@selesai/code 0.9.11 → 0.9.12

package/dist/extensions/pi-subagents/test/unit/model-scope-settings.test.ts

@@ -42,10 +42,17 @@ describe("subagents.modelScope discovery", () => {
 
 	it("exposes a user modelScope from discoverAgents", () => {
 		writeJson(path.join(tempHome, ".selesai", "agent", "settings.json"), {
-			subagents: { modelScope: { enforce: true, strict: true, allow: ["anthropic/*", "openai/gpt-5-*"] } },
+			subagents: { modelScope: { enforce: true, strict: true, allow: ["anthropic/*", "openai/gpt-5-*"], agents: { reviewer: { allow: ["inherit"] } } } },
 		});
 		const result = discoverAgents(tempProject, "both");
-		assert.deepEqual(result.modelScope, { enforce: true, strict: true, allow: ["anthropic/*", "openai/gpt-5-*"] });
+		assert.deepEqual(result.modelScope, { enforce: true, strict: true, allow: ["anthropic/*", "openai/gpt-5-*"], agents: { reviewer: { allow: ["inherit"] } } });
+	});
+
+	it("accepts enforcement with only named agent allow lists", () => {
+		writeJson(path.join(tempHome, ".selesai", "agent", "settings.json"), {
+			subagents: { modelScope: { enforce: true, agents: { worker: { allow: ["openai/gpt-5-mini"] } } } },
+		});
+		assert.deepEqual(discoverAgents(tempProject, "both").modelScope, { enforce: true, agents: { worker: { allow: ["openai/gpt-5-mini"] } } });
 	});
 
 	it("returns undefined when no modelScope is configured", () => {
@@ -54,13 +61,13 @@ describe("subagents.modelScope discovery", () => {
 
 	it("prefers project modelScope over user modelScope", () => {
 		writeJson(path.join(tempHome, ".selesai", "agent", "settings.json"), {
-			subagents: { modelScope: { enforce: true, allow: ["anthropic/*"] } },
+			subagents: { modelScope: { enforce: true, allow: ["anthropic/*"], agents: { reviewer: { allow: ["inherit"] } } } },
 		});
 		writeJson(path.join(tempProject, ".selesai", "settings.json"), {
-			subagents: { modelScope: { enforce: false, allow: ["deepseek/*"] } },
+			subagents: { modelScope: { enforce: true, agents: { worker: { allow: ["deepseek/*"] } } } },
 		});
 		const result = discoverAgents(tempProject, "both");
-		assert.deepEqual(result.modelScope, { enforce: false, allow: ["deepseek/*"] });
+		assert.deepEqual(result.modelScope, { enforce: true, agents: { worker: { allow: ["deepseek/*"] } } });
 	});
 
 	it("falls back to user modelScope when project does not set one", () => {
@@ -84,4 +91,11 @@ describe("subagents.modelScope discovery", () => {
 		});
 		assert.throws(() => discoverAgents(tempProject, "both"), /invalid 'modelScope'/);
 	});
+
+	it("rejects malformed per-agent scopes at discovery time", () => {
+		writeJson(path.join(tempHome, ".selesai", "agent", "settings.json"), {
+			subagents: { modelScope: { agents: { worker: { allow: [] } } } },
+		});
+		assert.throws(() => discoverAgents(tempProject, "both"), /modelScope\.agents\.worker\.allow/);
+	});
 });

package/dist/extensions/pi-subagents/test/unit/model-scope.test.ts

@@ -4,6 +4,7 @@ import {
 	checkModelScope,
 	matchesScopePattern,
 	parseModelScopeConfig,
+	resolveModelScopesForAgent,
 	type ModelScopeConfig,
 } from "../../src/runs/shared/model-scope.ts";
 
