@sjawhar/pi-legion-envoy 7.6.0 → 7.6.1

package/dist/envoy.js

@@ -35637,10 +35637,10 @@ function btwPrompt(question) {
   ].join(`
 `);
 }
-function sideTurn(pi, context) {
+function sideTurn(context) {
   const runEphemeralTurn = context?.runEphemeralTurn;
   if (runEphemeralTurn === undefined)
-    return pi.askEphemeral;
+    return;
   return ({ prompt, signal }) => runEphemeralTurn({ promptText: btwPrompt(prompt), signal });
 }
 
@@ -36051,7 +36051,7 @@ function envoyExtension(pi) {
         } else if (rendered.malformedDelivery === true) {
           console.warn("[envoy] dropping malformed Dispatch targeted delivery without a reply address");
         } else if (rendered.delivery?.mode === "btw") {
-          const answer = sideTurn(pi, activeSessionContext);
+          const answer = sideTurn(activeSessionContext);
           if (shuttingDown) {
             await refuse(rendered.delivery, "This OMP session is shutting down");
           } else if (answer === undefined) {
@@ -36248,7 +36248,7 @@ function envoyExtension(pi) {
     ],
     port: 0,
     title: activeSessionContext?.sessionManager.getSessionName?.() ?? "",
-    capabilities: sideTurn(pi, activeSessionContext) === undefined ? CAPABILITIES_WITHOUT_BTW : DELIVERY_CAPABILITIES,
+    capabilities: sideTurn(activeSessionContext) === undefined ? CAPABILITIES_WITHOUT_BTW : DELIVERY_CAPABILITIES,
     driving: false,
     selfSubscribed: true
   });
@@ -36645,7 +36645,7 @@ function envoyExtension(pi) {
   registerEnvoyWhoamiCommand(pi, replyAddress);
   pi.on("before_agent_start", async (event, context) => {
     const id = context.sessionManager.getSessionId();
-    if (id === "" || event.prompt.trim() === "" || !context.hasUI || sideTurn(pi, context) === undefined || legionManaged(id)) {
+    if (id === "" || event.prompt.trim() === "" || !context.hasUI || sideTurn(context) === undefined || legionManaged(id)) {
       return;
     }
     if (await isSubagent(context))
@@ -36677,7 +36677,7 @@ function envoyExtension(pi) {
     const id = context.sessionManager.getSessionId();
     endInjectedUserTurns(sessionID);
     const lastReply = event.messages?.findLast((message) => message.role === "assistant");
-    const ask = sideTurn(pi, context);
+    const ask = sideTurn(context);
     if (event.willContinue === true || lastReply?.stopReason !== "stop" || !context.hasUI || id === "" || ask === undefined || !checkOwed(id)) {
       return;
     }
@@ -36725,20 +36725,14 @@ function envoyExtension(pi) {
       return;
     const abort = new AbortController;
     askCheckAbort = abort;
-    let answered;
-    try {
-      answered = ask({
-        prompt: ASK_SELF_CHECK_PROMPT(open.snapshot.asks),
-        signal: abort.signal
-      }).then((reply) => reply.replyText, (error48) => {
-        if (!abort.signal.aborted)
-          logSelfCheckFailure(id, error48);
-        return;
-      });
-    } catch (error48) {
-      logSelfCheckFailure(id, error48);
-      answered = Promise.resolve(undefined);
-    }
+    const answered = ask({
+      prompt: ASK_SELF_CHECK_PROMPT(open.snapshot.asks),
+      signal: abort.signal
+    }).then((reply) => reply.replyText, (error48) => {
+      if (!abort.signal.aborted)
+        logSelfCheckFailure(id, error48);
+      return;
+    });
     const expiry = Promise.withResolvers();
     const expire = setTimeout(() => {
       const timedOut = new Error(`self-check timed out after ${selfCheckTimeoutMs} ms`);
@@ -36865,7 +36859,7 @@ Warnings: ${warnings.join("; ")}`, {
           const undelivered = source !== "" && result.holder === source && inSubagent;
           const published = result.holder === undefined ? `published ${result.envelope.event_id}` : `published ${result.envelope.event_id}; holder ${result.holder}`;
           return toolSuccess(undelivered ? `${published}
-Not delivered: that holder is the session this subagent sends as, and the listener drops a message whose source session is its recipient, so the agent that spawned you did not receive it. Reach it over hub instead.` : published, {
+Not delivered: that holder is the session this subagent sends as, and the listener drops a message whose source session is its recipient, so the agent that spawned you did not receive it. Reach it with a write to its agent:// address instead.` : published, {
             event_id: result.envelope.event_id,
             topic,
             ...result.holder === undefined ? {} : { holder: result.holder },
@@ -36886,7 +36880,7 @@ Not delivered: that holder is the session this subagent sends as, and the listen
           const address = await replyAddress(context, "", inSubagent);
           const subagent = inSubagent ? {
             session_id: context.sessionManager.getSessionId(),
-            note: address === "" ? "This session is a task subagent and registers no Envoy session of its own, and this process records no top-level session its transcript traces back to, so it has no reply address at all: say who you are in the message body, and reach the agent that spawned you over hub." : "This session is a task subagent and registers no Envoy session of its own; a reply to session_id reaches the agent that spawned it, which relays over hub. Your own envoy_publish never reaches that agent \u2014 use hub for that hop."
+            note: address === "" ? "This session is a task subagent and registers no Envoy session of its own, and this process records no top-level session its transcript traces back to, so it has no reply address at all: say who you are in the message body, and reach the agent that spawned you with a write to its agent:// address." : "This session is a task subagent and registers no Envoy session of its own; a reply to session_id reaches the agent that spawned it, which relays it with a write to your agent:// address. Your own envoy_publish never reaches that agent \u2014 use a write to its agent:// address for that hop."
           } : undefined;
           return toolSuccess(JSON.stringify({
             session_id: address,

