@staix/agent-hub 0.12.20 → 0.12.22

package/src/local/deny.ts

@@ -10,7 +10,6 @@ export const DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/arc
 export const DENY_NAMES = ["^\\.env", "\\.pem$", "\\.key$", "^id_rsa", "^id_ed25519", "^credentials(\\.|$)", "^auth\\.json$", "^\\.netrc$", "^\\.npmrc$", "^\\.pypirc$"];
 
 const hasSegment = (rel: string, seg: string) => `/${rel}/`.includes(`/${seg}/`);
-export { hasSegment };
 
 /** True when a path names something the worker must never read, write or report. `extra`: substrings from `local.deny`. */
 export function isDenied(path: string, extra: string[] = []): boolean {
@@ -27,6 +26,54 @@ const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
  */
 export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 
+/**
+ * The 16 code points HFS+ ignores in file names: U+200C-200F, U+202A-202E, U+206A-206F, U+FEFF (a probe found
+ * case-insensitive APFS ignores none). `mkdir .g<U+200D>it` on HFS+ makes what everything afterwards opens as
+ * `.git` (#270). One source for the seatbelt profile's folded patterns; the file tools' `foldSegment` removes
+ * every default-ignorable, a superset of these.
+ */
+export const HFS_IGNORABLE_POINTS = ["\u200C", "\u200D", "\u200E", "\u200F", "\u202A", "\u202B", "\u202C", "\u202D", "\u202E", "\u206A", "\u206B", "\u206C", "\u206D", "\u206E", "\u206F", "\uFEFF"];
+
+/**
+ * One HFS+-ignorable code point as a seatbelt regex atom. A group alternation, not a character class: the
+ * seatbelt regex engine is byte-oriented, so a quantifier after a multi-byte class member binds to its last
+ * byte and a class never matches the plain name (verified with the real sandbox-exec, #270).
+ */
+const HFS_IGNORABLE = `(${HFS_IGNORABLE_POINTS.join("|")})`;
+
+/** A regex source matching `name` with any number of HFS+-ignorable code points interleaved, at the ends included. */
+const hfsFoldedName = (name: string) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`;
+
+/**
+ * Seatbelt rules for the hub's and git's own names (#270). `.agenthub` is refused anywhere under the project root.
+ * `.git` is refused at any depth, the name itself included, so a planted repository cannot arrive by creation,
+ * rename, symlink or gitfile, and `config` and `hooks` directly under it are folded too; the cost is that
+ * `git init`, `git clone` and `git worktree add` no longer run inside the sandbox. `commondir` is refused at any
+ * depth below a `.git` and below each external git dir: that is where git keeps it for linked worktrees and
+ * submodules. An external git dir's `config`/`hooks` rules cover only its own children (plus the hooks
+ * directory's contents): at any depth they would deny refs named `config` or `hooks` in a worktree or submodule
+ * project (`git branch fix/config` fails on `.git/logs/refs/heads/fix/config`). Every pattern keeps its `^`
+ * anchor (an unanchored starred alternation does not match in this engine) and no folded literal contains the
+ * root: an SBPL string literal dies at 1024 bytes ("Error reading string"), which a long project path would trip.
+ */
+export function hubWriteRegexes(root: string, gitDirs: string[] = []): string[] {
+  const git = hfsFoldedName(".git");
+  const re = (s: string) => `(regex ${sbplString(s)})`;
+  const external = gitDirs.flatMap((d) => [
+    `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${re(`^.*/(${hfsFoldedName("config")}|${hfsFoldedName("hooks")})$`)})`,
+    `(subpath ${sbplString(`${d}/hooks`)})`,
+    `(require-all (subpath ${sbplString(d)}) ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
+  ]);
+  return [
+    `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
+    re(`^.*/${git}$`),
+    re(`^.*/${git}/${hfsFoldedName("config")}$`),
+    re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
+    `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
+    ...external,
+  ];
+}
+
 /**
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
  * anchored under the project root: a bare "private/" would otherwise match /private/var/... and deny the whole temp tree.

package/src/local/sandbox.ts

@@ -3,7 +3,7 @@ import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { realPath } from "../hub/project.ts";
-import { denyRegexes, sbplString } from "./deny.ts";
+import { denyRegexes, hubWriteRegexes, sbplString } from "./deny.ts";
 
