@selesai/code 0.5.20 → 0.5.21

package/dist/extensions/pi-subagents/test/unit/process-terminal.test.ts

@@ -0,0 +1,204 @@
+import assert from "node:assert/strict";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import test from "node:test";
+import {
+	finalizeProcessTerminal,
+	processTerminalPath,
+	readProcessTerminal,
+	sanitizeProcessTerminal,
+	writeProcessTerminalCandidate,
+} from "../../src/runs/background/process-terminal.ts";
+
+test("process-terminal proof requires the matching runner instance and writer close records", () => {
+	const asyncDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-process-terminal-"));
+	try {
+		writeProcessTerminalCandidate(asyncDir, {
+			version: 1,
+			runId: "run-1",
+			runnerProcessInstanceId: "runner-1",
+			expectedWriters: { "0": 1 },
+			writers: {
+				"0": [{
+					processInstanceId: "writer-1",
+					kind: "pi-writer",
+					attempt: 0,
+					closeObservedAt: 10,
+					exitCode: 0,
+					signal: null,
+				}],
+			},
+		});
+		fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({ runId: "run-1", state: "complete", lifecycleArtifactVersion: 3, steps: [{ agent: "worker", status: "complete" }] }));
+		fs.writeFileSync(path.join(asyncDir, "events.jsonl"), "");
+
+		const mismatch = finalizeProcessTerminal(asyncDir, "run-1", {
+			processInstanceId: "runner-2",
+			closeObservedAt: 20,
+			exitCode: 0,
+			signal: null,
+		});
+		assert.equal(mismatch.state, "unknown");
+		assert.equal(mismatch.reason, "runner-instance-mismatch");
+
+		fs.rmSync(processTerminalPath(asyncDir), { force: true });
+		const observed = finalizeProcessTerminal(asyncDir, "run-1", {
+			processInstanceId: "runner-1",
+			closeObservedAt: 30,
+			exitCode: 0,
+			signal: null,
+		});
+		assert.equal(observed.state, "observed");
+		assert.equal(observed.instances?.length, 2);
+		assert.equal(JSON.parse(fs.readFileSync(path.join(asyncDir, "status.json"), "utf8")).processTerminal.state, "observed");
+	} finally {
+		fs.rmSync(asyncDir, { recursive: true, force: true });
+	}
+});
+
+test("process-terminal rejects missing writer close evidence", () => {
+	const asyncDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-process-terminal-"));
+	try {
+		writeProcessTerminalCandidate(asyncDir, {
+			version: 1,
+			runId: "run-missing-writer",
+			runnerProcessInstanceId: "runner-missing-writer",
+			expectedWriters: { "0": 1 },
+			writers: { "0": [] },
+		});
+		fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({ runId: "run-missing-writer", state: "complete", lifecycleArtifactVersion: 3, steps: [{ agent: "worker", status: "complete" }] }));
+		fs.writeFileSync(path.join(asyncDir, "events.jsonl"), "");
+		const proof = finalizeProcessTerminal(asyncDir, "run-missing-writer", {
+			processInstanceId: "runner-missing-writer",
+			closeObservedAt: 40,
+			exitCode: 1,
+			signal: null,
+		});
+		assert.equal(proof.state, "unknown");
+		assert.equal(proof.reason, "writer-close-unverified");
+	} finally {
+		fs.rmSync(asyncDir, { recursive: true, force: true });
+	}
+});
+
+test("malformed process-terminal sidecars project unknown instead of throwing", () => {
+	const asyncDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-process-terminal-"));
+	try {
+		fs.writeFileSync(processTerminalPath(asyncDir), JSON.stringify({ version: 1, state: "bogus" }));
+		const proof = readProcessTerminal(asyncDir, { runId: "malformed-run", runnerProcessInstanceId: "malformed-runner" });
+		assert.equal(proof?.state, "unknown");
+		assert.equal(proof?.reason, "proof-write-failed");
+		assert.match(proof?.diagnostic ?? "", /Invalid process-terminal proof/);
+		fs.writeFileSync(path.join(asyncDir, "events.jsonl"), "");
+		const finalized = finalizeProcessTerminal(asyncDir, "malformed-run", {
+			processInstanceId: "malformed-runner",
+			closeObservedAt: 10,
+			exitCode: 1,
+			signal: null,
+		});
+		assert.equal(finalized.state, "unknown");
+	} finally {
+		fs.rmSync(asyncDir, { recursive: true, force: true });
+	}
+});
+
+test("process-terminal preserves stopped non-resumability and requires lease release acknowledgement", () => {
+	const asyncDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-process-terminal-"));
+	try {
+		writeProcessTerminalCandidate(asyncDir, {
+			version: 1,
+			runId: "stopped-run",
+			runnerProcessInstanceId: "stopped-runner",
+			expectedWriters: { "0": 1 },
+			writers: {
