@staix/agent-hub 0.12.21 → 0.12.23

package/src/local/deny.ts

@@ -1,4 +1,4 @@
-import { basename, sep } from "node:path";
+import { basename, dirname, sep } from "node:path";
 
 /**
  * The one denylist. tools.ts checks paths against it, sandbox.ts turns it into seatbelt rules, capture.ts keeps
@@ -10,7 +10,6 @@ export const DENY_SEGMENTS = [".maru/secrets", ".agenthub/state", ".agenthub/arc
 export const DENY_NAMES = ["^\\.env", "\\.pem$", "\\.key$", "^id_rsa", "^id_ed25519", "^credentials(\\.|$)", "^auth\\.json$", "^\\.netrc$", "^\\.npmrc$", "^\\.pypirc$"];
 
 const hasSegment = (rel: string, seg: string) => `/${rel}/`.includes(`/${seg}/`);
-export { hasSegment };
 
 /** True when a path names something the worker must never read, write or report. `extra`: substrings from `local.deny`. */
 export function isDenied(path: string, extra: string[] = []): boolean {
@@ -27,6 +26,76 @@ const sbplEscape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
  */
 export const sbplString = (s: string) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 
+/**
+ * The 16 code points HFS+ ignores in file names: U+200C-200F, U+202A-202E, U+206A-206F, U+FEFF (a probe found
+ * case-insensitive APFS ignores none). `mkdir .g<U+200D>it` on HFS+ makes what everything afterwards opens as
+ * `.git` (#270). One source for the seatbelt profile's folded patterns; the file tools' `foldSegment` removes
+ * every default-ignorable, a superset of these.
+ */
+export const HFS_IGNORABLE_POINTS = ["\u200C", "\u200D", "\u200E", "\u200F", "\u202A", "\u202B", "\u202C", "\u202D", "\u202E", "\u206A", "\u206B", "\u206C", "\u206D", "\u206E", "\u206F", "\uFEFF"];
+
+/**
+ * One HFS+-ignorable code point as a seatbelt regex atom. A group alternation, not a character class: the
+ * seatbelt regex engine is byte-oriented, so a quantifier after a multi-byte class member binds to its last
+ * byte and a class never matches the plain name (verified with the real sandbox-exec, #270).
+ */
+const HFS_IGNORABLE = `(${HFS_IGNORABLE_POINTS.join("|")})`;
+
+/** A regex source matching `name` with any number of HFS+-ignorable code points interleaved, at the ends included. */
+const hfsFoldedName = (name: string) => `${HFS_IGNORABLE}*${[...name].map((c) => sbplEscape(c)).join(`${HFS_IGNORABLE}*`)}${HFS_IGNORABLE}*`;
+
+/**
+ * Seatbelt rules for the hub's and git's own names (#270). `.agenthub` is refused anywhere under the project root.
+ * `.git` is refused at any depth, the name itself included, so a planted repository cannot arrive by creation,
+ * rename, symlink or gitfile, and `config` and `hooks` directly under it are folded too; the cost is that
+ * `git init`, `git clone` and `git worktree add` no longer run inside the sandbox. `commondir` is refused at any
+ * depth below a `.git` and below each external git dir: that is where git keeps it for linked worktrees and
+ * submodules. A submodule's git dir under `.git/modules/` gets the same `config`/`hooks` refusal at whatever depth
+ * submodules nest (a nested one lives under `.git/modules/<a>/modules/<b>`, #281), anchored at the discovered
+ * modules root so a directory named `refs`, `config` or `hooks` ABOVE the project neither disables the rule nor
+ * trips it; a `/refs/` or `/logs/` segment below the root keeps a branch or tag named `config` or `hooks` writable