package/dist/legion.js

@@ -17524,7 +17524,7 @@ function endInjectedUserTurns(sessionID) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "7.6.0",
+  version: "7.6.1",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -18936,6 +18936,29 @@ function refusedCommand(command, commands, rule) {
   }
   return;
 }
+var NON_FILE_WRITE_URL = /^(xd|agent|proc):\/\//iu;
+var READ_HEADER_TAG = /#[0-9A-Fa-f]{4}$/u;
+var PREFIXED_CONFLICT_URL = /^(.+):(conflict:\/\/.+)$/u;
+function unwrapReadHeader(path6) {
+  const trimmed = path6.trimEnd();
+  if (trimmed.length < 2 || !trimmed.startsWith("[") || !trimmed.endsWith("]"))
+    return path6;
+  const inner = trimmed.slice(1, -1);
+  const tag = READ_HEADER_TAG.exec(inner);
+  const target = tag === null ? inner : inner.slice(0, tag.index);
+  if (target.length === 0 || tag === null && target.includes("#"))
+    return path6;
+  return target;
+}
+function writeTarget(path6) {
+  const unwrapped = unwrapReadHeader(path6);
+  return PREFIXED_CONFLICT_URL.exec(unwrapped)?.[2] ?? unwrapped;
+}
+function nonFileWriteScheme(toolCall) {
+  if (toolCall.toolName !== "write" || typeof toolCall.input.path !== "string")
+    return;
+  return NON_FILE_WRITE_URL.exec(writeTarget(toolCall.input.path))?.[1]?.toLowerCase();
+}
 function paneRuleRefusal(toolCall, rules) {
   if (rules.length === 0)
     return;
@@ -18954,8 +18977,8 @@ function paneRuleRefusal(toolCall, rules) {
   let text;
   if (toolName === "eval" && typeof input.code === "string")
     text = input.code;
-  else if (toolName === "hub") {
-    text = [input.application, ...Array.isArray(input.args) ? input.args : [], input.text].filter((part) => typeof part === "string").join(" ");
+  else if (nonFileWriteScheme(toolCall) === "proc" && typeof input.content === "string") {
+    text = input.content;
   } else
     return;
   for (const rule of rules) {
@@ -18972,10 +18995,6 @@ var CODE_TOOL_REFUSAL = {
   reviewer: "the reviewer edits nothing except the final .legion/ cleanup commit via bash",
   merger: "the merger only verifies and reports"
 };
-var TOOL_DEVICE_URL = /^xd:\/\//iu;
-function isToolDeviceInvocation(toolCall) {
-  return toolCall.toolName === "write" && typeof toolCall.input.path === "string" && TOOL_DEVICE_URL.test(toolCall.input.path);
-}
 function legionExtension(pi) {
   const instance = randomUUID2().slice(0, 8);
   logger2.debug("extension instance loaded", { extension: import.meta.url, instance });
@@ -19056,7 +19075,7 @@ function legionExtension(pi) {
     const active = claimSession.capability(sessionID);
     const codeToolRefusal = active === undefined ? undefined : CODE_TOOL_REFUSAL[active.role];
     const mutatesCode = CODE_MUTATION_TOOLS.includes(toolCall.toolName) || active?.role === "architect" && toolCall.toolName === "bash" && !isSingleLegionCommand(toolCall.input.command);
-    if (codeToolRefusal !== undefined && mutatesCode && !isToolDeviceInvocation(toolCall)) {
+    if (codeToolRefusal !== undefined && mutatesCode && nonFileWriteScheme(toolCall) === undefined) {
       return { block: true, reason: codeToolRefusal };
     }
     if (!needsGrant(toolCall))

