@signalridge/pi-subagents 1.11.0 → 1.12.0

package/src/agent-runner.ts

@@ -17,6 +17,7 @@ import {
   DefaultResourceLoader,
   type ExtensionAPI,
   getAgentDir,
+  type ResolvedResource,
   SessionManager,
   SettingsManager,
 } from "@earendil-works/pi-coding-agent";
@@ -28,6 +29,7 @@ import { extractText } from "./context.js";
 import { assertNoRawInheritance, assertSafeChildSession } from "./context-boundary.js";
 import { DEFAULT_AGENTS } from "./default-agents.js";
 import { detectEnv } from "./env.js";
+import { extensionResourceIdentity, resolveExtensionResourceNames } from "./extension-resource-names.js";
 import { formatGateVerdict, type GateExec, runGate, workspaceFingerprint } from "./gate.js";
 import {
   INTERNAL_AGENT_CONFIG_OVERRIDE,
@@ -40,6 +42,8 @@ import { type ModelRegistry, resolveModel, shortModelLabel } from "./model-resol
 import { parentModelSessionOptions } from "./model-runtime-bridge.js";
 import { checkModelScope } from "./model-scope.js";
 import { createNestedSubagentTools, getMaxSubagentDepth, type NestedAgentManager } from "./nested-tools.js";
+import { ANSWER_SUBAGENT_QUESTION, type ParentQuestionHandler } from "./parent-questions.js";
+import { captureProjectTrust, childProjectTrust, configurationMcpFactory, isProjectResource } from "./project-trust.js";
 import { buildAgentPrompt, type PromptExtras } from "./prompts.js";
 import { shutdownAndDisposeSession } from "./session-lifecycle.js";
 import { preloadSkills } from "./skill-loader.js";
@@ -56,6 +60,7 @@ export const SUBAGENT_TOOL_NAMES = {
   AGENT: "Agent",
   GET_RESULT: "get_subagent_result",
   STEER: "steer_subagent",
+  ANSWER_QUESTION: ANSWER_SUBAGENT_QUESTION,
 } as const;
 