+ * (the round-3 regression of #277), at the price of leaving a submodule whose own path holds a `refs` or `logs`
+ * segment unprotected. The basenames are folded; a folded INTERMEDIATE component on HFS+ (a spelling of `modules`)
+ * is a known residual, the same one the external git dir rules carry. The directory entries above those files are
+ * protected as the `.git` name is: the discovered git dirs, the modules root and every component in between are
+ * refused as targets (rename, replace, symlink, recreate). An external git dir's `config`/`hooks` rules cover only
+ * its own children (plus the hooks directory's contents): at any depth they would deny refs named `config` or
+ * `hooks` in a worktree or submodule project (`git branch fix/config` fails on `.git/logs/refs/heads/fix/config`).
+ * Every pattern keeps its `^` anchor (an unanchored starred alternation does not match in this engine) and no
+ * folded literal contains the root: an SBPL string literal dies at 1024 bytes ("Error reading string"), which a
+ * long project path would trip. ponytail: the modules rules do contain the (plain) modules root; a project path
+ * over roughly 600 bytes with submodules would exceed the limit — fold the root's segments if one ever shows up.
+ */
+export function hubWriteRegexes(root: string, gitDirs: string[] = [], moduleGit?: { root: string; entries: string[] }): string[] {
+  const git = hfsFoldedName(".git");
+  const re = (s: string) => `(regex ${sbplString(s)})`;
+  const external = gitDirs.flatMap((d) => [
+    `(require-all ${re(`^${sbplEscape(d)}/[^/]+$`)} ${re(`^.*/(${hfsFoldedName("config")}|${hfsFoldedName("hooks")})$`)})`,
+    `(subpath ${sbplString(`${d}/hooks`)})`,
+    `(require-all (subpath ${sbplString(d)}) ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
+  ]);
+  const modules = moduleGit
+    ? [
+        // Every name matches whole components only: `(.*/)?` forces a boundary, so a submodule named `catalogs`
+        // or `prefs` keeps the refusal and one named `webhooks` keeps its ordinary writes (#281 round 2).
+        `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("config")}$`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
+        `(require-all ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?${hfsFoldedName("hooks")}(/|$)`)} (require-not ${re(`^${sbplEscape(moduleGit.root)}/(.*/)?(refs|logs)/`)}))`,
+        // A submodule git dir as a directory entry: no rename, replace, symlink or recreate. The basename is
+        // folded (HFS+ opens the folded spelling as the real entry); the plain prefix is the path as discovered.
+        ...moduleGit.entries.map((d) => re(`^${sbplEscape(dirname(d))}/${hfsFoldedName(basename(d))}$`)),
+      ]
+    : [];
+  return [
+    `(require-all (subpath ${sbplString(root)}) ${re(`^.*/${hfsFoldedName(".agenthub")}(/|$)`)})`,
+    re(`^.*/${git}$`),
+    re(`^.*/${git}/${hfsFoldedName("config")}$`),
+    re(`^.*/${git}/${hfsFoldedName("hooks")}(/|$)`),
+    `(require-all ${re(`^.*/${git}/.*$`)} ${re(`^.*/${hfsFoldedName("commondir")}$`)})`,
+    ...modules,
+    ...external,
+  ];
+}
+
 /**
  * Seatbelt regex filters equivalent to isDenied. Seatbelt sees absolute paths, so the `local.deny` substrings are
  * anchored under the project root: a bare "private/" would otherwise match /private/var/... and deny the whole temp tree.

