@tt-a1i/openpi 0.6.0 → 0.7.0

package/extensions/ai-providers/cursor/provider.ts

@@ -10,9 +10,11 @@ import type {
   Model,
   SimpleStreamOptions,
   TextContent,
+  ToolCall,
 } from "@earendil-works/pi-ai/compat";
 import { createAssistantMessageEventStream } from "@earendil-works/pi-ai/compat";
 import { emptyUsage } from "../usage.ts";
+import { ConnectFrameReader } from "./connect-frame-reader.ts";
 import {
   CURSOR_API_URL,
   CURSOR_CLIENT_VERSION,
@@ -35,6 +37,7 @@ import {
   CursorRuleSchema,
   CursorRuleTypeGlobalSchema,
   CursorRuleTypeSchema,
+  CursorToolCallSchema,
   ExecClientControlMessageSchema,
   ExecClientMessageSchema,
   ExecClientStreamCloseSchema,
@@ -44,6 +47,15 @@ import {
   KvClientMessageSchema,
   type KvServerMessage,
   KvServerMessageSchema,
+  McpArgsSchema,
+  McpImageContentSchema,
+  McpRejectedSchema,
+  McpResultSchema,
+  McpSuccessSchema,
+  McpTextContentSchema,
+  McpToolCallSchema,
+  McpToolResultContentItemSchema,
+  McpToolResultSchema,
   type ModelDetails,
   ModelDetailsSchema,
   RequestContextResultSchema,
@@ -59,8 +71,14 @@ import {
   UserMessageActionSchema,
   UserMessageSchema,
 } from "./proto.ts";
-import { create, fromBinary, toBinary } from "./protobuf.ts";
+import { create, encodeJsonValue, fromBinary, toBinary } from "./protobuf.ts";
 import { connectCursorHttp2 } from "./proxy.ts";
+import {
+  buildCursorTools,
+  CURSOR_PI_PROVIDER,
+  CURSOR_PI_TOOLS_SYSTEM_PROMPT,
+  decodeCursorTool,
+} from "./tool-bridge.ts";
 
 const CONNECT_END_STREAM_FLAG = 0b00000010;
 const CONNECT_COMPRESSED_FLAG = 0b00000001;
@@ -199,22 +217,51 @@ function rootPromptContent(
 
 function assistantRootContent(
   message: Extract<Message, { role: "assistant" }>,
+  results: Map<string, Extract<Message, { role: "toolResult" }>>,
 ) {
   const content: Array<Record<string, unknown>> = [];
   for (const item of message.content) {
     if (item.type === "text" && item.text) {
       content.push({ type: "text", text: item.text });
+    } else if (
+      item.type === "toolCall" &&
+      results.get(item.id)?.toolName === item.name
+    ) {
+      content.push({
+        type: "tool-call",
+        toolCallId: item.id,
+        toolName: item.name,
+        args: item.arguments,
+      });
     }
   }
   return content;
 }
 
+function pairedToolResults(messages: Message[], end: number) {
+  const calls = new Map<string, string>();
+  const results = new Map<string, Extract<Message, { role: "toolResult" }>>();
+  for (const message of messages.slice(0, end < 0 ? undefined : end)) {
+    if (message.role === "assistant") {
+      for (const part of message.content)
+        if (part.type === "toolCall") calls.set(part.id, part.name);
+    } else if (
+      message.role === "toolResult" &&
+      calls.get(message.toolCallId) === message.toolName
+    ) {
+      results.set(message.toolCallId, message);
+    }
+  }
+  return results;
+}
+
 function buildHistoryRootPrompt(
   messages: Message[],
   store: CursorBlobStore,
   activeUserIndex: number,
 ): Uint8Array[] {
   const entries: Uint8Array[] = [];
+  const results = pairedToolResults(messages, activeUserIndex);
   for (let index = 0; index < messages.length; index++) {
     if (index === activeUserIndex) break;
     const message = messages[index];
@@ -224,13 +271,29 @@ function buildHistoryRootPrompt(
       if (content.length === 0) continue;
       value = { role: "user", content };
     } else if (message.role === "assistant") {
-      const content = assistantRootContent(message);
+      const content = assistantRootContent(message, results);
       if (content.length === 0) continue;
       value = { role: "assistant", content };
     } else {
-      // Chat-only mode never replays assistant tool calls. Replaying only the
-      // matching tool result would create an invalid orphan in Cursor history.
-      continue;
+      if (results.get(message.toolCallId) !== message) continue;
+      value = {
+        role: "tool",
+        id: message.toolCallId,
+        content: [
+          {
+            type: "tool-result",
+            toolCallId: message.toolCallId,
+            toolName: message.toolName,
+            result: message.content.some((part) => part.type === "image")
+              ? rootPromptContent(message.content)
+              : message.content
+                  .filter((part) => part.type === "text")
+                  .map((part) => part.text)
+                  .join("\n"),
+            ...(message.isError ? { isError: true } : {}),
+          },
+        ],
+      };
     }
     entries.push(
       storeBlob(store, new TextEncoder().encode(JSON.stringify(value))),
@@ -242,13 +305,17 @@ function buildHistoryRootPrompt(
 function buildSystemPrompt(
   systemPrompt: Context["systemPrompt"],
   store: CursorBlobStore,
+  hasTools = false,
 ): Uint8Array[] {
   const prompts = systemPrompt
     ? Array.isArray(systemPrompt)
       ? systemPrompt
       : [systemPrompt]
     : ["You are a helpful assistant."];
-  return [...prompts, CURSOR_CHAT_ONLY_SYSTEM_PROMPT].map((prompt) =>
+  return [
+    ...prompts,
+    hasTools ? CURSOR_PI_TOOLS_SYSTEM_PROMPT : CURSOR_CHAT_ONLY_SYSTEM_PROMPT,
+  ].map((prompt) =>
     storeBlob(
       store,
       new TextEncoder().encode(
@@ -260,11 +327,12 @@ function buildSystemPrompt(
 
