@tangle-network/agent-runtime 0.113.0 → 0.114.0

package/dist/{supervise-S7glOjJH.js → supervise-tdxMJYem.js}

@@ -1,10 +1,10 @@
 import { c as RuntimeRunStateError, i as ConfigError, o as NotFoundError, t as AgentEvalError$1, u as ValidationError } from "./errors-DEAvWQPy.js";
 import { a as mapWithConcurrency, c as sleep, d as throwIfAborted, f as withTimeout, l as stringifySafe, n as addTokenUsage, o as randomSuffix, p as zeroTokenUsage, r as deleteBoxSafe, s as randomUuid, t as abortError, u as throwAbort } from "./util-Cc9g9Y-o.js";
-import { a as contentAddress, i as InMemorySpawnJournal, n as FileSpawnJournal, r as InMemoryResultBlobStore, t as FileResultBlobStore } from "./spawn-journal-DLhnom3e.js";
-import { A as createWorktree, C as routerChatWithUsage, D as runWorktreeChecks, O as runWorktreeHarness, T as runBrainLoop, a as runFinalizer, i as pickBestDelivered, j as removeWorktree, k as captureWorktreeDiff, l as withDriverExecutor, n as bestDelivered, o as runTree, t as createSupervisor, x as routerBrain, y as createActivityLog } from "./supervisor-zebR4ICs.js";
+import { a as contentAddress, i as InMemorySpawnJournal, n as FileSpawnJournal, r as InMemoryResultBlobStore, t as FileResultBlobStore } from "./spawn-journal-DCPbicXB.js";
+import { A as captureWorktreeDiff, C as routerChatWithUsage, E as runBrainLoop, M as removeWorktree, O as runWorktreeChecks, a as runFinalizer, i as pickBestDelivered, j as createWorktree, k as runWorktreeHarness, l as withDriverExecutor, n as bestDelivered, o as runTree, t as createSupervisor, x as routerBrain, y as createActivityLog } from "./supervisor-DKqolBGI.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-C7iJOWm3.js";
 import { a as notifySandboxEventObserver, n as extractLlmCallEvent } from "./sandbox-events-DeI5xX8P.js";
-import { i as resolveAgentEnvironmentProvider, n as providerAsExecutor, s as buildBackendOptions } from "./environment-provider-BsHpW4Dp.js";
+import { i as resolveAgentEnvironmentProvider, n as providerAsExecutor, s as buildBackendOptions } from "./environment-provider-CCaEhA-l.js";
 import { r as buildLoopSpanNodes } from "./otel-export-D34IQW1C.js";
 import { t as createStdioToolServer } from "./tool-server-RcWgLIsL.js";
 import { n as UI_LENSES } from "./substrate-B0TYNrXn.js";
@@ -12,8 +12,10 @@ import { argHash, computeFindingId, errorStreakDetector, estimateCost, isModelPr
 import { agentProfileSchema } from "@tangle-network/agent-interface";
 import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import path, { dirname } from "node:path";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import path, { dirname, isAbsolute, join, sep } from "node:path";
 import { spawn } from "node:child_process";
+import { homedir, tmpdir } from "node:os";
 import { createServer, request } from "node:http";
 import { request as request$1 } from "node:https";
 import { Readable, Writable } from "node:stream";
@@ -1273,6 +1275,386 @@ function createInbox() {
 	};
 }
 //#endregion
+//#region src/runtime/supervise/pi-mcp.ts
+/**
+*
+* MCP for the `pi` harness — the mount `piExecutor` performs before it spawns pi.
+*
+* pi ships NO MCP support of its own. MCP arrives through the `pi-mcp-adapter` extension, and the
+* adapter takes its config from a path the CALLER names: it registers a `--mcp-config <path>` flag
+* (`pi-mcp-adapter` `index.ts:252`, read back at `init.ts:101` and off raw argv at `utils.ts:55`).
+* So "give pi an MCP server" means: write the canonical `{ mcpServers: … }` object to a path this
+* run owns, pass that path with `--mcp-config`, make sure the adapter is loaded, and delete the
+* file afterwards. This module does exactly that and nothing else.
+*
+* Three rules carry the whole design:
+*
+* 1. **Fail loud, never fail safe.** If the profile declares MCP servers and `pi-mcp-adapter` is not
+*    installed, `preparePiMcp` throws BEFORE any file is written and before pi is spawned. A run
+*    whose tools never existed must fail, not score zero for the wrong reason.
+* 2. **`--no-extensions` is a trap.** When `extensions.pi.load` is an array, pi runs
+*    `--no-extensions`, which suppresses ALL auto-discovery — cwd `.pi/extensions`, global
+*    `~/.pi/agent/extensions`, AND the `settings.json` `packages` list that would otherwise have
+*    auto-loaded the adapter. So `load: ['pi-memory']` alongside `mcp` kills MCP dead even though
+*    the adapter IS installed. When MCP is declared, this module adds `pi-mcp-adapter` to the
+*    resolved load list and REPORTS that it did (`PiMcpReceipt.adapterInjected`). The caller's
+*    profile object is never mutated.