package/src/local/sandbox.ts

@@ -1,9 +1,10 @@
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, readdirSync, rmSync, type Dirent } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { realPath } from "../hub/project.ts";
-import { denyRegexes, sbplString } from "./deny.ts";
+import { hubGitSync } from "../hub/git.ts";
+import { denyRegexes, hubWriteRegexes, sbplString } from "./deny.ts";
 
 const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
 export const OUTPUT_CAP = 20_000;
@@ -40,12 +41,47 @@ function developerDir(): string | undefined {
 
 /** A submodule or worktree keeps its git dir outside the project; git needs it, minus the parts that execute or reconfigure. */
 function externalGitDirs(root: string): string[] {
-  const out = spawnSync("git", ["-C", root, "rev-parse", "--absolute-git-dir", "--git-common-dir"], { encoding: "utf8" });
+  // Runs in the hub process, outside the sandbox: the hardened helper keeps the repo's config from naming a program (#281).
+  const out = hubGitSync(["-C", root, "rev-parse", "--absolute-git-dir", "--git-common-dir"], { encoding: "utf8" });
   if (out.status !== 0) return [];
   const dirs = out.stdout.trim().split("\n").map((d) => resolve(root, d));
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
 
+/**
+ * The project's submodule git directories live under the common dir's `modules/` tree (the worktree case included:
+ * it is the main repo's `.git/modules`). Returns the modules root and every directory entry that must not be
+ * renamed, replaced, symlinked or recreated: each discovered git dir (a directory holding HEAD and config) and
+ * every component between it and the modules root (#281). Discovered in the hub process, outside the sandbox.
+ */
+function moduleGitDirs(root: string): { root: string; entries: string[] } | undefined {
+  const out = hubGitSync(["-C", root, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
+  if (out.status !== 0) return undefined;
+  const modulesRoot = join(resolve(root, out.stdout.trim()), "modules");
+  const dirs: string[] = [];
+  const walk = (dir: string, depth: number): void => {
+    if (depth > 8) return; // submodules do not nest deeper in practice; the regex rules still cover the names
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return; // no modules tree (no submodules): nothing to discover
+    }
+    const names = new Set(entries.map((e) => e.name));
+    if (names.has("HEAD") && names.has("config")) {
+      dirs.push(dir);
+      const nested = join(dir, "modules");
+      if (names.has("modules")) walk(nested, depth + 1); // a submodule of a submodule
+      return;
+    }
+    for (const e of entries) if (e.isDirectory()) walk(join(dir, e.name), depth + 1);
+  };
+  walk(modulesRoot, 0);
+  const entries = new Set<string>([modulesRoot]);
+  for (const d of dirs) for (let p = d; p.length > modulesRoot.length; p = dirname(p)) entries.add(p);
+  return { root: modulesRoot, entries: [...entries] };
+}
+
 /** The system directories a deny-default profile lets commands read and run from: dyld, frameworks, toolchains. */
 const SYSTEM_READABLE = ["/usr", "/bin", "/sbin", "/System", "/Library", "/opt", "/private/etc", "/private/var/db/timezone", "/private/var/db/dyld"];
 /**
@@ -74,6 +110,7 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
   const root = realPath(cwd);
   const gitDirs = externalGitDirs(root);
+  const moduleGit = moduleGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
   const dev = developerDir();
   const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
@@ -102,8 +139,12 @@ export function profile(cwd: string, network: SandboxNetwork, readAllow: string[
     ...start,
     "(deny file-write*)",
     `(allow file-write* (subpath ${q(root)}) (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
-    // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
-    `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
+    // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub. The .git and
+    // .agenthub patterns tolerate the code points HFS+ ignores in every segment, the .git name itself is refused
+    // at any depth (creation, rename, symlink, gitfile), a submodule git dir's config and hooks under
+    // .git/modules/ are refused at the depth submodules nest (#281), and the external git dirs get folded
+    // hooks/config rules (#270). The cost: git init, clone and worktree add no longer run inside the sandbox.
+    `(deny file-write* ${hubWriteRegexes(root, gitDirs, moduleGit).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
     // Python's own CA bundle (certifi, which pip vendors too): pip, requests and httpx read it instead of the system's (#64).

package/src/local/tools.ts

@@ -7,6 +7,15 @@ import { OUTPUT_CAP, sandboxedExec } from "./sandbox.ts";
 
 export { isDenied };
 
