@selesai/code 0.8.3 → 0.8.4

package/dist/extensions/pi-subagents/src/runs/foreground/workflow-foreground-steering.ts

@@ -0,0 +1,187 @@
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { AgentToolResult } from "@earendil-works/pi-agent-core";
+import type { Details, ForegroundRunControl, SubagentState } from "../../shared/types.ts";
+import { readStatus } from "../../shared/utils.ts";
+import {
+	consumeSteerAckFromDir,
+	readSteerCapability,
+	steerAcksDir,
+	steerCapabilityPath,
+	stepSteerInboxDir,
+	writeSteerRequestToExistingDir,
+	type SteerDeliveryMode,
+	type SteerRequest,
+} from "../background/control-channel.ts";
+
+export interface WorkflowForegroundSteeringTarget {
+	control: ForegroundRunControl;
+	workflowRunId: string;
+	sourceRunId: string;
+}
+
+export type WorkflowForegroundSteeringResolution =
+	| { ok: true; target: WorkflowForegroundSteeringTarget }
+	| { ok: false; message: string };
+
+function activeWorkflowError(state: SubagentState, workflowRunId: string, asyncDirRoot: string): string | undefined {
+	if (!state.currentSessionId) return "Workflow steering requires an active parent session.";
+	if (!state.workflowControllers?.has(workflowRunId)) return `Workflow '${workflowRunId}' has no live foreground child.`;
+	const status = readStatus(path.join(asyncDirRoot, workflowRunId));
+	if (!status || status.mode !== "workflow" || (status.state !== "running" && status.state !== "queued")) {
+		return `Workflow '${workflowRunId}' has no live foreground child.`;
+	}
+	if (status.sessionId !== state.currentSessionId) return `Workflow '${workflowRunId}' was not found in the active session.`;
+	return undefined;
+}
+
+function controlIsLiveInWorkflow(control: ForegroundRunControl, workflowRunId: string, sessionId: string): boolean {
+	return control.parentWorkflowRunId === workflowRunId
+		&& control.sessionId === sessionId
+		&& Boolean(control.workflowSteeringDir)
+		&& (control.activeChildren?.size ?? 0) > 0;
+}
+
+export function resolveWorkflowForegroundSteeringTarget(input: {
+	state: SubagentState;
+	childRunId?: string;
+	workflowRunId?: string;
+	asyncDirRoot: string;
+}): WorkflowForegroundSteeringResolution {
+	const { state, childRunId, asyncDirRoot } = input;
+	if (childRunId) {
+		const control = state.foregroundControls.get(childRunId);
+		if (!control?.parentWorkflowRunId) return { ok: false, message: `Foreground run '${childRunId}' is not a live workflow-owned child.` };
+		const workflowRunId = control.parentWorkflowRunId;
+		const workflowError = activeWorkflowError(state, workflowRunId, asyncDirRoot);
+		if (workflowError) return { ok: false, message: workflowError };
+		if (!controlIsLiveInWorkflow(control, workflowRunId, state.currentSessionId!)) {
+			return { ok: false, message: `Foreground run '${childRunId}' is not a live workflow-owned child in the active session.` };
+		}
+		return { ok: true, target: { control, workflowRunId, sourceRunId: childRunId } };
+	}
+
+	const workflowRunId = input.workflowRunId;
+	if (!workflowRunId) return { ok: false, message: "Workflow steering requires a workflow or child run id." };
+	const workflowError = activeWorkflowError(state, workflowRunId, asyncDirRoot);
+	if (workflowError) return { ok: false, message: workflowError };
+	const controls = [...state.foregroundControls.values()].filter((control) => controlIsLiveInWorkflow(control, workflowRunId, state.currentSessionId!));
+	if (controls.length === 0) return { ok: false, message: `Workflow '${workflowRunId}' has no live foreground child.` };
+	if (controls.length > 1) return { ok: false, message: `Workflow '${workflowRunId}' has ${controls.length} live foreground children; steer a child run id instead.` };
+	return { ok: true, target: { control: controls[0]!, workflowRunId, sourceRunId: workflowRunId } };
+}
+
+function managementError(message: string): AgentToolResult<Details> {
+	return { content: [{ type: "text", text: message }], isError: true, details: { mode: "management", results: [] } };
+}
+
+export async function steerWorkflowForegroundTarget(input: {
+	target: WorkflowForegroundSteeringTarget;
+	message: string;
+	mode?: SteerDeliveryMode;
+	index?: number;
+	signal?: AbortSignal;
+	ackTimeoutMs?: number;
+}): Promise<AgentToolResult<Details>> {
+	const { control, sourceRunId } = input.target;
+	const routeDir = control.workflowSteeringDir;
+	if (!routeDir || !fs.existsSync(routeDir)) return managementError(`Foreground run '${control.runId}' has no live workflow steering route.`);
+	const activeIndexes = [...(control.activeChildren?.keys() ?? [])].sort((left, right) => left - right);
+	const index = input.index ?? (activeIndexes.length === 1 ? activeIndexes[0] : undefined);
+	if (index === undefined) {
+		return managementError(activeIndexes.length === 0
+			? `Foreground run '${control.runId}' has no live child session.`