+* 3. **One config file per worker EXECUTION, never one per workspace.** `PiSeam.cwd` comes from the
+*    `ExecutorConfig` and is therefore shared by every worker the factory builds, so a config
+*    discovered by cwd is a file two concurrent siblings fight over. `mountPiMcpConfig` instead
+*    creates a fresh `mkdtemp` directory — OS-guaranteed unique, so no counter, lock, merge or
+*    restore is needed — and hands its path to `--mcp-config`. Concurrent workers built from ONE
+*    seam get ONE config each and never collide.
+*
+* Why the flag is safe to emit here even though pi only lists it under `Extension CLI Flags`: it is
+* emitted ONLY when the profile declares at least one usable MCP server, and that case has already
+* passed the `piMcpAdapterAvailable()` gate above, so the extension that registers the flag is
+* guaranteed loadable (auto-discovered, or force-loaded by the `--extension` this module appends).
+* A machine without the adapter never reaches the flag — it fails at the gate with an install
+* command instead.
+*
+* Where the run's servers sit in pi's config layering, stated plainly because it is a real
+* behavioral edge: `--mcp-config` REPLACES pi's user-global override file (`config.ts:310`,
+* `getPiGlobalConfigPath(overridePath)`), so the operator's own `~/.pi/agent/mcp.json` servers no
+* longer leak into a worker — good. It does NOT suppress project discovery: the adapter still
+* layers `<cwd>/.mcp.json` and `<cwd>/.pi/mcp.json` on top (`config.ts:352-373`), and those are
+* later sources, so a workspace that ships a server under the SAME NAME overrides this run's entry.
+* The consequence is worth naming: an A/B whose arms differ only in `profile.mcp` is confounded
+* when the shared workspace carries its own MCP config. Deleting a file the run did not create
+* would be worse — a run cannot quietly edit the repo it was pointed at.
+*
+* Upstream note: `@tangle-network/agent-profile-materialize` is the shared owner of profile → harness
+* mapping and already declares `pi` a first-class `HarnessId`, but as of 0.9.4 its pi arm answers
+* `unsupported('mcp', 'pi MCP requires a loaded MCP extension; the base Pi runtime has no MCP
+* control')` and its pi extensions arm answers `unsupported('extensions', …)`. That refusal is now
+* factually stale — the shape is exactly its `kimi-code` arm's (write a config file, push a config
+* flag, because the harness has no cwd discovery worth trusting). Teaching the materializer these
+* two rows is the durable home for this mapping; until it lands, this module is the only thing in
+* the `backend: 'pi'` path that can honor `profile.mcp` at all.
+*
+* Verified against pi 0.83.0 and pi-mcp-adapter 2.15.0.
+*
+* @experimental
+*/
+/** The pi extension that gives pi MCP at all. Everything here is gated on it being loadable. */
+const PI_MCP_ADAPTER = "pi-mcp-adapter";
+/** Overrides adapter detection for installs whose path does not carry the adapter's name. */
+const PI_MCP_ADAPTER_ENV = "AGENT_RUNTIME_PI_MCP_ADAPTER";
+/** The adapter-registered flag that names this run's config file (`pi-mcp-adapter` `index.ts:252`). */
+const PI_MCP_CONFIG_FLAG = "--mcp-config";
+/** pi's agent home. Holds `settings.json` and `npm/node_modules/<extension>`. */
+function piAgentDir() {
+	return process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+}
+/** `<agentDir>/npm`, whose `node_modules/<pkg>` holds installed pi extensions. */
+function piNpmRoot() {
+	return join(piAgentDir(), "npm");
+}
+/**
+* True when pi can actually consume MCP config — i.e. `pi-mcp-adapter` is installed. Ported from
+* cli-bridge `pi.ts:189`: an env override first (for vendored installs whose path does not carry the
+* adapter's name), then the npm install directory, then a scan of `settings.json` `packages` in
+* which a local-path entry is resolved by reading the target's `package.json` `name`. An
+* unreadable or absent `settings.json` reports "not detected"; it never throws and never assumes.
+*/
+function piMcpAdapterAvailable() {
+	const override = process.env[PI_MCP_ADAPTER_ENV];
+	if (override === "1" || override === "true") return true;
+	if (override === "0" || override === "false") return false;
+	const agentDir = piAgentDir();
+	if (existsSync(join(agentDir, "npm", "node_modules", "pi-mcp-adapter"))) return true;
+	try {
+		const settings = JSON.parse(readFileSync(join(agentDir, "settings.json"), "utf-8"));
+		if (!Array.isArray(settings.packages)) return false;
+		return settings.packages.some((entry) => packageEntryIsAdapter(entry, agentDir));
+	} catch {
+		return false;
+	}
+}
+/** One `settings.json` `packages[]` entry: a name containing the adapter, or a local path to it. */
+function packageEntryIsAdapter(entry, agentDir) {
+	if (typeof entry !== "string") return false;
+	if (entry.includes("pi-mcp-adapter")) return true;
+	const spec = entry.replace(/^(file|path):(\/\/)?/, "");
+	const windowsAbsolute = /^[A-Za-z]:[\\/]/.test(spec);
+	if (!isAbsolute(spec) && !windowsAbsolute && !spec.startsWith(".")) return false;
+	return readPackageName(isAbsolute(spec) || windowsAbsolute ? spec : join(agentDir, spec)) === PI_MCP_ADAPTER;
+}
+function readPackageName(packageDir) {
+	try {
+		const manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf-8"));
+		return typeof manifest.name === "string" ? manifest.name : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Read one `AgentProfileConfigValue` as public bytes. A `secret-ref` is REFUSED rather than
+* stringified: this executor has no secret provider, so the only alternatives are writing a
+* placeholder into the config (an auth failure disguised as a tool bug) or writing the literal
+* reference object (nonsense to the adapter). Plain strings, numbers and booleans are accepted
+* because profiles authored as JSON commonly carry them where the type says `{kind:'public'}`.
+*/
+function publicConfigString(value, where) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (value && typeof value === "object" && value.kind === "public") return value.value;
+	if (value && typeof value === "object" && value.kind === "secret-ref") throw new ConfigError(`piExecutor: ${where} is a secret-ref ("${value.key}") and piExecutor has no secret provider; resolve it before handing the profile to the executor, or declare a public value`);
+	throw new ValidationError(`piExecutor: ${where} is not a public configuration value`);
+}
+/**
+* Build the canonical `{ mcpServers }` body the adapter reads, from `AgentProfile.mcp`.
+*
+* This is cli-bridge's `buildCanonicalMcpServers`
+* (`/home/drew/code/cli-bridge/src/backends/profile-support.ts:253`) reproduced field for field and
+* in the same key order — same drop of `enabled:false`, same stdio-versus-remote decision
+* (`isStdioMcpSpec`, `profile-support.ts:177`), same `{command, args, env}` and `{type, url,
+* headers}` bodies, same silent drop of an entry with nothing to connect to. For any server both
+* input types can express, the emitted JSON is byte-identical.
+*
+* The two input types are not the same type, so three differences remain and each is a field one
+* side cannot express:
+*
+* 1. **`cwd` (emitted here, absent there).** `AgentProfileLocalMcpServer` has `cwd`; cli-bridge's
+*    `McpServerSpec` (`src/backends/types.ts:53`) has no such field, so it can never emit one. The
+*    adapter honors it (`pi-mcp-adapter` `types.ts:325`, `ServerEntry.cwd`), so dropping it would
+*    silently discard a declared setting. It is emitted where cli-bridge emits `timeout`.
+* 2. **`timeout` (emitted there, absent here).** `AgentProfileMcpServer` has no timeout field, so
+*    there is nothing to emit. (The adapter's own knob is `requestTimeoutMs`, not `timeout`.)
+* 3. **A `url` with no declared transport.** cli-bridge DROPS it — its remote branch requires an
+*    explicit `spec.type` — even though its own `McpServerSpec` docstring says "http is implied if
+*    `url` is set" (`types.ts:53-56`). `transport` is optional on `AgentProfileRemoteMcpServer`, so
+*    dropping such a server here would be exactly the silent-drop bug this module exists to fix.
+*    We honor the documented convention and emit `type: 'http'`.
+*
+* `sse` is ACCEPTED and forwarded verbatim, as cli-bridge forwards it. The adapter connects a URL
+* server by probing StreamableHTTP and falling back to `SSEClientTransport` when the probe fails
+* (`pi-mcp-adapter` `server-manager.ts:765`), so an SSE-only endpoint does connect. Its
+* `ServerEntry` (`types.ts:319`) carries no transport discriminator at all, which means the `type`
+* key is inert to the adapter either way — but it is what cli-bridge writes, and a config file that
+* round-trips the caller's declared transport is the one that stays readable by both.
+*/
+function buildPiMcpServers(mcp) {
+	const out = {};
+	if (!mcp || typeof mcp !== "object") return out;
+	for (const [name, raw] of Object.entries(mcp)) {
+		if (!name || !raw || typeof raw !== "object") continue;
+		if (raw.enabled === false) continue;
+		const transport = raw.transport;
+		const command = typeof raw.command === "string" && raw.command.length > 0 ? raw.command : null;
+		const url = typeof raw.url === "string" && raw.url.length > 0 ? raw.url : null;
+		if ((transport === "http" || transport === "sse" ? false : command !== null) && command !== null) {
+			const args = Array.isArray(raw.args) ? raw.args.map((a, i) => publicConfigString(a, `mcp["${name}"].args[${i}]`)) : [];
+			const env = readConfigRecord(raw.env, `mcp["${name}"].env`);
+			out[name] = {
+				command,
+				...args.length > 0 ? { args } : {},
+				...Object.keys(env).length > 0 ? { env } : {},
+				...typeof raw.cwd === "string" && raw.cwd.length > 0 ? { cwd: raw.cwd } : {}
+			};
+			continue;
+		}
+		if (url !== null && transport !== "stdio") {
+			const headers = readConfigRecord(raw.headers, `mcp["${name}"].headers`);
+			out[name] = {
+				type: transport === "sse" ? "sse" : "http",
+				url,
+				...Object.keys(headers).length > 0 ? { headers } : {}
+			};
+		}
+	}
+	return out;
+}
+function readConfigRecord(record, where) {
+	if (!record || typeof record !== "object") return {};
+	const out = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (value === void 0) continue;
+		out[key] = publicConfigString(value, `${where}["${key}"]`);
+	}
+	return out;
+}
+/**
+* Resolve one `extensions.pi.load` entry to an absolute extension entry file. Ported from cli-bridge
+* `resolvePiExtensionEntry` (`pi.ts:123`): an absolute path is used verbatim; a bare package name
+* resolves to `<npmRoot>/node_modules/<pkg>/<package.json main>`, `main` defaulting to `index.ts`.
+* The resolution is required because pi's per-file loader does NOT resolve bare specifiers against
+* `~/.pi/agent/npm/node_modules`. Fail-closed: an unreadable manifest or a missing entry file
+* rejects the run rather than letting an ablation arm run without the extension it declared.
+*/
+function resolvePiExtensionEntry(spec, npmRoot) {
+	let entry;
+	if (isAbsolute(spec)) entry = spec;
+	else {
+		const packageDir = join(npmRoot, "node_modules", spec);
+		let main = "index.ts";
+		try {
+			const manifest = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf-8"));
+			if (typeof manifest.main === "string" && manifest.main) main = manifest.main;
+		} catch (err) {
+			throw new ConfigError(`piExecutor: cannot load pi extension "${spec}": ${join(packageDir, "package.json")} is not readable (install it with \`pi install npm:${spec}\`): ${err instanceof Error ? err.message : String(err)}`);
+		}
+		entry = join(packageDir, main);
+	}
+	if (!existsSync(entry)) throw new ConfigError(`piExecutor: cannot load pi extension "${spec}": resolved entry ${entry} does not exist`);
+	return entry;
+}
+/** Does this `load` entry name the MCP adapter, before resolution? */
+function entryNamesAdapter(spec) {
+	if (!isAbsolute(spec)) return spec === PI_MCP_ADAPTER;
+	if (spec.split(/[\\/]/).includes("pi-mcp-adapter")) return true;
+	const parent = spec.slice(0, spec.lastIndexOf(sep) + 1);
+	return parent.length > 0 && readPackageName(parent) === "pi-mcp-adapter";
+}
+/**
+* Lower `AgentProfile.extensions.pi.load` into pi argv, honoring the `--no-extensions` trap.
+*
+* `load` absent (not an array) → no flags at all, so pi keeps its default discovery and the adapter
+* auto-loads from `settings.json` `packages`. `load` present → `--no-extensions` plus one
+* `--extension <absolute entry>` per listed extension, which is what makes an ablation arm
+* reproducible and leak-free.
+*
+* When `mcpRequested` is true and an explicit `load` array does not already name the adapter, the
+* adapter is APPENDED — otherwise `--no-extensions` would suppress the very extension that turns
+* the `--mcp-config` file into tools. The caller's profile is not touched; the addition is reported
+* through `adapterInjected` so it reaches the executor receipt and the live progress channel.
+*
+* A non-string or blank entry is a schema error here, not a silent skip: an ablation arm that
+* quietly drops a typo'd extension is the same class of structural false-null this module exists to
+* eliminate.
+*/
+function derivePiExtensionArgs(profile, mcpRequested) {
+	const load = profile?.extensions?.pi?.load;
+	if (!Array.isArray(load)) return {
+		args: [],
+		entries: [],
+		adapterInjected: false
+	};
+	const declared = [];
+	for (const [index, entry] of load.entries()) {
+		if (typeof entry !== "string" || !entry.trim()) throw new ValidationError(`piExecutor: extensions.pi.load[${index}] must be a non-empty string (got ${entry === null ? "null" : typeof entry})`);
+		declared.push(entry.trim());
+	}
+	const adapterInjected = mcpRequested && !declared.some(entryNamesAdapter);
+	const resolvedSpecs = adapterInjected ? [...declared, PI_MCP_ADAPTER] : declared;
+	const npmRoot = piNpmRoot();
+	const entries = resolvedSpecs.map((spec) => resolvePiExtensionEntry(spec, npmRoot));
+	const args = ["--no-extensions"];
+	for (const entry of entries) args.push("--extension", entry);
+	return {
+		args,
+		entries,
+		adapterInjected
+	};
+}
+/** Directory-name-safe form of a run id; the `mkdtemp` suffix supplies the uniqueness. */
+function runIdSlug(runId) {
+	const slug = runId.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+	return slug.length > 0 ? slug.slice(0, 60) : "worker";
+}
+/**
+* Write this worker execution's MCP config to a directory only it owns, and hand back the removal.
+*
+* Every property of the old cwd-discovered mount — a cross-process lock, a merge under whatever the
+* workspace already had, a verbatim byte restore, a symlink guard on `.pi` — existed because two
+* workers sharing a `PiSeam` shared one file path. `mkdtemp` deletes the shared path, and with it
+* the entire class of problem: the directory did not exist a moment ago, nothing else can name it,
+* `cleanup()` removes it whole, and two siblings started in the same millisecond get two configs.
+*
+* Returns `null` when there are no usable servers, so the no-MCP path writes nothing at all.
+*/
+function mountPiMcpConfig(mcpServers, options) {
+	const serverNames = Object.keys(mcpServers);
+	if (serverNames.length === 0) return null;
+	const slug = runIdSlug(options.runId);
+	const base = tmpdir();
+	const prefix = `agent-runtime-pi-mcp-${slug}-`;
+	let dir;
+	try {
+		dir = mkdtempSync(join(base, prefix));
+	} catch (err) {
+		throw new ConfigError(`piExecutor: cannot create a private MCP config directory under ${base}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const configPath = join(dir, "mcp.json");
+	try {
+		writeFileSync(configPath, JSON.stringify({ mcpServers }, null, 2), {
+			flag: "wx",
+			mode: 384
+		});
+	} catch (err) {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		throw new ConfigError(`piExecutor: failed to write the MCP config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let cleaned = false;
+	return {
+		configPath,
+		serverNames,
+		cleanup: () => {
+			if (cleaned) return;
+			cleaned = true;
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+}
+/**
+* The one call `piExecutor` makes before spawning pi: decide what pi must be told, fail loud if it
+* cannot work, then mount.
+*
+* Order matters and is the point:
+*
+* 1. Canonicalize `profile.mcp` first, so the adapter gate keys off servers that would ACTUALLY be
+*    written — a block of `enabled:false` entries must not trip it.
+* 2. If any server survives and `pi-mcp-adapter` is not installed, throw. No file has been written
+*    and pi has not been spawned.
+* 3. Lower `extensions.pi.load` (which may itself throw on an unresolvable extension) — still before
+*    any file exists.
+* 4. Only then create this execution's private config directory and emit `--mcp-config`.
+*
+* A profile with no usable MCP server is a pure no-op: no adapter check, no directory, no flags, no
+* throw. `extensions.pi.load` on its own still produces flags, because reproducible ablation arms
+* need them whether or not MCP is involved.
+*
+* The caller MUST call `mount.cleanup()` on every exit path — settle, throw, abort, timeout, and
+* spawn failure — so the directory does not outlive the worker that owns it.
+*/
+function preparePiMcp(profile, options) {
+	const mcpServers = buildPiMcpServers(profile?.mcp);
+	const requested = Object.keys(mcpServers);
+	if (requested.length > 0 && !piMcpAdapterAvailable()) throw new ConfigError(`piExecutor: cannot mount MCP servers for pi (${requested.join(", ")}): the ${PI_MCP_ADAPTER} extension is not installed. pi ships no MCP support of its own, so these servers would never connect and the worker would run tool-less. Looked in ${join(piNpmRoot(), "node_modules", PI_MCP_ADAPTER)} and in the \`packages\` list of ${join(piAgentDir(), "settings.json")}. Install it with \`pi install npm:${PI_MCP_ADAPTER}\`, or set ${PI_MCP_ADAPTER_ENV}=1 if it is vendored somewhere this check cannot see.`);
+	const extensions = derivePiExtensionArgs(profile, requested.length > 0);
+	if (requested.length === 0) return {
+		args: extensions.args,
+		mount: null,
+		receipt: void 0
+	};
+	const mount = mountPiMcpConfig(mcpServers, options);
+	if (!mount) return {
+		args: extensions.args,
+		mount: null,
+		receipt: void 0
+	};
+	return {
+		args: [
+			...extensions.args,
+			PI_MCP_CONFIG_FLAG,
+			mount.configPath
+		],
+		mount,
+		receipt: {
+			servers: mount.serverNames,
+			configPath: mount.configPath,
+			extensions: extensions.entries,
+			adapterInjected: extensions.adapterInjected
+		}
+	};
+}
+//#endregion
 //#region src/runtime/supervise/trace-source.ts
 /** Project a normalized tool step into the canonical agent-eval `ToolSpan`. When the step carries
 *  real wall-clock (`startedAt`/`endedAt`) the span gets a true duration; otherwise it collapses to
@@ -1510,6 +1892,32 @@ function sandboxSessionTraceSource(box, sessionId, opts = {}) {
 * usage whose dollar price is absent or zero stays explicitly unknown through the live usage
 * stream and terminal artifact.
 *
+* ## What of the `AgentProfile` this executor honors, and what it does not
+*
+* This adapter is NOT a profile materializer. It reads a deliberately small part of
+* `spec.profile`, and a caller who needs the rest must lower it before handing the profile over.
+* Stated exhaustively so a silent drop is never a surprise:
+*
+* | Field | Status |
+* | --- | --- |
+* | `profile.name` | honored — trace `runId` label only, no behavioral effect |
+* | `profile.prompt.systemPrompt` | honored — prepended to the task text (pi RPC takes no separate system-prompt channel) |
+* | `profile.mcp` | honored — written to this execution's own file and passed as `--mcp-config` for `pi-mcp-adapter`; see `pi-mcp.ts` |
+* | `profile.extensions.pi.load` | honored — lowered to `--no-extensions` + `--extension <abs>` |
+* | `profile.prompt.instructions` | DROPPED — fold into `systemPrompt` before calling |
+* | `profile.model` | DROPPED — the seam's `model` is the only model channel; a profile that disagrees with the seam is silently overridden by the seam |
+* | `profile.model.reasoningEffort` | DROPPED — no `--thinking` flag is emitted, so pi's configured `defaultThinkingLevel` applies |
+* | `profile.tools` | DROPPED — no `--no-tools` / allow-deny mapping; pi runs its full builtin tool set |
+* | `profile.permissions` | DROPPED |
+* | `profile.resources` (context / skills / commands / subagents / instructions) | DROPPED — nothing is written into the run cwd |
+* | `profile.hooks` | DROPPED |
+* | `profile.subagents`, `profile.connections`, `profile.modes`, `profile.confidential` | DROPPED |
+* | `profile.resources.failOnError` | not consulted — the MCP path above is unconditionally fail-closed, which is the stricter reading |
+* | every other `profile.extensions.<ns>` | DROPPED — only the `pi` namespace is read |
+*
+* Closing those gaps belongs in `@tangle-network/agent-profile-materialize`, whose plan this
+* executor would then apply, rather than in a second mapping grown here.
+*
 * @experimental
 */
 /** The runtime name `piExecutor` registers under. */
@@ -1521,7 +1929,9 @@ const piExecutor = (spec, ctx) => {
 	const seam = readPiSeam(ctx);
 	const inbox = createInbox();
 	const activity = createActivityLog(seam.activityWindow ?? 12);
-	const trace = createPushTraceSource({ runId: `pi-${spec.profile.name ?? "worker"}-${Date.now()}` });
+	const runId = `pi-${spec.profile.name ?? "worker"}-${Date.now()}`;
+	const trace = createPushTraceSource({ runId });
+	const derived = [];
 	const controller = new AbortController();
 	const cascade = () => controller.abort();
 	if (ctx.signal.aborted) controller.abort();
@@ -1540,6 +1950,7 @@ const piExecutor = (spec, ctx) => {
 			turns: state.turns,
 			pendingMessages: inbox.pending(),
 			recentActivity: activity.read(),
+			...derived.length > 0 ? { derived: [...derived] } : {},
 			note: state.note
 		}),
 		traceSource: () => trace.source,
@@ -1550,8 +1961,10 @@ const piExecutor = (spec, ctx) => {
 				controller,
 				seam,
 				spec,
+				runId,
 				inbox,
 				activity,
+				derived,
 				record: (step) => {
 					trace.record(step);
 				},
@@ -1588,7 +2001,28 @@ async function* streamPiSession(args) {
 	let usdKnown = true;
 	throwIfAborted(args.signal);
 	throwIfAborted(args.controller.signal);
-	const proc = spawnPi(seam);
+	const piMcp = preparePiMcp(args.spec.profile, {
+		...seam.cwd !== void 0 ? { cwd: seam.cwd } : {},
+		runId: args.runId
+	});
+	if (piMcp.receipt) {
+		const injected = piMcp.receipt.adapterInjected ? ` (+${PI_MCP_ADAPTER} added)` : "";
+		activity.push({
+			at: Date.now(),
+			kind: "note",
+			label: "mcp",
+			detail: `${piMcp.receipt.servers.join(", ")}${injected}`
+		});
+		args.derived.push(`mcp: mounted ${piMcp.receipt.servers.join(", ")} via --mcp-config ${piMcp.receipt.configPath}`);
+		if (piMcp.receipt.adapterInjected) args.derived.push(`extensions: added ${PI_MCP_ADAPTER} to extensions.pi.load — the profile's own list would have run under --no-extensions and suppressed it, mounting zero servers`);
+	}
+	let proc;
+	try {
+		proc = spawnPi(seam, piMcp.args);
+	} catch (spawnFailure) {
+		piMcp.mount?.cleanup();
+		throw spawnFailure;
+	}
 	state.proc = proc;
 	state.note = "connected";
 	const events = [];
@@ -1704,6 +2138,7 @@ async function* streamPiSession(args) {
 		args.signal.removeEventListener("abort", abortAll);
 		args.controller.signal.removeEventListener("abort", abortAll);
 		await killPi(proc, 2e3).catch(() => ({ destroyed: false }));
+		piMcp.mount?.cleanup();
 	}
 	if (args.signal.aborted || args.controller.signal.aborted) throw abortError();
 	if (!lastAssistant) throw new ValidationError("piExecutor: agent_settled without an assistant turn");
@@ -1717,12 +2152,14 @@ async function* streamPiSession(args) {
 		...usdKnown ? {} : { usdKnown: false },
 		ms: Date.now() - started
 	};
+	const out = {
+		content: state.lastText,
+		turns: state.turns,
+		...piMcp.receipt ? { mcp: piMcp.receipt } : {}
+	};
 	state.artifact = {
 		outRef: `pi:${hash(state.lastText)}`,
-		out: {
-			content: state.lastText,
-			turns: state.turns
-		},
+		out,
 		spent
 	};
 }
@@ -1896,8 +2333,13 @@ function taskText(task) {
 		return String(task);
 	}
 }
-/** Launch `pi --mode rpc`, plus provider/model flags derived from the seam's `provider/model`. */
-function spawnPi(seam) {
+/**
+* Launch `pi --mode rpc`, plus provider/model flags derived from the seam's `provider/model` and
+* the profile-derived extension flags (`--no-extensions` / `--extension`). Seam args go LAST so an
+* operator's explicit flag wins over a derived one under pi's last-flag-wins parsing; RPC mode has
+* no positional prompt, so nothing here has to precede an argument.
+*/
+function spawnPi(seam, profileArgs = []) {
 	const bin = seam.bin ?? "pi";
 	const argv = ["--mode", "rpc"];
 	if (seam.model) {
@@ -1905,6 +2347,7 @@ function spawnPi(seam) {
 		if (slash > 0) argv.push("--provider", seam.model.slice(0, slash), "--model", seam.model.slice(slash + 1));
 		else argv.push("--model", seam.model);
 	}
+	argv.push(...profileArgs);
 	if (seam.args) argv.push(...seam.args);
 	return spawn(bin, argv, {
 		...seam.cwd ? { cwd: seam.cwd } : {},
@@ -4570,7 +5013,7 @@ function createCoordinationTools(opts) {
 		},
 		{
 			name: "observe_agent",
-			description: "Inspect a worker WHILE IT RUNS, not only after it finishes: status, spend so far, and `progress` — how long since it last did anything (`idleMs`), whether that counts as stalled, how many turns it has taken, the last tools/files it touched (`recentActivity`), whether a steer can even reach it (`steerable`), and how many steers it has not yet read (`pendingMessages`). Returns the settled output artifact once it exists. Use this BEFORE steer_agent: a steer is only worth sending when the progress says the worker is on the wrong path or has stopped making any.",
+			description: "Inspect a worker WHILE IT RUNS, not only after it finishes: status, spend so far, and `progress` — how long since it last did anything (`idleMs`), whether that counts as stalled, how many turns it has taken, the last tools/files it touched (`recentActivity`), what its executor CHANGED about the profile you gave it (`derived` — an MCP config it materialized, an extension it had to add), whether a steer can even reach it (`steerable`), and how many steers it has not yet read (`pendingMessages`). Returns the settled output artifact once it exists. Use this BEFORE steer_agent: a steer is only worth sending when the progress says the worker is on the wrong path or has stopped making any.",
 			inputSchema: {
 				type: "object",
 				properties: { workerId: idArg },
@@ -5435,22 +5878,24 @@ function driverAgent(opts) {
 			let driverTurn = 0;
 			const meteredBrain = async (messages, tools, detail) => {
 				const res = await opts.brain(messages, tools);
-				if (res.usage || res.costUsd !== void 0) {
-					const turnSpend = {
-						iterations: 0,
-						tokens: {
-							input: res.usage?.input ?? 0,
-							output: res.usage?.output ?? 0
-						},
-						usd: res.costUsd ?? 0,
-						ms: 0
-					};
-					await scope.meter(turnSpend, {
-						driver: opts.name,
-						toolCalls: (res.toolCalls ?? []).map((c) => c.name),
-						...detail
-					});
-				}
+				const nothingReported = res.usage === void 0 && res.costUsd === void 0;
+				const turnSpend = {
+					iterations: 0,
+					tokens: {
+						input: res.usage?.input ?? 0,
+						output: res.usage?.output ?? 0
+					},
+					...res.usage === void 0 ? { tokensKnown: false } : {},
+					usd: res.costUsd ?? 0,
+					...nothingReported ? { usdKnown: false } : {},
+					ms: 0
+				};
+				await scope.meter(turnSpend, {
+					driver: opts.name,
+					toolCalls: (res.toolCalls ?? []).map((c) => c.name),
+					...res.usageUnknown === true ? { streamUsageMissing: true } : {},
+					...detail
+				});
 				return res;
 			};
 			const chat = async (messages, tools) => {
@@ -7927,6 +8372,6 @@ function supervise(profile, task, opts) {
 	return start();
 }
 //#endregion
-export { InMemoryDelegationStore as $, DELEGATE_INPUT_SCHEMA as A, createWorktreeCliExecutor as At, profileRichnessFinding as B, createSandboxForSpec as Bt, validateDelegateUiAuditArgs as C, defaultToolDetectors as Ct, createDelegateFeedbackHandler as D, cliWorktreeExecutor as Dt, DELEGATE_FEEDBACK_TOOL_NAME as E, createInMemoryRunContext as Et, delegate as F, piSeamKey as Ft, DELEGATION_TRACE_MAX_SPANS as G, probeSandboxCapabilities as Gt, DelegationTaskQueue as H, runAgentRounds as Ht, asAuthoredProfile as I, createPushTraceSource as It, composeLoopTraceEmitters as J, assertModelAllowed as Jt, buildDelegationTraceSpans as K, acquireSandbox as Kt, assessAuthoredProfile as L, decodeToolPart as Lt, createDelegateHandler as M, createSteerableSandboxSession as Mt, validateDelegateArgs as N, PI_RUNTIME as Nt, validateDelegateFeedbackArgs as O, createExecutor as Ot, defaultDelegateBudget as P, piExecutor as Pt, FileDelegationStore as Q, authoredWorker as R, sandboxSessionTraceSource as Rt, createDelegateUiAuditHandler as S, rollingDispatch as St, DELEGATE_FEEDBACK_INPUT_SCHEMA as T, createFileRunContext as Tt, hashIdempotencyInput as U, runLoop as Ut, supervisorInstructions as V, defaultSelectWinner as Vt, DELEGATION_TRACE_MAX_BYTES as W, createSandboxLineage as Wt, DelegationPersistenceError as X, createDelegationTraceCollector