@themoltnet/pi-runtime 0.16.0 → 0.18.0

package/dist/index.d.ts

@@ -461,6 +461,11 @@ export declare function decideForEvent(event: ToolCallEvent, policy: SessionTool
  * 4. **Output redirection** — a `bash` command that redirects output (`>`,
  *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
  *    through structured tools.
+ * 5. **Execution-redirecting environment prefixes** — a `VAR=value` prefix that
+ *    changes which binary argv names or injects code into it (`PATH`, `LD_*`,
+ *    `BASH_ENV`, …; see {@link UNSAFE_ENV_NAMES}). Such a prefix is not argv, so
+ *    the matched rule would describe a different program than the one that runs.
+ *    Benign assignments are unaffected.
  *
  * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
  * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
@@ -1529,13 +1534,41 @@ export declare interface ToolPolicyDecisionContext {
  * - `{ allow: false, reason }` — block it (enforce mode).
  * - `{ audit, ... }` — would-block, but proceed and record it (watch mode).
  */
-export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'tool_not_permitted';
+export declare type ToolPolicyDecisionReason = 'policy_off' | 'executor_protocol_tool' | 'policy_allowed' | 'shell_command_prefix_allowed' | 'shell_command_unresolvable' | 'arbitrary_code_interpreter' | 'shell_output_redirection_not_permitted' | 'unsafe_environment_assignment' | 'tool_not_permitted';
+
+/**
+ * A refusal, shaped for the task record. Carries no argv literals: the
+ * executables and the fingerprint identify an invocation without reproducing
+ * its arguments, which is what lets this reach a persisted, readable record
+ * with no redaction rule.
+ */
+declare interface ToolPolicyDecisionRecord {
+    /** `blocked` in enforce, `would_block` in watch. */
+    decision: 'blocked' | 'would_block';
+    tool_name: string;
+    tool_call_id?: string;
+    reason_code: ToolPolicyDecisionReason;
+    enforcement: ToolEnforcement;
+    /** Executables the policy did not authorize. */
+    unauthorized_executables?: string[];
+    /** Literal-free identification of each refused shell invocation. */
+    shell_fingerprints?: MissingShellCommand[];
+    degraded: boolean;
+    policy_snapshot_hash?: string;
+    runtime_profile_revision?: number;
+}
 
 export declare interface ToolPolicyExtensionDeps {
     policy: SessionToolPolicy;
     analyzer: ShellCommandAnalyzer;
     logger: ToolPolicyLogger;
     context?: ToolPolicyDecisionContext;
+    /**
+     * Called for every refusal so it reaches the task record, not only the
+     * daemon log. Pi's `tool_call` handler is synchronous, so this must not
+     * block: implementations fire and forget.
+     */
+    onDecision?: (decision: ToolPolicyDecisionRecord) => void;
 }
 
 /**

package/dist/index.js

@@ -2285,7 +2285,7 @@ function createMoltNetTools(config) {
 }
 //#endregion
 //#region src/otel/index.ts
-var TRACER_NAME = "@themoltnet/pi-extension/otel";
+var TRACER_NAME$1 = "@themoltnet/pi-extension/otel";
 function stripReservedAttrs(attrs) {
 	const out = {};
 	for (const [k, v] of Object.entries(attrs)) {
@@ -2296,7 +2296,7 @@ function stripReservedAttrs(attrs) {
 }
 function createPiOtelExtension(options = {}) {
 	return function piOtelExtension(pi) {
-		const tracer = trace.getTracer(TRACER_NAME);
+		const tracer = trace.getTracer(TRACER_NAME$1);
 		const extraAttrs = stripReservedAttrs(options.spanAttributes ?? {});
 		let sessionSpan;
 		let sessionCtx = context.active();
@@ -3946,8 +3946,123 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 	} };
 }
 //#endregion
+//#region src/tool-policy/decision-sink.ts
+function createToolPolicyDecisionSink(emit) {
+	const pending = [];
+	return {
+		record(record) {
+			try {
+				pending.push(Promise.resolve(emit(record)).catch(() => void 0));
+			} catch {}
+		},
+		async drain() {
+			while (pending.length > 0) {
+				const batch = pending.splice(0, pending.length);
+				await Promise.all(batch);
+			}
+		},
+		get size() {
+			return pending.length;
+		}
+	};
+}
+//#endregion
+//#region src/redact.ts
+var REDACTED = "[redacted]";
+/**
+* Replace values matching well-known credential shapes.