 /** Names of tools registered by this extension that subagents must NOT inherit. */
@@ -240,8 +245,9 @@ function extensionToolNamesInScope(session: AgentSession, ctx: {
   extNames: Set<string>;
   narrowing: Map<string, Set<string>>;
   nestedToolNames: Set<string>;
+  resolvedNames: Map<string, string[]>;
 }): () => Set<string> {
-  const { loader, toolNames, disallowedSet, extNames, narrowing, nestedToolNames } = ctx;
+  const { loader, toolNames, disallowedSet, extNames, narrowing, nestedToolNames, resolvedNames } = ctx;
   const builtins = new Set(toolNames);
   return () => {
     const keep = new Set<string>();
@@ -257,7 +263,7 @@ function extensionToolNamesInScope(session: AgentSession, ctx: {
       const path = tool.sourceInfo.path;
       const extension = extensionsByPath.get(path);
       if (extension) {
-        const canons = extensionCanonicalNames(extension.path);
+        const canons = resolvedNames.get(extension.path) ?? extensionCanonicalNames(extension.path);
         if (optInActive && !canons.some((c) => extNames.has(c))) continue;
         // First alias that carries a narrowing set — a user won't narrow one
         // extension under two different names, so first-match is correct.
@@ -331,8 +337,10 @@ export function installExtensionToolScope(session: AgentSession, inScope: () =>
  * the agent's whole result down with it.
  */
 async function runConfiguredGate(command: string, cwd: string, pi: ExtensionAPI): Promise<string> {
-  const exec: GateExec = (file, args, execOptions) =>
-    pi.exec(file, args, execOptions as Parameters<ExtensionAPI["exec"]>[2]);
+  const exec: GateExec = async (file, args, execOptions) => {
+    const result = await pi.exec(file, args, execOptions);
+    return { stdout: result.stdout, stderr: result.stderr, exitCode: result.killed ? 1 : result.code };
+  };
   try {
     const fingerprint = await workspaceFingerprint(cwd, exec);
     const verdict = await runGate({ command, cwd, exec, ...(fingerprint ? { fingerprint } : {}) });
@@ -622,9 +630,9 @@ export interface RunOptions {
    *
    * WARNING for future callers: if you pass `cwd` pointing at a directory the
    * user didn't open, you almost certainly must pass `configCwd` too —
-   * omitting it makes the target's `.pi` extensions execute in this process.
-   * (Worktree isolation is the one intentional exception: its copy IS the
-   * parent's repo, so config resolving inside it is correct.)
+   * a different configuration root does not inherit the parent's trust.
+   * Worktree execution with configCwd pointing at the parent retains trust;
+   * configuration discovered inside a new worktree is not implicitly trusted.
    */
   configCwd?: string;
   /** Called on tool start/end with activity info. */
@@ -681,7 +689,9 @@ export interface RunOptions {
    * Defaults to on wherever there is a UI to ask through; `false` withholds the
    * tool entirely rather than injecting one that always refuses.
    */
-  supervisorQuestions?: boolean;
+  supervisorQuestions?: boolean | "parent";
+  /** Manager-issued root clarification channel; never supplied by child tool args. */
+  parentQuestion?: ParentQuestionHandler;
   /** Runtime bridge for opt-in child-safe nested delegation. */
   nestedRuntime?: {
     manager: NestedAgentManager;
@@ -898,8 +908,36 @@ export async function runAgent(
   // an already-cancelled caller. This matters for tool-call signals: the
   // caller may be cancelled before this async function gets its first turn.
   throwIfAborted(options.signal);
+  if (options.supervisorQuestions === "parent" && !options.parentQuestion) {
+    throw new Error('Parent clarification requires a manager-issued background channel. Use Agent with run_in_background: true and supervisor_questions: "parent".');
+  }
+  const parentProjectTrust = captureProjectTrust(ctx);
+  // Configuration provenance is established synchronously, before definition
+  // admission, model setup, callbacks, or any await. Execution cwd is not trust.
+  const effectiveCwd = options.cwd ?? ctx.cwd;
+  const configCwd = options.configCwd ?? effectiveCwd;
+  const projectTrust = childProjectTrust(parentProjectTrust, configCwd);
+  const projectTrusted = projectTrust.trusted;
+  const deniedProjectResource = (path: string): boolean =>
+    projectTrust.deniedRoots.some(root => isProjectResource(path, root));
+  const agentDir = getAgentDir();
+  // Native global configuration is resolved before resource-path filtering.
+  // Reject aliases into denied roots before the SDK parses their declarations;
+  // do not copy or reinterpret the host's settings/MCP schemas here.
+  for (const filename of ["settings.json", "mcp.json"]) {
+    if (deniedProjectResource(join(agentDir, filename))) {
+      throw new Error(`Project trust denied for global configuration source "${filename}".`);
+    }
+  }
 
   const loadedConfig = getConfig(type);
+  // The request's provenance matters, not just the requested extension path:
+  // a denied definition can request packages anywhere (including npm caches).
+  // getConfig carries the actual fallback definition's provenance as well.
+  if ((!parentProjectTrust.trusted && loadedConfig.source === "project") ||
+    (loadedConfig.sourcePath && deniedProjectResource(loadedConfig.sourcePath))) {
+    throw new Error(`Project trust denied for agent definition "${type}".`);
+  }
   const internalOverride = options[INTERNAL_AGENT_CONFIG_OVERRIDE];
   const loadedAgentConfig = getAgentConfig(type);
   const config = internalOverride
@@ -982,12 +1020,6 @@ export async function runAgent(
     options.onAgentTierResolved?.(agentTierSnapshot, tierModelLabel);
   }
 
-  // Resolve working directory: worktree override > parent cwd
-  const effectiveCwd = options.cwd ?? ctx.cwd;
-  // Filesystem work happens in effectiveCwd; config discovery in configCwd.
-  // They differ only for SpawnOptions.cwd spawns (config stays with the parent).
-  const configCwd = options.configCwd ?? effectiveCwd;
-
   const env = await detectEnv(options.pi, effectiveCwd);
   throwIfAborted(options.signal);
 
@@ -1010,7 +1042,7 @@ export async function runAgent(
 
   // Skill preloading: when skills is string[], preload their content into prompt
   if (Array.isArray(skills)) {
-    const loaded = preloadSkills(skills, configCwd);
+    const loaded = preloadSkills(skills, configCwd, { projectTrusted, deniedResource: deniedProjectResource });
     if (loaded.length > 0) {
       extras.skillBlocks = loaded;
     }
@@ -1060,15 +1092,15 @@ export async function runAgent(
   // skills later, so the loader override must enforce this policy on every update.
   const noSkills = skills === false || Array.isArray(skills);
 
