@selesai/code 0.6.3 → 0.8.0

package/dist/extensions/pi-subagents/src/runs/shared/pi-args.ts

@@ -15,6 +15,7 @@ import { CHILD_TOOL_DIAGNOSTIC_PATH_ENV, MCP_DIRECT_CHILD_TOOLS_ENV, REQUIRED_CH
 import { CHILD_WATCHDOG_CONFIG_ENV, encodeChildWatchdogConfig, type ChildWatchdogConfig } from "../../watchdog/child-status.ts";
 import { WAIT_TOOL_ENABLED_ENV } from "../background/wait-config.ts";
 import { SELESAI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../shared/utils.ts";
+import { encodePermissionRules, PERMISSION_AUDIT_PATH_ENV, PERMISSION_POLICY_ENV, type PermissionRules } from "./permissions.ts";
 import { SUBAGENT_CAPABILITY_CEILING_ENV, capabilityCeilingAgentRestrictionSources, decodeSubagentCapabilityCeiling, encodeSubagentCapabilityCeiling, intersectSubagentCapabilityCeilings, isAgentAllowedByCapabilityCeiling, type ResolvedSubagentCapabilityCeiling, type SubagentCapabilityAudit } from "./capability-ceiling.ts";
 
 const TASK_ARG_LIMIT = 8000;
@@ -87,6 +88,8 @@ export interface BuildPiArgsInput {
 	};
 	toolBudget?: ResolvedToolBudget;
 	allowZeroToolBudget?: boolean;
+	permissionRules?: PermissionRules;
+	permissionAuditPath?: string;
 	childWatchdog?: ChildWatchdogConfig;
 	waitToolEnabled?: boolean;
 	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
@@ -125,7 +128,11 @@ export interface ResolvePiLaunchToolPlanInput {
 	mcpDirectTools?: string[];
 	cwd?: string;
 	requireReadTool?: boolean;
-	structuredOutput?: boolean;
+	structuredOutput?: boolean | {
+		schema: JsonSchemaObject;
+		schemaPath: string;
+		outputPath: string;
+	};
 	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
 	inheritedCapabilityCeiling?: ResolvedSubagentCapabilityCeiling;
 	agentName?: string;
@@ -386,6 +393,7 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	if (input.parentSessionId) {
 		env[SUBAGENT_ORCHESTRATOR_SESSION_ID_ENV] = input.parentSessionId;
 	}
+	const encodedPermissionRules = encodePermissionRules(input.permissionRules);
 	if (input.orchestratorIntercomTarget && input.parentSessionId && input.runId && input.childAgentName) {
 		const childIndex = input.childIndex ?? 0;
 		const channelDir = supervisorChannelDir(input.runId, input.childAgentName, childIndex);
@@ -393,6 +401,7 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 		fs.mkdirSync(path.join(channelDir, "replies"), { recursive: true });
 		env[SUBAGENT_SUPERVISOR_CHANNEL_DIR_ENV] = channelDir;
 	}
+	if (encodedPermissionRules) env[PERMISSION_AUDIT_PATH_ENV] = input.permissionAuditPath ?? path.join(tempDir, "permission-audit.jsonl");
 	if (input.runId) {
 		env[SUBAGENT_RUN_ID_ENV] = input.runId;
 	}
@@ -407,6 +416,7 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	else env.MCP_DIRECT_TOOLS = "__none__";
 	const encodedCapabilityCeiling = encodeSubagentCapabilityCeiling(toolPlan.capabilityCeiling);
 	if (encodedCapabilityCeiling) env[SUBAGENT_CAPABILITY_CEILING_ENV] = encodedCapabilityCeiling;
+	if (encodedPermissionRules) env[PERMISSION_POLICY_ENV] = encodedPermissionRules;
 	if (input.structuredOutput) {
 		env[STRUCTURED_OUTPUT_CAPTURE_ENV] = input.structuredOutput.outputPath;
 		env[STRUCTURED_OUTPUT_SCHEMA_ENV] = input.structuredOutput.schemaPath;

package/dist/extensions/pi-subagents/src/runs/shared/pi-spawn.ts

@@ -71,6 +71,11 @@ function normalizePath(filePath: string): string {
 	return path.isAbsolute(filePath) ? filePath : path.resolve(filePath);
 }
 