+export type ToolApproval = boolean | "expired" | "aborted";
+export interface ApprovalProvenance { source: "person" | "automatic" | "expired" | "aborted"; answerEpoch: number; eligibleExpiry?: boolean; }
+export type ApprovalObserver = (provenance: ApprovalProvenance) => void;
+export const APPROVAL_EXPIRED_TEXT = "error: approval expired: no person answered; do not retry this call; hand the task off or stop";
+export class ApprovalWaitStop extends Error {}
+const approvalError = (picked: ToolApproval, denied: string): string | undefined => picked === true ? undefined
+  : picked === "expired" ? APPROVAL_EXPIRED_TEXT
+  : picked === "aborted" ? "error: approval withdrawn because the turn ended; no operation was executed" : denied;
+
 export interface ToolContext {
   cwd: string;
   /** Extra denylist entries from config: substrings of the project-relative path. */
@@ -17,8 +26,10 @@ export interface ToolContext {
   sandboxEnv?: Record<string, string>;
   /** Turn cancellation signal, including the execution-budget wall cap. */
   signal?: AbortSignal;
-  /** Ask the console. Resolves false on deny or timeout. */
-  permit: (title: string, tool?: string, signal?: AbortSignal, path?: string) => Promise<boolean>;
+  /** Only true permits an effect; expiry and abort remain distinct from a person's denial. */
+  permit: (title: string, tool?: string, signal?: AbortSignal, canonicalTarget?: string, observe?: ApprovalObserver) => Promise<ToolApproval>;
+  /** Trusted process status, independent of what its stdout says. */
+  onProcessExit?: (code: number | null) => void;
   /** Publish a message to other peers mid-turn. Returns a one-line receipt. */
   send: (text: string, to?: string[]) => string;
 }
@@ -131,7 +142,8 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         let file = guardPath(ctx, String(a.path), "write");
         const approvedTarget = file;
         const content = String(a.content ?? "");
-        if (!(await ctx.permit(`write ${a.path} (${content.length} chars):\n${preview(content)}`, "write", ctx.signal, file))) return "error: the user did not approve this write";
+        const refused = approvalError(await ctx.permit(`write ${a.path} (${content.length} chars):\n${preview(content)}`, "write", ctx.signal, file), "error: the user did not approve this write");
+        if (refused) return refused;
         if (ctx.signal?.aborted) return "error: turn cancelled before write";
         file = guardPath(ctx, String(a.path), "write");
         if (file !== approvedTarget) return "error: path target changed during approval; inspect before retrying";
@@ -145,7 +157,8 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         let text = readFileSync(file, "utf8");
         let count = text.split(String(a.old)).length - 1;
         if (!a.old || count !== 1) return `error: \`old\` must match exactly once, it matched ${count} times`;
-        if (!(await ctx.permit(`edit ${a.path}:\n- ${preview(String(a.old), 600)}\n+ ${preview(String(a.new ?? ""), 600)}`, "edit", ctx.signal, file))) return "error: the user did not approve this edit";
+        const refused = approvalError(await ctx.permit(`edit ${a.path}:\n- ${preview(String(a.old), 600)}\n+ ${preview(String(a.new ?? ""), 600)}`, "edit", ctx.signal, file), "error: the user did not approve this edit");
+        if (refused) return refused;
         if (ctx.signal?.aborted) return "error: turn cancelled before edit";
         // Approval can outlive another peer's edit or a path change. Apply only the approved fragment to current bytes.
         file = guardPath(ctx, String(a.path), "write");
@@ -161,8 +174,10 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (!command.trim()) return "error: empty command";
         // The approver sees the whole command, not a prefix: what is hidden cannot be approved.
         if (command.length > 4000) return "error: command longer than 4000 characters; put it in a script file with write, then run that";
-        if (!(await ctx.permit(`bash: ${command}`, "bash", ctx.signal))) return "error: the user did not approve this command";
+        const refused = approvalError(await ctx.permit(`bash: ${command}`, "bash", ctx.signal), "error: the user did not approve this command");
+        if (refused) return refused;
         const res = await sandboxedExec(["/bin/bash", "-c", command], { cwd: ctx.cwd, profile: ctx.sandboxProfile, timeoutMs: (Number(a.timeout_s) || 120) * 1000, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}), ...(ctx.signal ? { signal: ctx.signal } : {}) });
+        try { ctx.onProcessExit?.(res.code); } catch { /* optional status observer never changes a tool result */ }
         return `${res.output}\n(exit ${res.code})`;
       }
       case "git": {
@@ -171,9 +186,13 @@ export async function runTool(name: string, rawArgs: string, ctx: ToolContext):
         if (!GIT_READ.has(sub) && !GIT_WRITE.has(sub)) return `error: git ${sub} is not available to the local worker`;
         const problem = gitArgsProblem(args, ctx.deny);
         if (problem) return `error: git ${sub}: ${problem}`;
-        if (GIT_WRITE.has(sub) && !(await ctx.permit(`git ${args.join(" ")}`, "git", ctx.signal))) return "error: the user did not approve this git command";
+        if (GIT_WRITE.has(sub)) {
+          const refused = approvalError(await ctx.permit(`git ${args.join(" ")}`, "git", ctx.signal), "error: the user did not approve this git command");
+          if (refused) return refused;
+        }
         // Sandboxed like bash: flags such as --output or an editor cannot write outside the project or reach the network.
         const res = await sandboxedExec(["git", "--no-pager", ...args], { cwd: ctx.cwd, profile: ctx.sandboxProfile, ...(ctx.sandboxEnv ? { env: ctx.sandboxEnv } : {}), ...(ctx.signal ? { signal: ctx.signal } : {}) });
+        try { ctx.onProcessExit?.(res.code); } catch { /* optional status observer never changes a tool result */ }
         return `${res.output}\n(exit ${res.code})`;
       }
       case "hub_send":