+			: `Foreground run '${control.runId}' has ${activeIndexes.length} live child sessions; provide index.`);
+	}
+	if (!activeIndexes.includes(index)) return managementError(`Foreground run '${control.runId}' child ${index} is not live.`);
+	const capability = readSteerCapability(routeDir, index);
+	if (capability?.supported === false) return managementError(`Foreground run '${control.runId}' child ${index} does not support steering.`);
+
+	const request: SteerRequest = {
+		type: "steer",
+		id: randomUUID(),
+		ts: Date.now(),
+		message: input.message.trim(),
+		...(input.mode && input.mode !== "steer" ? { mode: input.mode } : {}),
+		targetIndex: index,
+		source: "steer-action",
+	};
+	try {
+		writeSteerRequestToExistingDir(stepSteerInboxDir(routeDir, index), request);
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && (error as NodeJS.ErrnoException).code === "ENOENT") {
+			return managementError(`Foreground run '${control.runId}' has no live workflow steering route.`);
+		}
+		return managementError(`Failed to queue steering for foreground run ${control.runId}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+
+	const deadline = Date.now() + (input.ackTimeoutMs ?? 3_000);
+	let ack;
+	let routeRemoved = false;
+	while (Date.now() <= deadline) {
+		ack = consumeSteerAckFromDir(steerAcksDir(routeDir, index), request.id);
+		if (ack || input.signal?.aborted) break;
+		if (!fs.existsSync(routeDir)) {
+			routeRemoved = true;
+			break;
+		}
+		await new Promise<void>((resolve) => setTimeout(resolve, Math.min(50, Math.max(1, deadline - Date.now()))));
+	}
+	if (routeRemoved || (!ack && !input.signal?.aborted && !fs.existsSync(routeDir))) {
+		return managementError(`Foreground run '${control.runId}' has no live child session.`);
+	}
+	const target = ack?.state === "delivered"
+		? { index, state: "delivered" as const, deliveredAt: ack.ts }
+		: ack?.state === "queued"
+			? { index, state: "queued" as const }
+			: ack?.state === "failed"
+				? { index, state: "failed" as const, reason: ack.message }
+				: { index, state: "pending" as const };
+	const steering = {
+		requestId: request.id,
+		state: ack?.state === "delivered" ? "delivered" as const : ack?.state === "failed" ? "failed" as const : "pending" as const,
+		deliveryStatus: ack?.state === "delivered" ? "delivered" as const : "queued" as const,
+		sourceRunId,
+		targets: [target],
+	};
+	if (input.signal?.aborted) {
+		return { content: [{ type: "text", text: `Steering pending for foreground run ${control.runId} (request ${request.id}); caller aborted before acknowledgment.` }], details: { mode: "management", results: [], steering } };
+	}
+	if (ack?.state === "delivered") {
+		return { content: [{ type: "text", text: `Steering delivered for foreground run ${control.runId} (request ${request.id}).` }], details: { mode: "management", results: [], steering } };
+	}
+	if (ack?.state === "queued") {
+		return { content: [{ type: "text", text: `Steering queued for foreground run ${control.runId} (request ${request.id}).` }], details: { mode: "management", results: [], steering } };
+	}
+	if (ack?.state === "failed") {
+		return { content: [{ type: "text", text: `Steering failed for foreground run ${control.runId} (request ${request.id}): ${ack.message}` }], isError: true, details: { mode: "management", results: [], steering } };
+	}
+	return { content: [{ type: "text", text: `Steering pending for foreground run ${control.runId} (request ${request.id}); no acknowledgment was received.` }], details: { mode: "management", results: [], steering } };
+}
+
+export function workflowForegroundSteeringDir(asyncDirRoot: string, workflowRunId: string, childRunId: string): string {
+	return path.join(asyncDirRoot, workflowRunId, "control", "workflow-foreground", childRunId);
+}
+
+export function removeWorkflowForegroundSteeringRoute(control: ForegroundRunControl): void {
+	if (!control.workflowSteeringDir) return;
+	try {
+		fs.rmSync(control.workflowSteeringDir, { recursive: true, force: true });
+	} catch (error) {
+		console.warn(`[pi-subagents] Failed to remove workflow foreground steering route '${control.workflowSteeringDir}': ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+
+export function workflowForegroundSteeringLaunchOptions(control: ForegroundRunControl | undefined, index: number): Pick<import("../../shared/types.ts").RunSyncOptions, "steerInboxDir" | "steerCapabilityPath" | "steerAckDir"> {
+	if (!control?.workflowSteeringDir) return {};
+	const steerInboxDir = stepSteerInboxDir(control.workflowSteeringDir, index);
+	const steerAckDir = steerAcksDir(control.workflowSteeringDir, index);
+	fs.mkdirSync(steerInboxDir, { recursive: true });
+	fs.mkdirSync(steerAckDir, { recursive: true });
+	return {
+		steerInboxDir,
+		steerCapabilityPath: steerCapabilityPath(control.workflowSteeringDir, index),
+		steerAckDir,
+	};
+}