 /**
  * Cursor asks for these rules over the exec channel before generating text.
- * They are global rules only; the chat-only provider intentionally returns an
- * empty MCP tool list and never forwards `context.tools`.
+ * These rules keep Cursor-native tools disabled. The request-context response
+ * advertises only the active Pi tools through the MCP protocol bridge.
  */
 export function buildCursorRequestContextRules(
   systemPrompt: Context["systemPrompt"],
+  hasTools = false,
 ): CursorRule[] {
   const rules: CursorRule[] = systemPrompt?.trim()
     ? [
@@ -283,8 +351,10 @@ export function buildCursorRequestContextRules(
     : [];
   rules.push(
     create(CursorRuleSchema, {
-      fullPath: "/pi/cursor-chat-only.mdc",
-      content: CURSOR_CHAT_ONLY_SYSTEM_PROMPT,
+      fullPath: hasTools ? "/pi/cursor-tools.mdc" : "/pi/cursor-chat-only.mdc",
+      content: hasTools
+        ? CURSOR_PI_TOOLS_SYSTEM_PROMPT
+        : CURSOR_CHAT_ONLY_SYSTEM_PROMPT,
       source: 2,
       type: create(CursorRuleTypeSchema, {
         type: { case: "global", value: create(CursorRuleTypeGlobalSchema, {}) },
@@ -300,6 +370,7 @@ function buildHistoryTurns(
   activeUserIndex: number,
 ): Uint8Array[] {
   const turns: Uint8Array[] = [];
+  const results = pairedToolResults(messages, activeUserIndex);
   const end = activeUserIndex >= 0 ? activeUserIndex : messages.length;
   let index = 0;
   while (index < end) {
@@ -335,6 +406,68 @@ function buildHistoryTurns(
                 ),
               ),
             );
+          } else if (item.type === "toolCall") {
+            const result = results.get(item.id);
+            if (!result || result.toolName !== item.name) continue;
+            const args = Object.fromEntries(
+              Object.entries(item.arguments).map(([key, value]) => [
+                key,
+                encodeJsonValue(JSON.parse(JSON.stringify(value))),
+              ]),
+            );
+            const tool = create(CursorToolCallSchema, {
+              toolCallId: item.id,
+              tool: {
+                case: "mcpToolCall",
+                value: create(McpToolCallSchema, {
+                  args: create(McpArgsSchema, {
+                    name: item.name,
+                    toolName: item.name,
+                    providerIdentifier: CURSOR_PI_PROVIDER,
+                    toolCallId: item.id,
+                    args,
+                  }),
+                  result: create(McpToolResultSchema, {
+                    result: {
+                      case: "success",
+                      value: create(McpSuccessSchema, {
+                        isError: result.isError,
+                        content: result.content.map((part) =>
+                          create(McpToolResultContentItemSchema, {
+                            content:
+                              part.type === "text"
+                                ? {
+                                    case: "text",
+                                    value: create(McpTextContentSchema, {
+                                      text: part.text,
+                                    }),
+                                  }
+                                : {
+                                    case: "image",
+                                    value: create(McpImageContentSchema, {
+                                      data: Buffer.from(part.data, "base64"),
+                                      mimeType: part.mimeType,
+                                    }),
+                                  },
+                          }),
+                        ),
+                      }),
+                    },
+                  }),
+                }),
+              },
+            });
+            steps.push(
+              storeBlob(
+                store,
+                toBinary(
+                  ConversationStepSchema,
+                  create(ConversationStepSchema, {
+                    message: { case: "toolCall", value: tool },
+                  }),
+                ),
+              ),
+            );
           }
         }
       }
@@ -414,11 +547,14 @@ export async function buildCursorRequest(
   options?: SimpleStreamOptions,
 ): Promise<CursorRequestBuild> {
   const store: CursorBlobStore = new Map();
-  const activeIndex = lastUserIndex(context.messages);
+  const activeIndex =
+    context.messages.at(-1)?.role === "user"
+      ? lastUserIndex(context.messages)
+      : -1;
   const active = activeIndex >= 0 ? context.messages[activeIndex] : undefined;
   const activeContent = active?.role === "user" ? active.content : undefined;
   const rootPromptMessagesJson = [
-    ...buildSystemPrompt(context.systemPrompt, store),
+    ...buildSystemPrompt(context.systemPrompt, store, !!context.tools?.length),
     ...buildHistoryRootPrompt(context.messages, store, activeIndex),
   ];
   const state = create(ConversationStateStructureSchema, {
@@ -554,7 +690,7 @@ function isAbortError(
   );
 }
 