+				"0": [{ processInstanceId: "stopped-writer", kind: "pi-writer", attempt: 0, closeObservedAt: 10, exitCode: 0, signal: null }],
+			},
+			revivalLeaseToken: "lease-token",
+			revivalLeaseReleaseAcknowledged: false,
+		});
+		fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({ runId: "stopped-run", state: "stopped", lifecycleArtifactVersion: 3, steps: [{ agent: "worker", status: "stopped" }] }));
+		fs.writeFileSync(path.join(asyncDir, "events.jsonl"), "");
+		const unverified = finalizeProcessTerminal(asyncDir, "stopped-run", { processInstanceId: "stopped-runner", closeObservedAt: 20, exitCode: 0, signal: null });
+		assert.equal(unverified.state, "unknown");
+		assert.equal(unverified.reason, "canonical-session-release-unverified");
+
+		fs.rmSync(processTerminalPath(asyncDir), { force: true });
+		const candidatePath = path.join(asyncDir, "process-terminal-candidate.json");
+		const candidate = JSON.parse(fs.readFileSync(candidatePath, "utf8"));
+		candidate.revivalLeaseReleaseAcknowledged = true;
+		delete candidate.revivalLeaseToken;
+		fs.writeFileSync(candidatePath, JSON.stringify(candidate));
+		const observed = finalizeProcessTerminal(asyncDir, "stopped-run", { processInstanceId: "stopped-runner", closeObservedAt: 30, exitCode: 0, signal: null });
+		assert.equal(observed.state, "observed");
+		assert.equal(observed.resumeDisposition, "non-resumable");
+	} finally {
+		fs.rmSync(asyncDir, { recursive: true, force: true });
+	}
+});
+
+
+test("process-terminal rejects cross-run observed sidecars and inconsistent expected writer maps", () => {
+	const asyncDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-process-terminal-"));
+	try {
+		fs.writeFileSync(processTerminalPath(asyncDir), JSON.stringify({
+			version: 1,
+			state: "observed",
+			runId: "wrong-run",
+			runnerProcessInstanceId: "runner-1",
+			observedAt: 10,
+			instances: [{ processInstanceId: "runner-1", kind: "runner", closeObservedAt: 10, exitCode: 0, signal: null }],
+		}));
+		const crossRun = finalizeProcessTerminal(asyncDir, "actual-run", { processInstanceId: "runner-1", closeObservedAt: 20, exitCode: 0, signal: null });
+		assert.equal(crossRun.state, "unknown");
+		assert.equal(crossRun.reason, "proof-write-failed");
+		assert.match(crossRun.diagnostic ?? "", /wrong-run|expected/);
+
+		fs.rmSync(processTerminalPath(asyncDir), { force: true });
+		writeProcessTerminalCandidate(asyncDir, {
+			version: 1,
+			runId: "actual-run",
+			runnerProcessInstanceId: "runner-1",
+			expectedWriters: { "0": 0 },
+			writers: {
+				"0": [{ processInstanceId: "unexpected-writer", kind: "pi-writer", attempt: 0, closeObservedAt: 10, exitCode: 0, signal: null }],
+			},
+		});
+		fs.writeFileSync(path.join(asyncDir, "status.json"), JSON.stringify({ runId: "actual-run", state: "complete", lifecycleArtifactVersion: 3, steps: [{ agent: "worker", status: "complete" }] }));
+		fs.writeFileSync(path.join(asyncDir, "events.jsonl"), "");
+		const inconsistent = finalizeProcessTerminal(asyncDir, "actual-run", { processInstanceId: "runner-1", closeObservedAt: 30, exitCode: 0, signal: null });
+		assert.equal(inconsistent.state, "unknown");
+		assert.equal(inconsistent.reason, "writer-close-unverified");
+	} finally {
+		fs.rmSync(asyncDir, { recursive: true, force: true });
+	}
+});
+
+test("process-terminal sanitizes malformed status fallback proofs", () => {
+	const malformed = readProcessTerminal("/no/such/dir", { runId: "run-fallback", runnerProcessInstanceId: "runner-fallback" });
+	assert.equal(malformed, undefined);
+	const sanitized = sanitizeProcessTerminal({ version: 1, state: "bogus", runId: "run-fallback", runnerProcessInstanceId: "runner-fallback" }, { runId: "run-fallback", runnerProcessInstanceId: "runner-fallback" }, "status.json");
+	assert.equal(sanitized?.state, "unknown");
+	assert.equal(sanitized?.reason, "proof-write-failed");
+});
+
+test("process-terminal reports unknown when the runner candidate is unavailable", () => {
+	const asyncDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-process-terminal-"));
+	try {
+		const proof = finalizeProcessTerminal(asyncDir, "run-2", {
+			processInstanceId: "runner-2",
+			closeObservedAt: 40,
+			exitCode: 1,
+			signal: null,
+		});
+		assert.deepEqual(proof, {
+			version: 1,
+			state: "unknown",
+			runId: "run-2",
+			runnerProcessInstanceId: "runner-2",
+			reason: "runner-candidate-missing",
+		});
+	} finally {
+		fs.rmSync(asyncDir, { recursive: true, force: true });
+	}
+});

