killeros 1.4.8 → 1.4.9

package/CHANGELOG.md

@@ -2,11 +2,12 @@
 
 All notable changes to KillerOS are documented here.
 
-## [1.4.8] - 2026-08-02
+## [1.4.9] - 2026-08-02
 
 ### Changed
 
-- Parallel batches with write-capable roles now run through a shared pool by default; `writerConcurrency` caps the entire batch and setting it to `1` serializes the writer-containing batch. Reader-only batches reject `writerConcurrency` because it does not apply.
+- Parallel batches with write-capable roles now use one shared slot by default; `writerConcurrency` above `1` opts into concurrent shared-worktree writes only when path ownership is proven. Reader-only batches reject `writerConcurrency` because it does not apply.
+- Added an 8 MiB ceiling for one child JSONL record, bounded thread retention with inspectable tombstones, and scoped atomic `/init` reads and writes.
 
 ## [1.4.7] - 2026-08-01
 
@@ -32,7 +33,7 @@ All notable changes to KillerOS are documented here.
 ### Fixed
 
 - Removed the child-budget extension, its read-tool budget, and the default 250,000-token/$5 quota.
-- Removed default child wall-time, JSONL-line, trace, stderr, returned-output, and model-output-length stops; role `timeoutMs` and other child guards are now opt-in.
+- Removed default child wall-time, trace, stderr, returned-output, and model-output-length stops; role `timeoutMs` and other child guards are opt-in, while the parser retains a finite JSONL-record ceiling.
 - Removed forced early-report prompt text so roles can finish their assigned work naturally.
 - Treat model stop reason `length` as a completed child process instead of inventing a KillerOS `limited` result.
 - Documented the child lifecycle contract: children complete naturally; explicit user interruptions, configured guards, and real child-process failures remain visible.
@@ -115,6 +116,6 @@ All notable changes to KillerOS are documented here.
 ### Changed
 
 - Replaced the animated startup illustration and capability inventory with the Compact startup card and one external tip.
-- Standardized product branding on mixed-case `KillerOS` and the neutral `› KillerOS (v1.2.0)` lockup.
+- Standardized product branding on mixed-case `KillerOS` and the neutral lockup used in the v1.2.0 release.
 - Made theme neutrals achromatic while preserving the coral accent.
 - Replaced the footer progress bar with direct `percent left (tokens)` context telemetry and a critical `/compact` prompt.

package/Killeros.ts

@@ -2,6 +2,7 @@ import { execFileSync, spawn } from "node:child_process";
 import { promises as fs, closeSync, existsSync, openSync, readFileSync, readSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import {
   CONFIG_DIR_NAME,
   CustomEditor,
@@ -31,6 +32,7 @@ import {
   type TUI,
 } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import { MAX_NODE_TIMER_MS } from "./subagent-process.ts";
 import { registerSubagentTool } from "./subagents.ts";
 
 const COMMAND_BLUE_RGB = "120;169;255";
@@ -325,14 +327,17 @@ function registerConcisePrompt(pi: ExtensionAPI): void {
   }));
 }
 
-const INIT_READ_ONLY_TOOLS = new Set(["read", "ls", "find", "grep"]);
+const INIT_WRITE_TOOL = "killeros_init_write";
+const INIT_SCOPED_TOOLS = ["read", "ls", INIT_WRITE_TOOL] as const;
+const INIT_GENERATED_CONTENT_LIMIT = 128 * 1024;
 
 interface InitWorkflowState {
   active: boolean;
   targetPath?: string;
   writeAttempted: boolean;
   writeSucceeded: boolean;
-  writeToolCallId?: string;
+  projectRoot?: string;
+  activeTools?: string[];
   settle?: (writeSucceeded: boolean) => void;
 }
 
@@ -341,7 +346,8 @@ function resetInitState(state: InitWorkflowState): void {
   state.targetPath = undefined;
   state.writeAttempted = false;
   state.writeSucceeded = false;
-  state.writeToolCallId = undefined;
+  state.projectRoot = undefined;
+  state.activeTools = undefined;
 }
 
 const GOAL_ENTRY_TYPE = "killeros-goal";
@@ -580,33 +586,19 @@ function scheduleGoalContinuation(
     || runtime.state?.status !== "active"
     || runtime.continuationScheduled
     || runtime.continuationHeld
+    || runtime.goalTurnInFlight
     || initState.active
     || ctx.hasPendingMessages()) return;
   const current = runtime.state;
-  const now = Date.now();
-  const next: GoalState = {
-    ...current,
-    revision: current.revision + 1,
-    turns: current.turns + 1,
-    updatedAt: now,
-    activeStartedAt: current.activeStartedAt ?? now,
-  };
-  try {
-    persistGoalState(pi, runtime, "turn", next);
-  } catch (error) {
-    pauseGoalAfterFailure(pi, runtime, ctx, `continuation state could not be saved: ${error instanceof Error ? error.message : String(error)}`);
-    return;
-  }
-
   runtime.continuationScheduled = true;
-  runtime.goalTurnInFlight = true;
+  runtime.goalTurnInFlight = false;
   runtime.agentEndObserved = false;
   runtime.lastStopReason = undefined;
   runtime.lastError = undefined;
   try {
     pi.sendMessage({
       customType: GOAL_CONTINUATION_TYPE,
-      content: goalContinuationMessage(next, ctx),
+      content: goalContinuationMessage(current, ctx),
       display: false,
     }, { triggerTurn: true, deliverAs: "followUp" });
   } catch (error) {
@@ -772,6 +764,7 @@ function registerGoal(
     runtime.continuationScheduled = false;
     const current = runtime.state;
     if (!isGoalModeSupported(ctx) || !isSavedSession(ctx) || !current || current.status !== "active" || initState.active) return;
+    if (runtime.goalTurnInFlight) return { systemPrompt: `${event.systemPrompt}\n\n${goalSystemPrompt(current)}` };
     const now = Date.now();
     const next: GoalState = {
       ...current,
@@ -990,8 +983,13 @@ function registerGoal(
           scheduleGoalContinuation(pi, runtime, initState, ctx);
           ctx.ui.notify("Goal updated and active", "info");
         } catch (error) {
-          reportError(ctx, "Goal could not be edited", error);
-          scheduleGoalContinuation(pi, runtime, initState, ctx);
+          pauseGoalAfterFailure(
+            pi,
+            runtime,
+            ctx,
+            `Goal could not be edited: ${error instanceof Error ? error.message : String(error)}`,
+            "Automatic continuation is stopped. Retry /goal edit after session storage recovers.",
+          );
         }
         return;
       }
@@ -1064,11 +1062,17 @@ function registerGoalSettlement(
 ): void {
   pi.on("agent_settled", (_event, ctx) => {
     const wasGoalTurn = runtime.goalTurnInFlight;
+    const continuationWasScheduled = runtime.continuationScheduled;
     const agentEndObserved = runtime.agentEndObserved;
     runtime.goalTurnInFlight = false;
     runtime.agentEndObserved = false;
     runtime.continuationScheduled = false;
-    if (!wasGoalTurn || runtime.state?.status !== "active" || initState.active) return;
+    if (!wasGoalTurn || runtime.state?.status !== "active" || initState.active) {
+      if (continuationWasScheduled && runtime.state?.status === "active" && !initState.active) {
+        pauseGoalAfterFailure(pi, runtime, ctx, "the goal continuation ended before an agent turn started");
+      }
+      return;
+    }
     if (!agentEndObserved) {
       pauseGoalAfterFailure(pi, runtime, ctx, "the goal turn ended without an agent result");
       return;
@@ -1124,14 +1128,9 @@ type QuestionSelection =
   | { kind: "cancelled" }
   | { kind: "aborted" };
 
