(fd);
+	}
+}
+
+function isSubagentDetails(value: unknown): value is Details {
+	if (!value || typeof value !== "object") return false;
+	const details = value as { mode?: unknown; results?: unknown };
+	return typeof details.mode === "string" && Array.isArray(details.results);
+}
+
+function detailsFromSessionEntry(entry: unknown): Details | undefined {
+	if (!entry || typeof entry !== "object") return undefined;
+	const record = entry as { type?: unknown; customType?: unknown; details?: unknown; message?: unknown };
+	if (record.type === "custom_message" && record.customType === SLASH_RESULT_TYPE) {
+		const details = resolveSlashMessageDetails(record.details)?.result.details;
+		return isSubagentDetails(details) ? details : undefined;
+	}
+	if (record.type !== "message" || !record.message || typeof record.message !== "object") return undefined;
+	const message = record.message as { role?: unknown; toolName?: unknown; details?: unknown };
+	if (message.role !== "toolResult" || (message.toolName !== "subagent" && message.toolName !== "bg_wait")) return undefined;
+	return isSubagentDetails(message.details) ? message.details : undefined;
+}
+
+function metadataUsage(
+	artifactsDirs: string[],
+	input: { runId: string; agent: string },
+): Usage | undefined {
+	if (!/^[A-Za-z0-9._-]+$/.test(input.runId)) return undefined;
+	for (const artifactsDir of artifactsDirs) {
+		for (const index of [0, undefined] as const) {
+			const metadataPath = getArtifactPaths(artifactsDir, input.runId, input.agent, index).metadataPath;
+			try {
+				const metadata = readUsageMetadata(metadataPath);
+				if (!metadata) continue;
+				if (metadata.runId !== input.runId || metadata.agent !== input.agent) continue;
+				const usage = usageFromValue(metadata.usage);
+				if (usage && usageHasValue(usage)) return usage;
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code !== "ENOENT") console.error(`Failed to read subagent usage metadata '${metadataPath}':`, error);
+			}
+		}
+	}
+	return undefined;
+}
+
+/**
+ * Collect parent and child usage for the current session branch. Foreground
+ * children come from persisted `subagent`/`bg_wait` tool-result details; async
+ * workflow children are resolved through receipts and artifact metadata.
+ */
+export function collectSubagentCost(
+	ctx: ExtensionContext,
+	state: Pick<SubagentState, "baseCwd" | "artifactDirPreference">,
+): SubagentCostReport {
+	const parent = emptyUsage();
+	const childTotal = emptyUsage();
+	const total = emptyUsage();
+	const children: SubagentCostChild[] = [];
+	const seenChildren = new Set<string>();
+	const workflowRunIds = new Set<string>();
+	let unresolvedAsyncChildren = 0;
+
+	const addChild = (input: { agent?: string; runId?: string; usage?: Usage; sessionFile?: string }): boolean => {
+		if (!input.usage || !usageHasValue(input.usage)) return false;
+		const identity = input.runId ? `run:${input.runId}` : input.sessionFile ? `session:${input.sessionFile}` : undefined;
+		if (identity && seenChildren.has(identity)) return true;
+		if (identity) seenChildren.add(identity);
+		const usage = { ...input.usage };
+		children.push({
+			label: `Child ${children.length + 1} (${input.agent ?? "unknown"})`,
+			...(input.agent ? { agent: input.agent } : {}),
+			...(input.runId ? { runId: input.runId } : {}),
+			usage,
+			...(input.sessionFile ? { sessionFile: input.sessionFile } : {}),
+		});
+		addUsage(childTotal, usage);
+		return true;
+	};
+
+	for (const entry of ctx.sessionManager.getBranch()) {
+		const message = entry.type === "message" ? (entry as { message?: unknown }).message : undefined;
+		const parentUsage = assistantUsageFromMessage(message) ?? compactionUsageFromEntry(entry);
+		if (parentUsage) addUsage(parent, parentUsage);
+		const details = detailsFromSessionEntry(entry);
+		if (!details) continue;
+		if (details.mode === "workflow" && details.runId) workflowRunIds.add(details.runId);
+		for (const result of details.results) {
+			const resultRunId = (result as SingleResult & { runId?: unknown }).runId;
+			addChild({ agent: result.agent, runId: typeof resultRunId === "string" ? resultRunId : undefined, usage: usageFromValue(result.usage), sessionFile: result.sessionFile });