+*
+* Shape matching only: it catches the common accident (a pasted token, a
+* bearer header, an `env` dump) and nothing else. It is not a guarantee that a
+* string is free of secrets, and must never be described as one. Content-aware
+* processing is #1294's job; this is the cheap layer that composes with it.
+*/
+function redactKnownSecretShapes(value) {
+	return value.replace(/((?:bearer|basic)\s+)[a-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`).replace(/\bgh[pousr]_[a-z0-9_]{20,}\b/gi, REDACTED).replace(/\bsk-[a-z0-9_-]{16,}\b/gi, REDACTED).replace(/\beyJ[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\b/gi, REDACTED);
+}
+//#endregion
+//#region src/tool-policy/sanitize.ts
+/**
+* What a plausible executable name looks like once the analyzer has stripped
+* any directory: a bounded token of portable filename characters, plus the
+* punctuation that names real shell builtins (`:`, `[`).
+*/
+var PLAUSIBLE_EXECUTABLE = /^[A-Za-z0-9._@+:[\]-]{1,64}$/;
+/** Stands in for a command name we will not reproduce. */
+var UNREPORTABLE_EXECUTABLE = "<unreportable>";
+/**
+* Bound a command name before it reaches a durable sink.
+*
+* The executable name is model-controlled: whatever the model writes in
+* command position becomes the "executable" the gate reports, and refusals are
+* persisted to the task record, the daemon log and the trace. Without this, a
+* secret written in command position is copied verbatim into all three, which
+* is exactly the content those records are supposed not to carry.
+*
+* Two bounds, in order:
+*
+* 1. Known credential shapes are redacted outright.
+* 2. Anything that does not look like an executable name — too long, or
+*    outside portable filename characters — is replaced wholesale.
+*
+* Limits, stated plainly: this bounds the *shape* of what is reported. A short
+* secret made only of filename characters and matching no known token shape
+* still passes, and the {@link MissingShellCommand} fingerprint remains the
+* reliable identifier. Narrowing further would mean refusing to name the
+* program an operator needs to see, so this is the deliberate stopping point
+* until #1294's content-aware processing can be applied here too.
+*/
+function sanitizeExecutableName(name) {
+	if (redactKnownSecretShapes(name) !== name) return UNREPORTABLE_EXECUTABLE;
+	return PLAUSIBLE_EXECUTABLE.test(name) ? name : UNREPORTABLE_EXECUTABLE;
+}
+//#endregion
 //#region src/tool-policy/gate.ts
 /**
+* Environment variables that decide *which* binary an argv names, or inject
+* code into whichever one runs. A `VAR=value` prefix is not argv, so no
+* argv-prefix rule can describe it: `PATH=/tmp ls -la` matches a rule granting
+* `ls -la` while running an entirely different `ls`.
+*
+* Deliberately a short list of the loader, shell and interpreter entry points,
+* not a model of every program's configuration. Program-specific variables are
+* the same long tail as the analyzer's escape-flag table, and the ones git
+* honours are included because that table already models their `-c` twins.
+* What a process can reach once running is the sandbox's job (#2025).
+*/
+var UNSAFE_ENV_PREFIXES = ["LD_", "DYLD_"];
+var UNSAFE_ENV_NAMES = new Set([
+	"PATH",
+	"CDPATH",
+	"IFS",
+	"ENV",
+	"BASH_ENV",
+	"SHELLOPTS",
+	"BASHOPTS",
+	"PS4",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PYTHONHOME",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"NODE_OPTIONS",
+	"CLASSPATH",
+	"JAVA_TOOL_OPTIONS",
+	"GIT_SSH",
+	"GIT_SSH_COMMAND",
+	"GIT_EXTERNAL_DIFF",
+	"GIT_PAGER",
+	"GIT_EDITOR",
+	"GIT_SEQUENCE_EDITOR",
+	"GIT_EXEC_PATH"
+]);
+function isUnsafeEnvName(name) {
+	const upper = name.toUpperCase();
+	return UNSAFE_ENV_NAMES.has(upper) || UNSAFE_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+/**
 * Decide whether a tool call is permitted by the resolved policy.