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 export const OUTPUT_CAP = 20_000;
@@ -102,8 +102,11 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
     ...start,
     "(deny file-write*)",
     `(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
-    // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
-    `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
+    // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub. The .git and
+    // .agenthub patterns tolerate the code points HFS+ ignores in every segment, the .git name itself is refused
+    // at any depth (creation, rename, symlink, gitfile), and the external git dirs get folded hooks/config rules
+    // (#270). The cost: git init, clone and worktree add no longer run inside the sandbox.
+    `(deny file-write* ${hubWriteRegexes(root, gitDirs).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).

package/src/local/tools.ts

@@ -1,11 +1,21 @@
 import { lstatSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { realPath } from "../hub/project.ts";
-import { hasSegment, isDenied } from "./deny.ts";
+import { isHubWritePath } from "../hub/permission-mode.ts";
+import { isDenied } from "./deny.ts";
 import { OUTPUT_CAP, sandboxedExec } from "./sandbox.ts";
 
 export { isDenied };
 
+export type ToolApproval = boolean | "expired" | "aborted";
+export interface ApprovalProvenance { source: "person" | "automatic" | "expired" | "aborted"; answerEpoch: number; eligibleExpiry?: boolean; }
+export type ApprovalObserver = (provenance: ApprovalProvenance) => void;
+export const APPROVAL_EXPIRED_TEXT = "error: approval expired: no person answered; do not retry this call; hand the task off or stop";
+export class ApprovalWaitStop extends Error {}
+const approvalError = (picked: ToolApproval, denied: string): string | undefined => picked === true ? undefined
+  : picked === "expired" ? APPROVAL_EXPIRED_TEXT
+  : picked === "aborted" ? "error: approval withdrawn because the turn ended; no operation was executed" : denied;
+
 export interface ToolContext {
   cwd: string;
   /** Extra denylist entries from config: substrings of the project-relative path. */
@@ -16,15 +26,14 @@ export interface ToolContext {
   sandboxEnv?: Record<string, string>;
   /** Turn cancellation signal, including the execution-budget wall cap. */
   signal?: AbortSignal;
-  /** Ask the console. Resolves false on deny or timeout. */
-  permit: (title: string) => Promise<boolean>;
+  /** Only true permits an effect; expiry and abort remain distinct from a person's denial. */
+  permit: (title: string, tool?: string, signal?: AbortSignal, canonicalTarget?: string, observe?: ApprovalObserver) => Promise<ToolApproval>;
+  /** Trusted process status, independent of what its stdout says. */
+  onProcessExit?: (code: number | null) => void;
   /** Publish a message to other peers mid-turn. Returns a one-line receipt. */
   send: (text: string, to?: string[]) => string;
 }
 
-/** Not secret, but writing them changes what runs outside the worker's control. */
-const WRITE_DENY_SEGMENTS = [".git", ".agenthub"];
-
 const lexists = (p: string) => {
   try {
     lstatSync(p);
@@ -52,7 +61,9 @@ export function guardPath(ctx: Pick<ToolContext, "cwd" | "deny">, path: string,
   const rel = relative(root, real);
   if (rel.startsWith("..") || resolve(root, rel) !== real) throw new Error(`${path} is outside the project directory`);
   if (isDenied(rel, ctx.deny)) throw new Error(`${path} is on the secrets denylist`);
-  if (mode === "write" && WRITE_DENY_SEGMENTS.some((s) => hasSegment(rel, s))) throw new Error(`${path} is not writable by the local worker`);
+  // Not secret, but writing .git or .agenthub changes what runs outside the worker's control. Names are compared
+  // folded: a new `.GIT/config` is `.git/config` to a case-insensitive disk, and git then runs what it names.
+  if (mode === "write" && isHubWritePath(rel)) throw new Error(`${path} is not writable by the local worker`);
   return real;
 }
 