-  const agentDir = getAgentDir();
+  const settingsManager = SettingsManager.create(configCwd, agentDir, { projectTrusted });
 
   // Extension loading:
-  // - true  → all default-discovered extensions
+  // - true  → all child-safe default-discovered extensions
   // - false → none (noExtensions)
   // - string[] → allowlist. Bare names keep matching default-discovered
   //   extensions; path entries load explicitly; "*" keeps all defaults.
-  //   On Pi with replaceable built-ins, restrictive policies resolve paths
-  //   before loading, so excluded factories cannot replace a selected built-in.
+  //   Resolve enabled resources before loading: excluded factories cannot
+  //   replace selected built-ins or schedule unmanaged asynchronous wakes.
   //
   // Suppress AGENTS.md/CLAUDE.md and APPEND_SYSTEM.md — upstream's
   // buildSystemPrompt() re-appends both AFTER systemPromptOverride, which
@@ -1089,12 +1121,11 @@ export async function runAgent(
     : undefined;
   const keepNames = extensionsSpec?.names ?? new Set<string>();
   // `exclude_extensions:` is a denylist applied AFTER the include set — exclude wins.
-  // Plain canonical names only (case-insensitive). On older hosts filtering is
-  // post-factory; this is not a sandbox for extensions that already loaded.
+  // Plain canonical names only (case-insensitive). Preselection prevents
+  // factory execution, but resolving packages is not an untrusted-code sandbox.
   const excludeNames = new Set((excludeExtensions ?? []).map((n) => n.toLowerCase()));
   const hasExcludes = excludeNames.size > 0;
-  // The override filters on older hosts, validates preselection on new hosts,
-  // and ALWAYS puts our tool policy first. Pi passes one mutable
+  // The override validates preselection and ALWAYS puts our tool policy first. Pi passes one mutable
   // tool_call event through handlers in extension order; if an earlier extension
   // changes event.toolName, a later gate would inspect a different name from the
   // one Pi actually executes. Ordering before untrusted handlers is essential.
@@ -1108,6 +1139,7 @@ export async function runAgent(
   let discoveredNames: Set<string> | undefined;
   let prefilteredExtensionPaths: Set<string> | undefined;
   const resolvedExplicitNames = new Set<string>();
+  let resolvedNames = new Map<string, string[]>();
   const interactiveAskNames = new Set(ctx.hasUI ? (agentConfig?.askTools ?? []).map((name) => name.toLowerCase()) : []);
   const approvalTimer: ApprovalTimer = {
     isInteractiveAsk: (name) => interactiveAskNames.has(name.toLowerCase()),
@@ -1177,9 +1209,9 @@ export async function runAgent(
       });
     },
   }];
-  // Pi 0.99 exposes these as public SDK factories. Earlier supported hosts do
-  // not export them, so capability-check the namespace instead of importing a
-  // missing named export (which would prevent the whole extension from loading).
+  // Public SDK factories are verified on Pi 1.0.4. Capability-check the
+  // namespace rather than importing a potentially missing named export; this
+  // retained fallback does not establish support for older host versions.
   if ("createCodemodeExtension" in PiCodingAgent && typeof PiCodingAgent.createCodemodeExtension === "function") {
     extensionFactories.push({ name: "codemode", builtin: true, replaceable: true, factory: PiCodingAgent.createCodemodeExtension() });
   }
@@ -1187,21 +1219,27 @@ export async function runAgent(
     extensionFactories.push({ name: "tool-search", builtin: true, replaceable: true, factory: PiCodingAgent.createToolSearchExtension() });
   }
   if ("createMcpExtension" in PiCodingAgent && typeof PiCodingAgent.createMcpExtension === "function") {
-    extensionFactories.push({ name: "mcp", builtin: true, replaceable: true, factory: PiCodingAgent.createMcpExtension() });
+    extensionFactories.push({ name: "mcp", builtin: true, replaceable: true,
+      factory: configurationMcpFactory(PiCodingAgent.createMcpExtension(), configCwd, settingsManager) });
   }
 