package/dist/extensions/pi-subagents/test/unit/recursion-guard.test.ts

@@ -4,7 +4,6 @@ import {
 	checkSubagentDepth,
 	getSubagentDepthEnv,
 	DEFAULT_SUBAGENT_MAX_DEPTH,
-	DEFAULT_MAX_SUBAGENT_SPAWNS_PER_SESSION,
 	normalizeMaxSubagentDepth,
 	normalizeMaxSubagentSpawnsPerSession,
 	resolveMaxSubagentSpawnsPerSession,
@@ -39,12 +38,6 @@ describe("DEFAULT_SUBAGENT_MAX_DEPTH", () => {
 	});
 });
 
-describe("DEFAULT_MAX_SUBAGENT_SPAWNS_PER_SESSION", () => {
-	it("is 40", () => {
-		assert.equal(DEFAULT_MAX_SUBAGENT_SPAWNS_PER_SESSION, 40);
-	});
-});
-
 describe("normalizeMaxSubagentDepth", () => {
 	it("accepts integers >= 0", () => {
 		assert.equal(normalizeMaxSubagentDepth(0), 0);
@@ -74,20 +67,35 @@ describe("normalizeMaxSubagentSpawnsPerSession", () => {
 });
 
 describe("resolveMaxSubagentSpawnsPerSession", () => {
-	it("uses env when present", () => {
+	it("uses positive env values as opt-in caps", () => {
 		process.env.SELESAI_SUBAGENT_MAX_SPAWNS_PER_SESSION = "5";
 		assert.equal(resolveMaxSubagentSpawnsPerSession(1), 5);
 	});
 
-	it("falls back to config when env is absent", () => {
+	it("falls back to a positive config cap when env is absent", () => {
 		delete process.env.SELESAI_SUBAGENT_MAX_SPAWNS_PER_SESSION;
 		assert.equal(resolveMaxSubagentSpawnsPerSession(7), 7);
 	});
 
-	it("falls back to default when neither env nor config is valid", () => {
+	it("ignores invalid env values and falls back to config", () => {
+		for (const value of ["garbage", "-1", "1.5"]) {
+			process.env.SELESAI_SUBAGENT_MAX_SPAWNS_PER_SESSION = value;
+			assert.equal(resolveMaxSubagentSpawnsPerSession(7), 7);
+			assert.equal(resolveMaxSubagentSpawnsPerSession(undefined), undefined);
+		}
+	});
+
+	it("is unlimited by default", () => {
+		delete process.env.SELESAI_SUBAGENT_MAX_SPAWNS_PER_SESSION;
+		assert.equal(resolveMaxSubagentSpawnsPerSession(undefined), undefined);
+		assert.equal(resolveMaxSubagentSpawnsPerSession(-1), undefined);
+	});
+
+	it("treats zero as an explicit unlimited override", () => {
+		process.env.SELESAI_SUBAGENT_MAX_SPAWNS_PER_SESSION = "0";
+		assert.equal(resolveMaxSubagentSpawnsPerSession(7), undefined);
 		delete process.env.SELESAI_SUBAGENT_MAX_SPAWNS_PER_SESSION;
-		assert.equal(resolveMaxSubagentSpawnsPerSession(undefined), 40);
-		assert.equal(resolveMaxSubagentSpawnsPerSession(-1), 40);
+		assert.equal(resolveMaxSubagentSpawnsPerSession(0), undefined);
 	});
 });
 