+		}
+		for (const completion of details.completions ?? []) {
+			if (completion.mode === "workflow") workflowRunIds.add(completion.runId);
+			for (const result of completion.results ?? []) {
+				addChild({ agent: result.agent, runId: result.runId, usage: usageFromValue(result.usage), sessionFile: result.sessionFile });
+			}
+		}
+	}
+
+	let sessionFile: string | null = null;
+	try {
+		sessionFile = ctx.sessionManager.getSessionFile() ?? null;
+	} catch { /* an unpersisted session can still report direct child usage */ }
+	const artifactsDirs = new Set<string>();
+	const addArtifactsDir = (cwd: string | undefined): void => {
+		try {
+			artifactsDirs.add(getArtifactsDir(sessionFile, cwd, state.artifactDirPreference));
+		} catch { /* invalid or unavailable project roots are ignored */ }
+	};
+	addArtifactsDir(ctx.cwd);
+	addArtifactsDir(state.baseCwd);
+
+	for (const workflowRunId of workflowRunIds) {
+		try {
+			const status = readStatus(path.join(DIRS.async, workflowRunId));
+			addArtifactsDir(status?.cwd);
+			const receipt = readWorkflowReceipt(DIRS.async, workflowRunId);
+			const summaryChildren = new Map((receipt.workflowChildren?.children ?? []).map((child) => [child.childId, child]));
+			const refsByRunId = new Map<string, { runId: string; agent?: string }>();
+			const addRef = (runId: string | undefined, agent: string | undefined): void => {
+				if (!runId) return;
+				const existing = refsByRunId.get(runId);
+				if (!existing || (!existing.agent && agent)) refsByRunId.set(runId, { runId, ...(agent ? { agent } : {}) });
+			};
+			for (const [key, entry] of Object.entries(receipt.entries)) {
+				const summaryChild = summaryChildren.get(key);
+				const runIds = entry.continuation?.runIds?.length
+					? entry.continuation.runIds
+					: entry.latestRunId ? [entry.latestRunId] : summaryChild?.runId ? [summaryChild.runId] : [];
+				for (const runId of runIds) addRef(runId, entry.agent ?? summaryChild?.agent);
+			}
+			for (const child of receipt.workflowChildren?.children ?? []) {
+				if (!Object.hasOwn(receipt.entries, child.childId)) addRef(child.runId, child.agent);
+			}
+			for (const ref of refsByRunId.values()) {
+				if (seenChildren.has(`run:${ref.runId}`)) continue;
+				if (!ref.agent) {
+					unresolvedAsyncChildren += 1;
+					continue;
+				}
+				const usage = metadataUsage([...artifactsDirs], { runId: ref.runId, agent: ref.agent });
+				if (!usage || !addChild({ ...ref, usage })) unresolvedAsyncChildren += 1;
+			}
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") console.error(`Failed to resolve async subagent usage for '${workflowRunId}':`, error);
+		}
+	}
+
+	addUsage(total, parent);
+	addUsage(total, childTotal);
+	return { version: SUBAGENT_COST_REPORT_VERSION, parent, children, childTotal, total, unresolvedAsyncChildren };
+}
+
+function formatCostUsage(label: string, usage: Usage): string {
+	const extras = [
+		usage.cacheRead ? `cache read ${formatTokens(usage.cacheRead)}` : "",
+		usage.cacheWrite ? `cache write ${formatTokens(usage.cacheWrite)}` : "",
+		usage.turns ? `${usage.turns} turn${usage.turns === 1 ? "" : "s"}` : "",
+	].filter(Boolean);
+	return `${label}: ↑${formatTokens(usage.input)} ↓${formatTokens(usage.output)} $${usage.cost.toFixed(4)}${extras.length ? ` (${extras.join(", ")})` : ""}`;
+}
+
+/** The `/subagent-cost` text rendering of a collected report. */
+export function formatSubagentCostReport(report: SubagentCostReport): string {
+	const lines = [
+		"Subagent cost",
+		"",
+		formatCostUsage("Parent", report.parent),
+	];
+	if (report.children.length === 0) {
+		lines.push("No subagent child usage found in this session.");
+	} else {
+		for (const child of report.children) {
+			lines.push(formatCostUsage(child.label, child.usage));
+			if (child.sessionFile) lines.push(`  Session: ${child.sessionFile}`);
+		}
+	}
+	if (report.unresolvedAsyncChildren > 0) lines.push(`Async child usage unavailable: ${report.unresolvedAsyncChildren}.`);
+	lines.push("────────────────────────────", formatCostUsage("Children", report.childTotal), formatCostUsage("Total", report.total));
+	return lines.join("\n");
+}