package/src/memory/recall.ts

@@ -1,7 +1,7 @@
-import { spawnSync } from "node:child_process";
 import { basename, dirname, resolve } from "node:path";
 import { readFileSync } from "node:fs";
 import type { PeerId } from "../hub/envelope.ts";
+import { hubGitSync } from "../hub/git.ts";
 import type { MemoryClient } from "./client.ts";
 
 const PLATFORMS = ["claude", "codex", "kimi", "agent-hub"];
@@ -14,7 +14,7 @@ const HEADER =
 
 /** Project names from the outermost superproject down to this repo. */
 export function projectChain(cwd: string): string[] {
-  const git = (dir: string, arg: string) => spawnSync("git", ["-C", dir, "rev-parse", arg], { encoding: "utf8" }).stdout?.trim() ?? "";
+  const git = (dir: string, arg: string) => hubGitSync(["-C", dir, "rev-parse", arg], { encoding: "utf8" }).stdout?.trim() ?? "";
   const top = git(cwd, "--show-toplevel");
   if (!top) return [basename(cwd)];
 

package/src/models/mlx.ts

@@ -73,6 +73,7 @@ export interface ProcessSignature {
 const DEFAULT_RUNTIME_DIR = join(homedir(), ".agenthub", "runtimes", "mlx");
 const DEFAULT_MODEL_PATH = join(homedir(), ".agenthub", "models", "qwen3-8b-mlx");
 const OWNER_FILE = "owner.json";
+const GENERATION_DB_BUSY_TIMEOUT_MS = 100;
 const GENERATION_DB = "generation-slots.db";
 
 const ownerPath = (runtimeDir: string) => join(runtimeDir, OWNER_FILE);
@@ -185,7 +186,7 @@ function generationDatabase(runtimeDir: string): Database {
   mkdirSync(runtimeDir, { recursive: true, mode: 0o700 });
   const db = new Database(generationDbPath(runtimeDir), { create: true });
   try {
-    db.run("PRAGMA busy_timeout = 100");
+    db.run(`PRAGMA busy_timeout = ${GENERATION_DB_BUSY_TIMEOUT_MS}`);
     db.run(`CREATE TABLE IF NOT EXISTS generation_slots (
       slot INTEGER PRIMARY KEY,
       token TEXT NOT NULL,

