@selesai/code 0.13.32 → 0.13.34

package/dist/extensions/pi-subagents/test/integration/in-process-child.test.ts

@@ -9,6 +9,7 @@ import { describe, it, before, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import type { MockPi } from "../support/helpers.ts";
 import { createMockPi, createTempDir, makeAgent, makeAgentConfigs, removeTempDir } from "../support/helpers.ts";
 import { runSync } from "../../src/runs/foreground/execution.ts";
@@ -17,6 +18,9 @@ import { createNestedRoute } from "../../src/runs/shared/nested-events.ts";
 import { createStructuredOutputRuntime } from "../../src/runs/shared/structured-output.ts";
 import type { ForegroundChildSessionControls, SingleResult } from "../../src/shared/types.ts";
 
+/** Explicit child tool surfaces also receive the scoped capability gateway controls. */
+const CHILD_CAPABILITY_GATEWAY_TOOLS = ["capability_catalog", "capability_discover", "capability_skill_show"];
+
 async function waitFor(read: () => boolean, timeoutMs = 5_000): Promise<void> {
 	const deadline = Date.now() + timeoutMs;
 	while (!read()) {
@@ -71,6 +75,30 @@ describe("in-process foreground child", () => {
 		}
 	});
 
+	it("passes wrapped core tools and the Graft provider to a launched foreground child", async () => {
+		const wrapperPath = path.join(tempDir, "wrapped-core-tools.ts");
+		const graftExtensionPath = fileURLToPath(new URL("../../../pi-graft/index.ts", import.meta.url));
+		const tools = ["read", "grep", "graft_find_code"];
+		fs.writeFileSync(wrapperPath, [
+			"export default function register(pi) {",
+			"  const available = new Map(pi.getAllTools().map((tool) => [tool.name, tool]));",
+			"  for (const name of ['read', 'grep']) {",
+			"    const tool = available.get(name);",
+			"    if (tool) pi.registerTool({ ...tool, description: 'wrapped ' + name + ': ' + tool.description });",
+			"  }",
+			"}",
+		].join("\n"));
+		mockPi.onCall({ output: "read, grep, and Graft tools were available" });
+		const result = await runSync(tempDir, [makeAgent("worker", { tools, subagentOnlyExtensions: [wrapperPath, graftExtensionPath] })], "worker", "Inspect with read, grep, and Graft", { runId: "wrapped-graft-child" });
+		assert.equal(result.exitCode, 0, result.error);
+		const launch = mockPi.sessions[0]?.launch;
+		const expectedTools = [...tools, ...CHILD_CAPABILITY_GATEWAY_TOOLS];
+		assert.deepEqual(launch?.tools, expectedTools);
+		assert.deepEqual(launch?.runtime.requiredTools, expectedTools);
+		assert.ok(launch?.extensionPaths.includes(wrapperPath));
+		assert.ok(launch?.extensionPaths.includes(graftExtensionPath));
+	});
+
 	it("adds the fanout hook and nested route only for fanout-authorized children", async () => {
 		const route = createNestedRoute("hooks-fanout");
 		try {
@@ -84,7 +112,7 @@ describe("in-process foreground child", () => {
 			assert.equal(session?.launch.runtime.fanoutChild, true);
 			assert.deepEqual(session?.launch.runtime.nestedRoute, route);
 			assert.deepEqual(session?.launch.runtime.nestedParent, { parentRunId: "hooks-fanout", parentChildIndex: 0, depth: 1, path: [{ runId: "hooks-fanout", stepIndex: 0, agent: "delegator" }] });
-			assert.deepEqual(session?.launch.tools, ["read", "subagent"]);
+			assert.deepEqual(session?.launch.tools, ["read", "subagent", ...CHILD_CAPABILITY_GATEWAY_TOOLS]);
 		} finally {
 			fs.rmSync(path.dirname(route.eventSink), { recursive: true, force: true });
 		}

package/dist/extensions/pi-subagents/test/integration/intercom-result-delivery.test.ts

@@ -23,6 +23,9 @@ import {
 	tryImport,
 } from "../support/helpers.ts";
 