@@ -73,6 +74,7 @@ describe("checkModelScope", () => {
 		assert.equal(violation?.severity, "error");
 		assert.equal(violation?.model, "deepseek/deepseek-v4");
 		assert.deepEqual(violation?.allowedPatterns, ["anthropic/*", "openai/gpt-5-*"]);
+		assert.equal(violation?.origin, "modelScope");
 		assert.match(violation?.message ?? "", /outside the configured subagent model scope/);
 	});
 
@@ -101,6 +103,34 @@ describe("checkModelScope", () => {
 	});
 });
 
+describe("resolveModelScopesForAgent", () => {
+	it("returns independent global and agent checks with inherited flags", () => {
+		assert.deepEqual(
+			resolveModelScopesForAgent({ enforce: true, strict: true, allow: ["openai/*"], agents: { worker: { allow: ["openai/gpt-5-mini"] } } }, "worker", { provider: "openai", id: "gpt-5" }),
+			[
+				{ enforce: true, strict: true, allow: ["openai/*"], origin: "modelScope" },
+				{ enforce: true, strict: true, allow: ["openai/gpt-5-mini"], origin: "modelScope.agents.worker" },
+			],
+		);
+	});
+
+	it("expands inherit against the current parent model", () => {
+		const scopes = resolveModelScopesForAgent({ enforce: true, allow: ["inherit"], agents: { reviewer: { allow: ["inherit"] } } }, "reviewer", { provider: "anthropic", id: "claude-sonnet-4" });
+		assert.deepEqual(scopes.map((scope) => scope.allow), [["anthropic/claude-sonnet-4"], ["anthropic/claude-sonnet-4"]]);
+	});
+
+	it("keeps inherit literal when no parent model is available so enforcement fails closed", () => {
+		const [scope] = resolveModelScopesForAgent({ enforce: true, allow: ["inherit"] }, "worker", undefined);
+		const violation = checkModelScope("openai/gpt-5-mini", scope, "explicit");
+		assert.equal(violation?.severity, "error");
+		assert.deepEqual(violation?.allowedPatterns, ["inherit"]);
+	});
+
+	it("does not apply another agent's scope", () => {
+		assert.deepEqual(resolveModelScopesForAgent({ enforce: true, agents: { reviewer: { allow: ["inherit"] } } }, "worker", { provider: "openai", id: "gpt-5" }), []);
+	});
+});
+
 describe("parseModelScopeConfig", () => {
 	const meta = { filePath: "~/.selesai/agent/settings.json" };
 
@@ -115,6 +145,13 @@ describe("parseModelScopeConfig", () => {
 		);
 	});
 
+	it("parses per-agent scopes and permits agent-only enforcement", () => {
+		assert.deepEqual(
+			parseModelScopeConfig({ enforce: true, strict: true, agents: { worker: { allow: [" openai/gpt-5-mini "] }, unknown: { enforce: false } } }, meta),
+			{ enforce: true, strict: true, agents: { worker: { allow: ["openai/gpt-5-mini"] }, unknown: { enforce: false } } },
+		);
+	});
+
 	it("parses enforce alone", () => {
 		assert.deepEqual(parseModelScopeConfig({ enforce: false }, meta), { enforce: false });
 	});
@@ -151,4 +188,11 @@ describe("parseModelScopeConfig", () => {
 		assert.throws(() => parseModelScopeConfig({ enforce: true }, meta), /without a non-empty 'allow'/);
 		assert.throws(() => parseModelScopeConfig({ enforce: true, allow: [] }, meta), /non-empty array of patterns/);
 	});
+
+	it("rejects invalid agent scope shapes with the full field path", () => {
+		assert.throws(() => parseModelScopeConfig({ enforce: true, agents: { worker: [] } }, meta), /modelScope\.agents\.worker/);
+		assert.throws(() => parseModelScopeConfig({ agents: { worker: { allow: [] } } }, meta), /modelScope\.agents\.worker\.allow/);
+		assert.throws(() => parseModelScopeConfig({ agents: { worker: { agents: {} } } }, meta), /modelScope\.agents\.worker\.agents/);
+		assert.throws(() => parseModelScopeConfig({ agents: { " ": { allow: ["inherit"] } } }, meta), /non-empty agent name/);
+	});
 });