package/src/pi/extension.ts

@@ -19,6 +19,7 @@ let pollStopped = false;
 let toolSteps = 0;
 let lastActivity = 0;
 let usageSeq = 0;
+let shellSeq = 0;
 let forcedFailure = "";
 let turnGeneration = 0;
 let sessionId = "";
@@ -33,9 +34,13 @@ async function post(path: string, body: unknown): Promise<any> {
   if (!response.ok) throw new Error(`Pi bridge HTTP ${response.status}`);
   return response.json();
 }
-async function admitBudget(unit: BudgetUnit, idleUserBash = false): Promise<{ allowed: boolean; reservation?: string }> {
+async function admitBudget(unit: BudgetUnit, idleUserBash = false, generation = turnGeneration, callSessionId = sessionId): Promise<{ allowed: boolean; reservation?: string; reason?: string }> {
+  const current = () => generation === turnGeneration && callSessionId === sessionId;
+  const stale = () => ({ allowed: false, reason: "Pi tool lineage ended during admission; do not retry the old call" });
+  if (!current()) return stale();
   try {
-    const result = await post("/budget", { unit, generation: turnGeneration, ...(idleUserBash ? { idleUserBash: true } : {}) });
+    const result = await post("/budget", { unit, generation, ...(idleUserBash ? { idleUserBash: true } : {}) });
+    if (!current()) return stale();
     const decisions = Array.isArray(result?.decisions) ? result.decisions : [];
     const denied = decisions.find((item: any) => item?.allowed === false);
     if (!denied) return { allowed: true, ...(idleUserBash && typeof result?.reservation === "string" ? { reservation: result.reservation } : {}) };
@@ -43,12 +48,14 @@ async function admitBudget(unit: BudgetUnit, idleUserBash = false): Promise<{ al
     if (idleUserBash) return { allowed: false };
     forcedFailure = reason;
   } catch (error) {
+    if (!current()) return stale();
     if (idleUserBash) return { allowed: false };
     forcedFailure = `execution budget admission unavailable: ${(error as Error).message}`;
   }
-  try { await post("/event", { type: "agent_end", generation: turnGeneration, failed: true, error: forcedFailure }); } catch { /* abort remains authoritative when the bridge is unavailable */ }
-  runtimeCtx?.abort?.();
-  return { allowed: false };
+  const reason = forcedFailure;
+  try { await post("/event", { type: "agent_end", generation, failed: true, error: reason }); } catch { /* abort remains authoritative when the bridge is unavailable */ }
+  if (current()) runtimeCtx?.abort?.();
+  return { allowed: false, reason };
 }
 async function poll(pi: ExtensionAPI): Promise<void> {
   while (!pollStopped) {
@@ -77,10 +84,13 @@ async function poll(pi: ExtensionAPI): Promise<void> {
           shutdown?.();
         } else if (command.type === "abort_budget") {
           if (Number.isSafeInteger(command.generation) && command.generation === turnGeneration) {
-            const reason = "execution budget exhausted: elapsed_ms wall cap reached";
+            if (typeof runtimeCtx?.abort !== "function") throw new Error("Pi runtime cannot abort the current turn");
+            const generation = turnGeneration, callSessionId = sessionId;
+            const reason = command.cause === "approval" && typeof command.reason === "string" && command.reason
+              ? command.reason : "execution budget exhausted: elapsed_ms wall cap reached";
             forcedFailure = reason;
-            await post("/event", { type: "agent_end", generation: turnGeneration, failed: true, error: reason });
-            runtimeCtx?.abort?.();
+            await post("/event", { type: "agent_end", generation, failed: true, error: reason });
+            if (generation === turnGeneration && callSessionId === sessionId) runtimeCtx?.abort?.();
           }
         }
         await post("/ack", { id: command.id, ok: true });
@@ -107,7 +117,7 @@ export default function(pi: ExtensionAPI): void {
     const state = ctx.sessionManager.getHeader();
     sessionId = String(state?.id ?? "");
     try {
-      const claimed = await post("/event", { type: "session_start", ownerToken, pid: process.pid, signature: processSignature(process.pid), sessionId: state?.id, sessionFile: ctx.sessionManager.getSessionFile() });
+      const claimed = await post("/event", { type: "session_start", ownerToken, pid: process.pid, signature: processSignature(process.pid), sessionId: state?.id, sessionFile: ctx.sessionManager.getSessionFile(), approvalTurnAbort: typeof ctx.abort === "function" });
       if (claimed?.ok === false) { ctx.shutdown?.(); return; }
     } catch (error) { ctx.shutdown?.(); throw error; }
     if (!pollStarted) { pollStarted = true; void poll(pi); }
@@ -140,8 +150,10 @@ export default function(pi: ExtensionAPI): void {
   });
   pi.on("before_provider_request", async (_event: any, ctx: any) => {
     if (ctx.model?.provider && ctx.model.provider !== "agent-hub-local") { ctx.abort?.(); return undefined; }
-    try { if (!(await admitBudget("model_calls")).allowed) ctx.abort?.(); }
-    catch (error) { forcedFailure = `execution budget admission failed: ${(error as Error).message}`; ctx.abort?.(); }
+    const generation = turnGeneration, callSessionId = sessionId;
+    const current = () => generation === turnGeneration && callSessionId === sessionId;
+    try { if (!(await admitBudget("model_calls", false, generation, callSessionId)).allowed && current()) ctx.abort?.(); }
+    catch (error) { if (current()) { forcedFailure = `execution budget admission failed: ${(error as Error).message}`; ctx.abort?.(); } }