-const customInputHistory: string[] = [];
-
-function rememberCustomInput(value: string): void {
-  const existingIndex = customInputHistory.indexOf(value);
-  if (existingIndex >= 0) customInputHistory.splice(existingIndex, 1);
-  customInputHistory.push(value);
-  if (customInputHistory.length > 100) customInputHistory.shift();
-}
+const CUSTOM_INPUT_MAX_CHARACTERS = 4_000;
+const CUSTOM_INPUT_HISTORY_LIMIT = 100;
+const CUSTOM_INPUT_HISTORY_BYTES = 64 * 1024;
 
 function isPrintableInput(data: string): boolean {
   return data.length > 0 && !/[\u0000-\u001F\u007F-\u009F]/u.test(data);
@@ -1165,6 +1164,37 @@ function removeLastGrapheme(value: string): string {
 }
 
 function registerQuestionTool(pi: ExtensionAPI): void {
+  const customInputHistory: string[] = [];
+  let customInputHistoryBytes = 0;
+  const clearCustomInputHistory = (): void => {
+    customInputHistory.length = 0;
+    customInputHistoryBytes = 0;
+  };
+  const rememberCustomInput = (value: string): boolean => {
+    const bytes = Buffer.byteLength(value, "utf8");
+    if (bytes > CUSTOM_INPUT_HISTORY_BYTES) return false;
+    const existingIndex = customInputHistory.indexOf(value);
+    if (existingIndex >= 0) {
+      customInputHistoryBytes -= Buffer.byteLength(customInputHistory[existingIndex]!, "utf8");
+      customInputHistory.splice(existingIndex, 1);
+    }
+    while (customInputHistory.length >= CUSTOM_INPUT_HISTORY_LIMIT || customInputHistoryBytes + bytes > CUSTOM_INPUT_HISTORY_BYTES) {
+      const removed = customInputHistory.shift();
+      if (removed !== undefined) customInputHistoryBytes -= Buffer.byteLength(removed, "utf8");
+    }
+    customInputHistory.push(value);
+    customInputHistoryBytes += bytes;
+    return true;
+  };
+  const inputCharacterCount = (value: string): number => {
+    let count = 0;
+    for (const _character of value) count += 1;
+    return count;
+  };
+  pi.on("session_start", clearCustomInputHistory);
+  pi.on("session_tree", clearCustomInputHistory);
+  pi.on("session_shutdown", clearCustomInputHistory);
+
   pi.registerTool<typeof QuestionParams, QuestionDetails>({
     name: "question",
     label: "Question",
@@ -1246,7 +1276,14 @@ function registerQuestionTool(pi: ExtensionAPI): void {
         editor.onSubmit = (value) => {
           const answer = value.trim();
           if (answer) {
-            rememberCustomInput(answer);
+            if (inputCharacterCount(answer) > CUSTOM_INPUT_MAX_CHARACTERS) {
+              ctx.ui.notify(`Custom answers are limited to ${CUSTOM_INPUT_MAX_CHARACTERS} characters`, "error");
+              return;
+            }
+            if (!rememberCustomInput(answer)) {
+              ctx.ui.notify(`Custom answer history is limited to ${CUSTOM_INPUT_HISTORY_BYTES} bytes`, "error");
+              return;
+            }
             finish({ kind: "custom", answer });
             return;
           }
@@ -1268,7 +1305,13 @@ function registerQuestionTool(pi: ExtensionAPI): void {
               refresh();
               return;
             }
+            const before = editor.getExpandedText();
             editor.handleInput(data);
+            const after = editor.getExpandedText();
+            if (inputCharacterCount(after) > CUSTOM_INPUT_MAX_CHARACTERS) {
+              editor.setText(before);
+              ctx.ui.notify(`Custom answers are limited to ${CUSTOM_INPUT_MAX_CHARACTERS} characters`, "error");
+            }
             refresh();
             return;
           }
@@ -1576,6 +1619,7 @@ interface HookExecutionResult {
   stdout: string;
   stderr: string;
   timedOut: boolean;
+  exitUnconfirmed: boolean;
 }
 
 const HOOK_EVENTS: readonly KillerosHookEvent[] = ["tool_call", "tool_result", "agent_settled"];
@@ -1600,7 +1644,7 @@ function loadKillerosHooks(ctx: ExtensionContext): KillerosHookConfig {
           && typeof hook.command === "string"
           && hook.command.trim().length > 0
           && (hook.matcher === undefined || typeof hook.matcher === "string")
-          && (hook.timeoutMs === undefined || Number.isFinite(hook.timeoutMs));
+          && (hook.timeoutMs === undefined || Number.isSafeInteger(hook.timeoutMs) && hook.timeoutMs > 0 && hook.timeoutMs <= MAX_NODE_TIMER_MS);
         if (!valid) {
           ctx.ui.notify(`Ignored invalid ${event} hook ${index + 1} in ${configPath}`, "warning");
           return false;
@@ -1637,11 +1681,37 @@ function appendBounded(current: string, chunk: Buffer | string): string {
   return (current + chunk.toString()).slice(0, HOOK_OUTPUT_LIMIT);
 }
 
-function executeHook(command: string, cwd: string, environment: Record<string, string>, timeoutMs = 30_000): Promise<HookExecutionResult> {
+function terminateHookProcess(child: ReturnType<typeof spawn>, force: boolean): void {
+  if (process.platform === "win32" && force && child.pid) {
+    const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+      shell: false,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    killer.unref();
+    return;
+  }
+  if (process.platform !== "win32" && child.pid) {
+    try {
+      process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM");
+      return;
+    } catch {
+      // Fall back to the shell itself when a custom child has no process group.
+    }
+  }
+  try {
+    child.kill(force ? "SIGKILL" : "SIGTERM");
+  } catch {
+    // The hook may have already exited.
+  }
+}
+
+export function executeHook(command: string, cwd: string, environment: Record<string, string>, timeoutMs = 30_000, spawnProcess: typeof spawn = spawn): Promise<HookExecutionResult> {
   return new Promise((resolve) => {
-    const child = spawn(command, {
+    const child = spawnProcess(command, {
       cwd,
       env: { ...process.env, ...environment },
+      detached: process.platform !== "win32",
       shell: true,
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
@@ -1650,27 +1720,35 @@ function executeHook(command: string, cwd: string, environment: Record<string, s
     let stderr = "";
     let completed = false;
     let timedOut = false;
+    let exitUnconfirmed = false;
     let timer: NodeJS.Timeout | undefined;
-    const finish = (code: number): void => {
+    let forceTimer: NodeJS.Timeout | undefined;
+    let settleTimer: NodeJS.Timeout | undefined;
+    const finish = (code: number, unconfirmed = false): void => {
       if (completed) return;
       completed = true;
+      exitUnconfirmed = unconfirmed;
       if (timer) clearTimeout(timer);
-      resolve({ code, stdout, stderr, timedOut });
+      if (forceTimer) clearTimeout(forceTimer);
+      if (settleTimer) clearTimeout(settleTimer);
+      resolve({ code, stdout, stderr, timedOut, exitUnconfirmed });
     };
     child.stdout.on("data", (chunk) => { stdout = appendBounded(stdout, chunk); });
     child.stderr.on("data", (chunk) => { stderr = appendBounded(stderr, chunk); });
     child.on("error", (error) => {
       stderr = appendBounded(stderr, error.message);
-      finish(1);
+      finish(timedOut ? 124 : 1);
     });
-    child.on("close", (code) => finish(code ?? 1));
+    child.once("close", (code) => finish(timedOut ? 124 : code ?? 1));
     timer = setTimeout(() => {
       timedOut = true;
-      child.kill("SIGTERM");
-      setTimeout(() => child.kill("SIGKILL"), 1_000).unref?.();
-      finish(124);
+      terminateHookProcess(child, false);
+      forceTimer = setTimeout(() => {
+        if (completed) return;
+        terminateHookProcess(child, true);
+        settleTimer = setTimeout(() => finish(124, true), 1_000);
+      }, 1_000);
     }, Math.max(1_000, Math.min(timeoutMs, 300_000)));
-    timer.unref?.();
   });
 }
 
@@ -1684,7 +1762,7 @@ function hookEnvironment(event: KillerosHookEvent, toolName = "", payload: unkno
 
 function hookFailureMessage(hook: KillerosHook, result: HookExecutionResult): string {
   const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`;
-  return `Hook failed${result.timedOut ? " (timed out)" : ""}: ${hook.command}\n${detail}`;
+  return `Hook failed${result.timedOut ? " (timed out)" : ""}${result.exitUnconfirmed ? " (process exit unconfirmed)" : ""}: ${hook.command}\n${detail}`;
 }
 
 function registerLifecycleHooks(pi: ExtensionAPI): void {
@@ -1876,15 +1954,118 @@ Write concise guidance where every line answers: "Would removing this cause an a
 Verify command meaning rather than merely copying command names. Distinguish generated-but-committed artifacts from ignored outputs and use exact contract values. Exclude generic coding advice, directory inventories, obvious scripts, historical narration, personal preferences, secrets, and speculative recommendations.
 
