@tt-a1i/openpi 0.4.0 → 0.5.0

package/skills/subagents/REFERENCE.md

@@ -0,0 +1,189 @@
+# Agent types reference
+
+An agent type is a reusable child-agent definition shared by
+`subagent_spawn` and Workflow `agent()`: a named preset that can set a child's
+system prompt, model, and thinking level, and — the point of the feature —
+**which tools it may use at all**. Four provider-free built-in roles are always
+available: `explorer`, `implementer`, `reviewer`, and `advisor`.
+
+Without one, every subagent is the same thing: it inherits the parent model and
+the full child tool set, so a "read-only research" subagent still holds `write`,
+`edit`, and `bash`, restrained only by how the prompt was worded. A type turns
+that into an enforced boundary.
+
+## File format
+
+Types are markdown files with YAML frontmatter, one per file:
+
+```markdown
+---
+name: explore
+description: Read-only codebase exploration. Returns file:line references.
+tools: [read, grep, find, ls, fd, rg]
+model: anthropic/claude-sonnet-5 # optional
+reasoning_effort: medium # optional
+---
+
+You are a read-only exploration agent. Locate code and report concrete
+file:line references. You cannot modify files — do not attempt to.
+```
+
+| Field              | Required | Meaning                                                                              |
+| ------------------ | -------- | ------------------------------------------------------------------------------------ |
+| `name`             | yes      | `[a-z0-9-]`, ≤64 chars, and must equal the filename stem.                            |
+| `description`      | yes      | Shown to the parent model when it picks a type. ≤1024 chars.                         |
+| `tools`            | no       | Tool allowlist. **Omit to inherit the normal tool set.**                             |
+| `model`            | no       | `provider/model-id`, or a bare id resolved against the current provider; ≤256 chars. |
+| `reasoning_effort` | no       | `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`.                           |
+| body               | no       | Appended to the child's system prompt. ≤16384 chars.                                 |
+
+Each file is capped at 64 KiB and each tool name at 128 characters before it can
+enter a prompt or startup diagnostic. `name` must match the filename so a renamed
+file cannot keep answering to its old name. An explicit `model` or `reasoning_effort` argument on `subagent_spawn`,
+or `model`/`provider` or `effort` on Workflow `agent()`, overrides the type's own.
+
+## Built-in roles
+
+All built-ins omit a model, so they inherit the parent model unless configured
+through `/openpi-setup`. Their complete definitions can be replaced by a custom
+file with the same name.
+
+| Role          | Tools                                                               | Relative effort guidance | Purpose                                                |
+| ------------- | ------------------------------------------------------------------- | ------------------------ | ------------------------------------------------------ |
+| `explorer`    | `read grep find ls fd rg git_show git_diff git_log`                 | Moderate                 | Read-only codebase tracing; increase for harder tasks. |
+| `implementer` | `read bash edit write grep find ls fd rg git_show git_diff git_log` | Medium-high              | Focused implementation; adjust for scope and risk.     |
+| `reviewer`    | `read grep find ls fd rg git_show git_diff git_log`                 | High                     | Read-only correctness, safety, and regression review.  |
+| `advisor`     | `read grep find ls fd rg git_show git_diff git_log`                 | High                     | Deep read-only analysis and technical advice.          |
+
+These are relative selection hints, not fixed Pi thinking levels. Built-ins set
+no model or reasoning-effort default. An explicit user requirement takes
+priority; otherwise the parent model chooses from levels supported by the
+resolved child model according to the role and task difficulty. Their tool
+allowlists still intersect with plan mode and the child denylist.
+
+## Discovery
+
+Definitions are layered at each `session_start`:
+
+| Priority | Source                    | Loaded                         |
+| -------- | ------------------------- | ------------------------------ |
+| lowest   | package built-ins         | Always.                        |
+| middle   | `~/.pi/agent/agents/*.md` | Always.                        |
+| highest  | `<cwd>/.pi/agents/*.md`   | **Only in a trusted project.** |
+
+A project file supplies an attacker-controllable system prompt and tool list, so
+an untrusted repository contributes none. Each higher layer replaces the
+**complete** same-name definition from the layer below, and every override is
+reported as a diagnostic rather than applied silently.
+
+The Subagent extension initially registers only built-in and global types, then
+re-registers `subagent_spawn` at `session_start` from `ctx.cwd` and
+`ctx.isProjectTrusted()`. The Workflow extension resolves the same layers at
+`session_start` and snapshots that roster for each run. This honors temporary
+session-only trust decisions and cross-cwd session replacements without ever
+loading an untrusted project's prompt before trust resolves. Edits take effect
