@signalridge/pi-subagents 1.10.3 → 1.11.1

package/src/settings.ts

@@ -12,6 +12,7 @@ import { isManagedAgentTier, MAX_AGENT_TIER_PROFILES } from "@signalridge/pi-sub
 // edit index.ts in the same change.
 import { setDefaultToolTimeoutMs } from "./agent-runner.js";
 import { NO_FALLBACK } from "./agent-types.js";
+import { isProjectResource } from "./project-trust.js";
 import type { JoinMode, ThinkingLevel } from "./types.js";
 
 /** How a `@handle message` mention is dispatched. See `agentMentions`. */
@@ -722,11 +723,13 @@ function readSettingsFile(path: string): ReadSettings {
  * Load merged settings: global provides defaults, project overrides. Agent-tier
  * profiles are complete replacement units: a project entry never inherits one
  * field from the global entry, and an invalid project entry blocks that global
- * entry instead of silently reviving it.
+ * entry instead of silently reviving it. Runtime callers must pass captured trust;
+ * the default preserves standalone helper compatibility.
  */
-export function loadSettings(cwd: string = process.cwd()): SubagentsSettings {
-  const global = readSettingsFile(globalPath());
-  const project = readSettingsFile(projectPath(cwd));
+export function loadSettings(cwd: string = process.cwd(), projectTrusted = true): SubagentsSettings {
+  const empty = (): ReadSettings => ({ settings: {}, agentTiers: emptyAgentTiersSource() });
+  const global = projectTrusted || !isProjectResource(globalPath(), cwd) ? readSettingsFile(globalPath()) : empty();
+  const project = projectTrusted ? readSettingsFile(projectPath(cwd)) : empty();
   const { agentTiers: _globalAgentTiers, ...globalSettings } = global.settings;
   const { agentTiers: _projectAgentTiers, ...projectSettings } = project.settings;
   const agentTiers = mergeAgentTierSources(global.agentTiers, project.agentTiers);

package/src/skill-loader.ts

@@ -30,37 +30,48 @@ export interface PreloadedSkill {
   content: string;
 }
 
-export function preloadSkills(skillNames: string[], cwd: string): PreloadedSkill[] {
-  return skillNames.map((name) => ({ name, content: loadSkillContent(name, cwd) }));
+export interface PreloadSkillsOptions {
+  /** Denied/unknown project trust excludes both project roots; user skills remain available. */
+  projectTrusted: boolean;
+  /** Preserve denied source provenance even through aliases of user skill roots. */
+  deniedResource?: (path: string) => boolean;
 }
 
-function loadSkillContent(name: string, cwd: string): string {
+export function preloadSkills(skillNames: string[], cwd: string, options: PreloadSkillsOptions): PreloadedSkill[] {
+  return skillNames.map((name) => ({ name, content: loadSkillContent(name, cwd, options) }));
+}
+
+function loadSkillContent(name: string, cwd: string, options: PreloadSkillsOptions): string {
   if (isUnsafeName(name)) {
     return `(Skill "${name}" skipped: name contains path traversal characters)`;
   }
   const roots = [
-    join(cwd, ".pi", "skills"), // project — Pi standard
-    join(cwd, ".agents", "skills"), // project — Agent Skills spec
+    ...(options.projectTrusted === true ? [
+      join(cwd, ".pi", "skills"), // project — Pi standard
+      join(cwd, ".agents", "skills"), // project — Agent Skills spec
+    ] : []),
     join(getAgentDir(), "skills"), // user — Pi standard
     join(homedir(), ".agents", "skills"), // user — Agent Skills spec
     join(homedir(), ".pi", "skills"), // legacy global, pre-Pi
   ];
   for (const root of roots) {
-    const content = findInRoot(root, name);
+    if (options.deniedResource?.(root)) continue;
+    const content = findInRoot(root, name, options.deniedResource);
     if (content !== undefined) return content;
   }
   return `(Skill "${name}" not found in .pi/skills/, .agents/skills/, or global skill locations)`;
 }
 
-function findInRoot(root: string, name: string): string | undefined {
+function findInRoot(root: string, name: string, deniedResource?: (path: string) => boolean): string | undefined {
   if (isSymlink(root)) return undefined; // reject symlinked roots entirely
-  const flat = safeReadFile(join(root, `${name}.md`))?.trim();
+  const flatPath = join(root, `${name}.md`);
+  const flat = deniedResource?.(flatPath) ? undefined : safeReadFile(flatPath)?.trim();
   if (flat !== undefined) return flat;
-  return findSkillDirectory(root, name);
+  return findSkillDirectory(root, name, deniedResource);
 }
 
 /** BFS under `root` for a directory named `name` containing `SKILL.md`. Pi-conforming filters. */
-function findSkillDirectory(root: string, name: string): string | undefined {
+function findSkillDirectory(root: string, name: string, deniedResource?: (path: string) => boolean): string | undefined {
   if (!existsSync(root)) return undefined;
   const queue: string[] = [root];
 
@@ -85,6 +96,7 @@ function findSkillDirectory(root: string, name: string): string | undefined {
       // Symlinked dirs already filtered by entry.isDirectory() — Dirent uses lstat semantics.
       const path = join(current, entry.name);
       const skillMd = join(path, "SKILL.md");
+      if (deniedResource?.(skillMd)) continue;
       const isSkillDir = existsSync(skillMd);
 
       if (isSkillDir) {

package/src/types.ts

@@ -42,10 +42,12 @@ export interface AgentConfig {
    */
   color?: string;
   /**
-   * Tools whose every call needs the user to agree first (`ask_tools:`). The
-   * third answer between `tools:` and `disallowed_tools:`, for tools that are
-   * usually fine and occasionally not. Approval comes from the human, never
-   * from a model — see `ask-tools.ts`.
+   * Tools whose first call needs human approval for the child session
+   * (`ask_tools:`), including resumed turns of this in-memory child. A reopened
+   * child must ask again. The third answer between
+   * `tools:` and `disallowed_tools:` for tools that are usually fine and
+   * occasionally not. Approval comes from the human, never from a model —
+   * see `ask-tools.ts`.
    */
   askTools?: string[];
   /**