 *
 * Fail-closed in `enforce` (audited-but-allowed in `watch`, no-op in `off`) for:
@@ -3968,6 +4083,11 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace, config) {
 * 4. **Output redirection** — a `bash` command that redirects output (`>`,
 *    `2>`, `>>`, `&>`, …). No shell-command rule authorizes it; file writes go
 *    through structured tools.
+* 5. **Execution-redirecting environment prefixes** — a `VAR=value` prefix that
+*    changes which binary argv names or injects code into it (`PATH`, `LD_*`,
+*    `BASH_ENV`, …; see {@link UNSAFE_ENV_NAMES}). Such a prefix is not argv, so
+*    the matched rule would describe a different program than the one that runs.
+*    Benign assignments are unaffected.
 *
 * KNOWN LIMITATION (follow-up): the `escapable` risk tier (GTFOBins binaries
 * like `find`, `tar`, `awk` that document shell-spawn / file-write techniques)
@@ -3988,10 +4108,12 @@ function decideToolCall(input) {
 	};
 	const resolved = resolveNames(input);
 	if (resolved.kind === "unresolvable") return fenced(input.enforcement, "shell_command_unresolvable", "shell command could not be statically authorized", "unresolvable shell command (watch)");
-	const arbitraryCode = [...new Set(resolved.tools.filter((tool) => tool.risk === "arbitrary-code").map((tool) => tool.name))];
+	const unsafeEnv = (resolved.envAssignments ?? []).filter(isUnsafeEnvName);
+	if (unsafeEnv.length > 0) return fenced(input.enforcement, "unsafe_environment_assignment", `environment assignment not permitted by tool policy: ${unsafeEnv.join(", ")}`, `would block — environment assignment (watch): ${unsafeEnv.join(", ")}`, unsafeEnv);
+	const arbitraryCode = [...new Set(resolved.tools.filter((tool) => tool.risk === "arbitrary-code").map((tool) => sanitizeExecutableName(tool.name)))];
 	if (arbitraryCode.length > 0) return fenced(input.enforcement, "arbitrary_code_interpreter", `arbitrary-code interpreter not authorizable by tool policy: ${arbitraryCode.join(", ")}`, `would block — arbitrary-code interpreter (watch): ${arbitraryCode.join(", ")}`, arbitraryCode);
 	if (input.toolName !== "bash") {
-		const missing = resolved.tools.map((tool) => tool.name).filter((name) => !input.allowedTools.has(name));
+		const missing = resolved.tools.filter((tool) => !input.allowedTools.has(tool.name)).map((tool) => sanitizeExecutableName(tool.name));
 		if (missing.length === 0) return {
 			allow: true,
 			reasonCode: "policy_allowed"
@@ -4030,14 +4152,14 @@ function fingerprintArgv(argv) {
 }
 function toMatchedShellCommand(executable, argvPrefix) {
 	return {
-		executable,
+		executable: sanitizeExecutableName(executable),
 		argvPrefixFingerprint: fingerprintArgv(argvPrefix),
 		argvPrefixLength: argvPrefix.length
 	};
 }
 function toMissingShellCommand(tool) {
 	return {
-		executable: tool.name,
+		executable: sanitizeExecutableName(tool.name),
 		argvFingerprint: fingerprintArgv(tool.argv),
 		argvLength: tool.argv.length,
 		dynamicTokenCount: tool.argv.filter((token) => token === null).length
@@ -4093,12 +4215,94 @@ function resolveNames(input) {
 			argv: tool.argv,
 			risk: tool.risk
 		})),
-		hasOutputRedirection: analysis.hasOutputRedirection === true
+		hasOutputRedirection: analysis.hasOutputRedirection === true,
+		envAssignments: analysis.envAssignments
 	} : {
 		kind: "unresolvable",
 		reason: analysis.reason
 	};
 }
+//#endregion
+//#region src/tool-policy/telemetry.ts
+var METER_NAME$1 = "@themoltnet/pi-extension/tool-policy";
+/**
+* Counts every tool-policy decision.