-/** Cursor AgentService/Run, deliberately chat-only (no context.tools advertisement or Pi tool calls). */
+/** Cursor AgentService/Run with Pi-owned tool execution across provider turns. */
 export function streamCursor(
   model: Model<Api>,
   context: Context,
@@ -586,6 +722,8 @@ export function streamCursor(
     let turnEnded = false;
     let terminalError: Error | undefined;
     let finished = false;
+    const pendingCalls = new Map<string, ToolCall>();
+    let handingOffTools = false;
 
     const closeBlocks = () => {
       if (currentText) {
@@ -696,8 +834,9 @@ export function streamCursor(
           h2Request?.close(http2.constants.NGHTTP2_CANCEL);
         }, requestTimeoutMs);
       };
-      let frameBuffer: Buffer<ArrayBufferLike> = Buffer.alloc(0);
+      const frames = new ConnectFrameReader(MAX_CONNECT_FRAME_BYTES);
       const processFrame = (flags: number, bytes: Uint8Array) => {
+        if (handingOffTools) return;
         if ((flags & CONNECT_COMPRESSED_FLAG) !== 0) {
           throw new Error("Compressed Cursor Connect frames are unsupported");
         }
@@ -715,8 +854,11 @@ export function streamCursor(
                 case: "success",
                 value: create(RequestContextSuccessSchema, {
                   requestContext: create(RequestContextSchema, {
-                    rules: buildCursorRequestContextRules(context.systemPrompt),
-                    tools: [],
+                    rules: buildCursorRequestContextRules(
+                      context.systemPrompt,
+                      !!context.tools?.length,
+                    ),
+                    tools: buildCursorTools(context.tools),
                   }),
                 }),
               },
@@ -734,6 +876,60 @@ export function streamCursor(
             );
             return;
           }
+          if (exec.message.case === "mcpArgs") {
+            const args = exec.message.value;
+            if (args.smartModeApprovalOnly) {
+              // A probe must not become a tool call or preauthorize Pi execution.
+              const reply = create(AgentClientMessageSchema, {
+                message: {
+                  case: "execClientMessage",
+                  value: create(ExecClientMessageSchema, {
+                    id: exec.id,
+                    execId: exec.execId,
+                    message: {
+                      case: "mcpResult",
+                      value: create(McpResultSchema, {
+                        result: {
+                          case: "rejected",
+                          value: create(McpRejectedSchema, {
+                            reason:
+                              "Pi must evaluate permissions when executing the tool; approval-only probes cannot authorize execution.",
+                          }),
+                        },
+                      }),
+                    },
+                  }),
+                },
+              });
+              h2Request?.write(
+                frameConnectMessage(toBinary(AgentClientMessageSchema, reply)),
+              );
+              return;
+            }
+            const call = decodeCursorTool(args, context.tools);
+            if (
+              context.messages.some((message) =>
+                message.role === "toolResult"
+                  ? message.toolCallId === call.id
+                  : message.role === "assistant" &&
+                    message.content.some(
+                      (part) => part.type === "toolCall" && part.id === call.id,
+                    ),
+              )
+            ) {
+              throw new Error(
+                "Cursor attempted to replay a tool call identity already present in Pi history",
+              );
+            }
+            const previous = pendingCalls.get(call.id);
+            if (previous && JSON.stringify(previous) !== JSON.stringify(call)) {
+              throw new Error(
+                "Cursor repeated a tool call identity with different arguments",
+              );
+            }
+            pendingCalls.set(call.id, call);
+            return;
+          }
           const throwReply = create(AgentClientMessageSchema, {
             message: {
               case: "execClientControlMessage",
@@ -742,8 +938,9 @@ export function streamCursor(
                   case: "throw",
                   value: create(ExecClientThrowSchema, {
                     id: exec.id,
-                    error:
-                      "Cursor tools are not available in this chat-only provider",
+                    error: context.tools?.length
+                      ? "Cursor-native execution is unavailable; use advertised Pi MCP tools"
+                      : "Cursor tools are not available in this chat-only provider",
                     errorCode: "UNIMPLEMENTED",
                   }),
                 },
@@ -762,7 +959,9 @@ export function streamCursor(
             },
           });
           const error = new Error(
-            "Cursor requested a tool that is unavailable in chat-only mode",
+            context.tools?.length
+              ? "Cursor requested unsupported native execution outside Pi"
+              : "Cursor requested a tool that is unavailable in chat-only mode",
           );
           terminalError = error;
           if (!h2Request) {
@@ -784,10 +983,32 @@ export function streamCursor(
         }
         if (message.message.case === "interactionQuery") {
           throw new Error(
-            `Cursor interaction query ${message.message.value.query.case ?? "unknown"} is unavailable in chat-only mode`,
+            `Cursor interaction query ${message.message.value.query.case ?? "unknown"} is unavailable ${context.tools?.length ? "outside Pi's interaction lifecycle" : "in chat-only mode"}`,
           );
         }
         if (message.message.case !== "interactionUpdate") return;
+        const update = message.message.value;
+        if (
+          context.tools?.length &&
+          (update.message.case === "partialToolCall" ||
+            update.message.case === "toolCallStarted" ||
+            update.message.case === "toolCallCompleted")
+        ) {
+          const preview = update.message.value.toolCall;
+          if (preview && preview.tool.case !== "mcpToolCall") {
+            throw new Error(
+              "Cursor-native tools are unavailable; use the advertised Pi MCP tools",
+            );
+          }
+          // Only exec mcpArgs is an invocation. UI previews may be partial,
+          // duplicated, or emitted for approval probes, and never execute.
+          return;
+        }
+        if (context.tools?.length && update.message.case === "toolCallDelta") {
+          throw new Error(
+            "Cursor-native tool deltas are unavailable; use the advertised Pi MCP tools",
+          );
+        }
         processInteraction(
           message.message.value,
           output,
@@ -813,22 +1034,39 @@ export function streamCursor(
         );
       };
       const processData = (chunk: Buffer) => {
-        frameBuffer =
-          frameBuffer.length === 0
-            ? chunk
-            : Buffer.concat([frameBuffer, chunk]);
-        while (frameBuffer.length >= 5) {
-          const size = frameBuffer.readUInt32BE(1);
-          if (size > MAX_CONNECT_FRAME_BYTES) {
-            throw new Error(
-              `Cursor Connect frame exceeds ${MAX_CONNECT_FRAME_BYTES} bytes`,
-            );
+        frames.push(chunk, processFrame);
+        // Preserve tool batching while a complete header awaits its body.
+        if (frames.awaitingPayload) return;
+        if (pendingCalls.size > 0 && !handingOffTools) {
+          if (terminalError) throw terminalError;
+          if (options?.signal?.aborted)
+            throw new Error("Cursor request aborted");
+          closeBlocks();
+          for (const call of pendingCalls.values()) {
+            const contentIndex = output.content.length;
+            output.content.push(call);
+            stream.push({
+              type: "toolcall_start",
+              contentIndex,
+              partial: output,
+            });
+            stream.push({
+              type: "toolcall_delta",
+              contentIndex,
+              delta: JSON.stringify(call.arguments),
+              partial: output,
+            });
+            stream.push({
+              type: "toolcall_end",
+              contentIndex,
+              toolCall: call,
+              partial: output,
+            });
           }
-          if (frameBuffer.length < size + 5) return;
-          const flags = frameBuffer[0]!;
-          const data = frameBuffer.subarray(5, size + 5);
-          frameBuffer = frameBuffer.subarray(size + 5);
-          processFrame(flags, data);
+          output.stopReason = "toolUse";
+          handingOffTools = true;
+          turnEnded = true;
+          settle();
         }
       };
 