package/dist/skills/dispatch/references/messages.md

@@ -25,11 +25,11 @@ reply. A human may reply to your message in turn — the follow-up arrives as a
 `in_reply_to` names your message and whose `reply_body` quotes it; answer it the same way,
 `dispatch_message({ issue, in_reply_to: "<their reply id>", body })`, so the exchange reads as one
 thread. `dispatch_message` itself never carries `target` or `delivery`: agent-to-agent traffic goes
-through Envoy or the hub. A bearer that targets over HTTP names its own session in `actor`
-(`{kind: "session", id}`), and the card shows that session as the author. `GET /api/v1/agents`
-(any authenticated caller) lists live sessions with their capabilities (`aside`, `btw`, `steer`);
-target only a session that advertises the mode you want. Sending to a session with no issue
-(`POST /api/v1/agents/{session_id}/messages`) stays human-only.
+through Envoy or Oh My Pi's `agent://` messages. A bearer that targets over HTTP names its own
+session in `actor` (`{kind: "session", id}`), and the card shows that session as the author.
+`GET /api/v1/agents` (any authenticated caller) lists live sessions with their capabilities
+(`aside`, `btw`, `steer`); target only a session that advertises the mode you want. Sending to a
+session with no issue (`POST /api/v1/agents/{session_id}/messages`) stays human-only.
 
 ## Answering a direct message
 

package/dist/skills/envoy/SKILL.md

@@ -122,8 +122,9 @@ envoy_send(
 
 `envoy_whoami`'s `session_id` is the address a reply to you reaches. Inside a `task` subagent it
 is the session that spawned you: a subagent registers no Envoy session of its own, so a peer
-answering it reaches that session, which relays to you over hub. The `subagent` field in that
-output carries your own host session id — it is not an address, so never hand it to a peer.
+answering it reaches that session, which relays to you with a `write` to your `agent://` address.
+The `subagent` field in that output carries your own host session id — it is not an address, so
+never hand it to a peer.
 
 `session_id` is empty when nothing can be reached: a process that took no Envoy identity, or a
 subagent whose spawning session this process can no longer place (it forked away, and other
@@ -134,8 +135,8 @@ would send your peers to an agent that never spawned you.
 Your own `envoy_publish` never reaches the agent that spawned you. The listener delivers nothing
 to the session a message names as its source, and inside a subagent that source is your parent,
 so a publish to a role it holds — or to any topic it subscribes to — is accepted and delivered to
-nobody. Use hub for that one hop. `envoy_send` to any other session, including a reply, is
-unaffected.
+nobody. Use a `write` to its `agent://` address for that one hop. `envoy_send` to any other
+session, including a reply, is unaffected.
 
 ### Delivery capabilities
 

package/dist/skills/legion-worker/SKILL.md

@@ -62,11 +62,11 @@ workflow table. You may still use ordinary `task` subagents for your own phase w
 is a Legion role.
 Escalate a product, scope, design, cross-phase, or lifecycle decision to the owning architect with
 `envoy_publish` to its role topic (`notifications.role.` followed by its encoded token, see
-above), carrying the verified facts and the decision needed. `hub` only reaches subagents
-inside your own process, not the architect's separate one. Never write a decision block into a
-spec yourself: the architect decides whether the human must answer it and writes the block, since
-a new version of an approved root spec closes the tree's design gate. A standalone to-do only a
-human can do is a `dispatch_ask`, and its replies return to your own session.
+above), carrying the verified facts and the decision needed. A `write` to `agent://` only reaches
+agents inside your own process, not the architect's separate one. Never write a decision block
+into a spec yourself: the architect decides whether the human must answer it and writes the block,
+since a new version of an approved root spec closes the tree's design gate. A standalone to-do
+only a human can do is a `dispatch_ask`, and its replies return to your own session.
 
 Because the same agent is always resumed for its phase, you may receive more than one
 assignment across your lifetime: once the daemon ends your phase it suspends you, and when a later
@@ -152,9 +152,10 @@ new work.
 clone, so they all share one operation log: `jj undo`, `jj abandon`, and
 `jj op restore|revert|abandon|undo` rewrite it for every tree at once. The extension refuses them in every
 phase-worker pane before they run — a `bash` command in any position of a pipeline or `&&`
-chain, with or without `-R`, judged on the whole argument list; `eval` code; and a `hub`
-process start — from your own tool calls and from any `task` subagent you spawn (it runs in
-your pane, against the same log), and a `bash` command whose quoted text merely mentions `jj`
+chain, with or without `-R`, judged on the whole argument list (a supervised service's start
+included); `eval` code; and stdin written to a service (a `write` to `proc://<id>`) — from your
+own tool calls and from any `task` subagent you spawn (it runs in your pane, against the same
+log), and a `bash` command whose quoted text merely mentions `jj`
 with one of those words (a heredoc, an echo, a commit message) is refused too: write such text
 with the `write` tool or say "operation-log rollback" instead. `jj restore <paths>`,
 `jj op log`, and `jj op show` stay allowed. Recover forward only: a new commit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "7.6.0",
+  "version": "7.6.1",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {