larkin 0.4.19 → 0.4.21

package/dist/agent/context-prompt.cjs

@@ -16,7 +16,7 @@ const agent_cli_capabilities_js_1 = require("./agent-cli-capabilities.cjs");
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v23";
+exports.LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v25";
 /**
  * Agent 间协作唤醒引导（issue #75）：纯文本 @ 不会产生飞书 mention 事件，
  * 必须由模型直接构造真实的 mention 元素；`--mention` 扩展参数已移除。
@@ -106,7 +106,7 @@ class ContextPromptBuilder {
                 "",
                 "## Background subagents (pi)",
                 "Long-running, independent work MUST use the Agent tool with run_in_background: true. It is the ONLY supported background mechanism. nohup, `&`, disown, and shell background jobs are forbidden for delegated work.",
-                "Foreground bash is hard-capped at 60 seconds. Never pass a bash timeout above 60 (it is refused immediately), and never run a command you expect to exceed 60s in the foreground. If a task is expected to take longer than 60s, delegate it to a background subagent (Agent with run_in_background: true) BEFORE running any bash. If a foreground bash call is refused or times out at the 60s limit, do NOT retry it in the foreground; delegate the work to a background subagent instead.",
+                "Foreground bash is hard-capped at 60 seconds. Never pass a bash timeout above 60. Never use nested bash to outlive 60s. If work must outlive 60s, Agent({ prompt, description, run_in_background: true }) and inside that background agent use supervised_start (executable+args, shell:false) once, then loop supervised_wait (timeout <= 60). Wait timeout returns still running and does NOT kill the process; Steer can arrive after each wait. Total lifetime is 600s. Abort/cancel/shutdown reaps the process tree. Do not use nohup / '&' / disown.",
                 "Correct pattern:",
                 "1. Call Agent with arguments like {\"prompt\": \"<task>\", \"description\": \"<short label>\", \"run_in_background\": true}.",
                 "2. The tool returns an agent id immediately. Report it to the user and end the turn.",

package/dist/agent/context-prompt.mjs

@@ -13,7 +13,7 @@ import { agentCliPromptCapabilities } from "./agent-cli-capabilities.mjs";
  * 5. 版本化：每次实质改动 bump LARKIN_STANDING_PROMPT_VERSION，并同步 eval 数据集/graders/断言。
  * 6. 用 eval 验证：行为变化必须配套固定场景 + rubric（evals/*、test/support/*-grader.mjs、live 测试）。
  */
-export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v23";
+export const LARKIN_STANDING_PROMPT_VERSION = "larkin-standing-v25";
 /**
  * Agent 间协作唤醒引导（issue #75）：纯文本 @ 不会产生飞书 mention 事件，
  * 必须由模型直接构造真实的 mention 元素；`--mention` 扩展参数已移除。
@@ -103,7 +103,7 @@ export class ContextPromptBuilder {
                 "",
                 "## Background subagents (pi)",
                 "Long-running, independent work MUST use the Agent tool with run_in_background: true. It is the ONLY supported background mechanism. nohup, `&`, disown, and shell background jobs are forbidden for delegated work.",
-                "Foreground bash is hard-capped at 60 seconds. Never pass a bash timeout above 60 (it is refused immediately), and never run a command you expect to exceed 60s in the foreground. If a task is expected to take longer than 60s, delegate it to a background subagent (Agent with run_in_background: true) BEFORE running any bash. If a foreground bash call is refused or times out at the 60s limit, do NOT retry it in the foreground; delegate the work to a background subagent instead.",
+                "Foreground bash is hard-capped at 60 seconds. Never pass a bash timeout above 60. Never use nested bash to outlive 60s. If work must outlive 60s, Agent({ prompt, description, run_in_background: true }) and inside that background agent use supervised_start (executable+args, shell:false) once, then loop supervised_wait (timeout <= 60). Wait timeout returns still running and does NOT kill the process; Steer can arrive after each wait. Total lifetime is 600s. Abort/cancel/shutdown reaps the process tree. Do not use nohup / '&' / disown.",
                 "Correct pattern:",
                 "1. Call Agent with arguments like {\"prompt\": \"<task>\", \"description\": \"<short label>\", \"run_in_background\": true}.",
                 "2. The tool returns an agent id immediately. Report it to the user and end the turn.",

package/dist/agent/missed-outbound-scan.cjs

@@ -0,0 +1,123 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MISSED_OUTBOUND_REPEAT = exports.DEFAULT_MISSED_OUTBOUND_TITLE = void 0;
+exports.parseOmMessageId = parseOmMessageId;
+exports.parseScanDeliveryTarget = parseScanDeliveryTarget;
+exports.isDefaultMissedOutboundReminder = isDefaultMissedOutboundReminder;
+exports.ensureDefaultMissedOutboundScanReminder = ensureDefaultMissedOutboundScanReminder;
+exports.persistInboundScanTarget = persistInboundScanTarget;
+const node_path_1 = __importDefault(require("node:path"));
+const reminder_store_js_1 = require("./reminder-store.cjs");
+exports.DEFAULT_MISSED_OUTBOUND_TITLE = "Read scoped history from this reminder envelope's persisted deliveryTarget (chat: +chat-messages-list; thread: +threads-messages-list). Judge unanswered asks, undelivered follow-ups, and stalled work. On a hit, post a short status in the same conversation using that persisted deliveryTarget/anchor; otherwise stay silent. Never infer recipients from the title.";
+exports.DEFAULT_MISSED_OUTBOUND_REPEAT = "every:15m";
+const CHAT_TARGET = /^chat:(oc_[A-Za-z0-9]+)$/;
+const THREAD_TARGET = /^thread:(oc_[A-Za-z0-9]+):(omt_[A-Za-z0-9]+)$/;
+const OM_ID = /^om_[A-Za-z0-9]+$/;
+function parseOmMessageId(value, label = "message-id") {
+    const id = String(value || "").trim();
+    if (!OM_ID.test(id))
+        throw new Error(`${label} 必须是严格 om_ 语法`);
+    return id;
+}
+function parseScanDeliveryTarget(target, anchor) {
+    const deliveryTarget = String(target || "").trim();
+    if (!deliveryTarget) {
+        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
+    }
+    const chat = deliveryTarget.match(CHAT_TARGET);
+    if (chat) {
+        return {
+            deliveryTarget,
+            scope: "chat",
+            chatId: chat[1],
+            threadId: null,
+            deliveryAnchor: anchor ? parseOmMessageId(anchor, "delivery anchor") : null,
+        };
+    }
+    const thread = deliveryTarget.match(THREAD_TARGET);
+    if (thread) {
+        return {
+            deliveryTarget,
+            scope: "thread",
+            chatId: thread[1],
+            threadId: thread[2],
+            deliveryAnchor: parseOmMessageId(anchor, "delivery anchor"),
+        };
+    }
+    throw new Error("delivery target 必须是 chat:oc_… 或 thread:oc_…:omt_…，禁止推断 DM");
+}
+function isDefaultMissedOutboundReminder(reminder) {
+    return reminder?.title === exports.DEFAULT_MISSED_OUTBOUND_TITLE
+        && reminder.repeat === exports.DEFAULT_MISSED_OUTBOUND_REPEAT
+        && reminder.deliveryMode === "user"
+        && reminder.status === "scheduled";
+}
+function ensureDefaultMissedOutboundScanReminder(input) {
+    const parsed = parseScanDeliveryTarget(input.deliveryTarget, input.deliveryAnchor);
+    const recurrence = (0, reminder_store_js_1.parseRepeat)(exports.DEFAULT_MISSED_OUTBOUND_REPEAT);
+    if ("error" in recurrence)
+        throw new Error(recurrence.error);
+    const now = input.nowMs ?? Date.now();