+/** Children with an explicit tool surface also receive the scoped capability gateway controls. */
+const CHILD_CAPABILITY_GATEWAY_TOOLS = "capability_catalog,capability_discover,capability_skill_show";
+
 interface ExecutorResult {
 	content: Array<{ text?: string }>;
 	isError?: boolean;
@@ -308,8 +311,8 @@ describe("intercom result delivery cutover", { skip: !available ? "executor not
 
 		const isolatedArgs = await readMockCallArgs(0);
 		const normalArgs = await readMockCallArgs(1);
-		assert.equal(isolatedArgs[isolatedArgs.indexOf("--tools") + 1], "read");
-		assert.equal(normalArgs[normalArgs.indexOf("--tools") + 1], "read,contact_supervisor");
+		assert.equal(isolatedArgs[isolatedArgs.indexOf("--tools") + 1], `read,${CHILD_CAPABILITY_GATEWAY_TOOLS}`);
+		assert.equal(normalArgs[normalArgs.indexOf("--tools") + 1], `read,contact_supervisor,${CHILD_CAPABILITY_GATEWAY_TOOLS}`);
 		assert.equal(events.emitted.filter((entry) => entry.channel === "subagent:result-intercom").length, 1);
 		assert.deepEqual(result.details?.workflow?.value, { isolated: "Isolated child output", normal: "Normal child output" });
 	});
@@ -1106,7 +1109,7 @@ describe("intercom result delivery cutover", { skip: !available ? "executor not
 			const args = await readMockCallArgs(0);
 			assert.equal(args[args.indexOf("--session") + 1], sessionFile);
 			assert.equal(args[args.indexOf("--model") + 1], "anthropic/claude-sonnet-4:high");
-			assert.equal(args[args.indexOf("--tools") + 1], "read");
+			assert.equal(args[args.indexOf("--tools") + 1], `read,${CHILD_CAPABILITY_GATEWAY_TOOLS}`);
 			assert.equal(args.includes("--system-prompt"), true);
 			assert.equal(args.includes("--append-system-prompt"), false);
 			await waitForFile(path.join(RESULTS_DIR, `${revivedId}.json`));

package/dist/extensions/pi-subagents/test/integration/single-execution.part-2.test.ts

@@ -1623,6 +1623,31 @@ if (!fs.existsSync(${JSON.stringify(holdPath)})) { console.log('{}'); } else {
 		if (child?.artifactPaths?.outputPath) assert.match(fs.readFileSync(child.artifactPaths.outputPath, "utf-8"), /"note": "captured"/);
 	});
 
+	it("reports bounded structured_output rejection evidence without leaking the submitted value", { skip: !createSubagentExecutor ? "executor not importable" : undefined }, async () => {
+		const secret = "PRIVATE_STRUCTURED_OUTPUT_VALUE";
+		mockPi.onCall({
+			stdoutRaw: [
+				{ type: "tool_execution_start", toolCallId: "structured-rejected", toolName: "structured_output", args: { value: { secret } } },
+				{ type: "tool_result_end", message: { role: "toolResult", toolCallId: "structured-rejected", toolName: "structured_output", isError: true, content: [{ type: "text", text: `Structured output validation failed: value.secret: expected boolean; received value: ${secret}` }] } },
+				{ type: "tool_execution_end", toolCallId: "structured-rejected", toolName: "structured_output", isError: true },
+			].map((entry) => JSON.stringify(entry)).join("\n") + "\n",
+		});
+		const executor = makeExecutor([makeAgent("echo")]);
+		const result = await executor.execute(
+			"single-schema-rejected",
+			{ agent: "echo", task: "Return structured data", outputSchema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" } } }, acceptance: false },
+			new AbortController().signal,
+			undefined,
+			makeMinimalCtx(tempDir),
+		);
+
+		const child = result.details?.results?.[0];
+		assert.equal(result.isError, true);
+		assert.equal(child?.structuredOutputFailed, true);
+		assert.match(child?.error ?? "", /Structured output validation failed: value.secret/);
+		assert.doesNotMatch(child?.error ?? "", new RegExp(secret));
+	});
+
 	it("routes retained workflow follow-ups to distinct outputs without overwriting the writer report", { skip: !createSubagentExecutor ? "executor not importable" : undefined }, async () => {
 		for (const relative of [false, true]) {
 			const writerPath = path.join(tempDir, `writer-${relative}.md`);

package/dist/extensions/pi-subagents/test/unit/agent-frontmatter.test.ts

@@ -638,16 +638,16 @@ Do work
 		assert.equal(worker?.defaultContext, "fork");
 	});
 
-	it("loads packaged worker and oracle with fork defaultContext and advisor alias", () => {
+	it("loads packaged worker with fresh writer defaults and keeps oracle fork context", () => {
 		const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-builtin-default-context-"));
 		tempDirs.push(dir);
 		const agents = discoverAgentsAll(dir).builtin;
 