-  const settingsManager = SettingsManager.create(configCwd, agentDir);
+  for (const path of extensionsSpec?.paths ?? []) {
+    if (deniedProjectResource(path)) {
+      throw new Error(`Project extension source "${path}" requested by agent "${type}" is not trusted.`);
+    }
+  }
   let additionalExtensionPaths = extensionsSpec?.paths.length ? extensionsSpec.paths : undefined;
   let settingsBeforeLoad: string | undefined;
   // Pi 0.99 resolves replacement conflicts BEFORE extensionsOverride. A rogue
   // discovered extension can register /mcp, replace builtin:mcp, and only then
   // get filtered out by our allowlist. Resolve configured resources through the
   // public package API first and feed only the selected paths into a loader with
-  // discovery off. Older Pi hosts have no replaceable built-ins; keep their
-  // existing post-load filter instead of relying on new host behavior.
+  // discovery off. Always preselect, even under default inheritance: a
+  // pi-background factory can schedule model wakes beyond session.prompt(),
+  // after the manager has completed the record and cleaned its worktree.
   const builtinNames = extensionFactories.filter((factory) => typeof factory !== "function" && factory.builtin)
     .map((factory) => factory.name);
-  const prefilter = !noExtensions && (!loadAll || hasExcludes) && builtinNames.length > 0;
+  const prefilter = !noExtensions;
   if (prefilter) {
     await settingsManager.reload();
     throwIfAborted(options.signal);
@@ -1211,26 +1249,54 @@ export async function runAgent(
     // state or replace its source-resolution rules with path heuristics.
     const configured = await packages.resolve();
     throwIfAborted(options.signal);
-    const explicit = await packages.resolveExtensionSources(extensionsSpec?.paths ?? [], { temporary: true });
-    throwIfAborted(options.signal);
+    // Validate each source before cross-source dedup discards valid alias metadata.
+    const explicitSources = new Map<string, ResolvedResource[]>();
     for (const source of extensionsSpec?.paths ?? []) {
-      if (!existsSync(source) || !explicit.extensions.some((resource) => resource.enabled && resource.metadata.source === source)) {
+      const resolved = await packages.resolveExtensionSources([source], { temporary: true });
+      throwIfAborted(options.signal);
+      const enabled = resolved.extensions.filter(resource => resource.enabled);
+      if (!existsSync(source) || enabled.length === 0) {
         throw new Error(`Extension source "${source}" requested by agent "${type}" was not found or has no enabled extensions.`);
       }
+      explicitSources.set(source, enabled);
     }
+    const explicitResources = [...explicitSources.values()].flat();
     settingsBeforeLoad = JSON.stringify([settingsManager.getGlobalSettings(), settingsManager.getProjectSettings()]);
-    const enabledConfigured = configured.extensions.filter((resource) => resource.enabled).map((resource) => resource.path);
-    const enabledExplicit = explicit.extensions.filter((resource) => resource.enabled);
-    discoveredNames = new Set([...enabledConfigured, ...enabledExplicit.map((resource) => resource.path)].flatMap(extensionCanonicalNames));
+    const enabledConfigured = configured.extensions.filter((resource) => resource.enabled && !deniedProjectResource(resource.path));
+    const enabledExplicit = explicitResources;
+    for (const resource of enabledExplicit) {
+      if (deniedProjectResource(resource.path)) {
+        throw new Error(`Project extension "${resource.path}" requested by agent "${type}" is not trusted.`);
+      }
+    }
+    const resolved = await resolveExtensionResourceNames(
+      [...configured.extensions.filter(resource => !deniedProjectResource(resource.path)), ...enabledExplicit],
+      packages, extensionCanonicalNames,
+    );
+    throwIfAborted(options.signal);
+    resolvedNames = resolved.names;
+    discoveredNames = new Set([...enabledConfigured, ...enabledExplicit]
+      .flatMap(resource => resolvedNames.get(resource.path) ?? []));
+    let warnedBackground = false;
+    const admitChildExtension = (resource: ResolvedResource, intentional: boolean): boolean => {
+      if (!resolvedNames.get(resource.path)?.includes("pi-background")) return true;
+      const reason = `pi-background cannot load in agent "${type}": managed child sessions do not support asynchronous model wakes after completion/worktree cleanup`;
+      if (intentional) throw new Error(`${reason} (requested extension "${resource.path}").`);
+      if (!warnedBackground) {
+        warnedBackground = true;
+        options.onToolActivity?.({ type: "end", toolName: `extension-error:${reason}; excluded from inherited resources` });
+      }
+      return false;
+    };
     const selectedExplicit = enabledExplicit.filter((resource) =>
-      !extensionCanonicalNames(resource.path).some((name) => excludeNames.has(name)));
-    const explicitPaths = new Set(selectedExplicit.map((resource) => resource.path));
+      !resolvedNames.get(resource.path)?.some((name) => excludeNames.has(name)) && admitChildExtension(resource, true));
+    const explicitPaths = new Set(selectedExplicit.map((resource) => extensionResourceIdentity(resource.path)));
     // For priority, use the package's declared name rather than a generic entry
     // alias like "src"; unrelated packages often have src/index.ts too.
     const explicitNames = new Set(selectedExplicit.map((resource) =>
-      extensionPackageName(resource.path) ?? extensionCanonicalName(resource.path)));
-    for (const source of extensionsSpec?.paths ?? []) {
-      if (selectedExplicit.some((resource) => resource.metadata.source === source)) {
+      resolved.packageName(resource) ?? extensionCanonicalName(resource.path)));
+    for (const [source, resources] of explicitSources) {
+      if (resources.some(resource => explicitPaths.has(extensionResourceIdentity(resource.path)))) {
         resolvedExplicitNames.add(extensionCanonicalName(source));
       }
     }
@@ -1238,15 +1304,23 @@ export async function runAgent(
       // The loader normally loads temporary paths before discovered paths. Keep
       // that priority (including for directory/package paths with many entries).
       ...selectedExplicit.map((resource) => resource.path),
-      ...enabledConfigured.filter((path) => {
-        const names = extensionCanonicalNames(path);
+      ...enabledConfigured.filter((resource) => {
+        const names = resolvedNames.get(resource.path) ?? extensionCanonicalNames(resource.path);
         if (names.some((name) => excludeNames.has(name))) return false;
-        if (explicitPaths.has(path) || explicitNames.has(extensionPackageName(path) ?? extensionCanonicalName(path))) return false;
-        return loadAll || names.some((name) => bareNames.has(name));
-      }),
+        if (explicitPaths.has(extensionResourceIdentity(resource.path)) ||
+            explicitNames.has(resolved.packageName(resource) ?? extensionCanonicalName(resource.path))) return false;
+        const intentional = names.some((name) => bareNames.has(name));
+        return (loadAll || intentional) && admitChildExtension(resource, intentional);
+      }).map((resource) => resource.path),
     ];
-    prefilteredExtensionPaths = new Set(selectedPaths);
-    additionalExtensionPaths = [...prefilteredExtensionPaths];
+    const seen = new Set<string>();
+    additionalExtensionPaths = selectedPaths.filter(path => {
+      const identity = extensionResourceIdentity(path);
+      if (seen.has(identity)) return false;
+      seen.add(identity);
+      return true;
+    });
+    prefilteredExtensionPaths = new Set(additionalExtensionPaths);
   }
 