as Y, gateOnDeliverable as Yt, DelegationStateCorruptError as Z, createDelegationHistoryHandler as _, createCoordinationTools as _t, supervisorAgent as a, allWorkersStalled as at, DELEGATE_UI_AUDIT_INPUT_SCHEMA as b, freeSlots as bt, createMcpServer as c, noProgressFor as ct, DELEGATION_STATUS_TOOL_NAME as d, anytimeReport as dt, InMemoryFeedbackStore as et, createDelegationStatusHandler as f, areaUnderCurve as ft, DELEGATION_HISTORY_TOOL_NAME as g, DEFAULT_AWAIT_EVENT_TIMEOUT_MS as gt, DELEGATION_HISTORY_INPUT_SCHEMA as h, renderAnytimeTable as ht, resolveSupervisorProfile as i, allOf as it, DELEGATE_TOOL_NAME as j, DEFAULT_SANDBOX_STEERING_MAX_TURNS as jt, DELEGATE_DESCRIPTION as k, createExecutorRegistry as kt, DELEGATION_STATUS_DESCRIPTION as l, plateau as lt, DELEGATION_HISTORY_DESCRIPTION as m, plateauLength as mt, workerFromBackend as n, driverAgent as nt, serveCoordinationMcp as o, anyOf as ot, validateDelegationStatusArgs as p, bestSoFar as pt, capDelegationTrace as q, FileCoordinationLog as qt, assertCoordinationBinding as r, finalizeBestDelivered as rt, createInProcessTransport as s, createProgressTracker as st, supervise as t, eventToSnapshot as tt, DELEGATION_STATUS_INPUT_SCHEMA as u, sampleFromSettled as ut, validateDelegationHistoryArgs as v, createEventBus as vt, DELEGATE_FEEDBACK_DESCRIPTION as w, watchTrace as wt, DELEGATE_UI_AUDIT_TOOL_NAME as x, queueOf as xt, DELEGATE_UI_AUDIT_DESCRIPTION as y, effectiveConcurrency as yt, defaultProfileRichnessThresholds as z, createInbox as zt };
+export { InMemoryDelegationStore as $, FileCoordinationLog as $t, DELEGATE_INPUT_SCHEMA as A, createWorktreeCliExecutor as At, profileRichnessFinding as B, PI_MCP_ADAPTER_ENV as Bt, validateDelegateUiAuditArgs as C, defaultToolDetectors as Ct, createDelegateFeedbackHandler as D, cliWorktreeExecutor as Dt, DELEGATE_FEEDBACK_TOOL_NAME as E, createInMemoryRunContext as Et, delegate as F, piSeamKey as Ft, DELEGATION_TRACE_MAX_SPANS as G, createInbox as Gt, DelegationTaskQueue as H, buildPiMcpServers as Ht, asAuthoredProfile as I, createPushTraceSource as It, composeLoopTraceEmitters as J, runAgentRounds as Jt, buildDelegationTraceSpans as K, createSandboxForSpec as Kt, assessAuthoredProfile as L, decodeToolPart as Lt, createDelegateHandler as M, createSteerableSandboxSession as Mt, validateDelegateArgs as N, PI_RUNTIME as Nt, validateDelegateFeedbackArgs as O, createExecutor as Ot, defaultDelegateBudget as P, piExecutor as Pt, FileDelegationStore as Q, acquireSandbox as Qt, authoredWorker as R, sandboxSessionTraceSource as Rt, createDelegateUiAuditHandler as S, rollingDispatch as St, DELEGATE_FEEDBACK_INPUT_SCHEMA as T, createFileRunContext as Tt, hashIdempotencyInput as U, piMcpAdapterAvailable as Ut, supervisorInstructions as V, PI_MCP_CONFIG_FLAG as Vt, DELEGATION_TRACE_MAX_BYTES as W, preparePiMcp as Wt, DelegationPersistenceError as X, createSandboxLineage as Xt, createDelegationTraceCollector as Y, runLoop as Yt, DelegationStateCorruptError as Z, probeSandboxCapabilities as Zt, createDelegationHistoryHandler as _, createCoordinationTools as _t, supervisorAgent as a, allWorkersStalled as at, DELEGATE_UI_AUDIT_INPUT_SCHEMA as b, freeSlots as bt, createMcpServer as c, noProgressFor as ct, DELEGATION_STATUS_TOOL_NAME as d, anytimeReport as dt, assertModelAllowed as en, InMemoryFeedbackStore as et, createDelegationStatusHandler as f, areaUnderCurve as ft, DELEGATION_HISTORY_TOOL_NAME as g, DEFAULT_AWAIT_EVENT_TIMEOUT_MS as gt, DELEGATION_HISTORY_INPUT_SCHEMA as h, renderAnytimeTable as ht, resolveSupervisorProfile as i, allOf as it, DELEGATE_TOOL_NAME as j, DEFAULT_SANDBOX_STEERING_MAX_TURNS as jt, DELEGATE_DESCRIPTION as k, createExecutorRegistry as kt, DELEGATION_STATUS_DESCRIPTION as l, plateau as lt, DELEGATION_HISTORY_DESCRIPTION as m, plateauLength as mt, workerFromBackend as n, driverAgent as nt, serveCoordinationMcp as o, anyOf as ot, validateDelegationStatusArgs as p, bestSoFar as pt, capDelegationTrace as q, defaultSelectWinner as qt, assertCoordinationBinding as r, finalizeBestDelivered as rt, createInProcessTransport as s, createProgressTracker as st, supervise as t, gateOnDeliverable as tn, eventToSnapshot as tt, DELEGATION_STATUS_INPUT_SCHEMA as u, sampleFromSettled as ut, validateDelegationHistoryArgs as v, createEventBus as vt, DELEGATE_FEEDBACK_DESCRIPTION as w, watchTrace as wt, DELEGATE_UI_AUDIT_TOOL_NAME as x, queueOf as xt, DELEGATE_UI_AUDIT_DESCRIPTION as y, effectiveConcurrency as yt, defaultProfileRichnessThresholds as z, PI_MCP_ADAPTER as zt };
 
-//# sourceMappingURL=supervise-S7glOjJH.js.map
+//# sourceMappingURL=supervise-tdxMJYem.js.map