-		for (const name of ["worker", "oracle"]) {
-			const agent = agents.find((candidate) => candidate.name === name);
-			assert.equal(agent?.defaultContext, "fork", `${name} should default to fork context`);
-		}
+		const worker = agents.find((candidate) => candidate.name === "worker");
+		assert.equal(worker?.defaultContext, "fresh");
+		assert.equal(worker?.acceptanceRole, "writer");
 		const oracle = agents.find((candidate) => candidate.name === "oracle");
+		assert.equal(oracle?.defaultContext, "fork");
 		assert.deepEqual(oracle?.aliases, ["advisor"]);
 		assert.doesNotMatch(oracle?.tools?.join(",") ?? "", /contact_supervisor/);
 		for (const name of ["scout", "researcher", "oracle", "reviewer"]) {

package/dist/extensions/pi-subagents/test/unit/async-spawn-preload.test.ts

@@ -37,7 +37,19 @@ test("executeAsyncSingle preloads supplemental server aliases before jiti, but n
 		fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: pkg, version: "0.85.0", exports }));
 	}
 	const originalArgv1 = process.argv[1];
+	const inheritedGitEnv = {
+		GIT_DIR: "/outer/repo/.git",
+		GIT_WORK_TREE: "/outer/repo",
+		GIT_INDEX_FILE: "/outer/repo/.git/index",
+		GIT_CONFIG_COUNT: "1",
+		GIT_CONFIG_KEY_0: "core.hooksPath",
+		GIT_CONFIG_VALUE_0: "/outer/hooks",
+		GIT_AUTHOR_NAME: "Kept Author",
+		GIT_ENV_SENTINEL_KEEP: "kept",
+	};
+	const previousGitEnv = Object.fromEntries(Object.keys(inheritedGitEnv).map((key) => [key, process.env[key]]));
 	try {
+		Object.assign(process.env, inheritedGitEnv);
 		for (const pkg of Object.keys(hostExports)) {
 			if (pkg !== server) writeHostPackage(pkg);
 		}
@@ -79,6 +91,11 @@ test("executeAsyncSingle preloads supplemental server aliases before jiti, but n
 			assert.equal(spawn.mock.callCount(), scenario === "supplemental" ? 1 : scenario === "complete" ? 2 : 3);
 			const [command, args, options] = spawn.mock.calls.at(-1)!.arguments;
 			assert.ok(path.isAbsolute(command));
+			for (const key of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_CONFIG_COUNT", "GIT_CONFIG_KEY_0", "GIT_CONFIG_VALUE_0"]) {
+				assert.equal(options.env[key], undefined, key);
+			}
+			assert.equal(options.env.GIT_AUTHOR_NAME, "Kept Author");
+			assert.equal(options.env.GIT_ENV_SENTINEL_KEEP, "kept");
 			assert.equal(options.env[SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV], host);
 			const actualAliases = JSON.parse(options.env.JITI_ALIAS) as Record<string, string>;
 			assert.deepEqual(Object.fromEntries(Object.entries(actualAliases).map(([key, target]) => [key, fs.realpathSync(target)])), expectedAliases);
@@ -96,6 +113,10 @@ test("executeAsyncSingle preloads supplemental server aliases before jiti, but n
 	} finally {
 		t.mock.restoreAll();
 		syncBuiltinESMExports();
+		for (const [key, value] of Object.entries(previousGitEnv)) {
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
 		if (originalArgv1 === undefined) delete process.argv[1];
 		else process.argv[1] = originalArgv1;
 		fs.rmSync(root, { recursive: true, force: true });

package/dist/extensions/pi-subagents/test/unit/child-tool-plan-permission-system.test.ts

@@ -11,6 +11,7 @@ import * as path from "node:path";
 import { afterEach, describe, it } from "node:test";
 import { buildInProcessChildLaunch, type BuildInProcessChildLaunchInput } from "../../src/runs/shared/child-launch.ts";
 import {
+	CAPABILITY_GATEWAY_EXTENSION_PATH,
 	resolvePermissionSystemExtension,
 	resolvePiLaunchToolPlan,
 } from "../../src/runs/shared/child-tool-plan.ts";
@@ -19,6 +20,7 @@ const originalEnv = {
 	HOME: process.env.HOME,
 	USERPROFILE: process.env.USERPROFILE,
 	SELESAI_CODING_AGENT_DIR: process.env.SELESAI_CODING_AGENT_DIR,
+	SELESAI_CAPABILITY_GATEWAY: process.env.SELESAI_CAPABILITY_GATEWAY,
 };
 const tempRoots: string[] = [];
 