package/dist/extensions/pi-subagents/test/unit/rpc.test.ts

@@ -3,7 +3,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { describe, it } from "node:test";
-import { timeoutRequestPath } from "../../src/runs/background/control-channel.ts";
+import { stopRequestPath } from "../../src/runs/background/control-channel.ts";
 import {
 	SUBAGENT_RPC_PROTOCOL_VERSION,
 	SUBAGENT_RPC_READY_EVENT,
@@ -83,6 +83,14 @@ describe("subagent extension RPC bridge", () => {
 		assert.equal(reply.success, true);
 		assert.equal(reply.method, "ping");
 		assert.equal((reply as { data: { version?: number } }).data.version, SUBAGENT_RPC_PROTOCOL_VERSION);
+		assert.equal(
+			(reply as { data: { events?: { asyncComplete?: string } } }).data.events?.asyncComplete,
+			"subagent:async-complete",
+		);
+		assert.equal(
+			(reply as { data: { capabilities?: { nonRecoveringSteer?: boolean } } }).data.capabilities?.nonRecoveringSteer,
+			true,
+		);
 
 		bridge.dispose();
 	});
@@ -160,6 +168,31 @@ describe("subagent extension RPC bridge", () => {
 		bridge.dispose();
 	});
 
+	it("preserves schema-valid static parallel extension fields", async () => {
+		const events = new FakeEvents();
+		let executedParams: any;
+		const bridge = registerSubagentRpcBridge({
+			events,
+			getContext: () => ctx(),
+			execute: async (_id, params) => {
+				executedParams = params;
+				return {
+					content: [{ type: "text", text: "Async: worker [run-1]" }],
+					details: { mode: "chain", results: [], asyncId: "run-1", asyncDir: "/tmp/run-1" },
+				} as any;
+			},
+		});
+
+		const reply = await request(events, "spawn-chain-extra", "spawn", {
+			chain: [{ parallel: [{ agent: "worker", extensionField: true }] }],
+		});
+
+		assert.equal(reply.success, true);
+		assert.equal(executedParams.chain[0].parallel[0].extensionField, true);
+
+		bridge.dispose();
+	});
+
 	it("rejects foreground or management spawn requests before executor dispatch", async () => {
 		const events = new FakeEvents();
 		let executeCalls = 0;
@@ -185,6 +218,86 @@ describe("subagent extension RPC bridge", () => {
 		bridge.dispose();
 	});
 
+	it("delegates acknowledged steering through the existing async action", async () => {
+		const events = new FakeEvents();
+		let executedParams: unknown;
+		const bridge = registerSubagentRpcBridge({
+			events,
+			getContext: () => ctx(),
+			execute: async (_id, params) => {
+				executedParams = params;
+				return {
+					content: [{ type: "text", text: "Steering delivered." }],
+					details: { mode: "management", results: [] },
+				} as any;
+			},
+		});
+
+		const reply = await request(events, "steer-1", "steer", {
+			id: "abc123",
+			index: 0,
+			message: " Focus on the failing test. ",
+		});
+
+		assert.equal(reply.success, true);
+		assert.deepEqual(executedParams, {
+			action: "steer",
+			id: "abc123",
+			index: 0,
+			message: "Focus on the failing test.",
+			steeringRecovery: false,
+		});
+		assert.equal((reply as { data: { text?: string } }).data.text, "Steering delivered.");
+
+		bridge.dispose();
+	});
+
+	it("rejects targetless RPC steering before executor dispatch", async () => {
+		const events = new FakeEvents();
+		let executeCalls = 0;
+		const bridge = registerSubagentRpcBridge({
+			events,
+			getContext: () => ctx(),
+			execute: async () => {
+				executeCalls++;
+				return { content: [], details: { mode: "management", results: [] } } as any;
+			},
+		});
+
+		const reply = await request(events, "steer-no-target", "steer", {
+			message: "keep going",
+		});
+
+		assert.equal(reply.success, false);
+		assert.equal((reply as { error: { code: string } }).error.code, "invalid_params");
+		assert.match((reply as { error: { message: string } }).error.message, /requires id, runId, or dir/);
+		assert.equal(executeCalls, 0);
+		bridge.dispose();
+	});
+
+	it("rejects empty RPC steering before executor dispatch", async () => {
+		const events = new FakeEvents();
+		let executeCalls = 0;
+		const bridge = registerSubagentRpcBridge({
+			events,
+			getContext: () => ctx(),
+			execute: async () => {
+				executeCalls++;
+				return { content: [], details: { mode: "management", results: [] } } as any;
+			},
+		});
+
+		const reply = await request(events, "steer-empty", "steer", {
+			id: "abc123",
+			message: "   ",
+		});
+
+		assert.equal(reply.success, false);
+		assert.equal((reply as { error: { code: string } }).error.code, "invalid_params");
+		assert.equal(executeCalls, 0);
+		bridge.dispose();
+	});
+
 	it("delegates interrupt through the existing executor action", async () => {
 		const events = new FakeEvents();
 		let executedParams: unknown;
@@ -205,7 +318,7 @@ describe("subagent extension RPC bridge", () => {
 		bridge.dispose();
 	});
 