package/dist/extensions/pi-subagents/src/runs/shared/acceptance.ts

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type {
@@ -50,7 +51,7 @@ const ACCEPTANCE_CONFIG_KEYS = new Set(["level", "criteria", "evidence", "verify
 const ACCEPTANCE_GATE_KEYS = new Set(["id", "must", "evidence", "severity"]);
 const ACCEPTANCE_VERIFY_KEYS = new Set(["id", "command", "timeoutMs", "cwd", "env", "allowFailure"]);
 const ACCEPTANCE_REVIEW_KEYS = new Set(["agent", "focus", "required"]);
-const EXPLICIT_REVIEWED_UNAVAILABLE = "is an achieved status, not a requestable acceptance level. For a read-only commentator call, omit acceptance. To require independent review of a writer result, use acceptance.review.required and orchestrate the commentator separately.";
+const EXPLICIT_REVIEWED_UNAVAILABLE = "is an achieved status, not a requestable acceptance level. For a read-only reviewer call, omit acceptance. To require independent review of a writer result, use acceptance.review.required and orchestrate the reviewer separately.";
 
 function normalizeLevel(level: AcceptanceLevel | undefined): Exclude<AcceptanceLevel, "auto"> | "auto" {
 	return level ?? "auto";
@@ -87,20 +88,18 @@ function inferLevel(input: {
 	const reasons: string[] = [];
 	// Declared roles replace name heuristics, so use the full writer grammar to detect explicit mutation independently of the actual agent name.
 	const intent = classifyTaskMutationIntent(input.acceptanceRole ? "worker" : input.agentName, input.task ?? "");
-	const taskMutation = taskMayMutate(input.task ?? "");
-	const reviewerStyleAgent = /\b(?:commentator|reviewer|oracle|advisor)\b/.test(agent);
-	const readOnlyTask = (intent.kind === "read-only" && (!taskMutation || reviewerStyleAgent))
-		|| (intent.kind === "unknown" && !taskMutation && /\b(?:read[- ]only|review[- ]only|no edits|without edits|inspect|summari[sz]e)\b/.test(task));
+	const readOnlyTask = intent.kind === "read-only"
+		|| (intent.kind === "unknown" && /\b(?:read[- ]only|review[- ]only|no edits|without edits|inspect|summari[sz]e)\b/.test(task));
 	const rolePatchTask = input.acceptanceRole !== undefined
 		&& intent.kind !== "read-only"
 		&& !/\b(?:do not|don't|must not)\s+patch\b/.test(task)
 		&& /\bpatch\s+(?:(?:\.{0,2}[\\/])?(?:[\w.-]+[\\/])+[\w.-]+|[\w.-]+\.[a-z0-9]+\b|(?:the\s+)?parser\b)/.test(task);
-	const taskMayWrite = readOnlyTask ? false : taskMutation || intent.kind === "implementation" || rolePatchTask;
+	const taskMayWrite = readOnlyTask ? false : taskMayMutate(input.task ?? "") || intent.kind === "implementation" || rolePatchTask;
 	const readOnlyAgent = input.acceptanceRole === "read-only"
-		|| (input.acceptanceRole === undefined && /\b(?:commentator|architect|explorer|recapper|researcher|reviewer|oracle|scout|context-builder|analyst)\b/.test(agent));
+		|| (input.acceptanceRole === undefined && /\b(?:reviewer|oracle|scout|researcher|analyst)\b/.test(agent));
 	const writeTask = taskMayWrite
 		|| (input.acceptanceRole === "writer" && !readOnlyTask)
-		|| (input.acceptanceRole === undefined && /\b(?:builder|worker)\b/.test(agent) && !readOnlyTask);
+		|| (input.acceptanceRole === undefined && /\bworker\b/.test(agent) && !readOnlyTask);
 	const inferredReadOnly = readOnlyTask || (input.acceptanceRole === "read-only" && !taskMayWrite);
 	const roleResolvesReadOnly = input.acceptanceRole !== undefined && inferredReadOnly;
 	const keywordRiskReadOnly = input.acceptanceRole === undefined ? intent.kind === "read-only" : inferredReadOnly;
@@ -117,11 +116,11 @@ function inferLevel(input: {
 			reasons,
 			criteria: ["Implement the requested change without widening scope", "Return evidence sufficient for an independent acceptance review"],
 			evidence: requiredEvidenceForLevel("checked"),
-			review: { agent: "commentator", required: true },
+			review: { agent: "reviewer", required: true },
 		};
 	}
 	if (writeTask && !readOnlyTask) {
-		reasons.push(input.acceptanceRole === "writer" && !taskMayWrite ? "declared writer acceptance role" : "write-capable builder/task");
+		reasons.push(input.acceptanceRole === "writer" && !taskMayWrite ? "declared writer acceptance role" : "write-capable worker/task");
 		return {
 			level: "checked",
 			reasons,
@@ -130,7 +129,7 @@ function inferLevel(input: {
 		};
 	}
 	if (readOnlyAgent || readOnlyTask) {
-		reasons.push(input.acceptanceRole === "read-only" && !readOnlyTask ? "declared read-only acceptance role" : readOnlyAgent ? "read-only/commentator-style agent" : "read-only task wording");
+		reasons.push(input.acceptanceRole === "read-only" && !readOnlyTask ? "declared read-only acceptance role" : readOnlyAgent ? "read-only/reviewer-style agent" : "read-only task wording");
 		return {
 			level: "attested",
 			reasons,
@@ -154,6 +153,17 @@ export function normalizeAcceptanceInput(input: AcceptanceInput | undefined): Ac
 	return { ...input };
 }
 