+*
+* A decision reaches four sinks, each answering a different question:
+*
+* - **task record** (`tool_policy_decision` message) — the durable, per-attempt
+*   evidence an operator reads to see what was refused and under which policy.
+* - **this counter** — aggregate rates and alerting. Bounded attributes only;
+*   correlation ids deliberately live in the other three.
+* - **span** ({@link recordToolPolicyDecisionSpan}) — trace-level evidence. The
+*   gate refuses at pi's `tool_call` event, earlier than the
+*   `tool_execution_start` that creates `execute_tool`, so without it a blocked
+*   call appears in no trace at all.
+* - **daemon log** — local diagnostics. Not exported today; see #2326.
+*
+* Allowed decisions are counted too — without the denominator a refusal count
+* cannot be read as a rate.
+*/
+var decisionCounter = null;
+function getDecisionCounter() {
+	decisionCounter ??= metrics.getMeter(METER_NAME$1).createCounter("agent_runtime.tool_policy.decisions", {
+		description: "Runtime tool-policy decisions by outcome, reason and enforcement mode.",
+		unit: "1"
+	});
+	return decisionCounter;
+}
+/**
+* Attributes are deliberately low-cardinality: outcome, reason code,
+* enforcement mode and the degraded flag are all small closed sets. Task,
+* team, lease and tool-call ids are never attached — they are unbounded, and
+* the collector strips task ids from public metric datapoints anyway. The
+* per-decision detail lives in the task record instead.
+*/
+function recordToolPolicyDecisionMetric(metric) {
+	try {
+		getDecisionCounter().add(1, {
+			decision: metric.decision,
+			reason: metric.reason,
+			enforcement: metric.enforcement,
+			degraded: String(metric.degraded)
+		});
+	} catch {}
+}
+var TRACER_NAME = "@themoltnet/pi-extension/tool-policy";
+/**
+* Record a refusal on the trace.
+*
+* A blocked call has no span of its own otherwise: the gate refuses at pi's
+* `tool_call` event, which is earlier than the `tool_execution_start` that
+* creates `execute_tool`, so the call simply never appears. This span is that
+* missing evidence, parented to the live session span so it lands in the same
+* trace as the turn that attempted it.
+*
+* Unlike the counter, a span tolerates high cardinality, so it carries the
+* correlation fields the metric deliberately leaves off. It still carries no
+* argv literals — the executables and the record's fingerprints identify the
+* invocation without reproducing its arguments.
+*
+* The status is left UNSET on purpose: a refusal is the policy working, not a
+* system fault, and marking it ERROR would put correct behaviour in error views.
+*/
+function recordToolPolicyDecisionSpan(input, parentContext, correlation = {}) {
+	try {
+		const attributes = {
+			...correlation,
+			"moltnet.tool_policy.decision": input.decision,
+			"moltnet.tool_policy.reason": input.reason_code,
+			"moltnet.tool_policy.enforcement": input.enforcement,
+			"moltnet.tool_policy.degraded": input.degraded,
+			"gen_ai.tool.name": input.tool_name,
+			...input.policy_snapshot_hash ? { "moltnet.tool_policy.snapshot_hash": input.policy_snapshot_hash } : {},
+			...input.runtime_profile_revision !== void 0 ? { "moltnet.runtime_profile.revision": input.runtime_profile_revision } : {},
+			...input.unauthorized_executables?.length ? { "moltnet.tool_policy.unauthorized_executables": input.unauthorized_executables } : {}
+		};
+		const tracer = trace.getTracer(TRACER_NAME);
+		(parentContext ? tracer.startSpan("moltnet.tool_policy.decision", { attributes }, parentContext) : tracer.startSpan("moltnet.tool_policy.decision", { attributes })).end();
+	} catch {}
+}
 /**
 * Resolve the session's tool policy at start-up.