-	it("uses the existing async timeout control path for stop", async () => {
+	it("uses the async stop control path for stop", async () => {
 		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-rpc-stop-"));
 		try {
 			const events = new FakeEvents();
@@ -238,7 +351,7 @@ describe("subagent extension RPC bridge", () => {
 			assert.equal(reply.success, true);
 			assert.equal((reply as { data: { runId?: string; state?: string } }).data.runId, "run-stop");
 			assert.equal((reply as { data: { state?: string } }).data.state, "stopping");
-			assert.equal(fs.existsSync(timeoutRequestPath(asyncDir)), true);
+			assert.equal(fs.existsSync(stopRequestPath(asyncDir)), true);
 
 			bridge.dispose();
 		} finally {
@@ -283,7 +396,7 @@ describe("subagent extension RPC bridge", () => {
 			assert.equal(reply.success, false);
 			assert.equal((reply as { error: { code: string; message: string } }).error.code, "not_found");
 			assert.match((reply as { error: { message: string } }).error.message, /active session/);
-			assert.equal(fs.existsSync(timeoutRequestPath(asyncDir)), false);
+			assert.equal(fs.existsSync(stopRequestPath(asyncDir)), false);
 			assert.equal(killCalls, 0);
 
 			bridge.dispose();

package/dist/extensions/pi-subagents/test/unit/run-status.test.ts

@@ -308,7 +308,7 @@ describe("async run status inspection", () => {
 
 			const text = textContent(result);
 			assert.equal(result.isError, undefined);
-			assert.match(text, /Subagent fleet: 2 active/);
+			assert.match(text, /Subagent fleet: 2 tracked/);
 			assert.match(text, /Foreground runs:/);
 			assert.match(text, /fg-run \| running \| scout/);
 			assert.match(text, /Async runs:/);
@@ -456,9 +456,8 @@ describe("async run status inspection", () => {
 				startedAt: 100,
 				lastUpdate: 200,
 				currentStep: 0,
-				steerCount: 2,
-				lastSteerAt: 150,
-				steps: [{ agent: "worker", status: "running", startedAt: 100, steerCount: 2, lastSteerAt: 150 }],
+				steering: { requested: 2, scheduled: 1, pending: 1, delivered: 2, failed: 0, recovered: 1, lastRequestedAt: 150, lastDeliveredAt: 150, recent: [{ id: "request", requestedAt: 150, message: "guidance", targets: [{ index: 0, state: "recovered", recoveredAt: 180, lateDeliveredAt: 190 }] }] },
+				steps: [{ agent: "worker", status: "running", startedAt: 100, steering: { requested: 2, scheduled: 1, pending: 1, delivered: 2, failed: 0, recovered: 1, lastRequestedAt: 150, lastDeliveredAt: 150, recent: [{ id: "request", requestedAt: 150, message: "guidance", targets: [{ index: 0, state: "recovered", recoveredAt: 180, lateDeliveredAt: 190 }] }] } }],
 			}, null, 2), "utf-8");
 