+type GateAcceptanceNormalizationResult =
+	| { ok: true; acceptance?: AcceptanceInput }
+	| { ok: false; error: string };
+
+export function normalizeGateAcceptance(gate: unknown, acceptance: AcceptanceInput | undefined): GateAcceptanceNormalizationResult {
+	if (gate === undefined) return acceptance === undefined ? { ok: true } : { ok: true, acceptance };
+	if (typeof gate !== "string" || !gate.trim()) return { ok: false, error: "gate must be a non-empty command string." };
+	if (acceptance !== undefined) return { ok: false, error: "gate cannot be combined with acceptance; use one gate command or acceptance.verify." };
+	return { ok: true, acceptance: { level: "verified", verify: [{ id: "gate", command: gate.trim() }] } };
+}
+
 function explicitAcceptanceCanDisable(explicit: AcceptanceConfig): boolean {
 	return explicit.level === "none" && typeof explicit.reason === "string" && explicit.reason.trim().length > 0;
 }
@@ -171,7 +181,7 @@ export function validateAcceptanceInput(input: unknown, pathLabel = "acceptance"
 		if (input === "reviewed") errors.push(`${pathLabel} ${EXPLICIT_REVIEWED_UNAVAILABLE}`);
 		else if (!VALID_LEVELS.has(input as AcceptanceLevel)) errors.push(`${pathLabel} has invalid level '${input}'.`);
 		else if (input === "none") errors.push(`${pathLabel} level "none" requires a reason; use { level: "none", reason: "..." }.`);
-		else if (input === "verified") errors.push(`${pathLabel} level "verified" requires object form with at least one verify command.`);
+		else if (input === "verified") errors.push(`${pathLabel} level "verified" requires object form with at least one runtime verify command. Use level "checked" or provide a non-empty acceptance.verify array.`);
 		return errors;
 	}
 	if (!input || typeof input !== "object" || Array.isArray(input)) {
@@ -236,7 +246,7 @@ export function validateAcceptanceInput(input: unknown, pathLabel = "acceptance"
 		errors.push(`${pathLabel}.evidence must be an array. ${ACCEPTANCE_EVIDENCE_HELP}`);
 	}
 	if (value.level === "verified" && (!Array.isArray(value.verify) || value.verify.length === 0)) {
-		errors.push(`${pathLabel}.verify must contain at least one command when level is verified.`);
+		errors.push(`${pathLabel}.verify must contain at least one runtime command when level is verified. Use level "checked" or provide a non-empty acceptance.verify array.`);
 	} else if (value.verify !== undefined && !Array.isArray(value.verify)) {
 		errors.push(`${pathLabel}.verify must be an array.`);
 	}
@@ -927,7 +937,7 @@ function reportEvidenceStatus(report: AcceptanceReport, kind: AcceptanceEvidence
 }
 