package/dist/extensions/pi-subagents/test/integration/async-execution.part-3.test.ts

@@ -17,6 +17,7 @@ import { createEventBus, createTempDir, events, makeAgent, makeMinimalCtx, remov
 import { discoverAgents } from "../../src/agents/agents.ts";
 import { ACTIVE_ASYNC_CAPACITY_DIR, acquireActiveAsyncCapacity, activeAsyncCapacitySessionKey } from "../../src/runs/background/active-async-capacity.ts";
 import { deriveForkPromptCacheKey } from "../../src/runs/shared/child-tool-plan.ts";
+import { INVALID_STRUCTURED_OUTPUT_SCHEMA_ERROR, validateStructuredOutputValue } from "../../src/runs/shared/structured-output.ts";
 import type { AsyncExecutionResult, AsyncResultPayload, AsyncStatusPayload } from "../support/async-execution-fixture.ts";
 import {
 	installAsyncExecutionHooks, waitForMockPiRuntime, available, isAsyncAvailable,
@@ -1102,6 +1103,72 @@ export default function() {
 		assert.deepEqual(payload.results[0]?.structuredOutput, { ok: true, note: "async" });
 	});
 
+	it("background settlement preserves rejected structured_output evidence", { skip: !isAsyncAvailable() ? "jiti not available" : undefined }, async () => {
+		const diagnostic = "Structured output validation failed: ok: is required";
+		mockPi.onCall({
+			jsonl: [
+				{ type: "message_end", message: { role: "assistant", content: [{ type: "toolCall", id: "structured-rejected", name: "structured_output", arguments: { value: {} } }], model: "mock/test-model", stopReason: "toolUse", usage: { input: 1, output: 1, cacheRead: 0, cacheWrite: 0, cost: { total: 0 } } } },
+				{ type: "tool_execution_start", toolCallId: "structured-rejected", toolName: "structured_output", args: { value: {} } },
+				{ type: "tool_result_end", message: { role: "toolResult", toolCallId: "structured-rejected", toolName: "structured_output", isError: true, content: [{ type: "text", text: diagnostic }] } },
+				{ type: "tool_execution_end", toolCallId: "structured-rejected", toolName: "structured_output" },
+			],
+		});
+		const id = `async-single-schema-rejected-${Date.now().toString(36)}`;
+
+		executeAsyncSingle(id, {
+			agent: "worker",
+			task: "Return structured data",
+			agentConfig: makeAgent("worker"),
+			ctx: { pi: { events: { emit() {} } }, cwd: tempDir, currentSessionId: "session-1" },
+			artifactConfig: { enabled: false, includeInput: false, includeOutput: false, includeJsonl: false, includeMetadata: false, cleanupDays: 7 },
+			shareEnabled: false,
+			sessionRoot: path.join(tempDir, "sessions"),
+			maxSubagentDepth: 2,
+			acceptance: false,
+			structuredOutputSchema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" } } },
+		});
+
+		const payload = JSON.parse(fs.readFileSync(await waitForAsyncResultFile(id, 10_000), "utf-8")) as AsyncResultPayload;
+		const status = await waitForAsyncState(id, (candidate) => candidate.state === "failed");
+		assert.equal(payload.success, false);
+		assert.match(payload.results[0]?.error ?? "", /Structured output validation failed: ok: is required/);
+		assert.doesNotMatch(payload.results[0]?.error ?? "", /Missing structured_output call/);
+		assert.equal(payload.results[0]?.structuredOutputFailed, true);
+		assert.match(status.steps?.[0]?.error ?? "", /Structured output validation failed: ok: is required/);