 ## Generate
-Use the write tool exactly once to create or replace only the root AGENTS.md. Start with \`# AGENTS.md\`. Prefer a compact, high-signal guide over exhaustive documentation. Do not use edit and do not modify any other path.
+Use the \`killeros_init_write\` tool exactly once with only the generated text; it creates or replaces the root AGENTS.md and cannot target another path. Start with \`# AGENTS.md\`. Prefer a compact, high-signal guide over exhaustive documentation. Do not use edit, bash, or any other mutation tool.
 
 After writing, read AGENTS.md once to confirm the file is coherent and contains only claims supported by repository evidence. Summarize what was generated. KillerOS reloads Pi resources automatically after this turn, so do not invoke /reload.
 `.trim();
 
-function resolveInitToolPath(input: unknown, cwd: string): string | undefined {
+function initPathWithin(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+function initExcludedSegment(segment: string): boolean {
+  const normalized = segment.toLocaleLowerCase();
+  return [...INIT_SURVEY_EXCLUDED_DIRS].some((name) => name.toLocaleLowerCase() === normalized)
+    || [...INIT_SURVEY_EXCLUDED_FILES].some((name) => name.toLocaleLowerCase() === normalized);
+}
+
+function initInputPath(toolName: string, input: unknown): string | undefined {
   if (!input || typeof input !== "object") return undefined;
-  const toolPath = (input as { path?: unknown }).path;
-  return typeof toolPath === "string" ? path.resolve(cwd, toolPath) : undefined;
+  const record = input as Record<string, unknown>;
+  if (toolName === "read" && typeof record.file_path === "string") return record.file_path;
+  return typeof record.path === "string" ? record.path : toolName === "ls" || toolName === "find" || toolName === "grep" ? "." : undefined;
+}
+
+function normalizeInitReadPath(rawPath: string): string {
+  // Mirror Pi's built-in read/ls path normalization (stripAtPrefix, unicode spaces,
+  // tilde expansion, file URLs) so /init validates the exact path the scoped tools
+  // will resolve rather than the raw user text.
+  let normalized = rawPath.replace(/[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g, " ");
+  if (normalized.startsWith("@")) normalized = normalized.slice(1);
+  if (normalized === "~") normalized = os.homedir();
+  else if (normalized.startsWith("~/") || (process.platform === "win32" && normalized.startsWith("~\\"))) {
+    normalized = path.join(os.homedir(), normalized.slice(2));
+  }
+  if (/^file:\/\//u.test(normalized)) {
+    try {
+      normalized = fileURLToPath(normalized);
+    } catch {
+      return "";
+    }
+  }
+  return normalized;
+}
+
+function resolveInitToolPath(input: unknown, cwd: string): string | undefined {
+  const rawPath = initInputPath("read", input);
+  if (!rawPath) return undefined;
+  const normalizedPath = normalizeInitReadPath(rawPath);
+  return normalizedPath ? path.resolve(cwd, normalizedPath) : undefined;
+}
+
+async function initScopedPathError(
+  toolName: string,
+  input: unknown,
+  projectRoot: string,
+  targetPath: string,
+  writeSucceeded: boolean,
+): Promise<string | undefined> {
+  const rawPath = initInputPath(toolName, input);
+  if (!rawPath) return `/init ${toolName} requires a path under the project root`;
+  const normalizedPath = normalizeInitReadPath(rawPath);
+  if (!normalizedPath || normalizedPath.split(/[\\/]/u).includes("..")) return "/init rejects parent-directory read paths";
+  const candidate = toolName === "read"
+    ? resolveInitToolPath(input, projectRoot)
+    : path.resolve(projectRoot, normalizedPath);
+  if (!candidate || !initPathWithin(projectRoot, candidate)) return "/init reads must remain under the resolved project root";
+  const relativeSegments = path.relative(projectRoot, candidate).split(path.sep).filter(Boolean);
+  const isGeneratedTarget = writeSucceeded && candidate.toLocaleLowerCase() === targetPath.toLocaleLowerCase();
+  for (let index = 0; index < relativeSegments.length; index += 1) {
+    const segment = relativeSegments[index]!;
+    if (initExcludedSegment(segment) && !(isGeneratedTarget && index === relativeSegments.length - 1 && segment.toLocaleLowerCase() === "agents.md")) {
+      return "/init cannot read excluded guidance, skills, or dependency paths";
+    }
+  }
+
+  let current = projectRoot;
+  try {
+    for (const segment of relativeSegments) {
+      current = path.join(current, segment);
+      const stat = await fs.lstat(current);
+      if (stat.isSymbolicLink()) return "/init rejects symbolic-link and junction read paths";
+    }
+    const realPath = await fs.realpath(candidate);
+    if (!initPathWithin(projectRoot, realPath)) return "/init reads must remain under the resolved project root";
+    const stat = await fs.lstat(candidate);
+    if (stat.isSymbolicLink()) return "/init rejects symbolic-link and junction read paths";
+    if (stat.isFile() && stat.nlink > 1) return "/init rejects hard-linked read paths";
+  } catch (error) {
+    return `/init could not validate read path: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  return undefined;
+}
+
+interface InitTargetIdentity {
+  dev: number;
+  ino: number;
+  mode: number;
+  nlink: number;
+}
+
+async function initTargetIdentity(targetPath: string): Promise<InitTargetIdentity | undefined> {
+  try {
+    const stat = await fs.lstat(targetPath);
+    return { dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+
+function sameInitTargetIdentity(left: InitTargetIdentity | undefined, right: InitTargetIdentity | undefined): boolean {
+  if (!left || !right) return left === right;
+  return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode && left.nlink === right.nlink;
 }
 
 async function initTargetSafetyError(targetPath: string): Promise<string | undefined> {
@@ -1901,32 +2082,104 @@ async function initTargetSafetyError(targetPath: string): Promise<string | undef
   return undefined;
 }
 