 function checkNoStagedFiles(cwd: string): AcceptanceRuntimeCheck {
-	const result = spawnSync("git", ["status", "--short"], { cwd, encoding: "utf-8", windowsHide: true });
+	const result = spawnSync("git", ["status", "--short"], { cwd, encoding: "utf-8" });
 	if (result.status !== 0) {
 		return { id: "no-staged-files", status: "not-applicable", message: "git status unavailable; no staged-files check skipped" };
 	}
@@ -961,6 +971,28 @@ function trimOutput(value: string): string | undefined {
 	return trimmed.length > 12_000 ? `${trimmed.slice(0, 12_000)}\n...[truncated]` : trimmed;
 }
 
+const SENSITIVE_ENV_KEY_PATTERN = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASS|AUTH|CREDENTIAL|COOKIE|SESSION|PRIVATE|API_KEY|ACCESS_KEY)(?:_|$)/i;
+
+function effectiveVerifyEnv(env: Record<string, string> | undefined): Record<string, string> {
+	const inherited = Object.fromEntries(Object.entries(process.env).flatMap(([key, value]) => {
+		return typeof value === "string" ? [[key, value]] : [];
+	}));
+	return { ...inherited, ...(env ?? {}) };
+}
+
+function verifyRedactionEnv(env: Record<string, string> | undefined): Record<string, string> {
+	return Object.fromEntries(Object.entries(effectiveVerifyEnv(env)).filter(([key, value]) => {
+		return value.length >= 4 && SENSITIVE_ENV_KEY_PATTERN.test(key);
+	}));
+}
+
+function redactVerifyEnv(value: string, env: Record<string, string> | undefined): string {
+	let redacted = value;
+	const secrets = [...new Set(Object.values(verifyRedactionEnv(env)).filter(Boolean))].sort((left, right) => right.length - left.length);
+	for (const secret of secrets) redacted = redacted.replaceAll(secret, "[REDACTED]");
+	return redacted;
+}
+
 function uniqueStrings(items: Array<string | undefined>): string[] {
 	return unique(items.map((item) => item?.trim()).filter((item): item is string => Boolean(item)));
 }
@@ -997,6 +1029,108 @@ export function aggregateAcceptanceReport(input: {
 	};
 }
 