package/dist/extensions/pi-subagents/test/unit/mutation-evidence.test.ts

@@ -0,0 +1,129 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { buildTimeoutRecoverySummary, collectTrackedMutationEvidence, snapshotTrackedMutations } from "../../src/runs/shared/mutation-evidence.ts";
+import { evaluateCompletionMutationGuard } from "../../src/runs/shared/completion-guard.ts";
+
+function git(cwd: string, args: string[]): void {
+	execFileSync("git", args, { cwd, stdio: "ignore" });
+}
+
+function withRepo(run: (repo: string) => void): void {
+	const repo = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagents-mutation-evidence-"));
+	try {
+		git(repo, ["init"]);
+		git(repo, ["config", "user.email", "test@example.com"]);
+		git(repo, ["config", "user.name", "Test User"]);
+		fs.writeFileSync(path.join(repo, "tracked.txt"), "base\n", "utf-8");
+		git(repo, ["add", "tracked.txt"]);
+		git(repo, ["commit", "-m", "base"]);
+		run(repo);
+	} finally {
+		fs.rmSync(repo, { recursive: true, force: true });
+	}
+}
+
+describe("tracked mutation evidence", () => {
+	it("detects edits to a tracked file that was already dirty at child start", () => {
+		withRepo((repo) => {
+			fs.writeFileSync(path.join(repo, "tracked.txt"), "dirty before child\n", "utf-8");
+			const snapshot = snapshotTrackedMutations(repo);
+
+			fs.writeFileSync(path.join(repo, "tracked.txt"), "dirty after child\n", "utf-8");
+			fs.writeFileSync(path.join(repo, "untracked.txt"), "ignored by evidence\n", "utf-8");
+			const evidence = collectTrackedMutationEvidence(snapshot, repo);
+
+			assert.equal(evidence.attemptedMutation, true);
+			assert.deepEqual(evidence.changedFiles, ["tracked.txt"]);
+		});
+	});
+
+	it("detects a child reverting a tracked file that was dirty at child start", () => {
+		withRepo((repo) => {
+			fs.writeFileSync(path.join(repo, "tracked.txt"), "dirty before child\n", "utf-8");
+			const snapshot = snapshotTrackedMutations(repo);
+
+			fs.writeFileSync(path.join(repo, "tracked.txt"), "base\n", "utf-8");
+			const evidence = collectTrackedMutationEvidence(snapshot, repo);
+
+			assert.equal(evidence.attemptedMutation, true);
+			assert.deepEqual(evidence.changedFiles, ["tracked.txt"]);
+		});
+	});
+
+	it("detects staged edits to a tracked file that was already staged dirty at child start", () => {
+		withRepo((repo) => {
+			fs.writeFileSync(path.join(repo, "tracked.txt"), "staged before child\n", "utf-8");
+			git(repo, ["add", "tracked.txt"]);
+			const snapshot = snapshotTrackedMutations(repo);
+
+			fs.writeFileSync(path.join(repo, "tracked.txt"), "staged after child\n", "utf-8");
+			git(repo, ["add", "tracked.txt"]);
+			const evidence = collectTrackedMutationEvidence(snapshot, repo);
+
+			assert.equal(evidence.attemptedMutation, true);
+			assert.deepEqual(evidence.changedFiles, ["tracked.txt"]);
+		});
+	});
+
+	it("distinguishes unchanged and changed tracked diffs that exceed the fast buffer", () => {
+		withRepo((repo) => {
+			const largeBefore = `${"before\n".repeat(180_000)}before-tail\n`;
+			const largeAfter = `${"after\n".repeat(180_000)}after-tail\n`;
+			fs.writeFileSync(path.join(repo, "tracked.txt"), largeBefore, "utf-8");
+			const snapshot = snapshotTrackedMutations(repo);
+			const unchangedEvidence = collectTrackedMutationEvidence(snapshot, repo);
+
+			assert.equal(unchangedEvidence.attemptedMutation, false);
+			assert.deepEqual(unchangedEvidence.changedFiles, []);
+
+			fs.writeFileSync(path.join(repo, "tracked.txt"), largeAfter, "utf-8");
+			const evidence = collectTrackedMutationEvidence(snapshot, repo);
+
+			assert.equal(evidence.attemptedMutation, true);
+			assert.deepEqual(evidence.changedFiles, ["tracked.txt"]);
+		});
+	});
+
+	it("uses tracked evidence as completion guard mutation proof", () => {
+		const guard = evaluateCompletionMutationGuard({
+			agent: "worker",
+			task: "Implement the requested fix.",
+			messages: [{ role: "assistant", content: [{ type: "text", text: "Implemented." }] }],
+			tools: ["edit"],
+			mutationEvidence: {
+				source: "tracked-files",
+				trackedOnly: true,
+				changedFiles: ["tracked.txt"],
+				attemptedMutation: true,
+			},
+		});
+
+		assert.equal(guard.expectedMutation, true);
+		assert.equal(guard.attemptedMutation, true);
+		assert.equal(guard.triggered, false);
+	});
+
+	it("formats bounded timeout recovery data", () => {
+		const summary = buildTimeoutRecoverySummary({
+			termination: "timed-out",
+			evidence: {
+				source: "tracked-files",
+				trackedOnly: true,
+				changedFiles: ["tracked.txt"],
+				attemptedMutation: true,
+			},
+			currentTool: "edit",
+			currentPath: "tracked.txt",
+			sessionFile: "session.jsonl",
+		});
+
+		assert.deepEqual(summary.changedFiles, ["tracked.txt"]);
+		assert.match(summary.message, /termination: timed-out/);
+		assert.match(summary.message, /changed tracked files: tracked\.txt/);
+		assert.match(summary.message, /active tool: edit/);
+	});
+});