+function isStandalonePiExecutable(execPath: string): boolean {
+	const executableName = execPath.split(/[\\/]/).pop();
+	return /^(?:pi|selesai)(?:\.exe)?$/i.test(executableName ?? "");
+}
+
 export function resolvePiCliScript(
 	deps: PiSpawnDeps = {},
 ): string | undefined {
@@ -99,11 +104,10 @@ export function resolvePiCliScript(
 		const resolvePackageJson =
 			deps.resolvePackageJson ??
 			(() => {
-				const root = deps.piPackageRoot ?? resolvePiPackageRoot();
-				if (root) return path.join(root, "package.json");
-				const packageRoot = deps.resolvePackageEntry
-					? findPiPackageRootFromEntry(deps.resolvePackageEntry())
-					: resolveInstalledPiPackageRoot();
+				const packageRoot = deps.piPackageRoot
+					?? (deps.resolvePackageEntry ? findPiPackageRootFromEntry(deps.resolvePackageEntry()) : resolvePiPackageRoot())
+					?? resolveInstalledPiPackageRoot();
+				if (packageRoot) return path.join(packageRoot, "package.json");
 				if (!packageRoot)
 					throw new Error(
 						`Could not resolve ${PI_CODING_AGENT_PACKAGE} package root`,
@@ -142,10 +146,15 @@ export function getPiSpawnCommand(
 		return { command: piBinary, args };
 	}
 
+	const execPath = deps.execPath ?? process.execPath;
+	if (isStandalonePiExecutable(execPath)) {
+		return { command: execPath, args };
+	}
+
 	const piCliPath = resolvePiCliScript(deps);
 	if (piCliPath) {
 		return {
-			command: deps.execPath ?? process.execPath,
+			command: execPath,
 			args: [piCliPath, ...args],
 		};
 	}

package/dist/extensions/pi-subagents/src/runs/shared/run-history.ts

@@ -176,6 +176,6 @@ export function loadRunsForAgent(agent: string): RunEntry[] {
 
 	return lines
 		.map((line) => { try { return JSON.parse(line) as RunEntry; } catch { return undefined; } })
-		.filter((entry): entry is RunEntry => Boolean(entry) && entry.agent === agent)
+		.filter((entry): entry is RunEntry => entry !== undefined && entry.agent === agent)
 		.reverse();
 }

package/dist/extensions/pi-subagents/src/runs/shared/single-output.ts

@@ -1,19 +1,9 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { Message } from "@earendil-works/pi-ai";
-import type { MaxOutputConfig, OutputMode, SavedOutputReference } from "../../shared/types.ts";
-import { truncateOutput } from "../../shared/types.ts";
+import type { OutputMode, SavedOutputReference } from "../../shared/types.ts";
 import { hasMutationToolCapability } from "./completion-guard.ts";
 
-/**
- * Fixed internal context-fallback cap used when persisted output is unavailable
- * (persistence/read failure, `output: false`, or legacy results without a saved
- * path). Deliberately not exposed as a public parameter; reuse `truncateOutput()`
- * so the excerpt is bounded by both lines and bytes and never falls back to
- * unbounded output.
- */
-export const CONTEXT_FALLBACK_LIMIT: Required<MaxOutputConfig> = { bytes: 4096, lines: 80 };
-
 export interface SingleOutputSnapshot {
 	exists: boolean;
 	mtimeMs?: number;
@@ -135,34 +125,6 @@ function formatByteSize(bytes: number): string {
 	return `${value.toFixed(1)} ${units[unitIndex]}`;
 }
 