+const DEFAULT_VERIFY_TIMEOUT_MS = 120_000;
+
+function hash(value: string): string {
+	return createHash("sha256").update(value).digest("hex");
+}
+
+interface VerifyWorkspaceState {
+	kind: "git-tracked";
+	repoRoot: string;
+	cwdRelative: string;
+	head: string;
+	diffHash: string;
+}
+
+function readVerifyWorkspaceState(cwd: string): VerifyWorkspaceState | undefined {
+	const repo = spawnSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf-8" });
+	if (repo.status !== 0 || !repo.stdout.trim()) return undefined;
+	const repoRoot = fs.realpathSync(repo.stdout.trim());
+	const head = spawnSync("git", ["rev-parse", "HEAD"], { cwd: repoRoot, encoding: "utf-8" });
+	const diff = spawnSync("git", ["diff", "--binary", "--full-index", "HEAD", "--"], { cwd: repoRoot, encoding: "utf-8", maxBuffer: 50 * 1024 * 1024 });
+	if (head.status !== 0 || diff.status !== 0 || !head.stdout.trim()) return undefined;
+	return {
+		kind: "git-tracked",
+		repoRoot,
+		cwdRelative: path.relative(repoRoot, fs.realpathSync(cwd)) || ".",
+		head: head.stdout.trim(),
+		diffHash: hash(diff.stdout),
+	};
+}
+
+function isCachedVerifyResult(value: unknown): value is AcceptanceVerifyResult {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const result = value as Partial<AcceptanceVerifyResult>;
+	return typeof result.id === "string"
+		&& typeof result.command === "string"
+		&& (typeof result.exitCode === "number" || result.exitCode === null)
+		&& (result.status === "passed" || result.status === "failed" || result.status === "timed-out" || result.status === "allowed-failure")
+		&& typeof result.durationMs === "number";
+}
+
+async function runMemoizedVerifyCommand(command: AcceptanceVerifyCommand, defaultCwd: string, options: {
+	signal?: AbortSignal;
+	abortMessage?: string;
+	artifactsDir?: string;
+	runId?: string;
+} = {}): Promise<AcceptanceVerifyResult> {
+	const cwd = command.cwd ? path.resolve(defaultCwd, command.cwd) : defaultCwd;
+	let workspaceState: VerifyWorkspaceState | undefined;
+	try {
+		workspaceState = readVerifyWorkspaceState(cwd);
+	} catch {
+		workspaceState = undefined;
+	}
+	if (!workspaceState || !options.artifactsDir || !options.runId) {
+		return runVerifyCommand(command, defaultCwd, options);
+	}
+	const envKeys = Object.keys(command.env ?? {}).sort();
+	const envHash = hash(JSON.stringify(Object.fromEntries(Object.entries(effectiveVerifyEnv(command.env)).sort(([left], [right]) => left.localeCompare(right)))));
+	const timeoutMs = command.timeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS;
+	const cacheKey = hash(JSON.stringify({
+		version: 1,
+		command: command.command,
+		cwdRelative: workspaceState.cwdRelative,
+		envKeys,
+		envHash,
+		timeoutMs,
+		allowFailure: command.allowFailure === true,
+		head: workspaceState.head,
+		diffHash: workspaceState.diffHash,
+	}));
+	const artifactPath = path.join(options.artifactsDir, "acceptance", "verify", options.runId, `${cacheKey}.json`);
+	try {
+		const cached = JSON.parse(fs.readFileSync(artifactPath, "utf-8")) as { cacheKey?: unknown; result?: unknown };
+		if (cached.cacheKey === cacheKey && isCachedVerifyResult(cached.result)) {
+			return { ...cached.result, id: command.id, command: command.command, cwd, artifactPath, cacheKey, memoized: true, envKeys, envHash, workspaceState };
+		}
+	} catch {
+		// A cache miss or unreadable artifact must not prevent host verification.
+	}
+	const result = await runVerifyCommand(command, defaultCwd, options);
+	const evidenced: AcceptanceVerifyResult = { ...result, artifactPath, cacheKey, memoized: false, envKeys, envHash, workspaceState };
+	try {
+		fs.mkdirSync(path.dirname(artifactPath), { recursive: true });
+		fs.writeFileSync(artifactPath, JSON.stringify({
+			version: 1,
+			cacheKey,
+			command: command.command,
+			cwdRelative: workspaceState.cwdRelative,
+			envKeys,
+			envHash,
+			timeoutMs,
+			allowFailure: command.allowFailure === true,
+			workspaceState,
+			result: evidenced,
+		}, null, 2), "utf-8");
+	} catch (error) {
+		evidenced.artifactError = error instanceof Error ? error.message : String(error);
+		delete evidenced.artifactPath;
+	}
+	return evidenced;
+}
+
 function runVerifyCommand(command: AcceptanceVerifyCommand, defaultCwd: string, options: { signal?: AbortSignal; abortMessage?: string } = {}): Promise<AcceptanceVerifyResult> {
 	return new Promise((resolve) => {
 		const startedAt = Date.now();
@@ -1008,7 +1142,7 @@ function runVerifyCommand(command: AcceptanceVerifyCommand, defaultCwd: string,
 		let hardKill: NodeJS.Timeout | undefined;
 		const child = spawn(command.command, {
 			cwd,
-			env: { ...process.env, ...(command.env ?? {}) },
+			env: effectiveVerifyEnv(command.env),
 			shell: true,
 			stdio: ["ignore", "pipe", "pipe"],
 			windowsHide: true,
@@ -1036,13 +1170,13 @@ function runVerifyCommand(command: AcceptanceVerifyCommand, defaultCwd: string,
 				finish({
 					exitCode: null,
 					status: "timed-out",
-					stdout: trimOutput(stdout),
-					stderr: trimOutput(stderr || options.abortMessage || "Acceptance verification timed out."),
+					stdout: trimOutput(redactVerifyEnv(stdout, command.env)),
+					stderr: trimOutput(redactVerifyEnv(stderr || options.abortMessage || "Acceptance verification timed out.", command.env)),
 				});
 			}, 1000);
 			hardKill.unref?.();
 		};
-		const timeout = setTimeout(abortVerification, command.timeoutMs ?? 120_000);
+		const timeout = setTimeout(abortVerification, command.timeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS);
 		timeout.unref?.();
 		if (options.signal?.aborted) abortVerification();
 		else options.signal?.addEventListener("abort", abortVerification, { once: true });
@@ -1057,15 +1191,17 @@ function runVerifyCommand(command: AcceptanceVerifyCommand, defaultCwd: string,
 			finish({
 				exitCode,
 				status: timedOut ? "timed-out" : passed ? "passed" : command.allowFailure ? "allowed-failure" : "failed",
-				stdout: trimOutput(stdout),
-				stderr: trimOutput(stderr || (timedOut ? options.abortMessage ?? "" : "")),
+				stdout: trimOutput(redactVerifyEnv(stdout, command.env)),
+				stderr: trimOutput(redactVerifyEnv(stderr || (timedOut ? options.abortMessage ?? "" : ""), command.env)),
 			});
 		});
 		child.on("error", (error) => {
 			finish({
 				exitCode: timedOut ? null : 1,
 				status: timedOut ? "timed-out" : command.allowFailure ? "allowed-failure" : "failed",
-				stderr: timedOut ? trimOutput(stderr || options.abortMessage || "Acceptance verification timed out.") : error instanceof Error ? error.message : String(error),
+				stderr: timedOut
+					? trimOutput(redactVerifyEnv(stderr || options.abortMessage || "Acceptance verification timed out.", command.env))
+					: redactVerifyEnv(error instanceof Error ? error.message : String(error), command.env),
 			});
 		});
 	});
@@ -1087,6 +1223,8 @@ export async function evaluateAcceptance(input: {
 	signal?: AbortSignal;
 	abortMessage?: string;
 	reportOptional?: boolean;
+	artifactsDir?: string;
+	runId?: string;
 }): Promise<AcceptanceLedger> {
 	const acceptance = input.acceptance;
 	const initialStatus = acceptance.level === "none" ? "not-required" : "claimed";
@@ -1148,7 +1286,12 @@ export async function evaluateAcceptance(input: {
 		}
 		ledger.verifyRuns = [];
 		for (const command of acceptance.verify) {
-			ledger.verifyRuns.push(await runVerifyCommand(command, input.cwd, { signal: input.signal, abortMessage: input.abortMessage }));
+			ledger.verifyRuns.push(await runMemoizedVerifyCommand(command, input.cwd, {
+				signal: input.signal,
+				abortMessage: input.abortMessage,
+				artifactsDir: input.artifactsDir,
+				runId: input.runId,
+			}));
 			if (input.signal?.aborted) break;
 		}
 		if (ledger.verifyRuns.some((run) => run.status === "failed" || run.status === "timed-out")) {