@@ -33,6 +35,7 @@ function createFixture() {
 	process.env.HOME = home;
 	process.env.USERPROFILE = home;
 	process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+	delete process.env.SELESAI_CAPABILITY_GATEWAY;
 	process.chdir(projectDir);
 	return { root, agentDir, projectDir };
 }
@@ -397,3 +400,98 @@ describe("child launch <active_agent> tag injection", () => {
 		);
 	});
 });
+
+describe("capability gateway child runtime policy", () => {
+	const gatewayTools = ["capability_catalog", "capability_discover", "capability_skill_show"];
+
+	for (const host of ["parent", "runner"] as const) {
+		it(`adds only gateway controls for extension-permitted ${host} children`, () => {
+			const { agentDir } = createFixture();
+			process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+
+			const launch = buildInProcessChildLaunch(childLaunch({ host, tools: ["read", "web_explore"] }));
+			assert.equal(launch.toolPlan.capabilityGatewayEnabled, true);
+			assert.ok(launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			assert.deepEqual(launch.session.tools, ["read", "web_explore", ...gatewayTools]);
+			assert.ok(gatewayTools.every((tool) => launch.toolPlan.requiredChildTools.includes(tool)));
+			if (host === "runner") {
+				assert.equal(launch.session.ambientExtensions, true);
+				assert.ok(launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			} else {
+				assert.equal(launch.session.ambientExtensions, false);
+				assert.equal(launch.session.processEnv, undefined);
+			}
+		});
+	}
+
+	it("keeps omitted tools unrestricted without synthesizing an explicit allowlist", () => {
+		const { agentDir } = createFixture();
+		process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+		const launch = buildInProcessChildLaunch(childLaunch({ host: "runner" }));
+		assert.equal(launch.toolPlan.capabilityGatewayEnabled, true);
+		assert.equal(launch.session.tools, undefined);
+		assert.ok(launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+	});
+
+	for (const host of ["parent", "runner"] as const) {
+		it(`skips gateway for ${host} children with an explicit empty tool set`, () => {
+			const { agentDir } = createFixture();
+			process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+
+			const launch = buildInProcessChildLaunch(childLaunch({ host, tools: [] }));
+			assert.equal(launch.toolPlan.capabilityGatewayEnabled, false);
+			assert.deepEqual(launch.session.tools, []);
+			assert.ok(!launch.toolPlan.extensionArgs.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			assert.ok(!launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+		});
+	}
+
+	it("does not widen a capability ceiling and honors explicit extension policy", () => {
+		const { agentDir, projectDir } = createFixture();
+		process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+		const limited = resolvePiLaunchToolPlan({
+			tools: ["read", "web_explore"],
+			capabilityCeiling: { version: 1, allowedTools: ["read", "web_explore"], denyExtensions: false, sources: ["test"] },
+		});
+		assert.equal(limited.capabilityGatewayEnabled, false);
+		assert.deepEqual(limited.effectiveToolAllowlist, ["read", "web_explore"]);
+		assert.ok(!limited.extensionArgs.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+
+		const explicitBlock = resolvePiLaunchToolPlan({
+			tools: ["read"],
+			extensions: [path.join(projectDir, "other-extension.ts")],
+		});
+		assert.equal(explicitBlock.capabilityGatewayEnabled, false);
+		assert.ok(!explicitBlock.extensionArgs.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+
+		const explicitOptIn = resolvePiLaunchToolPlan({
+			tools: ["read"],
+			extensions: [],
+			subagentOnlyExtensions: [path.dirname(CAPABILITY_GATEWAY_EXTENSION_PATH)],
+		});
+		assert.equal(explicitOptIn.capabilityGatewayEnabled, true);
+		assert.ok(explicitOptIn.extensionArgs.includes(path.dirname(CAPABILITY_GATEWAY_EXTENSION_PATH)));
+		assert.ok(explicitOptIn.effectiveToolAllowlist.includes("capability_discover"));
+	});
+
+	for (const host of ["parent", "runner"] as const) {
+		it(`does not load or authorize the gateway for ${host} children with denyExtensions`, () => {
+			const { agentDir } = createFixture();
+			process.env.SELESAI_CODING_AGENT_DIR = agentDir;
+
+			const launch = buildInProcessChildLaunch(childLaunch({
+				host,
+				tools: ["read"],
+				subagentOnlyExtensions: [CAPABILITY_GATEWAY_EXTENSION_PATH],
+				capabilityCeiling: { version: 1, allowedTools: ["read"], denyExtensions: true, sources: ["test"] },
+			}));
+			assert.equal(launch.toolPlan.capabilityGatewayEnabled, false);
+			assert.deepEqual(launch.session.tools, ["read"]);
+			assert.ok(!launch.session.extensionPaths.includes(CAPABILITY_GATEWAY_EXTENSION_PATH));
+			assert.ok(!launch.toolPlan.requiredChildTools.some((tool) => tool.startsWith("capability_")));
+			if (host === "runner") {
+				assert.equal(launch.session.ambientExtensions, false);
+			}
+		});
+	}
+});

package/dist/extensions/pi-subagents/test/unit/child-tool-plan.test.ts

@@ -19,6 +19,17 @@ function runtimeSnapshotHost(serverName: string): McpRuntimeSnapshotHost {
 }
 