@@ -129,23 +140,29 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
       }
       case "write": {
         let file = guardPath(ctx, String(a.path), "write");
+        const approvedTarget = file;
         const content = String(a.content ?? "");
-        if (!(await ctx.permit(`write ${a.path} (${content.length} chars):\n${preview(content)}`))) return "error: the user did not approve this write";
+        const refused = approvalError(await ctx.permit(`write ${a.path} (${content.length} chars):\n${preview(content)}`, "write", ctx.signal, file), "error: the user did not approve this write");
+        if (refused) return refused;
         if (ctx.signal?.aborted) return "error: turn cancelled before write";
         file = guardPath(ctx, String(a.path), "write");
+        if (file !== approvedTarget) return "error: path target changed during approval; inspect before retrying";
         mkdirSync(dirname(file), { recursive: true });
         writeFileSync(file, content);
         return `wrote ${a.path}`;
       }
       case "edit": {
         let file = guardPath(ctx, String(a.path), "write");
+        const approvedTarget = file;
         let text = readFileSync(file, "utf8");
         let count = text.split(String(a.old)).length - 1;
         if (!a.old || count !== 1) return `error: \`old\` must match exactly once, it matched ${count} times`;
-        if (!(await ctx.permit(`edit ${a.path}:\n- ${preview(String(a.old), 600)}\n+ ${preview(String(a.new ?? ""), 600)}`))) return "error: the user did not approve this edit";
+        const refused = approvalError(await ctx.permit(`edit ${a.path}:\n- ${preview(String(a.old), 600)}\n+ ${preview(String(a.new ?? ""), 600)}`, "edit", ctx.signal, file), "error: the user did not approve this edit");
+        if (refused) return refused;
         if (ctx.signal?.aborted) return "error: turn cancelled before edit";
         // Approval can outlive another peer's edit or a path change. Apply only the approved fragment to current bytes.
         file = guardPath(ctx, String(a.path), "write");
+        if (file !== approvedTarget) return "error: path target changed during approval; inspect before retrying";
         text = readFileSync(file, "utf8");
         count = text.split(String(a.old)).length - 1;
         if (count !== 1) return `error: file changed during approval; \`old\` must match exactly once, it matched ${count} times`;
@@ -157,8 +174,10 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (!command.trim()) return "error: empty command";
         // The approver sees the whole command, not a prefix: what is hidden cannot be approved.
         if (command.length > 4000) return "error: command longer than 4000 characters; put it in a script file with write, then run that";
-        if (!(await ctx.permit(`bash: ${command}`))) return "error: the user did not approve this command";
+        const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal), "error: the user did not approve this command");
+        if (refused) return refused;
         const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}), ...(ctx.signal ? { signal: ctx.signal } : {}) });
+        try { ctx.onProcessExit?.(res.code); } catch { /* optional status observer never changes a tool result */ }
         return `${res.output}\n(exit ${res.code})`;
       }
       case "git": {
@@ -167,9 +186,13 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (!GIT_READ.has(sub) && !GIT_WRITE.has(sub)) return `error: git ${sub} is not available to the local worker`;
         const problem = gitArgsProblem(args, ctx.deny);
         if (problem) return `error: git ${sub}: ${problem}`;
-        if (GIT_WRITE.has(sub) && !(await ctx.permit(`git ${args.join(" ")}`))) return "error: the user did not approve this git command";
+        if (GIT_WRITE.has(sub)) {
+          const refused = approvalError(await ctx.permit(`git ${args.join(" ")}`, "git", ctx.signal), "error: the user did not approve this git command");
+          if (refused) return refused;
+        }
         // Sandboxed like bash: flags such as --output or an editor cannot write outside the project or reach the network.
         const res = await sandboxedExec(["git", "--no-pager", ...args], { cwd: ctx.cwd, profile: ctx.sandboxProfile, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}), ...(ctx.signal ? { signal: ctx.signal } : {}) });
+        try { ctx.onProcessExit?.(res.code); } catch { /* optional status observer never changes a tool result */ }
         return `${res.output}\n(exit ${res.code})`;
       }
       case "hub_send":