-/**
- * Bounded fallback for deliveries where the durable full output cannot be
- * referenced: persistence/write errors, unreadable saved paths, or no saved
- * path at all (legacy/`output: false`). Contains process status, the intended
- * output path, the concrete error, and a bounded 80-line/4-KiB excerpt of the
- * available output. Never claims a full artifact exists.
- */
-export function formatBoundedPersistenceFallback(input: {
-	error: string;
-	outputPath?: string;
-	fullOutput: string;
-	exitCode: number;
-	processError?: string;
-}): string {
-	const status = input.processError?.trim()
-		? `Process status: ${input.processError}`
-		: `Process status: ${input.exitCode === 0 ? "completed" : `failed (exit ${input.exitCode})`}`;
-	const bounded = truncateOutput(input.fullOutput, CONTEXT_FALLBACK_LIMIT);
-	const lines = [
-		`[Full output unavailable] ${input.error}`,
-		status,
-		...(input.outputPath ? [`Intended output path: ${input.outputPath}`] : []),
-		"Full output is unavailable; showing a bounded excerpt (first 80 lines / 4 KiB).",
-		bounded.text,
-	];
-	return lines.join("\n");
-}
-
 export function formatSavedOutputReference(savedPath: string, fullOutput: string): SavedOutputReference {
 	const absolutePath = path.resolve(savedPath);
 	const bytes = Buffer.byteLength(fullOutput, "utf-8");
@@ -255,35 +217,19 @@ export function finalizeSingleOutput(params: {
 	savedPath?: string;
 	outputReference?: SavedOutputReference;
 	saveError?: string;
-	error?: string;
 }): { displayOutput: string; savedPath?: string; outputReference?: SavedOutputReference; saveError?: string } {
-	if (params.savedPath) {
+	let displayOutput = params.truncatedOutput || params.fullOutput;
+	if (params.exitCode === 0 && params.savedPath) {
 		const outputReference = params.outputReference ?? formatSavedOutputReference(params.savedPath, params.fullOutput);
-		if (params.exitCode === 0 && params.outputMode === "file-only") {
+		if (params.outputMode === "file-only") {
 			return { displayOutput: outputReference.message, savedPath: params.savedPath, outputReference };
 		}
-		if (params.exitCode !== 0) {
-			// Failed runs with a successfully persisted result surface the error/status
-			// plus the saved-output reference, never raw child output.
-			const status = params.error?.trim() || `Subagent failed with exit code ${params.exitCode}`;
-			return { displayOutput: `${status}\n\n${outputReference.message}`, savedPath: params.savedPath, outputReference };
-		}
-		const displayOutput = `${params.truncatedOutput || params.fullOutput}\n\n${outputReference.message}`;
+		displayOutput += `\n\n${outputReference.message}`;
 		return { displayOutput, savedPath: params.savedPath, outputReference };
 	}
-	if (params.saveError && params.outputPath) {
-		// Persistence/read failure: only the bounded fallback is delivered. It must
-		// not claim a full artifact exists.
-		return {
-			displayOutput: formatBoundedPersistenceFallback({
-				error: params.saveError,
-				outputPath: params.outputPath,
-				fullOutput: params.fullOutput,
-				exitCode: params.exitCode,
-				processError: params.error,
-			}),
-			saveError: params.saveError,
-		};
+	if (params.exitCode === 0 && params.saveError && params.outputPath) {
+		displayOutput += `\n\nOutput file error: ${params.outputPath}\n${params.saveError}`;
+		return { displayOutput, saveError: params.saveError };
 	}
-	return { displayOutput: params.truncatedOutput || params.fullOutput };
+	return { displayOutput };
 }

package/dist/extensions/pi-subagents/src/runs/shared/subagent-prompt-runtime.ts

@@ -1,7 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import type { ExtensionAPI } from "@selesai/code";
+import type { ExtensionAPI, ExtensionContext } from "@selesai/code";
 import { registerNativeSupervisorClient } from "../../intercom/native-supervisor-channel.ts";
+import { decodePermissionRules, permissionDecision, PERMISSION_AUDIT_PATH_ENV, PERMISSION_POLICY_ENV } from "./permissions.ts";
 import { consumeSteerRequestsFromDir, steerAckPathFromDir, writeSteerAckAt, writeSteerCapabilityAt, writeSteerRequestToDir, type SteerRequest } from "../background/control-channel.ts";
 import { SUBAGENT_CHILD_AGENT_ENV, SUBAGENT_CHILD_INDEX_ENV, SUBAGENT_FANOUT_CHILD_ENV, SUBAGENT_STEER_ACK_DIR_ENV, SUBAGENT_STEER_CAPABILITY_ENV, SUBAGENT_STEER_INBOX_ENV } from "./pi-args.ts";
 import { RUNTIME_EXTENSION_ACK_EVENT, RUNTIME_EXTENSION_ACK_PATH_ENV, isRuntimeAcknowledgedExtensionId, writeRuntimeAcknowledgedExtensions } from "./runtime-acknowledged-extensions.ts";
@@ -18,6 +19,8 @@ import type { JsonSchemaObject, ResolvedToolBudget, SubagentState } from "../../
 import { resolveCurrentSessionId } from "../../shared/session-identity.ts";
 import { resolveWatchPath } from "../../shared/utils.ts";
 import { registerChildWatchdog } from "../../watchdog/register-child.ts";
+import { CHILD_WATCHDOG_CONFIG_ENV } from "../../watchdog/child-status.ts";
+import { requestWatchdogPermission, type WatchdogPermissionRequest, type WatchdogPermissionResult } from "../../watchdog/permission-arbiter.ts";
 import { SUBAGENT_WATCHDOG_WARNING_TYPE } from "../../watchdog/types.ts";
 import { resolveWaitToolConfig } from "../background/wait-config.ts";
 import { registerWaitTool } from "../background/wait-tool.ts";
@@ -45,7 +48,7 @@ export const CHILD_FANOUT_BOUNDARY_INSTRUCTIONS = [
 	"You are a child subagent with explicit fanout responsibility for this assigned task.",
 	"The parent session owns final orchestration, acceptance, and follow-up implementation launches.",
 	"You may use the `subagent` tool only for the fanout work explicitly requested in this task.",
-	"Do not broaden yourself into general parent orchestration. Do not launch follow-up workers unless the task explicitly asks for that.",
+	"Do not broaden yourself into general parent orchestration. Do not launch follow-up builders unless the task explicitly asks for that.",
 	"The maxSubagentDepth cap still applies and may block further fanout.",
 	"If you need to edit files, use the available editing tools. Do not print tool-call syntax, patches, or pseudo-tool calls as text.",
 ].join("\n");
@@ -241,6 +244,31 @@ export function formatSteerMessage(request: SteerRequest): string {
 	].join("\n");
 }
 