package/dist/extensions/pi-subagents/test/unit/native-supervisor-channel.test.ts

@@ -144,7 +144,7 @@ describe("native supervisor channel", () => {
 			) => { sent.push({ message, options }); },
 			getSessionName: () => "shared-name",
 		};
-		const channel = createNativeSupervisorChannel(pi as never, makeState(currentSessionId, ctx));
+		const channel = createNativeSupervisorChannel(pi as never, makeState(currentSessionId, ctx), { platform: "darwin" });
 
 		assert.deepEqual(registeredTools, []);
 		channel.start();
@@ -192,6 +192,81 @@ describe("native supervisor channel", () => {
 		assert.deepEqual(sent.map((message) => message.details?.id), [requestId]);
 	});
 
+	it("registers idle Darwin sessions without native watchers or polling", () => {
+		const currentSessionId = `session-${randomUUID()}`;
+		const ctx = {
+			cwd: process.cwd(),
+			hasUI: false,
+			sessionManager: {
+				getSessionId: () => currentSessionId,
+				getSessionFile: () => null,
+				getEntries: () => [],
+			},
+		};
+		const pi = {
+			getAllTools: () => [],
+			registerTool: () => {},
+			sendMessage: () => {},
+			getSessionName: () => "shared-name",
+		};
+		let watchCalls = 0;
+		const intervals: number[] = [];
+		const channel = createNativeSupervisorChannel(pi as never, makeState(currentSessionId, ctx), {
+			platform: "darwin",
+			watch: (() => { watchCalls += 1; throw new Error("Darwin must not call fs.watch."); }) as never,
+			timers: {
+				setInterval: ((_handler: () => void, delay?: number) => { intervals.push(delay ?? 0); return { unref() {} } as NodeJS.Timeout; }) as typeof setInterval,
+				clearInterval: (() => {}) as typeof clearInterval,
+				setImmediate,
+				clearImmediate,
+			},
+		});
+
+		channel.start();
+		channel.dispose();
+
+		assert.equal(watchCalls, 0);
+		assert.deepEqual(intervals, []);
+	});
+
+	it("activates Darwin supervisor polling only while child work is live", () => {
+		const currentSessionId = `session-${randomUUID()}`;
+		const ctx = {
+			cwd: process.cwd(),
+			hasUI: false,
+			sessionManager: {
+				getSessionId: () => currentSessionId,
+				getSessionFile: () => null,
+				getEntries: () => [],
+			},
+		};
+		const pi = {
+			getAllTools: () => [],
+			registerTool: () => {},
+			sendMessage: () => {},
+			getSessionName: () => "shared-name",
+		};
+		const state = makeState(currentSessionId, ctx);
+		state.foregroundControls.set("run-a", { runId: "run-a", startedAt: Date.now(), updatedAt: Date.now(), activeChildren: new Map(), schedulingOwners: 1 } as never);
+		const intervals: number[] = [];
+		const channel = createNativeSupervisorChannel(pi as never, state, {
+			platform: "darwin",
+			watch: (() => { throw new Error("Darwin must not call fs.watch."); }) as never,
+			timers: {
+				setInterval: ((_handler: () => void, delay?: number) => { intervals.push(delay ?? 0); return { unref() {} } as NodeJS.Timeout; }) as typeof setInterval,
+				clearInterval: (() => {}) as typeof clearInterval,
+				setImmediate,
+				clearImmediate,
+			},
+		});
+
+		channel.start();
+		channel.activateTransport();
+		channel.dispose();
+
+		assert.deepEqual(intervals, [250]);
+	});
+
 	it("delivers requests written under an existing request directory by watch event", async () => {
 		const currentSessionId = `session-${randomUUID()}`;
 		const runId = `run-${randomUUID()}`;
@@ -212,11 +287,19 @@ describe("native supervisor channel", () => {
 			sendMessage: (message: { details?: { id?: string } }) => { sent.push(message); },
 			getSessionName: () => "shared-name",
 		};
-		const channel = createNativeSupervisorChannel(pi as never, makeState(currentSessionId, ctx));
+		const watchListeners: fs.WatchListener<string>[] = [];
+		const channel = createNativeSupervisorChannel(pi as never, makeState(currentSessionId, ctx), {
+			platform: "linux",
+			watch: ((_filename: fs.PathLike, listener: fs.WatchListener<string>) => {
+				watchListeners.push(listener);
+				return { on: () => {}, close: () => {}, unref: () => {} } as unknown as fs.FSWatcher;
+			}) as never,
+		});
 
 		try {
 			channel.start();
 			const requestId = writeRequest({ sessionId: currentSessionId, runId });
+			for (const listener of watchListeners) listener("rename", `${requestId}.json`);
 			await waitForCondition(() => sent.some((message) => message.details?.id === requestId), "supervisor request watch delivery");
 		} finally {
 			channel.dispose();
@@ -375,6 +458,152 @@ describe("native supervisor channel", () => {
 		}
 	});
 