 *
@@ -4222,6 +4426,12 @@ function createToolPolicyExtension(deps) {
 					reason: decision.reasonCode,
 					...decision.matchedShellCommands?.length ? { shellFingerprints: decision.matchedShellCommands } : {}
 				}, "tool_policy.allowed");
+				recordToolPolicyDecisionMetric({
+					decision: "allowed",
+					reason: decision.reasonCode,
+					enforcement: deps.policy.enforcement,
+					degraded: deps.policy.degraded === true
+				});
 				return;
 			}
 			if ("audit" in decision) {
@@ -4231,9 +4441,10 @@ function createToolPolicyExtension(deps) {
 					toolCallId: event.toolCallId,
 					decision: "audit",
 					reason: decision.reasonCode,
-					...decision.missing?.length ? { missingExecutables: decision.missing } : {},
+					...decision.missing?.length ? { unauthorizedExecutables: decision.missing } : {},
 					...decision.missingShellCommands?.length ? { shellFingerprints: decision.missingShellCommands } : {}
 				}, "tool_policy.audit");
+				reportDecision(deps, "would_block", event, decision);
 				return;
 			}
 			deps.logger.warn({
@@ -4242,9 +4453,10 @@ function createToolPolicyExtension(deps) {
 				toolCallId: event.toolCallId,
 				decision: "blocked",
 				reason: decision.reasonCode,
-				...decision.missing?.length ? { missingExecutables: decision.missing } : {},
+				...decision.missing?.length ? { unauthorizedExecutables: decision.missing } : {},
 				...decision.missingShellCommands?.length ? { shellFingerprints: decision.missingShellCommands } : {}
 			}, "tool_policy.blocked");
+			reportDecision(deps, "blocked", event, decision);
 			return {
 				block: true,
 				reason: decision.reason
@@ -4252,6 +4464,37 @@ function createToolPolicyExtension(deps) {
 		});
 	};
 }
+/**
+* Hand a refusal to {@link ToolPolicyExtensionDeps.onDecision}, never letting a
+* reporting failure change the gate's verdict.
+*/
+function reportDecision(deps, decision, event, gateDecision) {
+	recordToolPolicyDecisionMetric({
+		decision,
+		reason: gateDecision.reasonCode,
+		enforcement: deps.policy.enforcement,
+		degraded: deps.policy.degraded === true
+	});
+	if (!deps.onDecision) return;
+	const missing = "missing" in gateDecision ? gateDecision.missing : void 0;
+	const shell = "missingShellCommands" in gateDecision ? gateDecision.missingShellCommands : void 0;
+	try {
+		deps.onDecision({
+			decision,
+			tool_name: event.toolName,
+			...event.toolCallId ? { tool_call_id: event.toolCallId } : {},
+			reason_code: gateDecision.reasonCode,
+			enforcement: deps.policy.enforcement,
+			...missing?.length ? { unauthorized_executables: missing } : {},
+			...shell?.length ? { shell_fingerprints: shell } : {},
+			degraded: deps.policy.degraded === true,
+			...deps.policy.executionPolicySnapshotHash ? { policy_snapshot_hash: deps.policy.executionPolicySnapshotHash } : {},
+			...deps.policy.executionRuntimeProfileRevision !== void 0 ? { runtime_profile_revision: deps.policy.executionRuntimeProfileRevision } : {}
+		});
+	} catch (error) {
+		deps.logger.warn({ err: error instanceof Error ? error.message : String(error) }, "tool_policy.decision_report_failed");
+	}
+}
 function decisionContext(deps) {
 	return {
 		...deps.context ?? {},
@@ -4401,7 +4644,6 @@ async function resolvePriorContext(agent, continueFrom) {
 //#region src/runtime/retry-triage.ts
 var MAX_TRIAGE_JSON_CHARS = 12e3;
 var MAX_TRIAGE_FIELD_CHARS = 2e3;
-var REDACTED = "[redacted]";
 var SECRET_KEY_PATTERN = /(?:api[_-]?key|token|secret|password|passwd|credential|authorization|private[_-]?key|access[_-]?token|refresh[_-]?token)/i;
 function createPiRetryTriage(options) {
 	return async (input) => {
@@ -4534,7 +4776,7 @@ function redactAndTruncate(value, path) {
 	return value;
 }
 function redactRetryTriageSecrets(value) {
-	return value.replace(/((?:bearer|basic)\s+)[a-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`).replace(/\bgh[pousr]_[a-z0-9_]{20,}\b/gi, REDACTED).replace(/\bsk-[a-z0-9_-]{16,}\b/gi, REDACTED).replace(/\beyJ[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\.[a-z0-9_-]{20,}\b/gi, REDACTED);
+	return redactKnownSecretShapes(value);