+	});
+
+	it("does not persist malformed outputSchema compiler text in background evidence", { skip: !isAsyncAvailable() ? "jiti not available" : undefined }, async () => {
+		const sentinel = "BACKGROUND_PRIVATE_SCHEMA_SENTINEL";
+		const structuredOutputSchema = { type: "string", pattern: `${sentinel}_[invalid` };
+		const validation = await validateStructuredOutputValue(structuredOutputSchema, "value");
+		assert.equal(validation.status, "invalid");
+		if (validation.status !== "invalid") return;
+		assert.match(validation.message, new RegExp(sentinel));
+		mockPi.onCall({
+			jsonl: [
+				{ type: "tool_execution_start", toolCallId: "structured-malformed-schema", toolName: "structured_output", args: { value: "value" } },
+				{ type: "tool_result_end", message: { role: "toolResult", toolCallId: "structured-malformed-schema", toolName: "structured_output", isError: true, content: [{ type: "text", text: `Structured output validation failed: ${validation.message}` }] } },
+				{ type: "tool_execution_end", toolCallId: "structured-malformed-schema", toolName: "structured_output" },
+			],
+		});
+		const id = `async-single-malformed-schema-${Date.now().toString(36)}`;
+		executeAsyncSingle(id, {
+			agent: "worker", task: "Return structured data", agentConfig: makeAgent("worker"),
+			ctx: { pi: { events: { emit() {} } }, cwd: tempDir, currentSessionId: "session-1" },
+			artifactConfig: { enabled: false, includeInput: false, includeOutput: false, includeJsonl: false, includeMetadata: false, cleanupDays: 7 },
+			shareEnabled: false, sessionRoot: path.join(tempDir, "sessions"), maxSubagentDepth: 2,
+			acceptance: false, structuredOutputSchema,
+		});
+
+		const resultPath = await waitForAsyncResultFile(id, 10_000);
+		const payloadText = fs.readFileSync(resultPath, "utf-8");
+		const payload = JSON.parse(payloadText) as AsyncResultPayload;
+		const status = await waitForAsyncState(id, (candidate) => candidate.state === "failed");
+		assert.match(payload.results[0]?.error ?? "", new RegExp(`^${escapeRegExp(INVALID_STRUCTURED_OUTPUT_SCHEMA_ERROR)}`));
+		assert.equal(payloadText.includes(sentinel), false);
+		assert.equal((status.steps?.[0]?.error ?? "").includes(sentinel), false);
+	});
+
 	it("background outputSchema runs fail closed when required acceptanceReport is missing", { skip: !isAsyncAvailable() ? "jiti not available" : undefined }, async () => {
 		mockPi.onCall({ output: "structured", structuredOutput: { ok: true } });
 		const id = `async-schema-missing-acceptance-${Date.now().toString(36)}`;

package/dist/extensions/pi-subagents/test/integration/in-process-child.test.ts

@@ -9,6 +9,7 @@ import { describe, it, before, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import type { MockPi } from "../support/helpers.ts";
 import { createMockPi, createTempDir, makeAgent, makeAgentConfigs, removeTempDir } from "../support/helpers.ts";
 import { runSync } from "../../src/runs/foreground/execution.ts";
@@ -17,6 +18,9 @@ import { createNestedRoute } from "../../src/runs/shared/nested-events.ts";
 import { createStructuredOutputRuntime } from "../../src/runs/shared/structured-output.ts";
 import type { ForegroundChildSessionControls, SingleResult } from "../../src/shared/types.ts";
 