 			const exact = inspectSubagentStatus({ id: "run-steered" }, {
@@ -469,8 +468,8 @@ describe("async run status inspection", () => {
 			});
 			const exactText = textContent(exact);
 			assert.equal(exact.isError, undefined);
-			assert.match(exactText, /Steering: 2 steers, last 1970-01-01T00:00:00\.150Z/);
-			assert.match(exactText, /Step 1: worker running, steering: 2 steers, last 1970-01-01T00:00:00\.150Z/);
+			assert.match(exactText, /Steering: 2 requested, 1 scheduled, 1 pending, 2 delivered, 0 failed, 1 recovered, 1 late acknowledged/);
+			assert.match(exactText, /Step 1: worker running/);
 
 			const list = inspectSubagentStatus({}, {
 				asyncDirRoot: asyncRoot,
@@ -480,7 +479,7 @@ describe("async run status inspection", () => {
 			});
 			const listText = textContent(list);
 			assert.equal(list.isError, undefined);
-			assert.match(listText, /2 steers \| last steer 1970-01-01T00:00:00\.150Z/);
+			assert.match(listText, /steering 1 scheduled, 1 pending, 2 delivered, 0 failed, 1 recovered/);
 		} finally {
 			fs.rmSync(root, { recursive: true, force: true });
 		}
@@ -961,6 +960,40 @@ describe("async run status inspection", () => {
 		}
 	});
 
+	it("shows stopped result-only runs without revive guidance", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-run-status-stopped-result-"));
+		try {
+			const asyncRoot = path.join(root, "runs");
+			const resultsDir = path.join(root, "results");
+			fs.mkdirSync(path.join(asyncRoot, "run-stopped-result"), { recursive: true });
+			fs.mkdirSync(resultsDir, { recursive: true });
+			const sessionFile = path.join(root, "session.jsonl");
+			fs.writeFileSync(sessionFile, "", "utf-8");
+			fs.writeFileSync(path.join(resultsDir, "run-stopped-result.json"), JSON.stringify({
+				id: "run-stopped-result",
+				agent: "worker",
+				success: false,
+				state: "stopped",
+				stopped: true,
+				sessionFile,
+				summary: "Subagent stopped by user.",
+			}, null, 2), "utf-8");
+
+			const result = inspectSubagentStatus({ id: "run-stopped-result" }, {
+				asyncDirRoot: asyncRoot,
+				resultsDir,
+			});
+
+			const text = textContent(result);
+			assert.equal(result.isError, undefined);
+			assert.match(text, /State: stopped/);
+			assert.match(text, /Resume: unavailable; stopped runs are not resumable/);
+			assert.doesNotMatch(text, /Revive:/);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
 	it("falls back to an existing result when async dir has no status file", () => {
 		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-run-status-result-fallback-"));
 		try {

package/dist/extensions/pi-subagents/test/unit/scheduled-runs.test.ts

@@ -14,6 +14,7 @@ import {
 	scheduledRunsEnabled,
 } from "../../src/runs/background/scheduled-runs.ts";
 import type { ExtensionConfig } from "../../src/shared/types.ts";
+import { encodeSubagentCapabilityCeiling, resolveCurrentSubagentCapabilityCeiling } from "../../src/api/capability-ceiling.ts";
 import type { ExtensionContext } from "@selesai/code";
 
 type TimerHandle = number;
@@ -78,7 +79,7 @@ async function flushMicrotasks(times = 10): Promise<void> {
 	for (let i = 0; i < times; i++) await Promise.resolve();
 }
 
-function createHarness(options: { config?: ExtensionConfig; storeRoot?: string; now?: number } = {}): TestHarness {
+function createHarness(options: { config?: ExtensionConfig; storeRoot?: string; now?: number; resolveCapabilityCeiling?: (sessionId: string) => { version: 1; allowedTools?: string[]; denyExtensions: boolean; sources: string[] } | undefined } = {}): TestHarness {
 	const timers = new FakeTimers();
 	const launches: LaunchRecord[] = [];
 	const clock = { now: options.now ?? 1_000_000 };
@@ -89,6 +90,7 @@ function createHarness(options: { config?: ExtensionConfig; storeRoot?: string;
 		now: () => clock.now,
 		randomId: () => "id-" + randomUUID().slice(0, 4),
 		timers,
+		resolveCapabilityCeiling: options.resolveCapabilityCeiling,
 		launch: (params, ctx, signal) => {
 			let resolve!: LaunchRecord["resolve"];
 			const promise = new Promise<{ content: Array<{ type: "text"; text: string }>; details: Record<string, unknown>; isError?: boolean }>((res) => {
@@ -190,6 +192,30 @@ describe("ScheduledRunManager create/list/status/cancel", () => {
 		assert.equal(harness.timers.pendingCount(), 0);
 	});
 