 describe("child tool plan", () => {
+	it("requires fanout authorization for the child supervisor reply tool", () => {
+		assert.throws(() => resolvePiLaunchToolPlan({ tools: ["read", "subagent_supervisor"] }), /subagent_supervisor.*requires fanout authorization/);
+		assert.throws(() => resolvePiLaunchToolPlan({ tools: ["read", "subagent", "subagent_supervisor"], excludeTools: ["subagent"] }), /subagent_supervisor.*requires fanout authorization/);
+		assert.throws(() => resolvePiLaunchToolPlan({
+			tools: ["read", "subagent", "subagent_supervisor"],
+			capabilityCeiling: { version: 1, allowedTools: ["read", "subagent_supervisor"], sources: ["test"] },
+		}), /subagent_supervisor.*requires fanout authorization/);
+		assert.equal(resolvePiLaunchToolPlan({ tools: ["read", "subagent", "subagent_supervisor"] }).fanoutAuthorized, true);
+		assert.equal(resolvePiLaunchToolPlan({ tools: ["read", "subagent_supervisor"], allowNestedSubagents: true }).fanoutAuthorized, true);
+	});
+
 	it("fails a launch that selects MCP tools from the adapter's runtime snapshot", () => {
 		const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-runtime-mcp-"));
 		try {

package/dist/extensions/pi-subagents/test/unit/completion-guard.test.ts

@@ -7,6 +7,7 @@ import {
 	evaluateCompletionMutationGuard,
 	expectsImplementationMutation,
 	hasMutationToolCall,
+	hasMutationToolCapability,
 	validateImplementationToolContract,
 } from "../../src/runs/shared/completion-guard.ts";
 import { isMutatingTool } from "../../src/runs/shared/long-running-guard.ts";
@@ -500,6 +501,17 @@ test("edit and write tool calls count as mutation attempts", () => {
 	assert.equal(hasMutationToolCall([assistantToolCall("write", { path: "a.ts" })]), true);
 });
 
+test("capability gateway controls never count as mutation capability", () => {
+	const gatewayTools = ["capability_catalog", "capability_discover", "capability_skill_show"];
+	assert.equal(hasMutationToolCapability(["read", "grep", ...gatewayTools], undefined), false);
+	assert.equal(validateImplementationToolContract({
+		agent: "worker",
+		task: "Implement the requested source fix.",
+		tools: ["read", "grep", "find", "ls", "contact_supervisor", ...gatewayTools],
+	}), "Agent 'worker' was given an implementation task, but its tool allowlist has no mutation-capable tools. Add bash, edit, write, or another mutation-capable tool to the agent, or use a read-only task/agent.");
+	assert.equal(hasMutationToolCapability(["read", "web_explore"], undefined), true);
+});
+
 test("declared extension mutation tools count without weakening unknown tools", () => {
 	const messages = [assistantToolCall("replace", { remove_from: "Liv" })];
 	assert.equal(hasMutationToolCall(messages), false);

package/dist/extensions/pi-subagents/test/unit/external-cli-runner.test.ts

@@ -43,6 +43,31 @@ describe("external CLI runner", () => {
 		}
 	});
 
+	it("strips inherited Git routing vars but honors an explicit environment allowlist", async () => {
+		const dir = tempDir();
+		const inherited = { GIT_DIR: "/outer/repo/.git", GIT_AUTHOR_NAME: "Kept Author" };
+		const previous = Object.fromEntries(Object.keys(inherited).map((key) => [key, process.env[key]]));
+		Object.assign(process.env, inherited);
+		const script = "process.stdout.write(JSON.stringify({gitDir:process.env.GIT_DIR??null,author:process.env.GIT_AUTHOR_NAME??null}))";
+		try {
+			const defaultEnv = await runExternalCli({ command: process.execPath, args: ["-e", script], cwd: dir, prompt: "x", asyncDir: dir, stepIndex: 1 });
+			assert.equal(defaultEnv.exitCode, 0);
+			assert.deepEqual(JSON.parse(defaultEnv.output), { gitDir: null, author: "Kept Author" });
+
+			const explicitEnv = await runExternalCli({
+				command: process.execPath, args: ["-e", script], cwd: dir, prompt: "x", asyncDir: dir, stepIndex: 2,
+				environment: { allowlist: ["GIT_DIR"] },
+			});
+			assert.equal(explicitEnv.exitCode, 0);
+			assert.deepEqual(JSON.parse(explicitEnv.output), { gitDir: "/outer/repo/.git", author: null });
+		} finally {
+			for (const [key, value] of Object.entries(previous)) {
+				if (value === undefined) delete process.env[key];
+				else process.env[key] = value;
+			}
+		}
+	});
+
 	it("delivers the combined prompt only through stdin and preserves argv", async () => {
 		const dir = tempDir();
 		const prompt = buildExternalCliPrompt("Follow exactly.", "Review $HOME; echo nope");