 }
 function truncateString(value, maxChars) {
 	if (value.length <= maxChars) return value;
@@ -5517,6 +5759,7 @@ function summarizePayloadForLog(kind, payload) {
 			phase: payload.phase,
 			message: typeof payload.message === "string" ? payload.message.slice(0, LOG_TRUNCATE_LIMIT) : payload.message
 		};
+		case "tool_policy_decision": return payload;
 		case "info": return Object.fromEntries(Object.entries(payload).map(([k, v]) => [k, typeof v === "string" ? v.slice(0, LOG_TRUNCATE_LIMIT) : v]));
 		default: return payload;
 	}
@@ -6053,6 +6296,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 	let reporterOpen = opts.reporterAlreadyOpened ?? false;
 	let managed = null;
 	let session = null;
+	const policyDecisionSink = createToolPolicyDecisionSink((record) => emit("tool_policy_decision", { ...record }));
 	let piSessionContext;
 	let providerRequestContext;
 	let subagentHandle = null;
@@ -6438,7 +6682,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			const piAuthDir = resolvePiCodingAgentDir();
 			const { modelHandle, modelRuntime } = await resolveRuntimeProfileModel(piAuthDir, opts.provider, opts.model, opts.runtimeProfileId);
 			const injectedSkills = injectedContext.skills;
-			const toolPolicyExtensions = [];
+			let buildToolPolicyExtensions = () => [];
 			let resolvedToolPolicy;
 			let unavailableRuntimeShellCommands = [];
 			let verifiedGuestExecutables = [];
@@ -6477,12 +6721,24 @@ async function executePiTask(claimedTask, reporter, opts) {
 						...policy,
 						allowedShellCommands
 					};
-					toolPolicyExtensions.push(createToolPolicyExtension({
-						policy: resolvedToolPolicy,
+					const sessionPolicy = resolvedToolPolicy;
+					buildToolPolicyExtensions = (execution) => [createToolPolicyExtension({
+						policy: sessionPolicy,
 						analyzer,
 						logger: toolPolicyLogger,
-						context: toolPolicyDecisionContext
-					}));
+						context: toolPolicyDecisionContext,
+						onDecision: (record) => {
+							recordToolPolicyDecisionSpan(record, piSessionContext, {
+								"moltnet.task.id": task.id,
+								"moltnet.task.attempt": attemptN,
+								"moltnet.execution.kind": execution
+							});
+							policyDecisionSink.record({
+								...record,
+								execution
+							});
+						}
+					})];
 				}
 			}
 			capabilityRouter?.setPolicy(resolvedToolPolicy ? {
@@ -6609,7 +6865,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 					parentAttemptN: attemptN,
 					contractRegistry: opts.subagentContractRegistry,
 					parentCancelSignal: reporter.cancelSignal,
-					extraExtensionFactories: [...runtimeSubagentExtensions, ...toolPolicyExtensions]
+					extraExtensionFactories: [...runtimeSubagentExtensions, ...buildToolPolicyExtensions("subagent")]
 				});
 				parentSubagentTools.push(subagentHandle.tool);
 			}
@@ -6658,7 +6914,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				sessionPersistence: executionPlan?.sessionPersistence ?? void 0,
 				extraExtensionFactories: [
 					...runtimeParentExtensions,
-					...toolPolicyExtensions,
+					...buildToolPolicyExtensions("parent"),
 					submitCompletion.extension
 				]
 			}));
@@ -6783,6 +7039,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			event: "subagent_summary",
 			callCount: subagentHandle.getCallCount()
 		});
+		await policyDecisionSink.drain();
 		await Promise.all([...recordingPromise, ...sandboxRetirementEvents]);
 		const cancelled = reporter.cancelSignal.aborted;
 		let parsedOutput = null;
@@ -6863,6 +7120,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 	} catch (err) {
 		return makeFailedOutput("executor_unexpected_error", err instanceof Error ? err.message : String(err));
 	} finally {
+		await policyDecisionSink.drain();
 		await cleanupAttempt({
 			cancelSignal: reporter.cancelSignal,
 			cancelListener,

package/dist/pi-config.d.ts

@@ -1,8 +1,30 @@
+/**
+ * Every input modality Pi understands. Canonical for the repo: daemon
+ * validation, CLI parsing and wire schemas derive their allowed values from
+ * this list so they cannot drift from what Pi actually accepts.