+on `/reload` or a new session — the same as skills.
+
+A malformed file is reported at session start and never prevents unrelated types
+from loading. Its own filename is blocked at that precedence layer: a broken
+project `implementer.md` cannot silently fall back to the broader global or
+built-in `implementer`. Unknown frontmatter keys make that file malformed rather
+than being ignored, so a misspelled `tools` or restriction field cannot expose
+the inherited full tool set. If an entire configured layer exists but cannot be
+read, all lower-precedence definitions are blocked because its intended overrides
+cannot be determined safely; a genuinely missing directory remains the normal
+no-override case.
+
+## Model and effort precedence
+
+For an `agent_type` child, model selection is: explicit call model → selected
+type file `model` → `/openpi-setup` assignment for that built-in role name →
+inherited parent model. Effort is: explicit call effort → selected type default
+(including a built-in) → parent effort. The generated `subagent_spawn.agent_type`
+roster shows each type's default effort or explicit parent inheritance; Workflow
+uses the same names and definitions. A custom `explorer.md` therefore replaces
+the built-in definition, while an explicit call argument still wins.
+
+`/openpi-setup` can assign any model currently present in Pi's registry to one or
+more built-in roles. Assignments are partial; omitted roles stay unchanged, and
+setting a role to `null` clears it back to parent-model inheritance. The
+assignment is read when each child is created, so it applies to the next spawn
+or Workflow `agent()` call without `/reload`.
+
+## Usage
+
+```
+subagent_spawn({ prompt: "...", name: "auth audit", agent_type: "explorer" })
+```
+
+Workflow scripts use the same role without hardcoding its configured model:
+
+```js
+await agent("Map the auth flow", { agent_type: "explorer" });
+```
+
+The `agent_type` parameter is always available because the built-in roles are
+always present. Agent Type file changes take effect on `/reload` or a new
+session for both direct Subagents and Workflows; each Workflow snapshots that
+session roster when its run starts.
+
+## What `tools:` actually guarantees
+
+The list is passed to pi as a session-level allowlist, which it composes with
+this package's existing child denylist:
+
+```js
+// pi: dist/core/agent-session.js
+const isAllowedTool = (name) =>
+  (!allowedToolNames || allowedToolNames.has(name)) &&
+  !excludedToolNames?.has(name);
+```
+
+Two consequences worth being precise about:
+
+- **It can only narrow.** Listing a denied tool (`subagent_spawn`, `bg_start`,
+  `ask_user`, …) does not grant it. The child boundary in
+  `extensions/shared/child-session.ts` stays authoritative, and the drift guard
+  that protects it is unaffected.
+- **It also unlocks.** Pi's default active set is only
+  `read, bash, edit, write`, so `grep`, `find`, and `ls` are otherwise
+  unreachable in a child. Naming them in `tools:` activates them.
+
+So `tools: [read, grep, find, ls]` yields a child that genuinely has no
+`write`, `edit`, or `bash` tool to call — not one that has been asked not to.
+Parent-only names are removed before the generated roster and spawn result are
+shown, so a type that lists `subagent_spawn` never advertises it as usable.
+A structured Workflow child additionally receives only its terminating
+`structured_output` tool; this does not restore any denied repository tool.
+
+While `/plan` is armed, `isolation: "worktree"` is rejected before Git is
+changed. A selected type whose declared tools plan mode would narrow (such as
+`implementer`) is also rejected rather than spawning it with a contradictory
+implementation prompt; use `explorer`, `reviewer`, `advisor`, or omit the type
+for read-only investigation.
+
+Unrecognized tool names are kept at parse time because a third-party extension
+may register them. After child extensions initialize, every explicitly listed
+child-safe tool is checked against the final active child registry before the
+first model prompt. An extension-registered tool therefore works normally; a
+typo or unavailable tool fails that direct Subagent or Workflow agent launch
+with a bounded error and sends no model tokens. Parent-only names remain denied
+and are not treated as missing, so the child denylist stays authoritative.
+
+## Implementation
+
+- `extensions/subagents/src/agent-types.ts` — built-ins, parsing, discovery, diagnostics, and model
+  precedence helpers.
+- `extensions/shared/subagent-roles.ts` — one typed source for built-in role names.
+- `extensions/subagents/index.ts` — safe initial discovery, session-scoped roster refresh and
+  re-registration, the `agent_type` parameter, and merging a type/config
+  assignment into the spawn task.
+- `extensions/subagents/src/backends/pi.ts` — applies `appendSystemPrompt` and the tool allowlist to
+  a direct subagent session.
+- `extensions/workflows/index.ts` and `extensions/workflows/runner.ts` — resolve the same
+  type for each Workflow call and enforce its prompt, model, effort, and tools.
+- `extensions/shared/child-session.ts` — `childToolPolicy(tools?)`, where the allowlist
+  and denylist compose.
+
+Covered by `tests/extensions/subagents/agent-types.test.ts`, including the trust gate and the
+narrowing-only property.