package/dist/extensions/pi-subagents/test/unit/git-environment.test.ts

@@ -0,0 +1,38 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { omitGitRoutingEnv } from "../../src/runs/shared/git-environment.ts";
+
+const GIT_ROUTING_ENV = {
+	GIT_ALTERNATE_OBJECT_DIRECTORIES: "/repo/objects",
+	GIT_COMMON_DIR: "/repo/common",
+	GIT_CONFIG: "/repo/config",
+	GIT_CONFIG_COUNT: "1",
+	GIT_CONFIG_KEY_0: "core.worktree",
+	GIT_CONFIG_PARAMETERS: "'core.worktree=/repo'",
+	GIT_CONFIG_VALUE_0: "/repo",
+	GIT_DIR: "/repo/.git",
+	GIT_GRAFT_FILE: "/repo/grafts",
+	GIT_IMPLICIT_WORK_TREE: "1",
+	GIT_INDEX_FILE: "/repo/index",
+	GIT_NAMESPACE: "tenant",
+	GIT_NO_REPLACE_OBJECTS: "1",
+	GIT_OBJECT_DIRECTORY: "/repo/object-dir",
+	GIT_PREFIX: "src/",
+	GIT_REPLACE_REF_BASE: "refs/replace/",
+	GIT_SHALLOW_FILE: "/repo/shallow",
+	GIT_WORK_TREE: "/repo",
+};
+
+describe("omitGitRoutingEnv", () => {
+	it("removes inherited repository routing and keeps unrelated values", () => {
+		assert.deepEqual(omitGitRoutingEnv({ ...GIT_ROUTING_ENV, KEEP_ME: "yes" }), { KEEP_ME: "yes" });
+	});
+
+	it("removes every indexed Git config entry", () => {
+		assert.deepEqual(omitGitRoutingEnv({ GIT_CONFIG_KEY_17: "user.name", GIT_CONFIG_VALUE_17: "Test", KEEP_ME: "yes" }), { KEEP_ME: "yes" });
+	});
+
+	it("matches names case-insensitively, as Windows and Git for Windows do", () => {
+		assert.deepEqual(omitGitRoutingEnv({ git_dir: "/repo/.git", Git_Work_Tree: "/repo", git_config_key_0: "core.bare", KEEP_ME: "yes" }), { KEEP_ME: "yes" });
+	});
+});

package/dist/extensions/pi-subagents/test/unit/preflight.test.ts

@@ -857,7 +857,9 @@ Project prompt.
 		assert.equal(result.ok, true);
 		if (!result.ok) return;
 		assert.deepEqual(result.contract.tools.excludeTools, ["write", "unknown_tool"]);
-		assert.deepEqual(result.contract.tools.effectiveAllowlist, ["read"]);
+		// An explicit tool surface also gets the scoped capability gateway tools, which
+		// this launch does not exclude (see the capability-gateway child policy tests).
+		assert.deepEqual(result.contract.tools.effectiveAllowlist, ["read", "capability_catalog", "capability_discover", "capability_skill_show"]);
 		assert.match(result.contract.launchContractDigest, /^[a-f0-9]{64}$/);
 	});
 

package/dist/extensions/pi-subagents/test/unit/rpc.test.ts

@@ -5,6 +5,7 @@ import * as path from "node:path";
 import { describe, it } from "node:test";
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
 import { consumeStopRequestPayload, stopRequestPath, stopRequestsDir } from "../../src/runs/background/control-channel.ts";
+import { getArtifactPaths, getArtifactsDir } from "../../src/shared/artifacts.ts";
 import {
 	SUBAGENT_RPC_PROTOCOL_VERSION,
 	SUBAGENT_RPC_READY_EVENT,
@@ -13,7 +14,7 @@ import {
 	subagentRpcReplyEvent,
 	type SubagentRpcReplyEnvelope,
 } from "../../src/extension/rpc.ts";
-import { SUBAGENT_CHILD_STATUS_EVENT, type Details, type SubagentChildStatusEvent, type SubagentState } from "../../src/shared/types.ts";
+import { DIRS, SUBAGENT_CHILD_STATUS_EVENT, type Details, type SubagentChildStatusEvent, type SubagentState } from "../../src/shared/types.ts";
 
 class FakeEvents {
 	readonly emitted: Array<{ event: string; data: unknown }> = [];
@@ -117,6 +118,8 @@ describe("subagent extension RPC bridge", () => {
 			(reply as { data: { capabilities?: { statusProjection?: unknown } } }).data.capabilities?.statusProjection,
 			{ version: 1, untargeted: "in-memory-when-ready", targeted: "executor" },
 		);
+		assert.deepEqual((reply as { data: { capabilities?: { cost?: unknown } } }).data.capabilities?.cost, { version: 1 });
+		assert.ok((reply as { data: { methods?: string[] } }).data.methods?.includes("cost"));
 