@@ -907,7 +1145,7 @@ export function streamCursor(
           .then(() => {
             if (!responseSeen)
               throw new Error("Cursor response headers were not received");
-            if (frameBuffer.length !== 0)
+            if (frames.incomplete)
               throw new Error("Incomplete Cursor Connect frame");
             settle();
           })
@@ -967,7 +1205,12 @@ export function streamCursor(
       output.usage.totalTokens = output.usage.input + output.usage.output;
       stream.push({
         type: "done",
-        reason: output.stopReason === "length" ? "length" : "stop",
+        reason:
+          output.stopReason === "toolUse"
+            ? "toolUse"
+            : output.stopReason === "length"
+              ? "length"
+              : "stop",
         message: output,
       });
       stream.end();

package/extensions/ai-providers/cursor/tool-bridge.ts

@@ -0,0 +1,68 @@
+/** Translate Cursor MCP requests into Pi calls; execution stays in Pi's loop. */
+import type { Context, ToolCall } from "@earendil-works/pi-ai/compat";
+import { type McpArgs, McpToolDefinitionSchema } from "./proto.ts";
+import {
+  create,
+  decodeJsonValue,
+  encodeJsonValue,
+  type JsonValue,
+} from "./protobuf.ts";
+
+export const CURSOR_PI_PROVIDER = "openpi";
+export const CURSOR_PI_TOOLS_SYSTEM_PROMPT =
+  "Use only the provided openpi MCP tools. These are the active Pi tools and Pi owns their execution and permissions. Do not use Cursor-native filesystem, shell, editing, web, task, or interaction tools. When tool results appear in conversation history, continue from those results. Do not repeat a completed tool call.";
+
+export function buildCursorTools(tools: Context["tools"]) {
+  return (tools ?? []).map((tool) => {
+    const schema: JsonValue = JSON.parse(JSON.stringify(tool.parameters));
+    return create(McpToolDefinitionSchema, {
+      name: tool.name,
+      providerIdentifier: CURSOR_PI_PROVIDER,
+      toolName: tool.name,
+      description: tool.description,
+      inputSchema: encodeJsonValue(schema),
+      inputSchemaJson: JSON.stringify(schema),
+    });
+  });
+}
+
+export function decodeCursorTool(
+  args: McpArgs,
+  tools: Context["tools"],
+): ToolCall {
+  const name = args.toolName || args.name;
+  if (
+    args.providerIdentifier !== CURSOR_PI_PROVIDER ||
+    (args.serverIdentifier && args.serverIdentifier !== CURSOR_PI_PROVIDER) ||
+    !name ||
+    (args.name && args.name !== name) ||
+    !tools?.some((tool) => tool.name === name)
+  ) {
+    throw new Error("Cursor requested an unadvertised Pi tool identity");
+  }
+  if (!args.toolCallId.trim())
+    throw new Error("Cursor MCP tool call has no identity");
+  const values: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(args.args)) {
+    // google.protobuf.Value, not JSON text. Define own properties so keys such
+    // as __proto__ cannot alter the decoded argument object's prototype.
+    if (!value.length || ![8, 17, 26, 32, 42, 50].includes(value[0]!)) {
+      throw new Error("Cursor MCP argument is not a protobuf JSON value");
+    }
+    const decoded = decodeJsonValue(value);
+    const validateJson = (item: JsonValue): void => {
+      if (typeof item === "number" && !Number.isFinite(item))
+        throw new Error("Cursor MCP argument contains a non-finite number");
+      if (item && typeof item === "object")
+        for (const child of Object.values(item)) validateJson(child);
+    };
+    validateJson(decoded);
+    Object.defineProperty(values, key, {
+      value: decoded,
+      enumerable: true,
+      configurable: true,
+      writable: true,
+    });
+  }
+  return { type: "toolCall", id: args.toolCallId, name, arguments: values };
+}