   const loader = new DefaultResourceLoader({
@@ -1258,7 +1332,11 @@ export async function runAgent(
     extensionsOverride,
     extensionFactories,
     noSkills,
-    skillsOverride: noSkills ? () => ({ skills: [], diagnostics: [] }) : undefined,
+    skillsOverride: noSkills
+      ? () => ({ skills: [], diagnostics: [] })
+      : !projectTrusted
+        ? (base) => ({ ...base, skills: base.skills.filter((skill) => !deniedProjectResource(skill.filePath)) })
+        : undefined,
     noPromptTemplates: true,
     noThemes: true,
     noContextFiles: true,
@@ -1272,7 +1350,12 @@ export async function runAgent(
       throw new Error(`Pi extension settings changed while loading agent "${type}"; retry with the current settings.`);
     }
     const loadedPaths = new Set(loader.getExtensions().extensions.map((extension) => extension.path));
-    for (const path of prefilteredExtensionPaths) {
+    // Preserve ordinary unrestricted inheritance: Pi may drop a faulty factory
+    // or let a replaceable built-in yield to another discovered extension. The
+    // original restrictive preselection still requires every selected path.
+    const validateSelected = !loadAll || hasExcludes || !projectTrusted ||
+      bareNames.size > 0 || (extensionsSpec?.paths.length ?? 0) > 0;
+    for (const path of validateSelected ? prefilteredExtensionPaths : []) {
       if (!loadedPaths.has(path)) {
         const diagnostic = loader.getExtensions().errors.find((error) => error.path === path);
         throw new Error(`Selected extension "${path}" was not loaded for agent "${type}"${diagnostic ? `: ${diagnostic.error}` : " (possibly replaced by another extension)"}.`);
@@ -1305,7 +1388,7 @@ export async function runAgent(
   // already raised above instead of silently losing a requested capability.
   // Two remaining misconfigurations to catch:
   //   - `extensions: [foo]` but no extension named foo was discovered (typo;
-  //     on older hosts path entries also fold their canonical name into
+  //     without preselection path entries also fold their canonical name into
   //     `keepNames`, so a failed path load is warned here).
   //   - `tools: ext:foo` but foo isn't in the loaded set (because `extensions:`
   //     didn't include it). Since v0.9, `ext:` no longer pulls extensions in;
@@ -1333,7 +1416,7 @@ export async function runAgent(
   }
   if (keepNames.size > 0 || extNames.size > 0) {
     const survivingNames = new Set(
-      loader.getExtensions().extensions.flatMap((e) => extensionCanonicalNames(e.path)),
+      loader.getExtensions().extensions.flatMap((e) => resolvedNames.get(e.path) ?? extensionCanonicalNames(e.path)),
     );
     for (const name of keepNames) {
       // A directory/package source can resolve to entries with different
@@ -1372,7 +1455,8 @@ export async function runAgent(
     const { configuredModel, source } = agentTierSnapshot;
     const scopeVerdict = checkModelScope({
       model,
-      cwd: ctx.cwd,
+      cwd: projectTrust.cwd,
+      authority: projectTrust,
       modelRegistry: ctx.modelRegistry,
       // scopeModels polices a tier chosen per dispatch, by the host model or by
       // a workflow script alike; a tier from the agent file or the configured
@@ -1411,6 +1495,7 @@ export async function runAgent(
         maxSubagentDepth: effectiveMaxDepth,
         allowedSubagents: agentConfig.allowedSubagents,
         configCwd,
+        projectTrust,
       })
     : [];
   // `contact_supervisor` is injected separately from the nested tools and under
@@ -1420,8 +1505,9 @@ export async function runAgent(
   // only a human to answer, which `hasUI` decides. Isolation still suppresses
   // it: an `isolated: true` agent is defined as built-in tools only.
   const supervisorTools =
-    ctx.hasUI && !isolated && options.supervisorQuestions !== false
+    (ctx.hasUI || options.supervisorQuestions === "parent") && !isolated && options.supervisorQuestions !== false
       ? createSupervisorTool({
+          ...(options.supervisorQuestions === "parent" ? { parentQuestion: options.parentQuestion } : {}),
           // Use the canonical agent type, not display_name: the question must
           // identify the actual subagent that requested the decision.
           agentLabel: agentConfig?.name ?? type,
@@ -1562,7 +1648,7 @@ export async function runAgent(
     throwIfAborted(options.signal);
 