+	it("marks attention after detach when the reply has not landed yet", () => {
+		const currentSessionId = `session-${randomUUID()}`;
+		const runId = `run-${randomUUID()}`;
+		writeRequest({ sessionId: currentSessionId, runId });
+		const ctx = {
+			cwd: process.cwd(),
+			hasUI: false,
+			sessionManager: {
+				getSessionId: () => currentSessionId,
+				getSessionFile: () => null,
+				getEntries: () => [],
+			},
+		};
+		const state = makeState(currentSessionId, ctx);
+		const pi = {
+			getAllTools: () => [],
+			registerTool: () => {},
+			sendMessage: () => {},
+			events: {
+				emit: () => {
+					state.foregroundRuns = new Map([[runId, {
+						runId,
+						mode: "single",
+						cwd: process.cwd(),
+						sessionId: currentSessionId,
+						updatedAt: Date.now(),
+						children: [{ agent: "worker", index: 0, status: "detached", updatedAt: Date.now() }],
+					}]]);
+				},
+			},
+			getSessionName: () => "shared-name",
+		};
+		const channel = createNativeSupervisorChannel(pi as never, state);
+		try {
+			channel.start();
+			const child = state.foregroundRuns.get(runId)!.children[0]!;
+			assert.equal(child.activityState, "needs_attention");
+			assert.equal(child.currentTool, "contact_supervisor");
+		} finally {
+			channel.dispose();
+		}
+	});
+
+	it("skips restamping attention when the reply already landed during detach", async () => {
+		const currentSessionId = `session-${randomUUID()}`;
+		const runId = `run-${randomUUID()}`;
+		const requestId = writeRequest({ sessionId: currentSessionId, runId });
+		const registeredTools = new Map<string, { execute: (_id: string, params: { action: string; replyTo?: string; message?: string }) => Promise<unknown> }>();
+		const ctx = {
+			cwd: process.cwd(),
+			hasUI: false,
+			sessionManager: {
+				getSessionId: () => currentSessionId,
+				getSessionFile: () => null,
+				getEntries: () => [],
+			},
+		};
+		const state = makeState(currentSessionId, ctx);
+		state.foregroundRuns = new Map();
+		const pi = {
+			getAllTools: () => [...registeredTools.keys()].map((name) => ({ name })),
+			registerTool: (tool: { name: string; execute: (_id: string, params: { action: string; replyTo?: string; message?: string }) => Promise<unknown> }) => {
+				registeredTools.set(tool.name, tool);
+			},
+			sendMessage: () => {
+				void registeredTools.get(NATIVE_SUPERVISOR_TOOL_NAME)!.execute("reply", {
+					action: "reply",
+					replyTo: requestId,
+					message: "Approved",
+				});
+			},
+			events: {
+				emit: () => {
+					state.foregroundRuns = new Map([[runId, {
+						runId,
+						mode: "single",
+						cwd: process.cwd(),
+						sessionId: currentSessionId,
+						updatedAt: Date.now(),
