billion-context-pi 0.1.25 → 0.1.26

package/README.md

@@ -86,17 +86,21 @@ This has two practical implications:
 
 ### acp_delegate — clean-context delegation
 
-Hand a self-contained task to a fresh pi process running in a clean context. Five built-in roles, each with a tailored tool whitelist and system prompt:
+Hand a self-contained task to a fresh pi process running in a clean context. Five built-in roles, each with a system prompt and a **soft tool guardrail**:
 
 | Role | Tools | Best for |
 |------|-------|----------|
-| `reviewer` | read, bash | Read-only code review (bugs, risks, file:line) |
-| `researcher` | read, bash | Read-only codebase investigation |
+| `reviewer` | read, bash, grep, find, ls + ACP | Read-only code review (bugs, risks, file:line) |
+| `researcher` | read, bash, grep, find, ls + ACP | Read-only codebase investigation |
 | `worker` | read, edit, write, bash | Make code changes |
-| `planner` | read, bash | Analyze + propose a step-by-step plan |
-| `oracle` | read, bash | Answer questions / advise |
+| `planner` | read, bash, grep, find, ls + ACP | Analyze + propose a step-by-step plan |
+| `oracle` | read, bash, grep, find, ls + ACP | Answer questions / advise |
 
-The full delegate result is saved to a file (`/tmp/acp-delegate/<runId>.out`); the tool result and injected notification carry only the **task title + file path** (no preview) — use `read` for the details. This keeps the parent context lean.
+Read-only roles (reviewer, researcher, planner, oracle) receive a restricted tool allowlist (`read, bash, grep, find, ls`) plus ACP context tools (`compress, decompress, search_context, acp_status`) so they can manage their own context. This prevents accidental file modifications, but `bash` can bypass it - **it is a guardrail, not a security boundary**.
+
+Worker runs on Pi's full default toolset - no `--tools` allowlist is applied, so any loaded extension or custom tools (e.g. ACP, LSP, MCP) remain available. This keeps primary-task delegation fully capable. The `read, edit, write, bash` listing above reflects core tools only.
+
+The full delegate result is saved to a file (`/tmp/acp-delegate/<runId>.out`); the tool result and injected notification carry only the **task title + file path** (no preview) - use `read` for the details. This keeps the parent context lean.
 
 - **Interactive (TUI) & RPC modes**: `async:true` (default) runs the child in the background; a short completion notification is injected into the chat when it finishes.
 - **Print / JSON modes** (`pi -p`, SDK): `async:true` auto-downgrades to **synchronous** — the result returns as the tool result in the same turn (the parent exits after one turn, so background injection would be lost).

package/README.zh-CN.md

@@ -85,17 +85,21 @@ billion-context 通过拦截 Pi 的 `context` 事件接管上下文管理。**Pi
 
 ### acp_delegate — 干净上下文委派
 
-把一个自包含的任务交给一个运行在干净上下文中的新 pi 进程。五个内置角色,各自有定制的工具白名单和系统提示:
+把一个自包含的任务交给一个运行在干净上下文中的新 pi 进程。五个内置角色,各自有系统提示和**软工具护栏**:
 
 | 角色 | 工具 | 适用场景 |
 |------|------|----------|
-| `reviewer` | read, bash | 只读代码审查(bug、风险、file:line) |
-| `researcher` | read, bash | 只读代码库调研 |
+| `reviewer` | read, bash, grep, find, ls + ACP | 只读代码审查(bug、风险、file:line) |
+| `researcher` | read, bash, grep, find, ls + ACP | 只读代码库调研 |
 | `worker` | read, edit, write, bash | 修改代码 |
-| `planner` | read, bash | 分析 + 提出分步计划 |
-| `oracle` | read, bash | 回答问题 / 建议 |
+| `planner` | read, bash, grep, find, ls + ACP | 分析 + 提出分步计划 |
+| `oracle` | read, bash, grep, find, ls + ACP | 回答问题 / 建议 |
 