   const inScope = noExtensions ? undefined : extensionToolNamesInScope(session, {
-    loader, toolNames, disallowedSet, extNames, narrowing, nestedToolNames,
+    loader, toolNames, disallowedSet, extNames, narrowing, nestedToolNames, resolvedNames,
   });
   checkToolCall = async (name, input, deadline) => {
     const run = async (): Promise<ToolCallEventResult | undefined> => {

package/src/agent-types.ts

@@ -302,11 +302,15 @@ export function getConfig(type: string): {
   excludeExtensions?: string[];
   skills: true | string[] | false;
   promptMode: "replace" | "append";
+  source?: AgentConfig["source"];
+  sourcePath?: string;
 } {
   const key = resolveKey(type);
   const config = key ? agents.get(key) : undefined;
   if (config && config.enabled !== false) {
     return {
+      source: config.source,
+      sourcePath: config.sourcePath,
       displayName: config.displayName ?? config.name,
       color: config.color,
       description: config.description,
@@ -322,6 +326,8 @@ export function getConfig(type: string): {
   const gp = agents.get("general-purpose");
   if (gp && gp.enabled !== false) {
     return {
+      source: gp.source,
+      sourcePath: gp.sourcePath,
       displayName: gp.displayName ?? gp.name,
       color: gp.color,
       description: gp.description,

package/src/custom-agents.ts

@@ -8,6 +8,7 @@ import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { isValidAgentTierKey } from "./agent-tiers.js";
 import { BUILTIN_TOOL_NAMES } from "./agent-types.js";
 import { DEFAULT_AGENTS } from "./default-agents.js";
+import { isProjectResource } from "./project-trust.js";
 import type { AgentConfig, MemoryScope } from "./types.js";
 import { sanitizeDisplayText } from "./ui/safe-text.js";
 
@@ -129,7 +130,8 @@ function createWarningSink(root: string): WarningSink {
   };
 }
 