 		bridge.dispose();
 	});
@@ -1147,4 +1150,105 @@ describe("subagent extension RPC bridge", () => {
 			fs.rmSync(root, { recursive: true, force: true });
 		}
 	});
+
+	it("answers cost with structured parent-plus-child accounting from the session branch", async () => {
+		const events = new FakeEvents();
+		const childUsage = { input: 8, output: 3, cacheRead: 5, cacheWrite: 0, cost: 0.25, turns: 1 };
+		const branch = [
+			{ type: "message", message: { role: "assistant", usage: { input: 15, output: 3, cacheRead: 30, cacheWrite: 0, cost: { total: 0.25 } } } },
+			{ type: "message", message: { role: "toolResult", toolName: "subagent", details: { mode: "single", results: [{ agent: "reviewer", runId: "run-a", usage: childUsage, sessionFile: "/sessions/child-a.jsonl" }] } } },
+			{ type: "message", message: { role: "toolResult", toolName: "bg_wait", details: { mode: "single", results: [], completions: [{ mode: "single", runId: "run-a", results: [{ agent: "reviewer", runId: "run-a", usage: childUsage }] }] } } },
+		];
+		const bridge = registerSubagentRpcBridge({
+			events,
+			getContext: () => ({
+				cwd: "/repo",
+				sessionManager: { getSessionId: () => "session-123", getSessionFile: () => "/sessions/parent.jsonl", getBranch: () => branch },
+			}) as any,
+			execute: async () => assert.fail("cost should not call executor"),
+			state: { baseCwd: "/repo" } as SubagentState,
+		});
+
+		const reply = await request(events, "cost-1", "cost");
+		assert.equal(reply.success, true);
+		assert.equal(reply.method, "cost");
+		const data = (reply as { data: { version: number; parent: Record<string, number>; children: Array<{ agent?: string; runId?: string }>; childTotal: Record<string, number>; total: Record<string, number>; unresolvedAsyncChildren: number } }).data;
+		assert.equal(data.version, 1);
+		assert.deepEqual(data.parent, { input: 15, output: 3, cacheRead: 30, cacheWrite: 0, cost: 0.25, turns: 1 });
+		assert.equal(data.children.length, 1, "run identity deduplicates the bg_wait completion");
+		assert.equal(data.children[0]?.agent, "reviewer");
+		assert.equal(data.children[0]?.runId, "run-a");
+		assert.deepEqual(data.childTotal, childUsage);
+		assert.deepEqual(data.total, { input: 23, output: 6, cacheRead: 35, cacheWrite: 0, cost: 0.5, turns: 2 });
+		assert.equal(data.unresolvedAsyncChildren, 0);
+
+		const rejected = await request(events, "cost-2", "cost", "not-an-object");
+		assert.equal(rejected.success, false);
+		assert.equal((rejected as { error: { code: string } }).error.code, "invalid_params");
+		bridge.dispose();
+	});
+
+	it("answers cost with receipt-recovered async usage and an unresolved lower bound", async () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-rpc-cost-async-"));
+		const workflowRunId = `workflow-rpc-cost-${process.pid}-${Date.now()}`;
+		const recoveredRunId = `child-rpc-cost-${process.pid}-${Date.now()}`;
+		const unresolvedRunId = `child-rpc-cost-missing-${process.pid}-${Date.now()}`;
+		const unresolvedWorkflowRunId = `workflow-rpc-cost-missing-${process.pid}-${Date.now()}`;
+		const asyncDir = path.join(DIRS.async, workflowRunId);
+		try {
+			const sessionFile = path.join(root, "sessions", "parent.jsonl");
+			const artifactsDir = getArtifactsDir(sessionFile, root, "session");
+			const metadataPath = getArtifactPaths(artifactsDir, recoveredRunId, "reviewer", 0).metadataPath;
+			fs.mkdirSync(path.dirname(sessionFile), { recursive: true });
+			fs.writeFileSync(sessionFile, "", "utf-8");
+			fs.mkdirSync(asyncDir, { recursive: true });
+			fs.mkdirSync(path.dirname(metadataPath), { recursive: true });
+			fs.writeFileSync(path.join(asyncDir, "workflow-receipt.json"), JSON.stringify({
+				version: 1, workflowRunId, state: "complete", createdAt: Date.now(),
+				entries: {
+					recovered: { key: "recovered", agent: "reviewer", latestRunId: recoveredRunId, continuation: { runIds: [recoveredRunId] }, resumability: { state: "resumable" } },
+					unresolved: { key: "unresolved", agent: "worker", latestRunId: unresolvedRunId, continuation: { runIds: [unresolvedRunId] }, resumability: { state: "resumable" } },
+					nestedWorkflow: { key: "nestedWorkflow", latestRunId: unresolvedWorkflowRunId, continuation: { runIds: [unresolvedWorkflowRunId] }, resumability: { state: "resumable" } },
+				},
+			}, null, 2), "utf-8");
+			const recoveredUsage = { input: 20, output: 4, cacheRead: 80, cacheWrite: 0, cost: 0.5, turns: 2 };
+			fs.writeFileSync(metadataPath, JSON.stringify({ runId: recoveredRunId, agent: "reviewer", usage: recoveredUsage }), "utf-8");
+
+			const events = new FakeEvents();
+			const bridge = registerSubagentRpcBridge({
+				events,
+				getContext: () => ({
+					cwd: root,
+					sessionManager: {
+						getSessionId: () => "session-async-cost",
+						getSessionFile: () => sessionFile,
+						getBranch: () => [{ type: "message", message: { role: "toolResult", toolName: "subagent", details: { mode: "workflow", runId: workflowRunId, results: [] } } }],
+					},
+				}) as any,
+				execute: async () => assert.fail("cost should not call executor"),
+				state: { baseCwd: root, artifactDirPreference: "session" } as SubagentState,
+			});
+
+			const reply = await request(events, "cost-async", "cost");
+			assert.equal(reply.success, true);
+			const data = (reply as { data: { children: Array<{ agent?: string; runId?: string }>; childTotal: Record<string, number>; total: Record<string, number>; unresolvedAsyncChildren: number } }).data;
+			assert.deepEqual(data.children.map(({ agent, runId }) => ({ agent, runId })), [{ agent: "reviewer", runId: recoveredRunId }]);
+			assert.deepEqual(data.childTotal, recoveredUsage);
+			assert.deepEqual(data.total, recoveredUsage, "totals remain a lower bound when metadata is unavailable");
+			assert.equal(data.unresolvedAsyncChildren, 2);
+			bridge.dispose();
+		} finally {
+			fs.rmSync(asyncDir, { recursive: true, force: true });
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
+	it("cost requires an active session context like every non-ping method", async () => {
+		const events = new FakeEvents();
+		const bridge = registerSubagentRpcBridge({ events, getContext: () => null, execute: async () => assert.fail("cost should not call executor") });
+		const reply = await request(events, "cost-3", "cost");
+		assert.equal(reply.success, false);
+		assert.equal((reply as { error: { code: string } }).error.code, "no_active_session");
+		bridge.dispose();
+	});
 });