+    const wantedAnchor = parsed.deliveryAnchor;
+    return (0, reminder_store_js_1.mutate)(input.storeFile, (store) => {
+        const sameIdentity = (reminder) => reminder.ownerAgentId === input.agentId
+            && reminder.title === exports.DEFAULT_MISSED_OUTBOUND_TITLE
+            && reminder.repeat === exports.DEFAULT_MISSED_OUTBOUND_REPEAT
+            && reminder.deliveryMode === "user"
+            && reminder.deliveryTarget === parsed.deliveryTarget;
+        const scheduled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "scheduled");
+        if (scheduled) {
+            if ((scheduled.deliveryAnchor || null) !== wantedAnchor)
+                scheduled.deliveryAnchor = wantedAnchor;
+            return { created: false, reminderId: scheduled.reminderId, rebuilt: false };
+        }
+        const canceled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "canceled");
+        if (canceled)
+            return { created: false, reminderId: canceled.reminderId, rebuilt: false };
+        const hadFired = store.reminders.some((reminder) => sameIdentity(reminder) && reminder.status === "fired");
+        store.reminders = store.reminders.filter((reminder) => !(sameIdentity(reminder) && reminder.status === "fired"));
+        const reminderId = (0, reminder_store_js_1.newId)();
+        store.reminders.push({
+            reminderId,
+            ownerAgentId: input.agentId,
+            title: exports.DEFAULT_MISSED_OUTBOUND_TITLE,
+            fireAt: (0, reminder_store_js_1.nowIso)(now + 15 * 60_000),
+            firedAt: null,
+            createdAt: (0, reminder_store_js_1.nowIso)(now),
+            status: "scheduled",
+            version: 1,
+            events: [],
+            deliveryTarget: parsed.deliveryTarget,
+            deliveryAnchor: wantedAnchor,
+            deliveryMode: "user",
+            repeat: exports.DEFAULT_MISSED_OUTBOUND_REPEAT,
+        });
+        return { created: true, reminderId, rebuilt: hadFired };
+    });
+}
+function persistInboundScanTarget(stateDir, event, agentId, storeFile = node_path_1.default.join(stateDir, "reminders.json")) {
+    if (event._sender_is_bot)
+        throw new Error("scan reminder 只接受 human inbound");
+    if (event._scan_authority !== true)
+        throw new Error("scan reminder 需要权威 chatType/senderIsBot");
+    if (event.chat_type !== "group")
+        throw new Error("scan reminder 只接受 group/thread，禁止 DM");
+    const chatId = String(event.chat_id || "");
+    if (!/^oc_[A-Za-z0-9]+$/.test(chatId)) {
+        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
+    }
+    const threadId = event.thread_id ? String(event.thread_id) : "";
+    const parsed = threadId
+        ? parseScanDeliveryTarget(`thread:${chatId}:${threadId}`, event.message_id)
+        : parseScanDeliveryTarget(`chat:${chatId}`, event.message_id || null);
+    ensureDefaultMissedOutboundScanReminder({
+        storeFile,
+        agentId,
+        deliveryTarget: parsed.deliveryTarget,
+        deliveryAnchor: parsed.deliveryAnchor,
+    });
+    return parsed;
+}