+export function registerPermissionGate(
+	pi: ExtensionAPI,
+	requestPermission: (request: WatchdogPermissionRequest) => Promise<WatchdogPermissionResult> = requestWatchdogPermission,
+): void {
+	const rules = decodePermissionRules(process.env[PERMISSION_POLICY_ENV]);
+	if (!rules) return;
+	const onRuntimeEvent = pi.on as unknown as (event: string, handler: (event: { toolName?: string; input?: unknown }, ctx: ExtensionContext) => unknown) => void;
+	onRuntimeEvent("tool_call", async (event, ctx) => {
+		const toolName = typeof event.toolName === "string" ? event.toolName : "tool";
+		const decision = permissionDecision(rules, toolName);
+		if (decision === "allow") return undefined;
+		if (decision === "deny") return { block: true, reason: `Blocked by pi-subagents permission rule: '${toolName}' is denied.` };
+		const result = await requestPermission({
+			ctx,
+			toolName,
+			args: event.input ?? {},
+			rawWatchdogConfig: process.env[CHILD_WATCHDOG_CONFIG_ENV],
+			auditPath: process.env[PERMISSION_AUDIT_PATH_ENV],
+			...(ctx.signal ? { signal: ctx.signal } : {}),
+		});
+		if (result.approved) return undefined;
+		return { block: true, reason: `Blocked by pi-subagents permission rule: ${result.reason}` };
+	});
+}
+
 function registerToolBudget(pi: ExtensionAPI, budget: ResolvedToolBudget | undefined): void {
 	if (!budget) return;
 	let toolCount = 0;
@@ -360,7 +388,7 @@ export function registerSteeringInbox(
 		return undefined;
 	};
 
-	const onRuntimeEvent = pi.on as unknown as (event: string, handler: (event: unknown) => unknown) => void;
+	const onRuntimeEvent = pi.on as unknown as (event: string, handler: (event: unknown, ctx?: unknown) => unknown) => void;
 	// Register input before the watcher so an accepted extension input cannot race request dispatch.
 	onRuntimeEvent("input", onInput);
 	onRuntimeEvent("session_start", () => start());
@@ -377,6 +405,7 @@ export function registerSteeringInbox(
 export default function registerSubagentPromptRuntime(pi: ExtensionAPI): void {
 	registerRuntimeExtensionAcknowledgements(pi);
 	registerSteeringInbox(pi);
+	registerPermissionGate(pi);
 	registerToolBudget(pi, decodeToolBudgetEnv(process.env[TOOL_BUDGET_ENV], { allowZero: process.env[TOOL_BUDGET_ZERO_AUTH_ENV] === "1" }));
 	registerChildWatchdog(pi);
 	const waitToolEnabled = resolveWaitToolConfig().enabled;
@@ -408,7 +437,7 @@ export default function registerSubagentPromptRuntime(pi: ExtensionAPI): void {
 		nativeSupervisorFallbackRegistered = true;
 		registerNativeSupervisorClient(pi);
 	};
-	const onRuntimeEvent = pi.on as unknown as (event: string, handler: (event: unknown) => unknown) => void;
+	const onRuntimeEvent = pi.on as unknown as (event: string, handler: (event: unknown, ctx?: unknown) => unknown) => void;
 	onRuntimeEvent("session_start", (_event: unknown, ctx: unknown) => {
 		const sessionManager = (ctx as { sessionManager?: Parameters<typeof resolveCurrentSessionId>[0] } | undefined)?.sessionManager;
 		waitState.currentSessionId = sessionManager ? resolveCurrentSessionId(sessionManager) : null;
@@ -455,13 +484,15 @@ export default function registerSubagentPromptRuntime(pi: ExtensionAPI): void {
 		});
 	}
 