+export async function writeInitAgentsFile(
+  targetPath: string,
+  content: string,
+  renameFile: typeof fs.rename = fs.rename,
+): Promise<void> {
+  const safetyError = await initTargetSafetyError(targetPath);
+  if (safetyError) throw new Error(safetyError);
+  const before = await initTargetIdentity(targetPath);
+  const tempDirectory = await fs.mkdtemp(path.join(path.dirname(targetPath), ".killeros-init-"));
+  const tempPath = path.join(tempDirectory, "AGENTS.md");
+  try {
+    const handle = await fs.open(tempPath, "wx", 0o600);
+    try {
+      await handle.writeFile(content, { encoding: "utf8" });
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const after = await initTargetIdentity(targetPath);
+    if (!sameInitTargetIdentity(before, after)) throw new Error("/init target changed while AGENTS.md was being generated");
+    await renameFile(tempPath, targetPath);
+  } finally {
+    await fs.rm(tempDirectory, { recursive: true, force: true });
+  }
+}
+
+function setInitTools(pi: ExtensionAPI, initState: InitWorkflowState, active: boolean): void {
+  const runtime = pi as ExtensionAPI & { getActiveTools?: () => string[]; setActiveTools?: (names: string[]) => void };
+  if (!runtime.getActiveTools || !runtime.setActiveTools) return;
+  if (active) {
+    initState.activeTools ??= runtime.getActiveTools().filter((name) => name !== INIT_WRITE_TOOL);
+    runtime.setActiveTools([...INIT_SCOPED_TOOLS]);
+  } else if (initState.activeTools) {
+    runtime.setActiveTools(initState.activeTools);
+    initState.activeTools = undefined;
+  } else {
+    runtime.setActiveTools(runtime.getActiveTools().filter((name) => name !== INIT_WRITE_TOOL));
+  }
+}
+
+function freezeInitToolInput(event: { input: Record<string, unknown> }): void {
+  const safeInput = Object.freeze({ ...event.input });
+  Object.defineProperty(event, "input", {
+    configurable: false,
+    enumerable: true,
+    value: safeInput,
+    writable: false,
+  });
+}
+
 function registerInitCommand(pi: ExtensionAPI, initState: InitWorkflowState, goalRuntime: GoalRuntime): void {
-  pi.on("tool_call", async (event) => {
-    const targetPath = initState.targetPath;
-    if (!initState.active || !targetPath || INIT_READ_ONLY_TOOLS.has(event.toolName)) return;
-    const toolPath = resolveInitToolPath(event.input, path.dirname(targetPath));
-    if (event.toolName === "write" && toolPath === targetPath && !initState.writeAttempted) {
-      const safetyError = await initTargetSafetyError(targetPath);
-      if (safetyError) return { block: true, reason: safetyError };
+  pi.registerTool({
+    name: INIT_WRITE_TOOL,
+    label: "Init write",
+    description: "Write the generated root AGENTS.md during /init; the destination is fixed by KillerOS.",
+    promptSnippet: "Write the generated root AGENTS.md during /init",
+    parameters: Type.Object({ content: Type.String({ minLength: 1, maxLength: INIT_GENERATED_CONTENT_LIMIT }) }),
+    executionMode: "sequential",
+    async execute(_toolCallId, params) {
+      if (!initState.active || !initState.targetPath) throw new Error("killeros_init_write is available only during /init");
+      if (initState.writeAttempted) throw new Error("/init may write the root AGENTS.md exactly once and may not modify any other file");
+      if (Buffer.byteLength(params.content, "utf8") > INIT_GENERATED_CONTENT_LIMIT) throw new Error(`/init output exceeds ${INIT_GENERATED_CONTENT_LIMIT} bytes`);
       initState.writeAttempted = true;
-      initState.writeToolCallId = event.toolCallId;
-      return;
-    }
-    return {
-      block: true,
-      reason: "/init may write the root AGENTS.md exactly once and may not modify any other file",
-    };
+      try {
+        await writeInitAgentsFile(initState.targetPath, params.content);
+        initState.writeSucceeded = true;
+        return {
+          content: [{ type: "text" as const, text: "Generated root AGENTS.md" }],
+          details: { path: initState.targetPath },
+        };
+      } catch (error) {
+        initState.writeAttempted = false;
+        throw error;
+      }
+    },
   });
 
-  pi.on("tool_result", (event) => {
-    if (!initState.active || event.toolName !== "write" || event.toolCallId !== initState.writeToolCallId) return;
-    if (event.isError) {
-      initState.writeAttempted = false;
-      initState.writeToolCallId = undefined;
+  pi.on("session_start", () => setInitTools(pi, initState, false));
+  pi.on("session_shutdown", () => {
+    setInitTools(pi, initState, false);
+    resetInitState(initState);
+  });
+  pi.on("before_agent_start", () => {
+    if (initState.active) setInitTools(pi, initState, true);
+  });
+  pi.on("tool_call", async (event) => {
+    if (!initState.active || !initState.projectRoot || !initState.targetPath) return;
+    if (event.toolName === INIT_WRITE_TOOL) {
+      if (initState.writeAttempted) return { block: true, reason: "/init may write AGENTS.md exactly once" };
+      freezeInitToolInput(event);
       return;
     }
-    initState.writeSucceeded = true;
+    if (!INIT_SCOPED_TOOLS.includes(event.toolName as (typeof INIT_SCOPED_TOOLS)[number])) {
+      return { block: true, reason: "/init may write the root AGENTS.md exactly once and may not modify any other file" };
+    }
+    const pathError = await initScopedPathError(event.toolName, event.input, initState.projectRoot, initState.targetPath, initState.writeSucceeded);
+    if (pathError) return { block: true, reason: pathError };
+    freezeInitToolInput(event);
   });
 
   pi.registerCommand("init", {
@@ -1953,13 +2206,23 @@ function registerInitCommand(pi: ExtensionAPI, initState: InitWorkflowState, goa
         return;
       }
       await ctx.waitForIdle();
+      let projectRoot: string;
+      try {
+        projectRoot = await fs.realpath(ctx.cwd);
+      } catch (error) {
+        reportError(ctx, "/init could not resolve the project root", error);
+        return;
+      }
       initState.active = true;
-      initState.targetPath = path.join(ctx.cwd, "AGENTS.md");
+      initState.projectRoot = projectRoot;
+      initState.targetPath = path.join(projectRoot, "AGENTS.md");
       initState.writeAttempted = false;
       initState.writeSucceeded = false;
+      setInitTools(pi, initState, true);
 
-      const survey = await runInitSurvey(ctx.cwd);
+      const survey = await runInitSurvey(projectRoot);
       if (!survey.output) {
+        setInitTools(pi, initState, false);
         resetInitState(initState);
         reportError(ctx, "/init could not scan the repository", survey.error ?? "no repository evidence was found");
         return;
@@ -1975,6 +2238,7 @@ function registerInitCommand(pi: ExtensionAPI, initState: InitWorkflowState, goa
           display: false,
         }, { triggerTurn: true });
       } catch (error) {
+        setInitTools(pi, initState, false);
         resetInitState(initState);
         initState.settle = undefined;
         reportError(ctx, "/init failed to start", error);
@@ -2002,6 +2266,7 @@ function registerInitSettlement(pi: ExtensionAPI, initState: InitWorkflowState):
     if (!initState.active) return;
     const settle = initState.settle;
     const writeSucceeded = initState.writeSucceeded;
+    setInitTools(pi, initState, false);
     resetInitState(initState);
     initState.settle = undefined;
     settle?.(writeSucceeded);

package/README.md

@@ -33,7 +33,7 @@ pi install git:github.com/KyrosHendrix/pi-KillerOS
 Pin an install to a release:
 
 ```bash
-pi install git:github.com/KyrosHendrix/pi-KillerOS@v1.4.8
+pi install git:github.com/KyrosHendrix/pi-KillerOS@v1.4.9
 ```
 
 Add `-l` to either command for a project-only install. Restart Pi after installing.
@@ -97,13 +97,13 @@ KillerOS ships `planner`, `reviewer`, `scout`, and `security` as read-only roles
 
 The default `agentScope: "user"` uses bundled and personal roles. Use `"project"` or `"both"` to opt into trusted project roles; a selected project override requires interactive confirmation. Role frontmatter requires `name`, `description`, `access`, and an explicit `tools` list. Optional fields are `model`, `thinking`, and `timeoutMs`. Every bundled role shows `model: inherit` and `thinking: inherit` as editable placeholders. Replace them with an available `provider/model` and a separate thinking level when you want to pin a role; `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max` are checked against that model’s supported capabilities.
 
-The tool supports a single `agent` + `task`, parallel `tasks`, or a sequential `chain` whose task text may include `{previous}`. Read-only-only batches run concurrently, up to four at a time. Batches with write-capable roles use one shared pool by default, up to ten tasks at once; set `writerConcurrency` to choose a smaller cap, or set it to `1` to serialize the entire batch. Reader-only batches reject `writerConcurrency` because it does not apply. All children share the parent worktree, so concurrent writers must avoid file conflicts. A call can also set `model` and `thinking` for every task, overriding role settings; use `inherit` to fall back to each role and then the active parent model. The `message` field is only valid with `action: "steer"`. For example:
+The tool supports a single `agent` + `task`, parallel `tasks`, or a sequential `chain` whose task text may include `{previous}`. Read-only-only batches run concurrently, up to four at a time. Batches with write-capable roles use one shared slot by default; set `writerConcurrency` above `1` only after proving path ownership in the shared worktree. Reader-only batches reject `writerConcurrency` because it does not apply. All children share the parent worktree, so concurrent writers must avoid file conflicts. A call can also set `model` and `thinking` for every task, overriding role settings; use `inherit` to fall back to each role and then the active parent model. The `message` field is only valid with `action: "steer"`. For example:
 
 ```json
 {"agent":"reviewer","task":"Review the change","model":"provider/model","thinking":"high"}
 ```
 