package/dist/agent/missed-outbound-scan.mjs

@@ -0,0 +1,112 @@
+import path from "node:path";
+import { mutate, newId, nowIso, parseRepeat } from "./reminder-store.mjs";
+export const DEFAULT_MISSED_OUTBOUND_TITLE = "Read scoped history from this reminder envelope's persisted deliveryTarget (chat: +chat-messages-list; thread: +threads-messages-list). Judge unanswered asks, undelivered follow-ups, and stalled work. On a hit, post a short status in the same conversation using that persisted deliveryTarget/anchor; otherwise stay silent. Never infer recipients from the title.";
+export const DEFAULT_MISSED_OUTBOUND_REPEAT = "every:15m";
+const CHAT_TARGET = /^chat:(oc_[A-Za-z0-9]+)$/;
+const THREAD_TARGET = /^thread:(oc_[A-Za-z0-9]+):(omt_[A-Za-z0-9]+)$/;
+const OM_ID = /^om_[A-Za-z0-9]+$/;
+export function parseOmMessageId(value, label = "message-id") {
+    const id = String(value || "").trim();
+    if (!OM_ID.test(id))
+        throw new Error(`${label} 必须是严格 om_ 语法`);
+    return id;
+}
+export function parseScanDeliveryTarget(target, anchor) {
+    const deliveryTarget = String(target || "").trim();
+    if (!deliveryTarget) {
+        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
+    }
+    const chat = deliveryTarget.match(CHAT_TARGET);
+    if (chat) {
+        return {
+            deliveryTarget,
+            scope: "chat",
+            chatId: chat[1],
+            threadId: null,
+            deliveryAnchor: anchor ? parseOmMessageId(anchor, "delivery anchor") : null,
+        };
+    }
+    const thread = deliveryTarget.match(THREAD_TARGET);
+    if (thread) {
+        return {
+            deliveryTarget,
+            scope: "thread",
+            chatId: thread[1],
+            threadId: thread[2],
+            deliveryAnchor: parseOmMessageId(anchor, "delivery anchor"),
+        };
+    }
+    throw new Error("delivery target 必须是 chat:oc_… 或 thread:oc_…:omt_…，禁止推断 DM");
+}
+export function isDefaultMissedOutboundReminder(reminder) {
+    return reminder?.title === DEFAULT_MISSED_OUTBOUND_TITLE
+        && reminder.repeat === DEFAULT_MISSED_OUTBOUND_REPEAT
+        && reminder.deliveryMode === "user"
+        && reminder.status === "scheduled";
+}
+export function ensureDefaultMissedOutboundScanReminder(input) {
+    const parsed = parseScanDeliveryTarget(input.deliveryTarget, input.deliveryAnchor);
+    const recurrence = parseRepeat(DEFAULT_MISSED_OUTBOUND_REPEAT);
+    if ("error" in recurrence)
+        throw new Error(recurrence.error);
+    const now = input.nowMs ?? Date.now();
+    const wantedAnchor = parsed.deliveryAnchor;
+    return mutate(input.storeFile, (store) => {
+        const sameIdentity = (reminder) => reminder.ownerAgentId === input.agentId
+            && reminder.title === DEFAULT_MISSED_OUTBOUND_TITLE
+            && reminder.repeat === DEFAULT_MISSED_OUTBOUND_REPEAT
+            && reminder.deliveryMode === "user"
+            && reminder.deliveryTarget === parsed.deliveryTarget;
+        const scheduled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "scheduled");
+        if (scheduled) {
+            if ((scheduled.deliveryAnchor || null) !== wantedAnchor)
+                scheduled.deliveryAnchor = wantedAnchor;
+            return { created: false, reminderId: scheduled.reminderId, rebuilt: false };
+        }
+        const canceled = store.reminders.find((reminder) => sameIdentity(reminder) && reminder.status === "canceled");
+        if (canceled)
+            return { created: false, reminderId: canceled.reminderId, rebuilt: false };
+        const hadFired = store.reminders.some((reminder) => sameIdentity(reminder) && reminder.status === "fired");
+        store.reminders = store.reminders.filter((reminder) => !(sameIdentity(reminder) && reminder.status === "fired"));
+        const reminderId = newId();
+        store.reminders.push({
+            reminderId,
+            ownerAgentId: input.agentId,
+            title: DEFAULT_MISSED_OUTBOUND_TITLE,
+            fireAt: nowIso(now + 15 * 60_000),
+            firedAt: null,
+            createdAt: nowIso(now),
+            status: "scheduled",
+            version: 1,
+            events: [],
+            deliveryTarget: parsed.deliveryTarget,
+            deliveryAnchor: wantedAnchor,
+            deliveryMode: "user",
+            repeat: DEFAULT_MISSED_OUTBOUND_REPEAT,
+        });
+        return { created: true, reminderId, rebuilt: hadFired };
+    });
+}
+export function persistInboundScanTarget(stateDir, event, agentId, storeFile = path.join(stateDir, "reminders.json")) {
+    if (event._sender_is_bot)
+        throw new Error("scan reminder 只接受 human inbound");
+    if (event._scan_authority !== true)
+        throw new Error("scan reminder 需要权威 chatType/senderIsBot");
+    if (event.chat_type !== "group")
+        throw new Error("scan reminder 只接受 group/thread，禁止 DM");
+    const chatId = String(event.chat_id || "");
+    if (!/^oc_[A-Za-z0-9]+$/.test(chatId)) {
+        throw new Error("user-facing reminder 必须显式指定 delivery target，不得从标题推断收件人");
+    }
+    const threadId = event.thread_id ? String(event.thread_id) : "";
+    const parsed = threadId
+        ? parseScanDeliveryTarget(`thread:${chatId}:${threadId}`, event.message_id)
+        : parseScanDeliveryTarget(`chat:${chatId}`, event.message_id || null);
+    ensureDefaultMissedOutboundScanReminder({
+        storeFile,
+        agentId,
+        deliveryTarget: parsed.deliveryTarget,
+        deliveryAnchor: parsed.deliveryAnchor,
+    });
+    return parsed;
+}