-	onRuntimeEvent("context", (event: { messages: unknown[] }) => {
+	onRuntimeEvent("context", (event: unknown) => {
+		if (!event || typeof event !== "object" || !("messages" in event) || !Array.isArray(event.messages)) return undefined;
 		const messages = stripParentOnlySubagentMessages(event.messages);
 		if (messages === event.messages) return undefined;
 		return { messages };
 	});
 
-	onRuntimeEvent("before_agent_start", async (event: { systemPrompt: string }) => {
+	onRuntimeEvent("before_agent_start", async (event: unknown) => {
+		if (!event || typeof event !== "object" || !("systemPrompt" in event) || typeof event.systemPrompt !== "string") return undefined;
 		registerNativeSupervisorFallbackOnce();
 		const intercomSessionName = process.env[SUBAGENT_INTERCOM_SESSION_NAME_ENV]?.trim();
 		if (intercomSessionName && typeof pi.setSessionName === "function") {

package/dist/extensions/pi-subagents/src/runs/shared/subagent-startup-retry.ts

@@ -1,4 +1,5 @@
 import type { Usage } from "../../shared/types.ts";
+import { formatProcessSignalError } from "./process-signal.ts";
 
 /**
  * Retry delays for child processes that exit before any model or tool activity.
@@ -10,6 +11,8 @@ export const SUBAGENT_STARTUP_RETRY_DELAYS_MS = [250, 750, 1500] as const;
 /** A genuine startup race should fail well before a model request can complete. */
 export const MAX_SUBAGENT_STARTUP_FAILURE_DURATION_MS = 2000;
 
+const SIGKILL_PROCESS_SIGNAL_ERROR = formatProcessSignalError("SIGKILL");
+
 export interface SubagentStartupFailureEvidence {
 	exitCode: number | null | undefined;
 	error?: string;
@@ -46,7 +49,7 @@ export function isRetryableSubagentStartupFailure(evidence: SubagentStartupFailu
 	return evidence.exitCode !== undefined
 		&& evidence.exitCode !== null
 		&& evidence.exitCode !== 0
-		&& !evidence.error?.trim()
+		&& (!evidence.error?.trim() || evidence.error === SIGKILL_PROCESS_SIGNAL_ERROR)
 		&& !evidence.finalOutput?.trim()
 		&& evidence.messageCount === 0
 		&& evidence.toolCount === 0
@@ -54,7 +57,7 @@ export function isRetryableSubagentStartupFailure(evidence: SubagentStartupFailu
 		&& evidence.durationMs >= 0
 		&& evidence.durationMs <= MAX_SUBAGENT_STARTUP_FAILURE_DURATION_MS
 		&& evidence.protocolError === undefined
-		&& (evidence.processSignal === undefined || evidence.processSignal === null)
+		&& (evidence.processSignal === undefined || evidence.processSignal === null || evidence.processSignal === "SIGKILL")
 		&& evidence.observedMutationAttempt !== true
 		&& evidence.detached !== true
 		&& evidence.interrupted !== true

package/dist/extensions/pi-subagents/src/runs/shared/task-intent.ts

@@ -1,5 +1,3 @@
-import type { AcceptanceRole } from "../../shared/types.ts";
-
 /**
  * Shared task mutation-intent classifier.
  *
@@ -138,31 +136,12 @@ function taskHasReadOnlyDeliverable(taskText: string): boolean {
 }
 