-Use the separate `model` and `thinking` fields for new configuration. The older `provider/model:thinking` model form remains accepted. Children run as isolated `pi --mode json -p` processes with a private `--session-dir` and `--session-id`, plus explicit local tools and `web_search`, `source_check`, `fetch_content`, and `get_search_content`. Steering restarts the same child session, so the child keeps its prior conversation. Each child explicitly loads `npm:pi-web-access`, discovers available skills, and keeps arbitrary extensions and prompt templates disabled; project-local skills load only when the parent project is trusted. Every bundled role is instructed to load the most relevant `SKILL.md` and report useful evidence. Children have no default token, dollar, turn, tool-call, research, wall-time, JSONL-line, trace, stderr, or returned-output execution quota. KillerOS bounds retained trace, stderr, and returned text and spills a large JSONL line to temporary storage; retention never stops a child or marks it `limited`. The parent limits each request to ten tasks, read-only-only batches to four concurrent readers, and bounds role files, task input, and combined parent output. An embedding caller may opt into named child resource guards. A parent tool-call abort cancels queued tasks but lets already-running children finish; explicit `interrupt` actions and session shutdown terminate active children and escalate after five seconds.
+Use the separate `model` and `thinking` fields for new configuration. The older `provider/model:thinking` model form remains accepted. Children run as isolated `pi --mode json -p` processes with a private `--session-dir` and `--session-id`, plus explicit local tools and `web_search`, `source_check`, `fetch_content`, and `get_search_content`. Steering restarts the same child session, so the child keeps its prior conversation. Each child explicitly loads `npm:pi-web-access`, discovers available skills, and keeps arbitrary extensions and prompt templates disabled; project-local skills load only when the parent project is trusted. Every bundled role is instructed to load the most relevant `SKILL.md` and report useful evidence. Children have no default token, dollar, turn, tool-call, research, wall-time, trace, stderr, or returned-output execution quota; each JSONL record still has a bounded 8 MiB parser ceiling. KillerOS bounds retained trace, stderr, and returned text and spills a large JSONL line to temporary storage; retention never stops a child or marks it `limited`. The parent limits each request to ten tasks, read-only-only batches to four concurrent readers, and bounds role files, task input, and combined parent output. An embedding caller may opt into named child resource guards. A parent tool-call abort cancels queued tasks but lets already-running children finish; explicit `interrupt` actions and session shutdown terminate active children and escalate after five seconds.
 
 ### Thread lifecycle
 
@@ -111,9 +111,9 @@ Each delegated task creates a named child thread. Its contract records the paren
 
 Threads move through `queued`, `active`, `done`, `failed`, `stopped`, and `closed`. The parent renders separate **Active** and **Done** lists. Active threads show their name, task, model, usage, and direct controls. Done threads keep their handoff and trace available until the parent closes them.
 
-The parent can inspect a thread’s prompt, role, model, tools, trace, usage, and handoff; steer an active thread with one bounded follow-up; interrupt one child or all active children; collect a concise handoff into parent context; and close a finished or stopped thread. An interrupt preserves the partial trace, states the reason, and reports the handoff as partial rather than successful.
+The parent can inspect a thread’s prompt, role, model, tools, trace, usage, and handoff; steer an active thread with one bounded follow-up; interrupt one child or all active children; collect a concise handoff into parent context; and close a finished or stopped thread. An interrupt preserves the partial trace, states the reason, and reports the handoff as partial rather than successful. Closing removes a thread from the active workspace; heavy trace and result payloads are evicted as needed under the bounded retention budget, leaving a small inspectable tombstone.
 
-A child completes naturally when it returns a final answer. The default path has no per-child execution quota. Explicit embedding options can add wall-time, output, trace, stderr, JSONL, token, or cost guards; those guards report their cause and return partial work clearly. The parent still bounds task count, reader concurrency, role files, task input, and combined parent output. Parent tool-call aborts leave active children running while queued work is settled as cancelled; explicit `interrupt` actions and real child-process failures remain visible. Session shutdown still terminates active children and escalates after five seconds.
+A child completes naturally when it returns a final answer. The default path has no per-child execution quota, while every JSONL record has an 8 MiB parser ceiling. Explicit embedding options can add wall-time, output, trace, stderr, JSONL, token, or cost guards; those guards report their cause and return partial work clearly. The parent still bounds task count, reader concurrency, role files, task input, and combined parent output. Parent tool-call aborts leave active children running while queued work is settled as cancelled; explicit `interrupt` actions and real child-process failures remain visible. Session shutdown still terminates active children and escalates after five seconds.
 
 The replacement lifecycle has nine phases:
 
@@ -124,8 +124,8 @@ The replacement lifecycle has nine phases:
 5. **Interrupt:** stop one or all active children while preserving partial work.
 6. **Collect:** return a concise handoff while retaining the expanded trace.
 7. **Guard:** honor only explicitly configured child resource guards; do not impose a routine turn stop.
-8. **Close:** remove a finished or stopped thread from the workspace without deleting its result record.
-9. **Prove:** test identity, visibility, controls, natural completion, guards, partial handoffs, and closure.
+8. **Close:** remove a finished or stopped thread from the workspace while retaining a small inspectable tombstone; heavy payloads may be evicted under the retention budget.
+9. **Prove:** test identity, visibility, controls, natural completion, guards, partial handoffs, bounded retention, and closure.
 
 ## Configuration
 
@@ -163,7 +163,7 @@ The package manifest lists Pi’s built-in modules as peer dependencies, so npm
 
 The [`pi-package`](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md) keyword makes a published npm release visible in Pi’s package catalog.
 