package/skills/subagents/SKILL.md

@@ -10,7 +10,7 @@ The tool definitions are canonical for parameters, limits, model syntax, isolati
 - Delegate substantial independent work, not a lookup or edit the parent can do directly.
 - Give the child a standalone prompt with paths, constraints, relevant context, and the expected report; it cannot see the parent conversation or ask the user.
 - Inherit the parent model by default. When choosing the child's reasoning effort, honor an explicit user requirement first; otherwise use the selected role's relative guidance and the task's difficulty, choosing from levels supported by the resolved child model.
-- Prefer a matching agent type when one exists; its tool restriction is enforced. Model precedence is explicit spawn override, selected type-file model, configured built-in role model, then parent model. Reasoning precedence is explicit spawn override, selected type default, then parent effort. Types live in `~/.pi/agent/agents/*.md` and, for trusted projects, `.pi/agents/*.md`; see `extensions/subagents/docs/agent-types.md`.
+- Prefer a matching agent type when one exists; its tool restriction is enforced. Model precedence is explicit spawn override, selected type-file model, configured built-in role model, then parent model. Reasoning precedence is explicit spawn override, selected type default, then parent effort. Types live in `~/.pi/agent/agents/*.md` and, for trusted projects, `.pi/agents/*.md`; see [Agent types](REFERENCE.md).
 - Isolate concurrent writers in worktrees according to the `subagent_spawn` schema so they cannot overwrite one checkout or git index. While Plan Mode is active, use only read-only exploration types (or no type); worktree isolation and types narrowed by Plan Mode are rejected.
 - After spawning, continue useful parent work. In an interactive session, if none remains, tell the user the child is still running and end the turn; automatic result delivery will re-invoke the parent when it settles. Do not block merely because the next step depends on the result or because there is nothing else to do. Use `subagent_wait` only when the user explicitly asks to keep the current response open for the result, or when non-interactive automation must return it in the same invocation.
 

package/skills/workflows/REFERENCE.md

@@ -18,7 +18,7 @@ Useful options include `agent_type`, `label`, `phase`, `schema`, `acceptance`, `
 