+	it("rejects capability-ceiling-restricted schedules instead of persisting policy-less jobs", async () => {
+		const harness = createHarness({ resolveCapabilityCeiling: () => ({ version: 1, allowedTools: ["read"], denyExtensions: true, sources: ["plan"] }) });
+		const result = await harness.manager.handleToolCall({ action: "schedule", agent: "worker", task: "review", schedule: "+10m" }, harness.ctx);
+		assert.equal(isError(result), true);
+		assert.match(result.content[0]!.text, /does not yet persist ceilings/);
+		assert.equal(harness.launches.length, 0);
+	});
+
+
+	it("rejects schedules restricted only by inherited process policy", async () => {
+		const previous = process.env.SELESAI_SUBAGENT_CAPABILITY_CEILING_V1;
+		try {
+			process.env.SELESAI_SUBAGENT_CAPABILITY_CEILING_V1 = encodeSubagentCapabilityCeiling({ version: 1, allowedTools: ["read"], denyExtensions: true, sources: ["ancestor"] });
+			const harness = createHarness({ resolveCapabilityCeiling: resolveCurrentSubagentCapabilityCeiling });
+			const result = await harness.manager.handleToolCall({ action: "schedule", agent: "worker", task: "review", schedule: "+10m" }, harness.ctx);
+			assert.equal(isError(result), true);
+			assert.match(result.content[0]!.text, /does not yet persist ceilings/);
+			assert.equal(harness.launches.length, 0);
+		} finally {
+			if (previous === undefined) delete process.env.SELESAI_SUBAGENT_CAPABILITY_CEILING_V1;
+			else process.env.SELESAI_SUBAGENT_CAPABILITY_CEILING_V1 = previous;
+		}
+	});
+
 	it("creates a scheduled job and arms a timer", async () => {
 		const harness = freshHarness();
 		const result = await harness.manager.handleToolCall({ action: "schedule", agent: "scout", task: "review later", schedule: "+10m", scheduleName: "nightly review" }, harness.ctx);
@@ -211,6 +237,27 @@ describe("ScheduledRunManager create/list/status/cancel", () => {
 		assert.match(none.content[0]!.text, /exactly one execution mode/);
 	});
 
+	it("rejects explicit reviewed acceptance at every scheduled nesting level before persisting a job", async () => {
+		const harness = freshHarness();
+		const cases = [
+			{ agent: "scout", task: "review later", acceptance: "reviewed" },
+			{ agent: "scout", task: "review later", acceptance: { level: "reviewed" } },
+			{ tasks: [{ agent: "scout", task: "review later", acceptance: "reviewed" }] },
+			{ chain: [{ agent: "scout", task: "review later", acceptance: { level: "reviewed" } }] },
+			{ chain: [{ parallel: [{ agent: "scout", task: "review later", acceptance: "reviewed" }] }] },
+		];
+		for (const params of cases) {
+			const result = await harness.manager.handleToolCall({
+				action: "schedule",
+				schedule: "+10m",
+				...params,
+			}, harness.ctx);
+			assert.equal(isError(result), true);
+			assert.match(result.content[0]!.text, /achieved status.*omit acceptance.*acceptance\.review\.required/i);
+		}
+		assert.equal(harness.timers.pendingCount(), 0);
+	});
+
 	it("requires a schedule and rejects fork/async-false/clarify-true", async () => {
 		const harness = freshHarness();
 		const noSchedule = await harness.manager.handleToolCall({ action: "schedule", agent: "scout", task: "x" }, harness.ctx);

package/dist/extensions/pi-subagents/test/unit/schemas.test.ts

@@ -180,9 +180,10 @@ describe("SubagentParams schema", { skip: !schemasAvailable ? "typebox not avail
 		assert.equal(actionSchema.type, "string");
 		assert.equal(actionSchema.enum, undefined);
 		const description = String(actionSchema.description ?? "");
-		assert.match(description, /Management\/control action only/);
-		assert.match(description, /Must be omitted for execution mode/);
-		assert.match(description, /single, parallel, or chain/);
+		assert.match(description, /Optional management\/control action/);
+		assert.match(description, /Omit this field entirely for execution\/delegation/);
+		assert.match(description, /\{agent, task\}, \{tasks\}, or \{chain\}/);
+		assert.match(description, /use it only for management\/control actions/);
 		assert.doesNotMatch(description, /orchestration\./);
 	});
 