-export function loadCustomAgents(cwd: string, strict = false): Map<string, AgentConfig> {
+/** Standalone callers retain discovery defaults; runtime callers must pass captured trust. */
+export function loadCustomAgents(cwd: string, strict = false, projectTrusted = true, deniedRoots: readonly string[] = []): Map<string, AgentConfig> {
   const discoveryRoot = normalizeDiscoveryRoot(cwd);
   const warningRoot = warningIdentity(cwd);
   const globalDir = join(getAgentDir(), "agents");
@@ -140,9 +142,12 @@ export function loadCustomAgents(cwd: string, strict = false): Map<string, Agent
   const agents = new Map<string, AgentConfig>();
   const priorities = new Map<string, number>();
   const skipped: SkippedAgent[] = [];
-  loadFromDir(globalDir, agents, "global", strict, warn, 0, priorities, skipped);            // lowest priority
-  loadFromDir(workspaceProjectDir, agents, "project", strict, warn, 1, priorities, skipped); // shared workspace
-  loadFromDir(projectDir, agents, "project", strict, warn, 2, priorities, skipped);          // highest priority (overwrites)
+  const denied = projectTrusted ? deniedRoots : [...deniedRoots, discoveryRoot];
+  loadFromDir(globalDir, agents, "global", strict, warn, 0, priorities, skipped, denied);
+  if (projectTrusted) {
+    loadFromDir(workspaceProjectDir, agents, "project", strict, warn, 1, priorities, skipped, denied);
+    loadFromDir(projectDir, agents, "project", strict, warn, 2, priorities, skipped, denied);
+  }
 
   // Only report a fallback when the skipped file was higher priority than the
   // definition that survived the complete discovery pass. A valid higher
@@ -164,7 +169,9 @@ function loadFromDir(
   priority: number,
   priorities: Map<string, number>,
   skipped: SkippedAgent[],
+  deniedRoots: readonly string[],
 ): void {
+  if (deniedRoots.some(root => isProjectResource(dir, root))) return;
   if (!existsSync(dir)) return;
 
   let files: string[];
@@ -184,6 +191,7 @@ function loadFromDir(
     const filenameType = basename(file, ".md");
 
     const path = join(dir, file);
+    if (deniedRoots.some(root => isProjectResource(path, root))) continue;
 
     const parsed = readAgentFile(path, strict, warn);
     if (!parsed) {

package/src/enabled-models.ts

@@ -3,7 +3,7 @@
  * + project-local `<cwd>/.pi/settings.json`, project wins) and resolves
  * entries to concrete `provider/modelId` keys for scope validation.
  *
- * **Project overrides global**, mirroring pi's own `SettingsManager`
+ * **Admitted project settings override global**, mirroring pi's own `SettingsManager`
  * deep-merge behavior and matching the precedence we use for our own
  * `subagents.json` settings (see `src/settings.ts:loadSettings`). If
  * project file has `enabledModels` set, it wholly replaces global's
@@ -25,6 +25,7 @@ import { join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { minimatch } from "minimatch";
 import type { ModelEntry } from "./model-resolver.js";
+import { isProjectResource, type ProjectTrust } from "./project-trust.js";
 
 /** Minimal registry shape — only the methods resolveEnabledModels actually calls. */
 export interface ModelRegistryRef {
@@ -61,11 +62,17 @@ function readField(path: string): string[] | undefined {
  * Read enabledModels from pi's settings — project-local overrides global.
  * Mirrors pi's SettingsManager deep-merge for the `enabledModels` field
  * (and matches our own loadSettings precedence in src/settings.ts).
- * Returns undefined when neither file has the field.
+ * Runtime callers pass captured configuration authority to exclude denied
+ * project sources and global aliases; standalone callers keep project defaults.
+ * Returns undefined when neither admitted file has the field.
  */
-export function readEnabledModels(cwd: string): string[] | undefined {
-  const [project, global] = settingsPaths(cwd);
-  return readField(project) ?? readField(global);
+export function readEnabledModels(cwd: string, authority?: ProjectTrust): string[] | undefined {
+  const [project, global] = settingsPaths(authority?.cwd ?? cwd);
+  // Standalone readers retain project precedence. Runtime readers must pass
+  // captured configuration authority, never infer it from execution cwd.
+  const denied = (path: string): boolean => authority?.deniedRoots.some(root => isProjectResource(path, root)) ?? false;
+  return (authority?.trusted !== false && !denied(project) ? readField(project) : undefined)
+    ?? (!denied(global) ? readField(global) : undefined);
 }
 