     return undefined;
   });
   pi.on("agent_settled", async (_event: any, ctx: any) => {
@@ -151,10 +163,11 @@ export default function(pi: ExtensionAPI): void {
     await post("/event", { type: "agent_settled", generation: turnGeneration, ...(text ? { text } : {}) });
   });
   pi.on("user_bash", async (event: any) => {
-    const admission = await admitBudget("tool_calls", true);
+    const generation = turnGeneration, callSessionId = sessionId;
+    const admission = await admitBudget("tool_calls", true, generation, callSessionId);
     if (!admission.allowed || !admission.reservation) return { cancel: true };
-    const result = await post("/tool", { name: "bash", args: { command: event.command, cwd: event.cwd }, toolCallId: `pi-shell-${Date.now()}`, purpose: "idle_user_bash", generation: turnGeneration, reservation: admission.reservation });
-    return { result: { output: String(result.text ?? result), exitCode: 0, cancelled: false, truncated: false } };
+    const result = await post("/tool", { name: "bash", args: { command: event.command, cwd: event.cwd }, toolCallId: `pi-shell-${Date.now()}-${++shellSeq}`, purpose: "idle_user_bash", generation, sessionId: callSessionId, reservation: admission.reservation });
+    return { result: { output: String(result.text ?? result), exitCode: typeof result.exitCode === "number" ? result.exitCode : undefined, cancelled: result.exitCode === null, truncated: false } };
   });
   // Managed sessions may only be handed over by PiPeer after it has fenced the
   // owner and verified the replacement identity. User /fork and /resume would
@@ -164,8 +177,11 @@ export default function(pi: ExtensionAPI): void {
   pi.on("session_shutdown", async () => { pollStopped = true; await post("/event", { type: "session_shutdown" }); });
   for (const raw of (() => { try { return JSON.parse(process.env.AGENTHUB_PI_TOOLS ?? "[]") as any[]; } catch { return []; } })()) {
     if (!raw || typeof raw.name !== "string" || !raw.parameters) continue;
-    pi.registerTool({ name: raw.name, label: raw.name, description: raw.description ?? raw.name, parameters: raw.parameters, async execute(toolCallId: string, params: unknown) {
-      if (!(await admitBudget("tool_calls")).allowed) return { content: [{ type: "text", text: `error: ${forcedFailure}` }], details: {}, isError: true };
+    pi.registerTool({ name: raw.name, label: raw.name, description: raw.description ?? raw.name, parameters: raw.parameters, async execute(toolCallId: string, params: unknown, signal?: AbortSignal) {
+      const generation = turnGeneration, callSessionId = sessionId;
+      if (signal?.aborted) return { content: [{ type: "text", text: "error: tool call cancelled before execution" }], details: {}, isError: true };
+      const admission = await admitBudget("tool_calls", false, generation, callSessionId);
+      if (!admission.allowed) return { content: [{ type: "text", text: `error: ${admission.reason ?? forcedFailure}` }], details: {}, isError: true };
       if (toolSteps++ >= maxSteps) {
         const reason = `Pi tool step limit ${maxSteps} reached`;
         forcedFailure = reason;
@@ -173,12 +189,19 @@ export default function(pi: ExtensionAPI): void {
         // event, so the adapter binds it while the turn still owns it. The counter already counts the
         // rejected pre-effect invocation (toolSteps++ above); its side effect never executes. The
         // reason text stays the failure record; the signal adds the validated counts.
-        try { await post("/event", { type: "ceiling", kind: PI_CEILING_KIND, unit: PI_CEILING_UNIT, count: toolSteps, limit: maxSteps, sessionId, generation: turnGeneration }); } catch { /* the agent_end failure below remains authoritative */ }
-        await post("/event", { type: "agent_end", generation: turnGeneration, failed: true, error: reason });
-        runtimeCtx?.abort?.();
+        try { await post("/event", { type: "ceiling", kind: PI_CEILING_KIND, unit: PI_CEILING_UNIT, count: toolSteps, limit: maxSteps, sessionId: callSessionId, generation }); } catch { /* the agent_end failure below remains authoritative */ }
+        await post("/event", { type: "agent_end", generation, failed: true, error: reason });
+        if (generation === turnGeneration && callSessionId === sessionId) runtimeCtx?.abort?.();
         return { content: [{ type: "text", text: `error: ${reason}` }], details: {}, isError: true };
       }
-      const result = await post("/tool", { name: raw.name, args: params, toolCallId });
+      const aborted = () => { void post("/event", { type: "tool_abort", sessionId: callSessionId, generation, toolCallId }).catch(() => undefined); };
+      if (signal?.aborted) return { content: [{ type: "text", text: "error: tool call cancelled before execution" }], details: {}, isError: true };
+      signal?.addEventListener("abort", aborted, { once: true });
+      let result: any;
+      try {
+        result = await post("/tool", { name: raw.name, args: params, toolCallId, sessionId: callSessionId, generation });
+        if (signal?.aborted) aborted();
+      } finally { signal?.removeEventListener("abort", aborted); }
       const text = String(result.text ?? result);
       // Pi 1.0.1 reads isError === true alone (#181). The bridge computes `failed` with the
       // managed-tool failure contract (toolResultFailed); the extension never re-parses the text.