-委派的完整结果保存到文件(`/tmp/acp-delegate/<runId>.out`);工具结果和注入通知只携带**任务标题 + 文件路径**(无预览)— 需要细节时用 `read` 读取。这让父上下文保持精简。
+只读角色(reviewer、researcher、planner、oracle)获得受限工具白名单(`read, bash, grep, find, ls`)+ ACP 上下文工具(`compress, decompress, search_context, acp_status`),以便管理自己的上下文。这能防止意外修改文件,但 `bash` 可绕过 - **这是护栏,不是安全边界**。
+
+Worker 运行在 Pi 的完整默认工具集上 - 不应用 `--tools` 白名单,因此任何已加载的扩展或自定义工具(如 ACP、LSP、MCP)保持可用。这确保主任务委派能力完整。上表中的 `read, edit, write, bash` 仅反映核心工具。
+
+委派的完整结果保存到文件(`/tmp/acp-delegate/<runId>.out`);工具结果和注入通知只携带**任务标题 + 文件路径**(无预览)- 需要细节时用 `read` 读取。这让父上下文保持精简。
 
 - **交互(TUI)与 RPC 模式**:`async:true`(默认)在后台运行子进程;完成时一条简短通知注入到聊天框。
 - **Print / JSON 模式**(`pi -p`、SDK):`async:true` 自动降级为**同步** — 结果在同一轮作为工具结果返回(父进程一轮后即退出,后台注入会丢失)。

package/dist/delegate-tool.d.ts

@@ -1,5 +1,5 @@
-import { Type } from "typebox";
-import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { Type, type Static } from "typebox";
+import type { ExtensionAPI, ExtensionContext, ToolDefinition } from "@earendil-works/pi-coding-agent";
 /** Snapshot of currently-running delegate runs, for the TUI status widget. */
 export declare function runningRunsSnapshot(): {
     runId: string;
@@ -14,6 +14,7 @@ declare const DelegateParams: Type.TObject<{
     model: Type.TOptional<Type.TString>;
     async: Type.TOptional<Type.TBoolean>;
 }>;
+type DelegateArgs = Static<typeof DelegateParams>;
 declare const CancelParams: Type.TObject<{
     runId: Type.TString;
 }>;
@@ -22,6 +23,22 @@ declare const WaitParams: Type.TObject<{
     timeout: Type.TOptional<Type.TInteger>;
 }>;
 export declare function makeDelegateTool(pi: ExtensionAPI): ToolDefinition<typeof DelegateParams>;
+/** If the delegate already delivered its result via a system notification
+ *  (the close handler injected before this wait was called), return a short
+ *  "already delivered" message pointing at the result file, so the model
+ *  never sees the same result twice (once via the injected notification,
+ *  once via this tool result). Returns null when the run was NOT injected,
+ *  in which case the caller delivers the full payload via formatRunResult(). */
+export declare function injectedWaitMessage(run: {
+    injected?: boolean;
+    result?: {
+        file: string;
+    };
+}, runId: string, remainingLine: string): string | null;
 export declare function makeDelegateWaitTool(_pi: ExtensionAPI): ToolDefinition<typeof WaitParams>;
 export declare function makeDelegateCancelTool(_pi: ExtensionAPI): ToolDefinition<typeof CancelParams>;
+export declare function buildChildArgs(args: DelegateArgs, rolePrompt: string, ctx: ExtensionContext): Promise<{
+    cliArgs: string[];
+    tmpDir: string;
+}>;
 export {};