+/** Explicit child tool surfaces also receive the scoped capability gateway controls. */
+const CHILD_CAPABILITY_GATEWAY_TOOLS = ["capability_catalog", "capability_discover", "capability_skill_show"];
+
 async function waitFor(read: () => boolean, timeoutMs = 5_000): Promise<void> {
 	const deadline = Date.now() + timeoutMs;
 	while (!read()) {
@@ -71,6 +75,30 @@ describe("in-process foreground child", () => {
 		}
 	});
 
+	it("passes wrapped core tools and the Graft provider to a launched foreground child", async () => {
+		const wrapperPath = path.join(tempDir, "wrapped-core-tools.ts");
+		const graftExtensionPath = fileURLToPath(new URL("../../../pi-graft/index.ts", import.meta.url));
+		const tools = ["read", "grep", "graft_find_code"];
+		fs.writeFileSync(wrapperPath, [
+			"export default function register(pi) {",
+			"  const available = new Map(pi.getAllTools().map((tool) => [tool.name, tool]));",
+			"  for (const name of ['read', 'grep']) {",
+			"    const tool = available.get(name);",
+			"    if (tool) pi.registerTool({ ...tool, description: 'wrapped ' + name + ': ' + tool.description });",
+			"  }",
+			"}",
+		].join("\n"));
+		mockPi.onCall({ output: "read, grep, and Graft tools were available" });
+		const result = await runSync(tempDir, [makeAgent("worker", { tools, subagentOnlyExtensions: [wrapperPath, graftExtensionPath] })], "worker", "Inspect with read, grep, and Graft", { runId: "wrapped-graft-child" });
+		assert.equal(result.exitCode, 0, result.error);
+		const launch = mockPi.sessions[0]?.launch;
+		const expectedTools = [...tools, ...CHILD_CAPABILITY_GATEWAY_TOOLS];
+		assert.deepEqual(launch?.tools, expectedTools);
+		assert.deepEqual(launch?.runtime.requiredTools, expectedTools);
+		assert.ok(launch?.extensionPaths.includes(wrapperPath));
+		assert.ok(launch?.extensionPaths.includes(graftExtensionPath));
+	});
+
 	it("adds the fanout hook and nested route only for fanout-authorized children", async () => {
 		const route = createNestedRoute("hooks-fanout");
 		try {
@@ -84,7 +112,7 @@ describe("in-process foreground child", () => {
 			assert.equal(session?.launch.runtime.fanoutChild, true);
 			assert.deepEqual(session?.launch.runtime.nestedRoute, route);
 			assert.deepEqual(session?.launch.runtime.nestedParent, { parentRunId: "hooks-fanout", parentChildIndex: 0, depth: 1, path: [{ runId: "hooks-fanout", stepIndex: 0, agent: "delegator" }] });
-			assert.deepEqual(session?.launch.tools, ["read", "subagent"]);
+			assert.deepEqual(session?.launch.tools, ["read", "subagent", ...CHILD_CAPABILITY_GATEWAY_TOOLS]);
 		} finally {
 			fs.rmSync(path.dirname(route.eventSink), { recursive: true, force: true });
 		}

package/dist/extensions/pi-subagents/test/integration/intercom-result-delivery.test.ts

@@ -23,6 +23,9 @@ import {
 	tryImport,
 } from "../support/helpers.ts";
 