package/dist/extensions/pi-subagents/src/runs/shared/dynamic-fanout.ts

@@ -49,7 +49,7 @@ const DYNAMIC_EXPAND_FROM_KEYS = new Set(["output", "path"]);
 const DYNAMIC_PARALLEL_KEYS = new Set(["agent", "task", "phase", "label", "outputSchema", "cwd", "output", "outputMode", "reads", "progress", "skill", "model", "toolBudget", "acceptance", "agentContract", "gateOn"]);
 const RUNNER_DYNAMIC_PARALLEL_KEYS = new Set([
 	...DYNAMIC_PARALLEL_KEYS,
-	"outputName", "structured", "inheritProjectContext", "inheritSkills", "skills", "outputPath", "namespaceOutputPath", "maxSubagentDepth", "waitToolEnabled",
+	"outputName", "structured", "inheritProjectContext", "inheritSkills", "skills", "outputPath", "namespaceOutputPath", "maxSubagentDepth", "timeoutMs", "waitToolEnabled",
 	"structuredOutput", "structuredOutputSchema", "tools", "extensions", "subagentOnlyExtensions", "mcpDirectTools", "capabilityCeiling", "completionGuard", "systemPrompt",
 	"systemPromptMode", "thinking", "modelCandidates", "sessionFile", "effectiveAcceptance", "acceptanceInput", "acceptanceRole", "parentSessionId", "launchResolvedExtensions",
 ]);

package/dist/extensions/pi-subagents/src/runs/shared/mcp-direct-tool-allowlist.ts

@@ -38,6 +38,7 @@ interface ServerEntry {
 	exposeResources?: boolean;
 	includeTools?: string[];
 	excludeTools?: string[];
+	protocolVersion?: string;
 	directTools?: boolean | string[];
 }
 
@@ -284,6 +285,7 @@ export function computeMcpServerHash(definition: ServerEntry): string {
 		exposeResources: definition.exposeResources,
 		includeTools: definition.includeTools,
 		excludeTools: definition.excludeTools,
+		protocolVersion: definition.protocolVersion,
 	};
 	return createHash("sha256").update(stableStringify(identity)).digest("hex");
 }