 - Prefer a matching `agent_type`. Model precedence is explicit model/provider, type file, configured built-in role, then parent. Effort precedence is explicit effort, type default, then parent.
 - `schema` validates structured output. Use it whenever later workflow logic branches on fields.
-- `acceptance: { criteria: [{ id, description, requiredEvidence? }] }` requires the same child to return an evidence ledger. Missing, malformed, or rejected criteria make `ok:false` while preserving output and evidence.
+- `acceptance: { criteria: [{ id, description, requiredEvidence?: string[] }] }` requires the same child to return an evidence ledger. An invocation accepts 1–32 criteria; each criterion has a 1–500 character human-readable `description` and an optional `requiredEvidence` array of at most 16 concise string labels (up to 120 characters each). The child must return exact matching labels in `acceptance.criteria[].evidence`. A criterion without `requiredEvidence` is an attestation of its description, not an evidence-backed gate; criteria that need evidence-backed acceptance must declare the required labels. Missing, malformed, or rejected criteria make `ok:false` while preserving output and evidence.
 - `operator: "name"` reuses one in-memory child Session for serialized follow-ups inside the same run. Its model, role/tools, effort, structured mode, and cwd are frozen by the first activation. Operators cannot use per-call worktrees or replay, and do not survive restarts.
 - `inputs: [ref, ...]` accepts successful opaque refs from the same workflow run only. Each conclusion is bounded to 16 KiB and total injected input to 48 KiB. The total budget is fairly distributed, so a large fan-out cannot starve later results merely because of order; partial projections are labeled. Full successful child results remain in the run's `agent-results/` artifacts. Inputs are marked as untrusted data; the resulting graph is observability, not scheduling authority.
 - Fair projection preserves the head and tail of every partial result and names its run-relative `agent-results/agent-N.json` audit artifact. That path is provenance for the parent/operator, not a child-readable handle. Fair presence is not proof of full evidence coverage: for large fan-out, group source refs into local Report agents, then pass only their refs to a global Report. The workflow script—not Runtime—must state planned, selected, covered, failed, and deferred counts.
@@ -40,7 +40,9 @@ Each call persists intent, admission, and execution state. Interrupted nontermin
 
 ## Lifecycle and replay
 
-Interactive TUI runs return an accepted run id immediately by default, release the parent turn, and later deliver a terminal completion with a stable delivery id. Delivery is at least once: normal retries do not duplicate a run, but a process loss after Pi accepts the message and before the receipt is persisted can replay the same id. `wait: true` explicitly waits inline; interrupting that wait releases only the waiter and the run continues. Print/automation defaults to waiting because it has no later delivery channel. The deprecated `background` parameter remains an inverse compatibility alias and cannot be combined with `wait`.
+Interactive TUI runs return an accepted run id immediately by default, release the parent turn, and later deliver a terminal completion with a stable delivery id. Delivery is at least once: normal retries do not duplicate a run, but a process loss after Pi accepts the message and before the receipt is persisted can replay the same id. `wait: true` explicitly waits inline; interrupting that wait releases only the waiter and the run continues. Print/automation defaults to waiting because it has no later delivery channel.
+
+New calls must use `wait`. For compatibility with released OpenPI versions, the deprecated `background` alias remains accepted during the current migration window: replace `background: true` with `wait: false`, or `background: false` with `wait: true`, and do not provide both fields. The alias will be removed only in an announced breaking release. Persisted artifact/details fields named `background` remain actual detached-state facts and are not part of that removal.
 
 Loading the Workflow capability exposes `workflow`, `workflow_status`, and `workflow_stop` as one stable group; starting or settling a run does not mutate the model tool Schema. `workflow_status` returns a bounded state/coverage summary and artifact path without consuming or repeating the full completion. `workflow_stop` is idempotent and preserves partial artifacts. A failed completion send remains pending with the same per-run delivery identity and is retried when the parent settles or the Session is restored.