package/src/pi/extension.ts

@@ -19,6 +19,7 @@ let pollStopped = false;
 let toolSteps = 0;
 let lastActivity = 0;
 let usageSeq = 0;
+let shellSeq = 0;
 let forcedFailure = "";
 let turnGeneration = 0;
 let sessionId = "";
@@ -33,9 +34,13 @@ async function post(path: string, body: unknown): Promise<any> {
   if (!response.ok) throw new Error(`Pi bridge HTTP ${response.status}`);
   return response.json();
 }
-async function admitBudget(unit: BudgetUnit, idleUserBash = false): Promise<{ allowed: boolean; reservation?: string }> {
+async function admitBudget(unit: BudgetUnit, idleUserBash = false, generation = turnGeneration, callSessionId = sessionId): Promise<{ allowed: boolean; reservation?: string; reason?: string }> {
+  const current = () => generation === turnGeneration && callSessionId === sessionId;
+  const stale = () => ({ allowed: false, reason: "Pi tool lineage ended during admission; do not retry the old call" });
+  if (!current()) return stale();
   try {
-    const result = await post("/budget", { unit, generation: turnGeneration, ...(idleUserBash ? { idleUserBash: true } : {}) });
+    const result = await post("/budget", { unit, generation, ...(idleUserBash ? { idleUserBash: true } : {}) });
+    if (!current()) return stale();
     const decisions = Array.isArray(result?.decisions) ? result.decisions : [];
     const denied = decisions.find((item: any) => item?.allowed === false);
     if (!denied) return { allowed: true, ...(idleUserBash && typeof result?.reservation === "string" ? { reservation: result.reservation } : {}) };
@@ -43,12 +48,14 @@ async function admitBudget(unit: BudgetUnit, idleUserBash = false): Promise<{ al
     if (idleUserBash) return { allowed: false };
     forcedFailure = reason;
   } catch (error) {
+    if (!current()) return stale();
     if (idleUserBash) return { allowed: false };
     forcedFailure = `execution budget admission unavailable: ${(error as Error).message}`;
   }
-  try { await post("/event", { type: "agent_end", generation: turnGeneration, failed: true, error: forcedFailure }); } catch { /* abort remains authoritative when the bridge is unavailable */ }
-  runtimeCtx?.abort?.();
-  return { allowed: false };
+  const reason = forcedFailure;
+  try { await post("/event", { type: "agent_end", generation, failed: true, error: reason }); } catch { /* abort remains authoritative when the bridge is unavailable */ }
+  if (current()) runtimeCtx?.abort?.();
+  return { allowed: false, reason };
 }
 async function poll(pi: ExtensionAPI): Promise<void> {
   while (!pollStopped) {
@@ -77,10 +84,13 @@ async function poll(pi: ExtensionAPI): Promise<void> {
           shutdown?.();
         } else if (command.type === "abort_budget") {
           if (Number.isSafeInteger(command.generation) && command.generation === turnGeneration) {
-            const reason = "execution budget exhausted: elapsed_ms wall cap reached";
+            if (typeof runtimeCtx?.abort !== "function") throw new Error("Pi runtime cannot abort the current turn");
+            const generation = turnGeneration, callSessionId = sessionId;
+            const reason = command.cause === "approval" && typeof command.reason === "string" && command.reason
+              ? command.reason : "execution budget exhausted: elapsed_ms wall cap reached";
             forcedFailure = reason;
-            await post("/event", { type: "agent_end", generation: turnGeneration, failed: true, error: reason });
-            runtimeCtx?.abort?.();
+            await post("/event", { type: "agent_end", generation, failed: true, error: reason });
+            if (generation === turnGeneration && callSessionId === sessionId) runtimeCtx?.abort?.();
           }
         }
         await post("/ack", { id: command.id, ok: true });
@@ -107,7 +117,7 @@ export default function(pi: ExtensionAPI): void {
     const state = ctx.sessionManager.getHeader();
     sessionId = String(state?.id ?? "");
     try {
-      const claimed = await post("/event", { type: "session_start", ownerToken, pid: process.pid, signature: processSignature(process.pid), sessionId: state?.id, sessionFile: ctx.sessionManager.getSessionFile() });
+      const claimed = await post("/event", { type: "session_start", ownerToken, pid: process.pid, signature: processSignature(process.pid), sessionId: state?.id, sessionFile: ctx.sessionManager.getSessionFile(), approvalTurnAbort: typeof ctx.abort === "function" });
       if (claimed?.ok === false) { ctx.shutdown?.(); return; }
     } catch (error) { ctx.shutdown?.(); throw error; }
     if (!pollStarted) { pollStarted = true; void poll(pi); }
@@ -140,8 +150,10 @@ export default function(pi: ExtensionAPI): void {
   });
   pi.on("before_provider_request", async (_event: any, ctx: any) => {
     if (ctx.model?.provider && ctx.model.provider !== "agent-hub-local") { ctx.abort?.(); return undefined; }
-    try { if (!(await admitBudget("model_calls")).allowed) ctx.abort?.(); }
-    catch (error) { forcedFailure = `execution budget admission failed: ${(error as Error).message}`; ctx.abort?.(); }
+    const generation = turnGeneration, callSessionId = sessionId;
+    const current = () => generation === turnGeneration && callSessionId === sessionId;
+    try { if (!(await admitBudget("model_calls", false, generation, callSessionId)).allowed && current()) ctx.abort?.(); }
+    catch (error) { if (current()) { forcedFailure = `execution budget admission failed: ${(error as Error).message}`; ctx.abort?.(); } }