package/dist/extensions/pi-subagents/src/runs/shared/model-fallback.ts

@@ -183,7 +183,7 @@ function defaultScopeWarn(violation: ModelScopeViolation): void {
  * sentinel), the child must inherit the parent session's *in-memory* model
  * (`provider/id`) instead of being left to resolve its own model. Without an
  * explicit `provider/id`, the child falls back to the global
- * `~/.selesai/agent/settings.json` default, which is shared across every open Selesai
+ * `~/.selesai/agent/settings.json` default, which is shared across every open PI
  * session — so a different session that last changed its model in the TUI would
  * silently contaminate this session's subagents (see issue #266). Passing an
  * explicit `provider/id` keeps each session's children isolated to that
@@ -191,7 +191,8 @@ function defaultScopeWarn(violation: ModelScopeViolation): void {
  *
  * An explicitly requested model string is resolved via {@link resolveModelCandidate}.
  * When `options.scope.enforce` is on, an out-of-scope resolved model throws for
- * an explicit (`source: "explicit"`) request and warns for an inherited one.
+ * an explicit (`source: "explicit"`) request and warns for an inherited one,
+ * unless strict scope enforcement makes inherited violations hard errors.
  */
 export function resolveSubagentModelOverride(
 	requestedModel: string | boolean | undefined,
@@ -245,7 +246,7 @@ export function resolveEffectiveSubagentModel(
 }
 
 export interface BuildModelCandidatesOptions {
-	/** Fallback models are inherited agent config and warn, rather than error, when out of scope. */
+	/** Fallback models warn by default and throw when strict scope enforcement is enabled. */
 	scope?: ModelScopeConfig;
 	onWarn?: (violation: ModelScopeViolation) => void;
 }
@@ -265,9 +266,12 @@ export function buildModelCandidates(
 		if (!raw) continue;
 		const normalized = resolveModelCandidate(raw.trim(), availableModels, preferredProvider);
 		if (!normalized || seen.has(normalized)) continue;
-		if (index > 0 && options?.scope?.enforce) {
+		if ((index > 0 || options?.scope?.strict === true) && options?.scope?.enforce) {
 			const violation = checkModelScope(normalized, options.scope, "inherited");
-			if (violation) (options.onWarn ?? defaultScopeWarn)(violation);
+			if (violation) {
+				if (violation.severity === "error") throw new Error(violation.message);
+				(options.onWarn ?? defaultScopeWarn)(violation);
+			}
 		}
 		seen.add(normalized);
 		candidates.push(normalized);

package/dist/extensions/pi-subagents/src/runs/shared/model-scope.ts

@@ -6,7 +6,8 @@
  * where the model came from: an explicit caller-supplied model (`--model`,
  * tool-call `model`, or a TUI clarify pick) is a hard error, while a model
  * inherited from agent frontmatter / `defaultModel` / the parent session only
- * emits a warning so existing configurations keep working.
+ * emits a warning so existing configurations keep working. Optional strict
+ * enforcement makes inherited models hard errors too.
  *
  * The decision logic ({@link checkModelScope}) is a pure function of its
  * inputs so it can be unit-tested without touching the filesystem or config.
@@ -16,6 +17,8 @@ import { splitKnownThinkingSuffix } from "../../shared/model-info.ts";
 
 export interface ModelScopeConfig {
 	enforce?: boolean;
+	/** Reject inherited and fallback models outside the allowlist instead of warning. */
+	strict?: boolean;
 	/** Glob-style allow patterns (only `*` is special), matched against `provider/id`. */
 	allow?: string[];
 }
@@ -67,7 +70,7 @@ export function checkModelScope(
 	if (allow.some((pattern) => matchesScopePattern(model, pattern))) return undefined;
 
 	const baseModel = stripThinkingSuffix(model);
-	const severity: ModelScopeViolation["severity"] = source === "explicit" ? "error" : "warn";
+	const severity: ModelScopeViolation["severity"] = source === "explicit" || scope.strict === true ? "error" : "warn";
 	return {
 		model: baseModel,
 		severity,
@@ -102,6 +105,13 @@ export function parseModelScopeConfig(
 		config.enforce = input.enforce;
 	}
 
+	if ("strict" in input) {
+		if (typeof input.strict !== "boolean") {
+			throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.strict'; expected a boolean.`);
+		}
+		config.strict = input.strict;
+	}
+
 	if ("allow" in input) {
 		if (!Array.isArray(input.allow)) {
 			throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected an array of strings.`);

package/dist/extensions/pi-subagents/src/runs/shared/parallel-utils.ts

@@ -40,6 +40,7 @@ export interface RunnerSubagentStep {
 	outputMode?: "inline" | "file-only";
 	sessionFile?: string;
 	maxSubagentDepth?: number;
+	timeoutMs?: number;
 	waitToolEnabled?: boolean;
 	structuredOutput?: {
 		schema: import("../../shared/types.ts").JsonSchemaObject;