package/dist/index.js

@@ -7649,15 +7649,19 @@ var MAX_DEPTH = 2;
 var SYNC_TIMEOUT_MS = 5 * 6e4;
 var RESULT_SUMMARY_CHARS = 500;
 var OUT_DIR = join4(tmpdir2(), "acp-delegate");
+var ACP_TOOLS = ["compress", "decompress", "search_context", "acp_status"];
+var RESTRICTED_TOOLS = "read,bash,grep,find,ls";
 var AGENTS = {
   reviewer: {
-    tools: "read,bash",
+    tools: RESTRICTED_TOOLS,
+    restricted: true,
     prompt: `You are a senior code reviewer with read-only access.
 Read the given code and report: bugs, security/safety risks, correctness issues, and concrete improvement suggestions.
 Be specific \u2014 cite file:line for every finding. Do NOT modify any files; only read and report.`
   },
   researcher: {
-    tools: "read,bash",
+    tools: RESTRICTED_TOOLS,
+    restricted: true,
     prompt: `You are a code researcher with read-only access.
 Investigate the codebase to answer the question thoroughly. Report findings with exact file:line references, function/type signatures, and relevant code snippets.
 Do NOT modify any files; only read and report.`
@@ -7669,13 +7673,15 @@ Make exactly the requested code changes \u2014 minimal, focused, following exist
 After editing, briefly summarize what you changed and why. Do not expand scope.`
   },
   planner: {
-    tools: "read,bash",
+    tools: RESTRICTED_TOOLS,
+    restricted: true,
     prompt: `You are a technical planner with read-only access.
 Analyze the task and produce a concrete, ordered step-by-step implementation plan with rationale for each step.
 Cite file:line for code you reference. Do NOT modify any files; only read and propose.`
   },
   oracle: {
-    tools: "read,bash",
+    tools: RESTRICTED_TOOLS,
+    restricted: true,
     prompt: `You are an expert advisor with read-only access.
 Answer the question concisely with clear reasoning. Cite file:line when referencing code. Do NOT modify any files.`
   }
@@ -7731,7 +7737,7 @@ var agentListLine = (name) => {
     planner: "analyze + propose step-by-step plan (read-only)",
     oracle: "answer questions / advise (read-only)"
   };
-  return `  \u2022 ${name} \u2014 ${blurb[name]} [tools: ${def.tools}]`;
+  return `  \u2022 ${name} - ${blurb[name]} [tools: ${def.tools}${def.restricted ? " + ACP context tools" : ""}]`;
 };
 function makeDelegateTool(pi) {
   return {
@@ -7772,6 +7778,12 @@ function remainingLineForWait(selfRunId) {
   const remaining = Array.from(runs.values()).filter((r) => r.status === "running" && r.runId !== selfRunId).length;
   return remaining > 0 ? ` ${remaining} delegate${remaining === 1 ? " is" : "s are"} still running.` : "";
 }
+function injectedWaitMessage(run, runId, remainingLine) {
+  if (!run.injected) return null;
+  const file = run.result?.file;
+  const fileLine = file ? ` If you need details, read the result file: \`${file}\`.` : "";
+  return `Delegate \`${runId}\` already delivered its result via a system notification when it finished \u2014 no need to wait on it again.${remainingLine}${fileLine}`;
+}
 function makeDelegateWaitTool(_pi) {
   return {
     name: "acp_delegate_wait",
@@ -7794,6 +7806,11 @@ function makeDelegateWaitTool(_pi) {
         return { details: void 0, content: [{ type: "text", text: `Delegate \`${args.runId}\` was cancelled (no result).${remainingLineForWait(args.runId)}` }] };
       }
       if (run.status !== "running") {
+        const dedup = injectedWaitMessage(run, args.runId, remainingLineForWait(args.runId));
+        if (dedup) {
+          run.consumed = true;
+          return { details: void 0, content: [{ type: "text", text: dedup }] };
+        }
         run.consumed = true;
         if (!run.result) {
           return { details: void 0, content: [{ type: "text", text: `Delegate \`${args.runId}\` finished but no result is available (persist error).` }] };
@@ -7958,6 +7975,7 @@ async function runDelegate(pi, args, ctx, signal) {
           return;
         }
         const injected = injectResult(pi, args.agent, runId, args.task, code, file2);
+        run.injected = injected;
         debug.event("delegate-done", { runId, code, status: run.status, injected, outLen: output.length, file: file2 });
         delegateStatusWidget.poke();
       }).catch((err) => {
@@ -8003,6 +8021,11 @@ async function buildChildArgs(args, rolePrompt, ctx) {
 