 /**

package/src/extension-resource-names.ts

@@ -0,0 +1,105 @@
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import { basename, dirname, join, resolve } from "node:path";
+import type { DefaultPackageManager, ResolvedResource } from "@earendil-works/pi-coding-agent";
+
+/** Built-in identifiers and missing resources retain their original identity. */
+export function extensionResourceIdentity(path: string): string {
+  if (path.startsWith("builtin:") || path.startsWith("<")) return path;
+  try { return realpathSync(path); } catch { return resolve(path); }
+}
+
+function packageShortName(root: string): string | undefined {
+  try {
+    const name: unknown = JSON.parse(readFileSync(join(root, "package.json"), "utf-8")).name;
+    return typeof name === "string" ? name.split("/").pop()?.toLowerCase() : undefined;
+  } catch { return undefined; }
+}
+
+function isDirectory(path: string): boolean {
+  try { return statSync(path).isDirectory(); } catch { return false; }
+}
+
+/** Find candidate roots only; the public resolver decides which own the entry. */
+function candidatePackageRoots(entry: string): string[] {
+  if (entry.startsWith("builtin:") || entry.startsWith("<")) return [];
+  const roots: string[] = [];
+  let dir = isDirectory(entry) ? entry : dirname(entry);
+  for (;;) {
+    if (basename(dir) === "node_modules") break;
+    if (existsSync(join(dir, "package.json"))) roots.push(dir);
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return roots;
+}
+
+/** Only Node's supported module entry, never factory evaluation or sibling scanning. */
+function resourceIdentities(path: string): string[] {
+  const identity = extensionResourceIdentity(path);
+  if (!isDirectory(identity)) return [identity];
+  try {
+    return [identity, extensionResourceIdentity(createRequire(join(identity, "package.json")).resolve(identity))];
+  } catch { return [identity]; }
+}
+
+/** Union aliases for admission/exclusion; keep declared ownership separate for priority. */
+export async function resolveExtensionResourceNames(
+  resources: ResolvedResource[],
+  packages: DefaultPackageManager,
+  pathNames: (path: string) => string[],
+): Promise<{ names: Map<string, string[]>; packageName: (resource: ResolvedResource) => string | undefined }> {
+  const entries = new Map<string, { paths: Set<string>; names: Set<string>; owners: Set<string> }>();
+  for (const resource of resources) {
+    const identity = extensionResourceIdentity(resource.path);
+    let entry = entries.get(identity);
+    if (!entry) {
+      entry = { paths: new Set([identity]), names: new Set(), owners: new Set() };
+      entries.set(identity, entry);
+    }
+    entry.paths.add(resource.path);
+    if (resource.metadata.packageRoot) {
+      const name = packageShortName(resource.metadata.packageRoot);
+      if (name) entry.owners.add(name);
+    }
+  }
+  const probes = new Map<string, Set<string>>();
+  const canonicalOwners = new Map<string, string>();
+  for (const [identity, entry] of entries) {
+    for (const path of entry.paths) {
+      for (const name of pathNames(path)) entry.names.add(name);
+    }
+    // A lexical file alias must not conceal the canonical declaring package.
+    // A nearer non-owning manifest must not stop ancestor discovery either.
+    for (const root of candidatePackageRoots(identity)) {
+      let declared = probes.get(root);
+      if (!declared) {
+        const resolved = await packages.resolveExtensionSources([root], { temporary: true });
+        // Enabled is a selection preference, not evidence of file ownership.
+        declared = new Set(resolved.extensions.flatMap(resource => resourceIdentities(resource.path)));
+        probes.set(root, declared);
+      }
+      if (declared.has(identity)) {
+        const name = packageShortName(root);
+        if (name) {
+          entry.owners.add(name);
+          if (!canonicalOwners.has(identity)) canonicalOwners.set(identity, name);
+        }
+      }
+    }
+    for (const name of entry.owners) entry.names.add(name);
+  }
+  const names = new Map<string, string[]>();
+  for (const entry of entries.values()) {
+    for (const path of entry.paths) names.set(path, [...entry.names]);
+  }
+  return {
+    names,
+    // Identical paths can have different declaring metadata. Never key this by
+    // path alone. Direct entries use nearest canonical declaring ownership.
+    packageName: resource => resource.metadata.packageRoot
+      ? packageShortName(resource.metadata.packageRoot)
+      : canonicalOwners.get(extensionResourceIdentity(resource.path)),
+  };
+}