+ */
+export declare const PI_MODEL_MODALITIES: readonly ["text", "image"];
+
+/** Input modalities Pi understands for a model entry. */
+export declare type PiModelModality = (typeof PI_MODEL_MODALITIES)[number];
+
+/**
+ * A model entry in Pi's `models.json`. `input` declares the modalities the
+ * model accepts. Pi treats an entry with no `input` as text-only, so a vision
+ * model must declare `['text', 'image']` or image content parts never reach
+ * the provider.
+ */
+export declare interface PiModelSpec {
+    id: string;
+    input?: readonly PiModelModality[];
+}
+
 export declare interface WriteMultiProviderPiConfigInput extends WritePiConfigBase {
     /** Provider registry keyed by Pi provider id. */
     providers: Readonly<Record<string, WritePiProviderInput>>;
     provider?: never;
     model?: never;
+    input?: never;
     baseUrl?: never;
     apiKeyEnvRef?: never;
 }
@@ -27,8 +49,8 @@ export declare interface WritePiProviderInput {
     api: string;
     /** Provider base URL. */
     baseUrl: string;
-    /** Model ids exposed by this provider. */
-    models: readonly string[];
+    /** Models exposed by this provider. */
+    models: readonly PiModelSpec[];
     /** Optional Pi environment placeholder, e.g. `$OLLAMA_API_KEY`. */
     apiKeyEnvRef?: string;
 }
@@ -38,6 +60,8 @@ export declare interface WriteSingleProviderPiConfigInput extends WritePiConfigB
     provider: string;
     /** Pi model id, e.g. `qwen3-coder:480b-cloud`. */
     model: string;
+    /** Input modalities for `model`. Omitted leaves Pi's text-only default. */
+    input?: readonly PiModelModality[];
     /**
      * OpenAI-completions base URL for the provider. Defaults to Ollama Cloud.
      */

package/dist/pi-config.js

@@ -3,6 +3,22 @@ import { join } from "node:path";
 //#region src/pi-config.ts
 /** Node-only writer used by daemon serve runs and live evals. */
 /**
+* Every input modality Pi understands. Canonical for the repo: daemon
+* validation, CLI parsing and wire schemas derive their allowed values from
+* this list so they cannot drift from what Pi actually accepts.
+*/
+var PI_MODEL_MODALITIES = ["text", "image"];
+/**
+* Normalise a model entry to Pi's on-disk shape. `input` is emitted only when
+* declared, so a text-only model serializes as a bare `{ id }`.
+*/
+function toPiModel(entry) {
+	return {
+		id: entry.id,
+		...entry.input && entry.input.length > 0 ? { input: [...entry.input] } : {}
+	};
+}
+/**
 * Write Pi `models.json` + `settings.json`. Eval callers use the single-provider
 * form so scores stay attributable; serve callers may supply many providers.
 */
@@ -12,12 +28,15 @@ function writePiConfig(input) {
 		api: provider.api,
 		...provider.apiKeyEnvRef ? { apiKey: provider.apiKeyEnvRef } : {},
 		baseUrl: provider.baseUrl,
-		models: provider.models.map((id) => ({ id }))
+		models: provider.models.map(toPiModel)
 	}])) : { [input.provider]: {
 		api: "openai-completions",
 		apiKey: input.apiKeyEnvRef ?? "$OLLAMA_API_KEY",
 		baseUrl: input.baseUrl ?? "https://ollama.com/v1",
-		models: [{ id: input.model }]
+		models: [toPiModel({
+			id: input.model,
+			input: input.input
+		})]
 	} };
 	writeFileSync(join(input.piDir, "models.json"), JSON.stringify({ providers }, null, 2) + "\n", "utf8");
 	const defaultSettings = multiProvider ? { enableInstallTelemetry: false } : {
@@ -35,4 +54,4 @@ function writePiConfig(input) {
 	}, null, 2) + "\n", "utf8");
 }
 //#endregion
-export { writePiConfig };
+export { PI_MODEL_MODALITIES, writePiConfig };