 function isReviewerStyleAgent(agent: string): boolean {
-	return /\b(?:architect|commentator|explorer|recapper|researcher)\b/i.test(agent);
-}
-
-/**
- * Resolve an agent's acceptance routing role: a declared `acceptanceRole`
- * always wins; otherwise the established name heuristics apply (builder-named
- * agents are writers; architect/commentator/explorer/recapper/researcher/
- * analyst-named agents are read-only). This is the single shared source of
- * truth for acceptance inference and task-aware advisory routing so the two
- * cannot drift. Alias values are never role signals.
- */
-export function resolveAgentRoutingRole(
-	agentName: string,
-	acceptanceRole?: AcceptanceRole,
-): "writer" | "read-only" | undefined {
-	if (acceptanceRole !== undefined) return acceptanceRole;
-	const agent = agentName.toLowerCase();
-	if (/\bbuilder\b/.test(agent)) return "writer";
-	if (/\b(?:architect|commentator|explorer|recapper|researcher|analyst)\b/.test(agent)) return "read-only";
-	return undefined;
+	return /\b(?:commentator|advisor|reviewer|oracle)\b/i.test(agent);
 }
 
 function hasImplementationIntent(agent: string, taskText: string): boolean {
 	if (isReviewerStyleAgent(agent)) return REVIEWER_REQUIRED_EDIT_PATTERNS.some((pattern) => pattern.test(taskText));
-	if (agent === "builder") return WORKER_IMPLEMENTATION_PATTERNS.some((pattern) => pattern.test(taskText));
+	if (agent === "worker" || agent === "builder") return WORKER_IMPLEMENTATION_PATTERNS.some((pattern) => pattern.test(taskText));
 	return GENERAL_IMPLEMENTATION_PATTERNS.some((pattern) => pattern.test(taskText));
 }
 

package/dist/extensions/pi-subagents/src/runs/shared/turn-budget.ts

@@ -23,9 +23,10 @@ export function resolveTurnBudgetConfig(
 	return { turnBudget: { maxTurns: budget.maxTurns, graceTurns } };
 }
 
-export function appendTurnBudgetSystemPrompt(systemPrompt: string, budget: ResolvedTurnBudget | undefined): string {
+export function appendTurnBudgetSystemPrompt(systemPrompt: string, budget: { maxTurns: number; graceTurns?: number } | undefined): string {
 	if (!budget) return systemPrompt;
-	const grace = budget.graceTurns === 1 ? "1 additional assistant turn" : `${budget.graceTurns} additional assistant turns`;
+	const graceTurns = budget.graceTurns ?? DEFAULT_TURN_BUDGET_GRACE_TURNS;
+	const grace = graceTurns === 1 ? "1 additional assistant turn" : `${graceTurns} additional assistant turns`;
 	const block = [
 		"## Turn budget",
 		`This child run has a soft budget of ${budget.maxTurns} assistant turn${budget.maxTurns === 1 ? "" : "s"}.`,
@@ -55,8 +56,8 @@ export function formatTurnBudgetOutput(message: string, output: string): string
 		: message;
 }
 
-export function initialTurnBudgetState(budget: ResolvedTurnBudget): TurnBudgetState {
-	return { ...budget, outcome: "within-budget", turnCount: 0 };
+export function initialTurnBudgetState(budget: { maxTurns: number; graceTurns?: number }): TurnBudgetState {
+	return { maxTurns: budget.maxTurns, graceTurns: budget.graceTurns ?? DEFAULT_TURN_BUDGET_GRACE_TURNS, outcome: "within-budget", turnCount: 0 };
 }
 
 export function turnBudgetState(budget: ResolvedTurnBudget, turnCount: number, exceeded: boolean): TurnBudgetState {
@@ -91,8 +92,7 @@ export function turnBudgetDecision(
 	enforceHardLimit = false,
 ): "continue" | "defer" | "abort" {
 	const hardLimit = budget.maxTurns + budget.graceTurns;
-	if (turnCount < hardLimit) return "continue";
+	if (terminalAssistantStop || turnCount < hardLimit) return "continue";
 	if (toolWorkActiveOrStarting && !enforceHardLimit) return "defer";
-	if (turnCount === hardLimit && terminalAssistantStop) return "continue";
 	return "abort";
 }

package/dist/extensions/pi-subagents/src/runs/shared/worktree.ts

@@ -2,14 +2,16 @@ import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { resolveAuthorityDecision, type AuthorityPolicyConfig } from "../../policy/authority.ts";
 
 export interface WorktreeSetup {
 	cwd: string;
 	worktrees: WorktreeInfo[];
 	baseCommit: string;
+	capturedDiffs?: WorktreeDiff[];
 }
 