package/src/pi/tool-receipts.ts

@@ -2,6 +2,23 @@ import { chmodSync } from "node:fs";
 import { Database } from "bun:sqlite";
 import { createHash } from "node:crypto";
 import { PreEffectToolRefusal } from "../hub/tool-refusal.ts";
+import { HUB_DB_BUSY_TIMEOUT_MS } from "../hub/db-timeout.ts";
+
+export const PI_TOOL_RESULT_CAP = 100_000;
+/** Bound encoded text before wrapping it so escaping never cuts off trusted exit metadata. */
+export function packPiShellResult(text: string, exitCode: number | null): string {
+  const pack = (value: string) => JSON.stringify({ kind: "user-bash-result", text: value, exitCode });
+  const full = pack(text);
+  if (full.length <= PI_TOOL_RESULT_CAP) return full;
+  const suffix = "\n[output truncated]";
+  let low = 0, high = text.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (pack(text.slice(0, middle) + suffix).length <= PI_TOOL_RESULT_CAP) low = middle;
+    else high = middle - 1;
+  }
+  return pack(text.slice(0, low) + suffix);
+}
 
 /** Private, session-scoped dedupe. An interrupted effect is never automatically repeated. */
 export class PiToolReceipts {
@@ -11,8 +28,8 @@ export class PiToolReceipts {
   private readonly pending = new Map<string, Promise<string>>();
   constructor(file: string) {
     this.db = new Database(file, { create: true });
+    this.db.run(`PRAGMA busy_timeout = ${HUB_DB_BUSY_TIMEOUT_MS}`);
     chmodSync(file, 0o600);
-    this.db.run("PRAGMA busy_timeout = 5000");
     this.db.run(`CREATE TABLE IF NOT EXISTS pi_tool_receipts (
       session TEXT NOT NULL, call_id TEXT NOT NULL, fingerprint TEXT NOT NULL,
       state TEXT NOT NULL, result TEXT, PRIMARY KEY(session, call_id))`);
@@ -33,7 +50,7 @@ export class PiToolReceipts {
     const claim = this.db.query("INSERT OR IGNORE INTO pi_tool_receipts(session,call_id,fingerprint,state) VALUES(?,?,?,'pending')").run(session, callId, fingerprint);
     if (!claim.changes) return this.execute(session, callId, name, args, run);
     const settle = (result: string): string => {
-      const text = result.slice(0, 100_000);
+      const text = result.slice(0, PI_TOOL_RESULT_CAP);
       this.db.query("UPDATE pi_tool_receipts SET state='done',result=? WHERE session=? AND call_id=?").run(text, session, callId);
       return text;
     };