package/extensions/ai-providers/index.ts

@@ -3,8 +3,8 @@
  *
  * Adds OAuth-backed Google Antigravity and Cursor model providers. Both are
  * inert until the user logs in and selects one of their models. Cursor uses
- * AgentService/Run in deliberately chat-only mode: Cursor-native coding tools
- * are not exposed or executed by this extension.
+ * AgentService/Run with an experimental bridge to normal Pi tool calls.
+ * Cursor-native coding tools are not exposed or executed by this extension.
  *
  * Wire protocol: Cloud Code Assist `v1internal:streamGenerateContent` over
  * SSE (see antigravity/provider.ts). Reference implementation: oh-my-pi's
@@ -13,7 +13,6 @@
 
 import { createProvider, type ProviderStreams } from "@earendil-works/pi-ai";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { createOAuthAuth } from "./oauth-adapter.ts";
 import { encodeApiKey } from "./antigravity/credentials.ts";
 import { fetchAntigravityModels } from "./antigravity/discovery.ts";
 import {
@@ -31,6 +30,7 @@ import { transformCursorImageInput } from "./cursor/input-images.ts";
 import { CURSOR_MODELS } from "./cursor/models.ts";
 import { loginCursor, refreshCursorToken } from "./cursor/oauth.ts";
 import { streamCursor } from "./cursor/provider.ts";
+import { createOAuthAuth } from "./oauth-adapter.ts";
 
 function providerStreams(
   streamSimple: ProviderStreams["streamSimple"],

package/extensions/file-mutation-display/index.ts

@@ -27,15 +27,19 @@ function compact<TParams extends TSchema, TDetails, TState>(
 export default function fileMutationDisplay(pi: ExtensionAPI) {
   pi.on("session_start", (_event, ctx) => {
     const display = loadSetupConfig().ui;
-    if (ctx.mode === "tui") {
-      // Ctrl+O remains a temporary override. A new/reloaded session starts from
-      // the persisted defaults instead of inheriting an old expanded toggle.
-      ctx.ui.setToolsExpanded(
-        display.subagentResultDisplay === "full" &&
-          display.bashToolDisplay === "full" &&
-          display.fileMutationDisplay === "full",
-      );
-    }
+    // This extension changes only the interactive TUI projection. Headless
+    // sessions must keep Pi's native definitions, especially bash: replacing
+    // it here would drop the SettingsManager-provided shellPath and can make
+    // Windows resolve the WSL System32 stub instead of the configured shell.
+    if (ctx.mode !== "tui") return;
+
+    // Ctrl+O remains a temporary override. A new/reloaded session starts from
+    // the persisted defaults instead of inheriting an old expanded toggle.
+    ctx.ui.setToolsExpanded(
+      display.subagentResultDisplay === "full" &&
+        display.bashToolDisplay === "full" &&
+        display.fileMutationDisplay === "full",
+    );
 
     pi.registerTool(
       compact(

package/extensions/shared/agent-transcript.ts

@@ -409,7 +409,7 @@ function findResult(
 }
 
 /**
- * Caches finalized transcript items by identity and width. Live state remains
+ * Caches finalized transcript items by identity, width, and cwd. Live state remains
  * uncached because it changes on every stream tick; callers clear this cache
  * from their component's invalidate() when Pi changes theme.
  */
@@ -434,7 +434,8 @@ export class AgentTranscriptRenderer {
     for (let index = 0; index < document.items.length; index++) {
       const item = document.items[index];
       const context = itemContext(document.items, index, liveIds, pairing);
-      const key = `${width}|${context.token}`;
+      // Fallback tool rows relativize paths against the document's cwd.
+      const key = JSON.stringify([width, context.token, document.cwd]);
       const cacheable = !document.toolRenderer || !itemHasTool(item);
       const cached = cacheable ? this.itemCache.get(item)?.get(key) : undefined;
       const lines =

package/extensions/shared/child-session.ts

@@ -550,6 +550,20 @@ export function effectiveChildToolAllowlist(tools?: readonly string[]) {
   );
 }
 
+/** Project the parent's active surface into a child; a role can only narrow it.
+ * Active tools are a visibility choice, not a filesystem/network sandbox.
+ * Inactive tools are not implicitly activated by delegation.
+ */
+export function inheritedChildToolAllowlist(
+  parentTools: readonly string[],
+  roleTools?: readonly string[],
+) {
+  const allowed = roleTools === undefined ? undefined : new Set(roleTools);
+  return effectiveChildToolAllowlist([...new Set(parentTools)])!.filter(
+    (name) => allowed === undefined || allowed.has(name),
+  );
+}
+
 export function childToolPolicy(tools?: readonly string[]) {
   const effectiveTools = effectiveChildToolAllowlist(tools);
   return {