-For release `1.4.8`, publish after the validation checks pass:
+For release `1.4.9`, publish after the validation checks pass:
 
 ```bash
 npm login

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "killeros",
-  "version": "1.4.8",
+  "version": "1.4.9",
   "description": "A production-hardened TUI and workflow extension for the Pi coding agent.",
   "type": "module",
   "keywords": [
@@ -46,11 +46,11 @@
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*",
-    "@earendil-works/pi-tui": "*",
-    "pi-web-access": "*",
-    "typebox": "*"
+    "@earendil-works/pi-ai": ">=0.82.1",
+    "@earendil-works/pi-coding-agent": ">=0.82.1",
+    "@earendil-works/pi-tui": ">=0.82.1",
+    "pi-web-access": ">=0.17.1",
+    "typebox": ">=1.1.38 <2"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.82.1",

package/subagent-lifecycle.ts

@@ -97,6 +97,8 @@ export interface SubagentThread extends SubagentThreadSpec {
   result?: string;
   failure?: { message: string; code?: string };
   stopReason?: string;
+  /** True when close evicted the heavy trace, prompt, handoff, and result fields. */
+  evicted: boolean;
   timestamps: SubagentThreadTimestamps;
   version: number;
 }
@@ -192,6 +194,7 @@ function snapshot(thread: SubagentThread): SubagentThread {
     result: thread.result,
     failure: thread.failure ? { ...thread.failure } : undefined,
     stopReason: thread.stopReason,
+    evicted: thread.evicted,
     timestamps: { ...thread.timestamps },
     version: thread.version,
   };
@@ -287,6 +290,7 @@ export class SubagentThreadRegistry {
       usage: emptyUsage(),
       trace: [],
       steering: [],
+      evicted: false,
       timestamps: { createdAt: timestamp, updatedAt: timestamp },
       version: 1,
     };
@@ -413,7 +417,7 @@ export class SubagentThreadRegistry {
     return snapshot(thread);
   }
 
-  /** Closes a terminal record while retaining its result for inspection. */
+  /** Closes a terminal record and retains only a small tombstone for inspection. */
   close(id: SubagentThreadId): SubagentThread {
     this.assertOpen();
     const thread = this.requireThread(id);
@@ -421,10 +425,32 @@ export class SubagentThreadRegistry {
     if (!isTerminal(thread.state)) throw new Error(`Cannot close thread ${id} from ${thread.state}`);
     thread.state = "closed";
     thread.timestamps.closedAt = this.now();
+    thread.prompt = "[closed thread prompt evicted]";
+    thread.handoff = undefined;
+    thread.trace = [];
+    thread.steering = [];
+    thread.result = undefined;
+    thread.failure = thread.failure ? { message: thread.failure.message.slice(0, 512), code: thread.failure.code } : undefined;
+    thread.evicted = true;
     this.changed(thread, "close");
     return snapshot(thread);
   }
 
+  /** Remove the oldest closed tombstones and return bounded eviction notices. */
+  pruneClosed(maxRecords: number): SubagentThread[] {
+    this.assertOpen();
+    const closed = [...this.threads.values()]
+      .filter((thread) => thread.state === "closed")
+      .sort((left, right) => (left.timestamps.closedAt ?? left.timestamps.updatedAt) - (right.timestamps.closedAt ?? right.timestamps.updatedAt));
+    const removed: SubagentThread[] = [];
+    while (closed.length > Math.max(0, Math.floor(maxRecords))) {
+      const thread = closed.shift()!;
+      this.threads.delete(thread.id);
+      removed.push(snapshot(thread));
+    }
+    return removed;
+  }
+
   subscribe(listener: SubagentThreadListener): () => void {
     if (this.disposed) return () => {};
     this.listeners.add(listener);

package/subagent-process.ts

@@ -3,7 +3,10 @@ import { closeSync, mkdtempSync, openSync, readFileSync, rmSync, statSync, write
 import os from "node:os";
 import path from "node:path";
 
+export const MAX_NODE_TIMER_MS = 2_147_483_647;
+
 export const SUBAGENT_PROCESS_LIMITS = {
+  jsonlLineBytes: 8 * 1024 * 1024,
   killGraceMs: 5_000,
 } as const;
 
@@ -219,7 +222,10 @@ function normalizeLimits(overrides: Partial<SubagentProcessLimits> | undefined):
   const limits = { ...SUBAGENT_PROCESS_LIMITS, ...overrides };
   for (const name of ["wallTimeMs", "jsonlLineBytes", "traceBytes", "stderrBytes", "outputBytes", "killGraceMs"] as const) {
     const value = limits[name];
-    if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0)) throw new RangeError(`${name} must be a positive safe integer`);
+    if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0 || value > MAX_NODE_TIMER_MS && (name === "wallTimeMs" || name === "killGraceMs"))) {
+      const bound = name === "wallTimeMs" || name === "killGraceMs" ? ` no greater than ${MAX_NODE_TIMER_MS}` : "";
+      throw new RangeError(`${name} must be a positive safe integer${bound}`);
+    }
   }
   for (const name of ["quotaTokens", "quotaUsd"] as const) {
     const value = limits[name];

package/subagents.ts

@@ -16,7 +16,7 @@ import {
 import { Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { SubagentThreadRegistry, type SubagentThread, type SubagentThreadId, type SubagentThreadState } from "./subagent-lifecycle.ts";
-import { runSubagentProcess, type SubagentProcessHandle, type SubagentProcessResult } from "./subagent-process.ts";
+import { MAX_NODE_TIMER_MS, runSubagentProcess, type SubagentProcessHandle, type SubagentProcessResult } from "./subagent-process.ts";
 import { formatThreadBoard, formatThreadInspection, type ThreadRecord as ThreadBoardRecord } from "./subagent-ui.ts";
 
 export const SUBAGENT_LIMITS = {
@@ -26,6 +26,8 @@ export const SUBAGENT_LIMITS = {
   traceRetentionBytes: 8 * 1024 * 1024,
   stderrRetentionBytes: 1 * 1024 * 1024,
   taskOutputRetentionBytes: 1 * 1024 * 1024,
+  threadRetentionRecords: 64,
+  threadRetentionBytes: 128 * 1024 * 1024,
   roleFileBytes: 64 * 1024,
   taskCharacters: 20_000,
   killGraceMs: 5_000,
@@ -302,7 +304,7 @@ function parseAgentFile(filePath: string, source: AgentSource, limits: SubagentL
     tools,
     model: typeof modelValue === "string" ? modelValue.trim() : undefined,
     thinking: typeof thinkingValue === "string" ? thinkingValue.trim() : undefined,
-    timeoutMs: optionalPositiveInteger(frontmatter, filePath, "timeoutMs"),
+    timeoutMs: optionalPositiveInteger(frontmatter, filePath, "timeoutMs", undefined, MAX_NODE_TIMER_MS),
     prompt,
     source,
     filePath,
@@ -748,8 +750,8 @@ function createSubagentParams(limits: Pick<SubagentLimits, "maxTasks" | "maxRead
     all: Type.Optional(Type.Boolean({ description: "Interrupt every active child thread" })),
     agent: Type.Optional(Type.String({ minLength: 1, maxLength: 64, description: "Agent role for single mode" })),
     task: Type.Optional(Type.String({ minLength: 1, maxLength: limits.taskCharacters, description: "Task for single mode" })),
-    tasks: Type.Optional(Type.Array(taskSchema, { minItems: 1, maxItems: limits.maxTasks, description: `Parallel role tasks: read-only batches run concurrently up to ${limits.maxReadConcurrency}; batches with writers use a shared pool by default up to ${limits.maxTasks}. Set writerConcurrency to cap that pool, or set it to 1 to serialize the entire writer-containing batch; concurrent writers share the parent worktree, so callers must avoid file conflicts` })),
-    writerConcurrency: Type.Optional(Type.Integer({ minimum: 1, maximum: limits.maxTasks, description: `Optional shared-pool cap for parallel tasks that include writers. Defaults to ${limits.maxTasks}; set 1 to serialize the entire writer-containing batch. Concurrent writers share the parent worktree, so callers must avoid file conflicts` })),
+    tasks: Type.Optional(Type.Array(taskSchema, { minItems: 1, maxItems: limits.maxTasks, description: `Parallel role tasks: read-only batches run concurrently up to ${limits.maxReadConcurrency}; batches with writers use one shared slot by default. Set writerConcurrency to opt into a larger shared pool; concurrent writers share the parent worktree, so callers must prove path ownership` })),
+    writerConcurrency: Type.Optional(Type.Integer({ minimum: 1, maximum: limits.maxTasks, description: `Optional shared-pool cap for parallel tasks that include writers. Defaults to 1 when writers are selected; values above 1 opt into concurrent shared-worktree writes. Concurrent writers must prove path ownership` })),
     chain: Type.Optional(Type.Array(chainTaskSchema, { minItems: 1, maxItems: limits.maxTasks, description: "Sequential role tasks; {previous} inserts the prior result" })),
     model: Type.Optional(Type.String({ minLength: 1, maxLength: 256, description: "Model for every task as provider/model; inherit uses each role setting or the active parent" })),
     thinking: Type.Optional(Type.String({ minLength: 1, maxLength: 16, description: "Thinking effort for every task: off, minimal, low, medium, high, xhigh, max, or inherit" })),
@@ -775,6 +777,41 @@ function clipCharacters(text: string, maxCharacters: number, fromEnd = false): s
   return (fromEnd ? characters.slice(-maxCharacters) : characters.slice(0, maxCharacters)).join("");
 }
 
+function codePointLength(text: string): number {
+  let length = 0;
+  for (const _character of text) length += 1;
+  return length;
+}
+
+function expandChainTask(template: string, previous: string, maxCharacters: number): string | undefined {
+  const placeholder = "{previous}";
+  let occurrences = 0;
+  let searchFrom = 0;
+  while (true) {
+    const index = template.indexOf(placeholder, searchFrom);
+    if (index < 0) break;
+    occurrences += 1;
+    searchFrom = index + placeholder.length;
+  }
+  if (occurrences === 0) return codePointLength(template) <= maxCharacters ? template : undefined;
+
+  const expandedCharacters = codePointLength(template) + occurrences * (codePointLength(previous) - codePointLength(placeholder));