+						children: [{ agent: "worker", index: 0, status: "detached", updatedAt: Date.now() }],
+					}]]);
+				},
+			},
+			getSessionName: () => "shared-name",
+		};
+		const channel = createNativeSupervisorChannel(pi as never, state);
+		try {
+			channel.start();
+			const child = state.foregroundRuns.get(runId)!.children[0]!;
+			assert.equal(child.status, "detached");
+			assert.equal(child.activityState, undefined);
+			assert.equal(child.currentTool, undefined);
+			assert.equal(channel.pending.has(requestId), false);
+		} finally {
+			channel.dispose();
+		}
+	});
+
+	it("clears remembered attention even when currentTool is not contact_supervisor", async () => {
+		const currentSessionId = `session-${randomUUID()}`;
+		const runId = `run-${randomUUID()}`;
+		const requestId = writeRequest({ sessionId: currentSessionId, runId });
+		const registeredTools = new Map<string, { execute: (_id: string, params: { action: string; replyTo?: string; message?: string }) => Promise<unknown> }>();
+		const ctx = {
+			cwd: process.cwd(),
+			hasUI: false,
+			sessionManager: {
+				getSessionId: () => currentSessionId,
+				getSessionFile: () => null,
+				getEntries: () => [],
+			},
+		};
+		const state = makeState(currentSessionId, ctx);
+		state.foregroundRuns = new Map([[runId, {
+			runId,
+			mode: "single",
+			cwd: process.cwd(),
+			sessionId: currentSessionId,
+			updatedAt: 1,
+			children: [{ agent: "worker", index: 0, status: "detached", activityState: "needs_attention", currentTool: "edit", updatedAt: 1 }],
+		}]]);
+		const pi = {
+			getAllTools: () => [...registeredTools.keys()].map((name) => ({ name })),
+			registerTool: (tool: { name: string; execute: (_id: string, params: { action: string; replyTo?: string; message?: string }) => Promise<unknown> }) => {
+				registeredTools.set(tool.name, tool);
+			},
+			sendMessage: () => {},
+			getSessionName: () => "shared-name",
+		};
+		const channel = createNativeSupervisorChannel(pi as never, state);
+		try {
+			channel.start();
+			state.foregroundRuns.get(runId)!.children[0]!.currentTool = "edit";
+			await registeredTools.get(NATIVE_SUPERVISOR_TOOL_NAME)!.execute("reply", {
+				action: "reply",
+				replyTo: requestId,
+				message: "Approved",
+			});
+			const child = state.foregroundRuns.get(runId)!.children[0]!;
+			assert.equal(child.activityState, undefined);
+			assert.equal(child.currentTool, undefined);
+		} finally {
+			channel.dispose();
+		}
+	});
+
 	it("matches supervisor requests against the runtime session id instead of persisted session file path", () => {
 		const currentSessionId = `session-${randomUUID()}`;
 		const persistedSessionFile = path.join(os.tmpdir(), `${currentSessionId}.jsonl`);