     return undefined;
   });
   pi.on("agent_settled", async (_event: any, ctx: any) => {
@@ -151,10 +163,11 @@ export default function(pi: ExtensionAPI): void {
     await post("/event", { type: "agent_settled", generation: turnGeneration, ...(text ? { text } : {}) });
   });
   pi.on("user_bash", async (event: any) => {
-    const admission = await admitBudget("tool_calls", true);
+    const generation = turnGeneration, callSessionId = sessionId;
+    const admission = await admitBudget("tool_calls", true, generation, callSessionId);
     if (!admission.allowed || !admission.reservation) return { cancel: true };
-    const result = await post("/tool", { name: "bash", args: { command: event.command, cwd: event.cwd }, toolCallId: `pi-shell-${Date.now()}`, purpose: "idle_user_bash", generation: turnGeneration, reservation: admission.reservation });
-    return { result: { output: String(result.text ?? result), exitCode: 0, cancelled: false, truncated: false } };
+    const result = await post("/tool", { name: "bash", args: { command: event.command, cwd: event.cwd }, toolCallId: `pi-shell-${Date.now()}-${++shellSeq}`, purpose: "idle_user_bash", generation, sessionId: callSessionId, reservation: admission.reservation });
+    return { result: { output: String(result.text ?? result), exitCode: typeof result.exitCode === "number" ? result.exitCode : undefined, cancelled: result.exitCode === null, truncated: false } };
   });
   // Managed sessions may only be handed over by PiPeer after it has fenced the
   // owner and verified the replacement identity. User /fork and /resume would
@@ -164,8 +177,11 @@ export default function(pi: ExtensionAPI): void {
   pi.on("session_shutdown", async () => { pollStopped = true; await post("/event", { type: "session_shutdown" }); });
   for (const raw of (() => { try { return JSON.parse(process.env.AGENTHUB_PI_TOOLS ?? "[]") as any[]; } catch { return []; } })()) {
     if (!raw || typeof raw.name !== "string" || !raw.parameters) continue;
-    pi.registerTool({ name: raw.name, label: raw.name, description: raw.description ?? raw.name, parameters: raw.parameters, async execute(toolCallId: string, params: unknown) {
-      if (!(await admitBudget("tool_calls")).allowed) return { content: [{ type: "text", text: `error: ${forcedFailure}` }], details: {}, isError: true };
+    pi.registerTool({ name: raw.name, label: raw.name, description: raw.description ?? raw.name, parameters: raw.parameters, async execute(toolCallId: string, params: unknown, signal?: AbortSignal) {
+      const generation = turnGeneration, callSessionId = sessionId;
+      if (signal?.aborted) return { content: [{ type: "text", text: "error: tool call cancelled before execution" }], details: {}, isError: true };
+      const admission = await admitBudget("tool_calls", false, generation, callSessionId);
+      if (!admission.allowed) return { content: [{ type: "text", text: `error: ${admission.reason ?? forcedFailure}` }], details: {}, isError: true };
       if (toolSteps++ >= maxSteps) {
         const reason = `Pi tool step limit ${maxSteps} reached`;
         forcedFailure = reason;
@@ -173,12 +189,19 @@ export default function(pi: ExtensionAPI): void {
         // event, so the adapter binds it while the turn still owns it. The counter already counts the
         // rejected pre-effect invocation (toolSteps++ above); its side effect never executes. The
         // reason text stays the failure record; the signal adds the validated counts.
-        try { await post("/event", { type: "ceiling", kind: PI_CEILING_KIND, unit: PI_CEILING_UNIT, count: toolSteps, limit: maxSteps, sessionId, generation: turnGeneration }); } catch { /* the agent_end failure below remains authoritative */ }
-        await post("/event", { type: "agent_end", generation: turnGeneration, failed: true, error: reason });
-        runtimeCtx?.abort?.();
+        try { await post("/event", { type: "ceiling", kind: PI_CEILING_KIND, unit: PI_CEILING_UNIT, count: toolSteps, limit: maxSteps, sessionId: callSessionId, generation }); } catch { /* the agent_end failure below remains authoritative */ }
+        await post("/event", { type: "agent_end", generation, failed: true, error: reason });
+        if (generation === turnGeneration && callSessionId === sessionId) runtimeCtx?.abort?.();
         return { content: [{ type: "text", text: `error: ${reason}` }], details: {}, isError: true };
       }
-      const result = await post("/tool", { name: raw.name, args: params, toolCallId });
+      const aborted = () => { void post("/event", { type: "tool_abort", sessionId: callSessionId, generation, toolCallId }).catch(() => undefined); };
+      if (signal?.aborted) return { content: [{ type: "text", text: "error: tool call cancelled before execution" }], details: {}, isError: true };
+      signal?.addEventListener("abort", aborted, { once: true });
+      let result: any;
+      try {
+        result = await post("/tool", { name: raw.name, args: params, toolCallId, sessionId: callSessionId, generation });
+        if (signal?.aborted) aborted();
+      } finally { signal?.removeEventListener("abort", aborted); }
       const text = String(result.text ?? result);
       // Pi 1.0.1 reads isError === true alone (#181). The bridge computes `failed` with the
       // managed-tool failure contract (toolResultFailed); the extension never re-parses the text.