+/** Children with an explicit tool surface also receive the scoped capability gateway controls. */
+const CHILD_CAPABILITY_GATEWAY_TOOLS = "capability_catalog,capability_discover,capability_skill_show";
+
 interface ExecutorResult {
 	content: Array<{ text?: string }>;
 	isError?: boolean;
@@ -308,8 +311,8 @@ describe("intercom result delivery cutover", { skip: !available ? "executor not
 
 		const isolatedArgs = await readMockCallArgs(0);
 		const normalArgs = await readMockCallArgs(1);
-		assert.equal(isolatedArgs[isolatedArgs.indexOf("--tools") + 1], "read");
-		assert.equal(normalArgs[normalArgs.indexOf("--tools") + 1], "read,contact_supervisor");
+		assert.equal(isolatedArgs[isolatedArgs.indexOf("--tools") + 1], `read,${CHILD_CAPABILITY_GATEWAY_TOOLS}`);
+		assert.equal(normalArgs[normalArgs.indexOf("--tools") + 1], `read,contact_supervisor,${CHILD_CAPABILITY_GATEWAY_TOOLS}`);
 		assert.equal(events.emitted.filter((entry) => entry.channel === "subagent:result-intercom").length, 1);
 		assert.deepEqual(result.details?.workflow?.value, { isolated: "Isolated child output", normal: "Normal child output" });
 	});
@@ -1106,7 +1109,7 @@ describe("intercom result delivery cutover", { skip: !available ? "executor not
 			const args = await readMockCallArgs(0);
 			assert.equal(args[args.indexOf("--session") + 1], sessionFile);
 			assert.equal(args[args.indexOf("--model") + 1], "anthropic/claude-sonnet-4:high");
-			assert.equal(args[args.indexOf("--tools") + 1], "read");
+			assert.equal(args[args.indexOf("--tools") + 1], `read,${CHILD_CAPABILITY_GATEWAY_TOOLS}`);
 			assert.equal(args.includes("--system-prompt"), true);
 			assert.equal(args.includes("--append-system-prompt"), false);
 			await waitForFile(path.join(RESULTS_DIR, `${revivedId}.json`));

package/dist/extensions/pi-subagents/test/integration/single-execution.part-2.test.ts

@@ -1623,6 +1623,31 @@ if (!fs.existsSync(${JSON.stringify(holdPath)})) { console.log('{}'); } else {
 		if (child?.artifactPaths?.outputPath) assert.match(fs.readFileSync(child.artifactPaths.outputPath, "utf-8"), /"note": "captured"/);
 	});
 
+	it("reports bounded structured_output rejection evidence without leaking the submitted value", { skip: !createSubagentExecutor ? "executor not importable" : undefined }, async () => {
+		const secret = "PRIVATE_STRUCTURED_OUTPUT_VALUE";
+		mockPi.onCall({
+			stdoutRaw: [
+				{ type: "tool_execution_start", toolCallId: "structured-rejected", toolName: "structured_output", args: { value: { secret } } },
+				{ type: "tool_result_end", message: { role: "toolResult", toolCallId: "structured-rejected", toolName: "structured_output", isError: true, content: [{ type: "text", text: `Structured output validation failed: value.secret: expected boolean; received value: ${secret}` }] } },
+				{ type: "tool_execution_end", toolCallId: "structured-rejected", toolName: "structured_output", isError: true },
+			].map((entry) => JSON.stringify(entry)).join("\n") + "\n",
+		});
+		const executor = makeExecutor([makeAgent("echo")]);
+		const result = await executor.execute(
+			"single-schema-rejected",
+			{ agent: "echo", task: "Return structured data", outputSchema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" } } }, acceptance: false },
+			new AbortController().signal,
+			undefined,
+			makeMinimalCtx(tempDir),
+		);
+
+		const child = result.details?.results?.[0];
+		assert.equal(result.isError, true);
+		assert.equal(child?.structuredOutputFailed, true);
+		assert.match(child?.error ?? "", /Structured output validation failed: value.secret/);
+		assert.doesNotMatch(child?.error ?? "", new RegExp(secret));
+	});
+
 	it("routes retained workflow follow-ups to distinct outputs without overwriting the writer report", { skip: !createSubagentExecutor ? "executor not importable" : undefined }, async () => {
 		for (const relative of [false, true]) {
 			const writerPath = path.join(tempDir, `writer-${relative}.md`);

package/dist/extensions/pi-subagents/test/unit/agent-frontmatter.test.ts

@@ -638,16 +638,16 @@ Do work
 		assert.equal(worker?.defaultContext, "fork");
 	});
 