-interface WorktreeInfo {
+export interface WorktreeInfo {
 	path: string;
 	agentCwd: string;
 	branch: string;
@@ -36,9 +38,21 @@ export interface WorktreeCleanupTask {
 	branch: string;
 	worktreeRemoved: boolean;
 	branchRemoved: boolean;
+	preserved?: boolean;
+	reason?: string;
 	errors?: string[];
 }
 
+export type WorktreeCleanupIntent =
+	| { kind: "preserve"; capturedDiffs?: WorktreeDiff[]; handoffManifestPath?: string }
+	| {
+		kind: "discard";
+		authorization:
+			| { kind: "policy"; policy?: AuthorityPolicyConfig }
+			| { kind: "confirmed"; policy?: AuthorityPolicyConfig };
+	}
+	| { kind: "setup-rollback" };
+
 export interface WorktreeCleanupReport {
 	state: "complete" | "partial";
 	tasks: WorktreeCleanupTask[];
@@ -99,7 +113,7 @@ interface RepoState {
 const DEFAULT_WORKTREE_SETUP_HOOK_TIMEOUT_MS = 30000;
 
 function runGit(cwd: string, args: string[]): GitResult {
-	const result = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf-8" });
+	const result = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf-8", windowsHide: true });
 	return {
 		stdout: result.stdout ?? "",
 		stderr: result.stderr ?? "",
@@ -121,7 +135,9 @@ function resolveRepoState(cwd: string): RepoState {
 	const cwdRelative = resolveRepoCwdRelative(cwd);
 	const toplevel = runGitChecked(cwd, ["rev-parse", "--show-toplevel"]).trim();
 
-	const status = runGitChecked(toplevel, ["status", "--porcelain"]);
+	// pi-subagents writes durable runtime state under .pi-subagents/ by default;
+	// that state must not make managed isolation unusable for later runs.
+	const status = runGitChecked(toplevel, ["status", "--porcelain", "--", ":!.pi-subagents"]);
 	if (status.trim().length > 0) {
 		throw new Error("worktree isolation requires a clean git working tree. Commit or stash changes first.");
 	}
@@ -314,6 +330,7 @@ function runWorktreeSetupHook(
 		input: JSON.stringify(input),
 		timeout: hook.timeoutMs,
 		shell: false,
+		windowsHide: true,
 	});
 
 	if (result.error) {
@@ -515,21 +532,111 @@ function writeEmptyPatch(patchPath: string): void {
 	}
 }
 