package/src/pi/process-signature.ts

@@ -17,3 +17,26 @@ export function processSignature(pid: number): string | undefined {
     return text ? createHash("sha256").update(text).digest("hex") : undefined;
   } catch { return undefined; }
 }
+
+export type Liveness = "live" | "gone" | "unknown";
+
+/**
+ * #226: the one ownership check behind every recorded pid (hub manifest, registry claim, recovery runner, manager
+ * owner, launcher records). With a recorded `signature` the identity decides: equal is live, different is gone (the
+ * pid was reused, after a reboot for example, also by a process we may not signal), and a pid that exists but whose
+ * identity cannot be read is unknown. Without one (records written by 0.12.20 and older) the pid probe answers as it
+ * always did: live, gone on ESRCH, unknown otherwise. Unknown is never gone.
+ */
+// ponytail: `ps lstart` is derived from boot time plus the process's age; a wall-clock step on Linux can change it for a
+// live process, which then reads as gone (a second hub could take its claim). Upgrade path: a boot-id or start-tick
+// (Linux /proc/<pid>/stat field 22) component in the signature.
+export function processLiveness(pid: unknown, signature?: string | null, identity: (pid: number) => string | undefined = processSignature): Liveness {
+  if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) return "unknown";
+  if (signature) {
+    let current: string | undefined;
+    try { current = identity(pid); } catch { /* unreadable: the pid probe below decides between gone and unknown */ }
+    if (current) return current === signature ? "live" : "gone";
+  }
+  try { process.kill(pid, 0); return signature ? "unknown" : "live"; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === "ESRCH" ? "gone" : "unknown"; }
+}

package/src/pi/tool-receipts.ts

@@ -1,6 +1,23 @@
 import { chmodSync } from "node:fs";
 import { Database } from "bun:sqlite";
 import { createHash } from "node:crypto";
+import { PreEffectToolRefusal } from "../hub/tool-refusal.ts";
+
+export const PI_TOOL_RESULT_CAP = 100_000;
+/** Bound encoded text before wrapping it so escaping never cuts off trusted exit metadata. */
+export function packPiShellResult(text: string, exitCode: number | null): string {
+  const pack = (value: string) => JSON.stringify({ kind: "user-bash-result", text: value, exitCode });
+  const full = pack(text);
+  if (full.length <= PI_TOOL_RESULT_CAP) return full;
+  const suffix = "\n[output truncated]";
+  let low = 0, high = text.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (pack(text.slice(0, middle) + suffix).length <= PI_TOOL_RESULT_CAP) low = middle;
+    else high = middle - 1;
+  }
+  return pack(text.slice(0, low) + suffix);
+}
 
 /** Private, session-scoped dedupe. An interrupted effect is never automatically repeated. */
 export class PiToolReceipts {
@@ -31,10 +48,15 @@ export class PiToolReceipts {
     }
     const claim = this.db.query("INSERT OR IGNORE INTO pi_tool_receipts(session,call_id,fingerprint,state) VALUES(?,?,?,'pending')").run(session, callId, fingerprint);
     if (!claim.changes) return this.execute(session, callId, name, args, run);
-    const work = Promise.resolve().then(run).then((result) => {
-      const text = result.slice(0, 100_000);
+    const settle = (result: string): string => {
+      const text = result.slice(0, PI_TOOL_RESULT_CAP);
       this.db.query("UPDATE pi_tool_receipts SET state='done',result=? WHERE session=? AND call_id=?").run(text, session, callId);
       return text;
+    };
+    // Legacy pending rows have no refusal proof: neither the current board nor an error's text can settle them.
+    const work = Promise.resolve().then(run).then(settle, (error: unknown) => {
+      if (error instanceof PreEffectToolRefusal) return settle(`error: ${error.message}`);
+      throw error;
     }).catch(() => "error: tool outcome is uncertain; stop and reconcile it, do not repeat the effect")
       .finally(() => this.pending.delete(key));
     this.pending.set(key, work);