package/dist/extensions/pi-subagents/test/unit/run-status.test.ts

@@ -1630,4 +1630,40 @@ describe("async run status inspection", () => {
 			fs.rmSync(root, { recursive: true, force: true });
 		}
 	});
+
+	it("returns a workflow terminal proof after every async child exits", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-run-status-workflow-terminal-"));
+		try {
+			const asyncRoot = path.join(root, "runs");
+			const asyncDir = path.join(asyncRoot, "workflow-parent");
+			const childDir = path.join(asyncRoot, "child-run");
+			fs.mkdirSync(asyncDir, { recursive: true });
+			fs.mkdirSync(childDir);
+			const childProof = {
+				version: 1, state: "observed", runId: "child-run", runnerProcessInstanceId: "runner-1", observedAt: 300,
+				instances: [{ kind: "runner", processInstanceId: "runner-1", closeObservedAt: 300, exitCode: 0, signal: null }],
+			};
+			fs.writeFileSync(path.join(childDir, "process-terminal.json"), JSON.stringify(childProof));
+			fs.writeFileSync(path.join(childDir, "status.json"), JSON.stringify({
+				runId: "child-run", mode: "single", state: "complete", startedAt: 100, lastUpdate: 300,
+				processTerminal: { version: 1, state: "pending", runId: "child-run", runnerProcessInstanceId: "runner-1" },
+			}));
+			fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({
+				runId: "workflow-parent", mode: "workflow", state: "complete", startedAt: 100, lastUpdate: 200, endedAt: 250,
+				steps: [{ agent: "worker", workflowKey: "main", runId: "child-run", async: true, status: "completed" }],
+				workflowChildren: {
+					version: 1, parentToolCallId: "tool-call", workflowRunId: "workflow-parent", inventoryComplete: true,
+					workflowState: "completed", children: [{ childId: "main", runId: "child-run", state: "completed" }],
+				},
+			}, null, 2), "utf-8");
+
+			const result = inspectSubagentStatus({ id: "workflow-parent" }, { asyncDirRoot: asyncRoot, resultsDir: path.join(root, "results") });
+			assert.deepEqual(result.details.workflowTerminalProof, {
+				version: 1, kind: "workflow", runId: "workflow-parent", state: "observed", dispatchClosed: true,
+				observedAt: 300, children: [childProof],
+			});
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
 });