+  if (expandedCharacters > maxCharacters) return undefined;
+
+  const pieces: string[] = [];
+  let start = 0;
+  while (true) {
+    const index = template.indexOf(placeholder, start);
+    if (index < 0) {
+      pieces.push(template.slice(start));
+      break;
+    }
+    pieces.push(template.slice(start, index), previous);
+    start = index + placeholder.length;
+  }
+  return pieces.join("");
+}
+
 function buildSteeredTask(task: string, steering: readonly string[], maxCharacters: number): string {
   const steeringLabel = "\n\nParent steering:\n";
   const steeringText = clipCharacters(steering.join("\n"), Math.max(0, maxCharacters - [...steeringLabel].length), true);
@@ -936,6 +973,49 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
   const threads = new SubagentThreadRegistry();
   const activeRuntimes = new Map<string, ActiveThreadRuntime>();
   const savedResults = new Map<string, SubagentTaskResult>();
+  const evictedThreadParents = new Map<string, string | undefined>();
+  const maxClosedThreads = Number.isSafeInteger(limits.threadRetentionRecords) && limits.threadRetentionRecords > 0
+    ? limits.threadRetentionRecords
+    : SUBAGENT_LIMITS.threadRetentionRecords;
+
+  const rememberEvictedThreads = (threadsToRemember: readonly SubagentThread[]): void => {
+    for (const thread of threadsToRemember) evictedThreadParents.set(thread.id, thread.parentId);
+    while (evictedThreadParents.size > maxClosedThreads) {
+      const oldest = evictedThreadParents.keys().next().value;
+      if (oldest === undefined) break;
+      evictedThreadParents.delete(oldest);
+    }
+  };
+  const pruneClosedThreads = (): void => {
+    if (threads.isDisposed) return;
+    rememberEvictedThreads(threads.pruneClosed(maxClosedThreads));
+  };
+
+  const resultBytes = (result: SubagentTaskResult): number => Buffer.byteLength([
+    result.task,
+    ...result.trace,
+    result.stderr,
+    result.output,
+    result.errorMessage ?? "",
+  ].join("\n"), "utf8");
+  const trimSavedResults = (): void => {
+    const candidates = threads.listAll()
+      .filter((thread) => ["done", "failed", "stopped"].includes(thread.state))
+      .sort((left, right) => left.timestamps.createdAt - right.timestamps.createdAt);
+    const retainedBytes = (): number => [...savedResults.values()].reduce((total, result) => total + resultBytes(result), 0);
+    while ((savedResults.size > limits.threadRetentionRecords || retainedBytes() > limits.threadRetentionBytes) && candidates.length) {
+      const candidate = candidates.shift()!;
+      savedResults.delete(candidate.id);
+      const current = threads.inspect(candidate.id);
+      if (current && ["done", "failed", "stopped"].includes(current.state)) threads.close(candidate.id);
+    }
+    pruneClosedThreads();
+  };
+  const saveResult = (threadId: string, result: SubagentTaskResult): void => {
+    savedResults.delete(threadId);
+    savedResults.set(threadId, cloneResult(result));
+    trimSavedResults();
+  };
 
   const detailsFor = (
     parentId: string,
@@ -946,13 +1026,17 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
   ): SubagentDetails => {
     const all = threads.listAll().filter((thread) => thread.parentId === parentId);
     const visible = all.filter((thread) => thread.state !== "closed");
+    const selectedClosed = selectedThreadId
+      ? all.find((thread) => thread.id === selectedThreadId && thread.state === "closed")
+      : undefined;
+    const listed = selectedClosed ? [...visible, selectedClosed] : visible;
     const results = visible.map((thread) => threadResult(thread, savedResults.get(thread.id)));
     return {
       ...cloneDetails(mode, scope, projectAgentsDir, results),
       parentId,
-      threads: all,
-      activeThreads: all.filter((thread) => thread.state === "active"),
-      doneThreads: all.filter((thread) => ["done", "failed", "stopped"].includes(thread.state)),
+      threads: listed,
+      activeThreads: visible.filter((thread) => thread.state === "active"),
+      doneThreads: visible.filter((thread) => ["done", "failed", "stopped"].includes(thread.state)),
       selectedThreadId,
     };
   };
@@ -980,6 +1064,7 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
         lines.push(`Trace: ${selected.trace.length} entries`);
         if (selected.result) lines.push(`Handoff: ${selected.result}`);
         if (selected.stopReason) lines.push(`Reason: ${selected.stopReason}`);
+        if (selected.evicted) lines.push("Retention: heavy thread data was evicted after close");
       }
     }
     return boundedText(lines.join("\n"), limits.toolOutputBytes, "\n\n[Thread board truncated; inspect a child thread for its bounded detail.]");
@@ -988,7 +1073,7 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
   const syncThread = (threadId: SubagentThreadId, next: SubagentTaskResult, runtime?: ActiveThreadRuntime): SubagentTaskResult => {
     const effective = mergeTaskResults(runtime?.aggregate, next, limits.traceRetentionBytes, limits.stderrRetentionBytes);
     if (runtime?.requestedReason && next.status === "cancelled") effective.terminationReason = runtime.requestedReason;
-    savedResults.set(threadId, cloneResult(effective));
+    saveResult(threadId, effective);
     let thread = threads.inspect(threadId);
     if (!thread || threads.isDisposed) return effective;
     if (thread.state === "queued" && next.status === "running") {
@@ -1042,17 +1127,19 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
         runtime.controller.abort();
       }
       threads.dispose();
+      savedResults.clear();
+      evictedThreadParents.clear();
     });
   }
 
   pi.registerTool({
     name: "subagent",
     label: "Subagents",
-    description: `Spawn and manage named child threads. Children finish naturally. Parallel tasks with write-capable roles use one shared pool by default, up to ${limits.maxTasks}; read-only batches run concurrently up to ${limits.maxReadConcurrency}. Set writerConcurrency to cap the shared pool, or set it to 1 to serialize the entire writer-containing batch. Concurrent writers share the parent worktree, so callers must avoid file conflicts. The message parameter is only valid with action steer. Use action list, inspect, steer, interrupt, collect, and close to manage active and completed handoffs.`,
+    description: `Spawn and manage named child threads. Children finish naturally. Parallel tasks with write-capable roles use one shared slot by default; read-only batches run concurrently up to ${limits.maxReadConcurrency}. Set writerConcurrency above 1 only after proving path ownership in the shared worktree. The message parameter is only valid with action steer. Use action list, inspect, steer, interrupt, collect, and close to manage active and completed handoffs.`,
     promptSnippet: "Delegate bounded specialist work to isolated KillerOS subagents",
     promptGuidelines: [
       "Use subagent for clearly separable specialist work; prefer read-only scout, planner, reviewer, or security roles before a writer.",
-      `Parallel tasks with write-capable roles use one shared pool by default because all children share the parent worktree. Set writerConcurrency to cap the pool, or set it to 1 to serialize the entire writer-containing batch; callers remain responsible for file conflicts.`,
+      "Parallel tasks with write-capable roles use one shared slot by default because all children share the parent worktree. Set writerConcurrency above 1 only when callers have proved path ownership; callers remain responsible for file conflicts.",
       "Every child can load relevant skills with read and can use web_search, source_check, fetch_content, and get_search_content for external research.",
       "When the user names a model or thinking effort, pass model and thinking separately; use inherit when the active parent or role setting should decide.",
       "Keep completed and stopped threads inspectable until the parent explicitly closes them.",
@@ -1080,7 +1167,13 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
       if (action === "inspect") {
         if (!params.threadId) throw new Error("inspect requires threadId");
         const thread = threads.inspect(params.threadId as SubagentThreadId);
-        if (!thread || thread.parentId !== parentId) throw new Error(`Unknown child thread ${JSON.stringify(params.threadId)}`);
+        if (!thread) {
+          if (evictedThreadParents.get(params.threadId) === parentId) {
+            return actionResult(`Thread ${params.threadId} was evicted from bounded retention; its heavy data is no longer available.`, params.threadId);
+          }
+          throw new Error(`Unknown child thread ${JSON.stringify(params.threadId)}`);
+        }
+        if (thread.parentId !== parentId) throw new Error(`Unknown child thread ${JSON.stringify(params.threadId)}`);
         return actionResult(threadBoardText(parentId, params.threadId), params.threadId);
       }
       if (action === "steer") {
@@ -1138,7 +1231,9 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
         const thread = threads.inspect(params.threadId as SubagentThreadId);
         if (!thread || thread.parentId !== parentId) throw new Error(`Unknown child thread ${JSON.stringify(params.threadId)}`);
         threads.close(params.threadId as SubagentThreadId);
-        return actionResult(`Closed ${params.threadId}. Its result record remains inspectable.`, params.threadId);
+        savedResults.delete(params.threadId);
+        pruneClosedThreads();
+        return actionResult(`Closed ${params.threadId}. Heavy trace and handoff data were evicted; a tombstone remains inspectable.`, params.threadId);