package/dist/extensions/pi-subagents/test/unit/nested-control.test.ts

@@ -4,7 +4,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { afterEach, describe, it } from "node:test";
 import registerFanoutChildSubagentExtension from "../../src/extension/fanout-child.ts";
-import { createSubagentExecutor } from "../../src/runs/foreground/subagent-executor.ts";
+import { createSubagentExecutor, readNestedRecoveryDescriptor } from "../../src/runs/foreground/subagent-executor.ts";
 import { createNestedRoute, findNestedControlResult, projectNestedEvents, readNestedControlRequests, readNestedControlResults, snapshotNestedEventFiles, writeNestedControlRequest, writeNestedControlResult, writeNestedEvent } from "../../src/runs/shared/nested-events.ts";
 import {
 	SUBAGENT_CHILD_ENV,
@@ -17,6 +17,7 @@ import {
 	SUBAGENT_PARENT_RUN_ID_ENV,
 } from "../../src/runs/shared/pi-args.ts";
 import { ASYNC_DIR, type SubagentState } from "../../src/shared/types.ts";
+import { createRunFanoutBudget } from "../../src/runs/shared/run-fanout-budget.ts";
 
 const routeRoots: string[] = [];
 const fanoutListenerCleanupKey = "__piSubagentFanoutChildNestedControlInboxCleanups";
@@ -379,6 +380,32 @@ describe("nested control routing", () => {
 		}
 	});
 
+	it("restores the original extension bindings for terminal nested revival", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-nested-binding-recovery-"));
+		try {
+			const descriptor = {
+				version: 1,
+				runFanoutBudget: createRunFanoutBudget("nested-bound", 64),
+				sourceRunId: "nested-bound",
+				agent: "worker",
+				cwd: root,
+				systemPromptMode: "replace",
+				inheritProjectContext: false,
+				inheritSkills: false,
+				outputMode: "inline",
+				maxSubagentDepth: 2,
+				share: false,
+				extensionBindings: { "shepherd.dispatch/1": { role: "coder" } },
+			};
+			fs.writeFileSync(path.join(root, "recovery-descriptor.json"), JSON.stringify(descriptor));
+			assert.deepEqual(readNestedRecoveryDescriptor(root, "nested-bound", "worker")?.extensionBindings, descriptor.extensionBindings);
+			assert.throws(() => readNestedRecoveryDescriptor(root, "other-run", "worker"), /different source run/);
+			assert.throws(() => readNestedRecoveryDescriptor(root, "nested-bound", "reviewer"), /different agent/);
+		} finally {
+			fs.rmSync(root, { recursive: true, force: true });
+		}
+	});
+
 	it("rejects stopped nested runs before attempting revival", async () => {
 		const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-nested-stopped-resume-"));
 		try {