 Complete the task below.`, "utf8");
   const cliArgs = ["-p", "--no-session", "--append-system-prompt", promptFile];
+  const agentDef = AGENTS[args.agent];
+  if (agentDef?.restricted) {
+    const merged = [.../* @__PURE__ */ new Set([...agentDef.tools.split(",").map((s) => s.trim()), ...ACP_TOOLS])];
+    cliArgs.push("--tools", merged.join(","));
+  }
   if (args.model && args.model.includes("/")) {
     const [providerId, ...rest] = args.model.split("/");
     const modelId = rest.join("/");
@@ -8209,7 +8232,7 @@ async function statusReport(runtime, ctx) {
   const activeBlocksList = state.blocks.filter((b) => b.active);
   const totalBlocksList = state.blocks;
   const lines = [];
-  const versionStr = "0.1.25" ? `billion-context-pi@${"0.1.25"}` : "";
+  const versionStr = "0.1.26" ? `billion-context-pi@${"0.1.26"}` : "";
   lines.push("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E");
   lines.push("\u2502           ACP Context Analysis              \u2502");
   lines.push("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F");
@@ -8567,7 +8590,7 @@ async function checkForUpdate(autoUpdate, notify) {
     const data = await res.json();
     const latest = data.version;
     if (!latest) return;
-    const current = runtimeVersion ?? "0.1.25";
+    const current = runtimeVersion ?? "0.1.26";
     debug.event("update-check", {
       current,
       latest,
@@ -8602,7 +8625,7 @@ import { readFile as readFile2, writeFile as writeFile4, stat, copyFile, rename
 import { existsSync } from "fs";
 import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
-var ACP_TOOLS = ["compress", "decompress", "search_context", "acp_status"];
+var ACP_TOOLS2 = ["compress", "decompress", "search_context", "acp_status"];
 var BUILTIN_DEFAULT_TOOLS = {
   advisor: ["read", "grep", "find", "ls", "bash", "intercom"],
   "context-builder": ["read", "grep", "find", "ls", "bash", "write", "web_search", "intercom"],
@@ -8622,9 +8645,9 @@ function resolveAgentDir() {
 }
 function desiredTools(existing, name) {
   const base = Array.isArray(existing?.tools) && existing.tools.length > 0 ? [...existing.tools] : [...BUILTIN_DEFAULT_TOOLS[name] ?? []];
-  const hasAll = ACP_TOOLS.every((t) => base.includes(t));
+  const hasAll = ACP_TOOLS2.every((t) => base.includes(t));
   if (hasAll) return { tools: base, changed: false };
-  for (const t of ACP_TOOLS) if (!base.includes(t)) base.push(t);
+  for (const t of ACP_TOOLS2) if (!base.includes(t)) base.push(t);
   return { tools: base, changed: true };
 }
 async function ensureSubagentAcpTools(settingsPath) {
@@ -8695,7 +8718,7 @@ async function ensureSubagentAcpTools(settingsPath) {
     if (typeof v !== "object" || v === null) throw new Error("agentOverrides missing after write");
     for (const name of Object.keys(BUILTIN_DEFAULT_TOOLS)) {
       const tools = v[name]?.tools;
-      if (!Array.isArray(tools) || !ACP_TOOLS.every((t) => tools.includes(t))) {
+      if (!Array.isArray(tools) || !ACP_TOOLS2.every((t) => tools.includes(t))) {
         throw new Error(`${name} missing ACP tools after write`);
       }
     }