-	it("loads packaged worker and oracle with fork defaultContext and advisor alias", () => {
+	it("loads packaged worker with fresh writer defaults and keeps oracle fork context", () => {
 		const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-builtin-default-context-"));
 		tempDirs.push(dir);
 		const agents = discoverAgentsAll(dir).builtin;
 
-		for (const name of ["worker", "oracle"]) {
-			const agent = agents.find((candidate) => candidate.name === name);
-			assert.equal(agent?.defaultContext, "fork", `${name} should default to fork context`);
-		}
+		const worker = agents.find((candidate) => candidate.name === "worker");
+		assert.equal(worker?.defaultContext, "fresh");
+		assert.equal(worker?.acceptanceRole, "writer");
 		const oracle = agents.find((candidate) => candidate.name === "oracle");
+		assert.equal(oracle?.defaultContext, "fork");
 		assert.deepEqual(oracle?.aliases, ["advisor"]);
 		assert.doesNotMatch(oracle?.tools?.join(",") ?? "", /contact_supervisor/);
 		for (const name of ["scout", "researcher", "oracle", "reviewer"]) {

package/dist/extensions/pi-subagents/test/unit/async-spawn-preload.test.ts

@@ -37,7 +37,19 @@ test("executeAsyncSingle preloads supplemental server aliases before jiti, but n
 		fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: pkg, version: "0.85.0", exports }));
 	}
 	const originalArgv1 = process.argv[1];
+	const inheritedGitEnv = {
+		GIT_DIR: "/outer/repo/.git",
+		GIT_WORK_TREE: "/outer/repo",
+		GIT_INDEX_FILE: "/outer/repo/.git/index",
+		GIT_CONFIG_COUNT: "1",
+		GIT_CONFIG_KEY_0: "core.hooksPath",
+		GIT_CONFIG_VALUE_0: "/outer/hooks",
+		GIT_AUTHOR_NAME: "Kept Author",
+		GIT_ENV_SENTINEL_KEEP: "kept",
+	};
+	const previousGitEnv = Object.fromEntries(Object.keys(inheritedGitEnv).map((key) => [key, process.env[key]]));
 	try {
+		Object.assign(process.env, inheritedGitEnv);
 		for (const pkg of Object.keys(hostExports)) {
 			if (pkg !== server) writeHostPackage(pkg);
 		}
@@ -79,6 +91,11 @@ test("executeAsyncSingle preloads supplemental server aliases before jiti, but n
 			assert.equal(spawn.mock.callCount(), scenario === "supplemental" ? 1 : scenario === "complete" ? 2 : 3);
 			const [command, args, options] = spawn.mock.calls.at(-1)!.arguments;
 			assert.ok(path.isAbsolute(command));
+			for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_CONFIG_COUNT", "GIT_CONFIG_KEY_0", "GIT_CONFIG_VALUE_0"]) {
+				assert.equal(options.env[key], undefined, key);
+			}
+			assert.equal(options.env.GIT_AUTHOR_NAME, "Kept Author");
+			assert.equal(options.env.GIT_ENV_SENTINEL_KEEP, "kept");
 			assert.equal(options.env[SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV], host);
 			const actualAliases = JSON.parse(options.env.JITI_ALIAS) as Record<string, string>;
 			assert.deepEqual(Object.fromEntries(Object.entries(actualAliases).map(([key, target]) => [key, fs.realpathSync(target)])), expectedAliases);
@@ -96,6 +113,10 @@ test("executeAsyncSingle preloads supplemental server aliases before jiti, but n
 	} finally {
 		t.mock.restoreAll();
 		syncBuiltinESMExports();
+		for (const [key, value] of Object.entries(previousGitEnv)) {
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
 		if (originalArgv1 === undefined) delete process.argv[1];
 		else process.argv[1] = originalArgv1;
 		fs.rmSync(root, { recursive: true, force: true });