-function cleanupSingleWorktree(repoCwd: string, worktree: WorktreeInfo): WorktreeCleanupTask {
+function handoffRecordsPatch(manifestPath: string | undefined, patchPath: string): boolean {
+	if (!manifestPath || !fs.existsSync(manifestPath)) return false;
+	try {
+		const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf-8")) as {
+			version?: unknown;
+			groups?: Array<{ children?: Array<{ patch?: { path?: unknown; error?: unknown } }> }>;
+		};
+		if (manifest.version !== 1 || !Array.isArray(manifest.groups)) return false;
+		const resolvedPatchPath = path.resolve(patchPath);
+		return manifest.groups.some((group) => Array.isArray(group.children) && group.children.some((child) =>
+			child.patch?.error === undefined
+			&& typeof child.patch?.path === "string"
+			&& path.resolve(child.patch.path) === resolvedPatchPath,
+		));
+	} catch {
+		return false;
+	}
+}
+
+function cleanupSingleWorktree(
+	setup: WorktreeSetup,
+	worktree: WorktreeInfo,
+	intent: WorktreeCleanupIntent,
+): WorktreeCleanupTask {
 	const errors: string[] = [];
 	let worktreeRemoved = false;
 	let branchRemoved = false;
+	if (intent.kind !== "setup-rollback") {
+		try {
+			removeSyntheticPathsBeforeDiff(worktree);
+		} catch (error) {
+			errors.push(`synthetic path cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		const status = runGit(worktree.path, ["status", "--porcelain"]);
+		const baseDiff = runGit(worktree.path, ["diff", "--quiet", setup.baseCommit, "--"]);
+		if (status.status !== 0 || (baseDiff.status !== 0 && baseDiff.status !== 1)) {
+			const reason = status.status !== 0
+				? status.stderr.trim() || status.stdout.trim() || "git status failed"
+				: baseDiff.stderr.trim() || baseDiff.stdout.trim() || "git diff check failed";
+			return {
+				index: worktree.index,
+				path: worktree.path,
+				branch: worktree.branch,
+				worktreeRemoved: false,
+				branchRemoved: false,
+				preserved: true,
+				reason: "cleanup safety check failed",
+				errors: [...errors, `cleanup refused: ${reason}`],
+			};
+		}
+		const hasWork = status.stdout.trim().length > 0 || baseDiff.status === 1;
+		if (hasWork && intent.kind === "preserve") {
+			const captured = (intent.capturedDiffs ?? setup.capturedDiffs)?.find((diff) => diff.index === worktree.index);
+			const patchCaptured = captured !== undefined
+				&& captured.error === undefined
+				&& fs.existsSync(captured.patchPath)
+				&& fs.statSync(captured.patchPath).size > 0
+				&& handoffRecordsPatch(intent.handoffManifestPath, captured.patchPath);
+			if (!patchCaptured) {
+				const reason = "worktree contains changes that are not represented by a captured handoff patch";
+				return {
+					index: worktree.index,
+					path: worktree.path,
+					branch: worktree.branch,
+					worktreeRemoved: false,
+					branchRemoved: false,
+					preserved: true,
+					reason,
+					errors: [...errors, `cleanup refused: ${reason}; preserved ${worktree.path}`],
+				};
+			}
+		}
+		if (hasWork && intent.kind === "discard") {
+			const decision = resolveAuthorityDecision({ action: "discardWorktree", policy: intent.authorization.policy });
+			const authorized = decision === "auto" || (decision === "confirm" && intent.authorization.kind === "confirmed");
+			if (!authorized) {
+				const reason = decision === "forbid"
+					? "authority policy forbids worktree discard"
+					: "worktree discard requires explicit user confirmation";
+				return {
+					index: worktree.index,
+					path: worktree.path,
+					branch: worktree.branch,
+					worktreeRemoved: false,
+					branchRemoved: false,
+					preserved: true,
+					reason,
+					errors: [...errors, `cleanup refused: ${reason}; preserved ${worktree.path}`],
+				};
+			}
+		}
+	}
 	try {
-		runGitChecked(repoCwd, ["worktree", "remove", "--force", worktree.path]);
+		runGitChecked(setup.cwd, ["worktree", "remove", "--force", worktree.path]);
 		worktreeRemoved = true;
 	} catch (error) {
 		errors.push(`worktree removal failed: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	try {
-		runGitChecked(repoCwd, ["branch", "-D", worktree.branch]);
-		branchRemoved = true;
-	} catch (error) {
-		errors.push(`branch removal failed: ${error instanceof Error ? error.message : String(error)}`);
+	if (worktreeRemoved) {
+		try {
+			runGitChecked(setup.cwd, ["branch", "-D", worktree.branch]);
+			branchRemoved = true;
+		} catch (error) {
+			errors.push(`branch removal failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
 	}
 	return {
 		index: worktree.index,
@@ -569,7 +676,7 @@ export function createWorktrees(cwd: string, runId: string, count: number, optio
 			cwd: repo.toplevel,
 			worktrees,
 			baseCommit: repo.baseCommit,
-		});
+		}, { kind: "setup-rollback" });
 		throw error;
 	}
 
@@ -602,13 +709,17 @@ export function diffWorktrees(setup: WorktreeSetup, agents: string[], diffsDir:
 		}
 	}
 
+	setup.capturedDiffs = diffs;
 	return diffs;
 }
 
-export function cleanupWorktrees(setup: WorktreeSetup): WorktreeCleanupReport {
+export function cleanupWorktrees(
+	setup: WorktreeSetup,
+	intent: WorktreeCleanupIntent = { kind: "preserve", ...(setup.capturedDiffs ? { capturedDiffs: setup.capturedDiffs } : {}) },
+): WorktreeCleanupReport {
 	const tasks: WorktreeCleanupTask[] = [];
 	for (let index = setup.worktrees.length - 1; index >= 0; index--) {
-		tasks.push(cleanupSingleWorktree(setup.cwd, setup.worktrees[index]!));
+		tasks.push(cleanupSingleWorktree(setup, setup.worktrees[index]!, intent));
 	}
 	tasks.sort((left, right) => left.index - right.index);
 	const errors: string[] = [];