@@ -240,6 +241,12 @@ describe("SubagentParams schema", { skip: !schemasAvailable ? "typebox not avail
 		assert.equal(linesSchema.maximum, 500);
 		assert.match(String(linesSchema.description ?? ""), /transcript/i);
 
+		const additionalSchema = SubagentParams?.properties?.additional;
+		assert.ok(additionalSchema, "additional schema should exist");
+		assert.equal(additionalSchema.minimum, 1);
+		assert.match(String(additionalSchema.description ?? ""), /grant-spawn-budget/);
+		assert.match(String(additionalSchema.description ?? ""), /root interactive parent/i);
+
 		const controlSchema = SubagentParams?.properties?.control;
 		assert.ok(controlSchema, "control schema should exist");
 		assert.equal(controlSchema.properties?.needsAttentionAfterMs?.minimum, 1);
@@ -416,6 +423,14 @@ describe("SubagentParams schema", { skip: !schemasAvailable ? "typebox not avail
 		assert.equal(acceptanceSchema.type, undefined);
 		assert.equal(hasAnyOfType(acceptanceSchema, "string"), true);
 		assert.equal(hasAnyOfType(acceptanceSchema, "boolean"), true);
+		const acceptanceStringBranches = anyOfBranches(acceptanceSchema).filter((branch) => branch.type === "string");
+		const acceptanceLevelBranch = acceptanceStringBranches.find((branch) => Array.isArray(branch.enum) && branch.enum.includes("auto"));
+		assert.deepEqual(acceptanceLevelBranch?.enum, ["auto", "attested", "checked", "verified"], "evidence levels end at verified");
+		const reviewedRecoveryBranch = acceptanceStringBranches.find((branch) => Array.isArray(branch.enum) && branch.enum.includes("reviewed"));
+		assert.deepEqual(reviewedRecoveryBranch?.enum, ["reviewed"]);
+		assert.equal(reviewedRecoveryBranch?.deprecated, true);
+		assert.match(String(acceptanceSchema.description ?? ""), /reviewer\/read-only calls, omit acceptance/i);
+		assert.match(String(acceptanceSchema.description ?? ""), /acceptance\.review\.required/);
 		const acceptanceObjectBranch = anyOfBranches(acceptanceSchema).find((branch) => branch.type === "object");
 		assert.ok(acceptanceObjectBranch, "acceptance should support object config");
 		assert.equal(acceptanceObjectBranch.additionalProperties, true);
@@ -499,6 +514,8 @@ describe("SubagentParams schema", { skip: !schemasAvailable ? "typebox not avail
 			{ tasks: [{ agent: "worker", task: "Fix" }], maxRuntimeMs: 1000 },
 			{ chain: [{ agent: "worker", task: "Fix" }], timeoutMs: 1000, maxRuntimeMs: 1000 },
 			{ agent: "worker", task: "Fix", acceptance: "checked" },
+			{ agent: "worker", task: "Fix", acceptance: "reviewed" },
+			{ agent: "worker", task: "Fix", acceptance: { level: "none", reason: "parent will verify manually" } },
 			{ agent: "worker", task: "Fix", acceptance: { level: "checked", review: false } },
 			{ tasks: [{ agent: "worker", task: "Fix", acceptance: false }] },
 			{ chain: [{ agent: "worker", acceptance: { level: "checked" } }] },
@@ -517,6 +534,7 @@ describe("SubagentParams schema", { skip: !schemasAvailable ? "typebox not avail
 		];
 		const invalidValues = [
 			{ skill: 123 },
+			{ agent: "worker", task: "Fix", acceptance: "none" },
 			{ skill: [123] },
 			{ output: 123 },
 			{ timeoutMs: 0 },