       }
 
       const scope: AgentScope = params.agentScope ?? "user";
@@ -1198,11 +1293,11 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
       if (params.writerConcurrency !== undefined && hasParallel && writerIndexes.length === 0) {
         throw new Error("writerConcurrency requires at least one write-capable role");
       }
-      const writerConcurrency = params.writerConcurrency ?? limits.maxTasks;
+      const writerConcurrency = params.writerConcurrency ?? (writerIndexes.length > 0 ? 1 : limits.maxReadConcurrency);
       const useSharedParallelPool = hasParallel && writerIndexes.length > 0;
       const executionNote = hasParallel
         ? writerIndexes.length
-          ? `Parallel schedule: all tasks run through a shared pool of up to ${writerConcurrency}${params.writerConcurrency === undefined ? " (default)" : ""}; concurrent write-capable tasks share the parent worktree, so callers must avoid file conflicts.`
+          ? `Parallel schedule: all tasks run through a shared pool of up to ${writerConcurrency}${params.writerConcurrency === undefined ? " (safe default)" : " (explicit)"}; concurrent write-capable tasks share the parent worktree, so callers must prove path ownership.`
           : `Parallel schedule: read-only tasks run concurrently up to ${limits.maxReadConcurrency}.`
         : undefined;
 
@@ -1230,42 +1325,48 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
           details: { ...board, executionNote, results: currentResults, aggregateUsage: aggregateUsage(currentResults) },
         });
       };
+      const failQueuedTask = (index: number, reason: string, message: string): void => {
+        const threadId = threadRecords[index]!.id;
+        const thread = threads.inspect(threadId);
+        if (thread?.state === "queued") threads.begin(threadId);
+        results[index] = {
+          ...results[index]!,
+          status: "failed",
+          terminationReason: reason,
+          errorMessage: message,
+        };
+        if (threads.inspect(threadId)?.state === "active") threads.fail(threadId, { message, code: reason });
+        saveResult(threadId, results[index]!);
+        emit();
+      };
       const runAt = async (index: number, task: string): Promise<void> => {
         const threadId = threadRecords[index]!.id;
         const initialThread = threads.inspect(threadId);
         if (signal?.aborted) {
           results[index] = { ...results[index]!, status: "cancelled", terminationReason: "abort" };
           if (initialThread?.state === "queued" || initialThread?.state === "active") threads.stop(threadId, { reason: "abort" });
-          savedResults.set(threadId, cloneResult(results[index]!));
+          saveResult(threadId, results[index]!);
           emit();
           return;
         }
         if (!initialThread) return;
         if (initialThread.state === "closed") {
           results[index] = { ...results[index]!, status: "cancelled", terminationReason: initialThread.stopReason ?? "disposed" };
-          savedResults.set(threadId, cloneResult(results[index]!));
+          saveResult(threadId, results[index]!);
           emit();
           return;
         }
         if (initialThread.state === "stopped") {
           results[index] = { ...results[index]!, status: "cancelled", terminationReason: initialThread.stopReason ?? "interrupted" };
-          savedResults.set(threadId, cloneResult(results[index]!));
+          saveResult(threadId, results[index]!);
           emit();
           return;
         }
         if (initialThread.state !== "queued") return;
         const input = inputs[index]!;
         threads.begin(threadId);
-        if ([...task].length > limits.taskCharacters) {
-          results[index] = {
-            ...results[index]!,
-            status: "failed",
-            terminationReason: "task_limit",
-            errorMessage: `Expanded task exceeds ${limits.taskCharacters} characters`,
-          };
-          threads.fail(threadId, { message: results[index]!.errorMessage ?? "Expanded task exceeds the task limit", code: "task_limit" });
-          savedResults.set(threadId, cloneResult(results[index]!));
-          emit();
+        if (codePointLength(task) > limits.taskCharacters) {
+          failQueuedTask(index, "task_limit", `Expanded task exceeds ${limits.taskCharacters} characters`);
           return;
         }
         const controller = new AbortController();
@@ -1291,7 +1392,7 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
             errorMessage: message,
           };
           threads.fail(threadId, { message, code: "session_error" });
-          savedResults.set(threadId, cloneResult(results[index]!));
+          saveResult(threadId, results[index]!);
           emit();
           return;
         }
@@ -1306,7 +1407,7 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
           const reason = runtime.requestedReason ?? currentThread?.stopReason ?? (threads.isDisposed ? "session_shutdown" : "interrupted");
           results[index] = { ...results[index]!, status: "cancelled", terminationReason: reason };
           if (!threads.isDisposed && currentThread?.state === "active") threads.stop(threadId, { reason });
-          savedResults.set(threadId, cloneResult(results[index]!));
+          saveResult(threadId, results[index]!);
           emit();
           return;
         }
@@ -1321,7 +1422,7 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
           limited.errorMessage = message;
           runtime.aggregate = limited;
           results[index] = cloneResult(limited);
-          savedResults.set(threadId, cloneResult(limited));
+          saveResult(threadId, limited);
           if (!threads.isDisposed && threads.inspect(threadId)?.state === "active") {
             threads.stop(threadId, {
               usage: threadUsage(limited.usage),
@@ -1402,11 +1503,31 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
             runtime.aggregate = mergeTaskResults(runtime.aggregate, next, limits.traceRetentionBytes, limits.stderrRetentionBytes);
             runtime.aggregate.task = task;
             results[index] = cloneResult(runtime.aggregate);
-            savedResults.set(threadId, cloneResult(runtime.aggregate));
+            saveResult(threadId, runtime.aggregate);
             const shouldRestart = runtime.steering.length > 0 && !controller.signal.aborted && (runtime.restarting || next.status === "complete" || next.status === "cancelled");
             if (!shouldRestart) break;
             const previousHandle = runtime.handle;
-            if (previousHandle && !(await waitForConfirmedProcessExit(previousHandle))) break;
+            if (previousHandle && !(await waitForConfirmedProcessExit(previousHandle))) {
+              const message = "Child process exit was not confirmed before the steering restart";
+              const unconfirmed = cloneResult(runtime.aggregate ?? results[index]!);
+              unconfirmed.status = "failed";
+              unconfirmed.terminationReason = "process_exit_unconfirmed";
+              unconfirmed.errorMessage = message;
+              runtime.aggregate = unconfirmed;
+              results[index] = cloneResult(unconfirmed);
+              saveResult(threadId, unconfirmed);
+              if (!threads.isDisposed && threads.inspect(threadId)?.state === "active") {
+                threads.fail(threadId, {
+                  usage: threadUsage(unconfirmed.usage),
+                  result: unconfirmed.output || undefined,
+                  handoff: unconfirmed.output ? { summary: unconfirmed.output } : undefined,
+                  message,
+                  code: "process_exit_unconfirmed",
+                });
+              }
+              emit();
+              break;
+            }
             if (controller.signal.aborted || threads.isDisposed) break;
             const steering = runtime.steering.splice(0);
             runtime.restarting = false;
@@ -1444,14 +1565,14 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
           if (result.status !== "queued") continue;
           const thread = threads.inspect(threadRecords[index]!.id);
           const alreadyStopped = thread?.state === "stopped";
-          result.status = signal?.aborted || alreadyStopped ? "cancelled" : "failed";
+          result.status = signal?.aborted || alreadyStopped || reason === "chain_stopped" ? "cancelled" : "failed";
           result.terminationReason = alreadyStopped
             ? thread.stopReason ?? "interrupted"
             : signal?.aborted ? "abort" : reason;
           if (thread?.state === "queued" || thread?.state === "active") {
             threads.stop(threadRecords[index]!.id, { reason: result.terminationReason });
           }
-          savedResults.set(threadRecords[index]!.id, cloneResult(result));
+          saveResult(threadRecords[index]!.id, result);
         }
       };
 
@@ -1459,7 +1580,11 @@ export function registerSubagentTool(pi: ExtensionAPI, options: SubagentRuntimeO
       if (hasChain) {
         let previous = "";
         for (let index = 0; index < inputs.length; index += 1) {
-          const task = inputs[index]!.task.replaceAll("{previous}", previous);
+          const task = expandChainTask(inputs[index]!.task, previous, limits.taskCharacters);
+          if (task === undefined) {
+            failQueuedTask(index, "task_limit", `Expanded task exceeds ${limits.taskCharacters} characters`);
+            break;
+          }
           await runAt(index, task);
           if (results[index]!.status !== "complete") break;
           previous = results[index]!.output;