package/dist/feishu/host-shell.cjs

@@ -51,6 +51,7 @@ const host_business_state_js_1 = require("./host-business-state.cjs");
 const host_processing_eye_js_1 = require("./host-processing-eye.cjs");
 const inbox_projection_js_1 = require("../agent/inbox-projection.cjs");
 const host_reminder_orchestrator_js_1 = require("../agent/host-reminder-orchestrator.cjs");
+const missed_outbound_scan_js_1 = require("../agent/missed-outbound-scan.cjs");
 const host_channel_business_js_1 = require("./host-channel-business.cjs");
 const interaction_orchestrator_js_1 = require("./interaction-orchestrator.cjs");
 const message_policy_js_1 = require("./message-policy.cjs");
@@ -385,6 +386,14 @@ function createHostShell({ env = process.env, runtimeHost, channelPackage, event
                 // append/dedupe decision is durable. Agent model-seen state is untouched.
                 if (event.event_id)
                     seenEventIds.add(eventKey);
+                if (!event._sender_is_bot && event._scan_authority) {
+                    try {
+                        (0, missed_outbound_scan_js_1.persistInboundScanTarget)(agent.stateDir, event, agent.agentId);
+                    }
+                    catch (error) {
+                        log(`inbound scan target 未持久化: ${error.message}`);
+                    }
+                }
                 if (append.status === "duplicate_consumed")
                     return null;
                 const inboxEnvelope = append.envelope;

package/dist/feishu/host-shell.mjs

@@ -11,6 +11,7 @@ import { HostEnvelopeProjector, HostStateProjection, SenderIdentityCache, projec
 import { ProcessingEyeOrchestrator } from "./host-processing-eye.mjs";
 import { projectInboxEnvelope, targetKeyOfInboxEnvelope } from "../agent/inbox-projection.mjs";
 import { HostReminderOrchestrator } from "../agent/host-reminder-orchestrator.mjs";
+import { persistInboundScanTarget } from "../agent/missed-outbound-scan.mjs";
 import { HostChannelBusiness } from "./host-channel-business.mjs";
 import { HostInteractionOrchestrator } from "./interaction-orchestrator.mjs";
 import { targetFor } from "./message-policy.mjs";
@@ -345,6 +346,14 @@ export function createHostShell({ env = process.env, runtimeHost, channelPackage
                 // append/dedupe decision is durable. Agent model-seen state is untouched.
                 if (event.event_id)
                     seenEventIds.add(eventKey);
+                if (!event._sender_is_bot && event._scan_authority) {
+                    try {
+                        persistInboundScanTarget(agent.stateDir, event, agent.agentId);
+                    }
+                    catch (error) {
+                        log(`inbound scan target 未持久化: ${error.message}`);
+                    }
+                }
                 if (append.status === "duplicate_consumed")
                     return null;
                 const inboxEnvelope = append.envelope;

package/dist/feishu/message-policy.cjs

@@ -39,6 +39,8 @@ function normalizeChannelMessage(message) {
         _mentioned_bot: Boolean(message.mentionedBot || message.mentionAll),
         _mention_all: Boolean(message.mentionAll),
         _sender_is_bot: message.senderIsBot === true,
+        _scan_authority: typeof message.senderIsBot === "boolean"
+            && (message.chatType === "group" || message.chatMode === "topic"),
     };
 }
 function slug10(value) {

package/dist/feishu/message-policy.mjs

@@ -26,6 +26,8 @@ export function normalizeChannelMessage(message) {
         _mentioned_bot: Boolean(message.mentionedBot || message.mentionAll),
         _mention_all: Boolean(message.mentionAll),
         _sender_is_bot: message.senderIsBot === true,
+        _scan_authority: typeof message.senderIsBot === "boolean"
+            && (message.chatType === "group" || message.chatMode === "topic"),
     };
 }
 export function slug10(value) {

package/dist/runtime/pi-inline-extensions.mjs

@@ -1,6 +1,8 @@
+import fs from "node:fs";
+import path from "node:path";
 import { pathToFileURL } from "node:url";
 import bashTimeoutExtension from "./pi-bash-timeout-extension.mjs";
-import { bundledPiSubagentExtensionPath } from "./pi-subagent-injection.mjs";
+import { bundledPiSubagentExtensionPath, materializeEmbeddedPiSubagentBundle } from "./pi-subagent-injection.mjs";
 import piSubagentRecordWatchdog from "./pi-subagent-record-watchdog.mjs";
 /**
  * Load the prebuilt, patched subagent bundle shipped in dist/ rather than the
@@ -9,11 +11,15 @@ import piSubagentRecordWatchdog from "./pi-subagent-record-watchdog.mjs";
  * continue to use the prebuilt patched bundle.
  */
 async function loadBundledPiSubagentExtension() {
-    if (process.env.LARKIN_STANDALONE === "1") {
-        const loaded = await import("@tintinweb/pi-subagents/dist/index.js");
-        if (!loaded.default)
-            throw new Error("Larkin bounded pi-subagents package is invalid; refusing to start builtin Pi");
-        return loaded.default;
+    // Compiled standalone already has the patched package in Bun's module graph.
+    // The materialized sibling bundle externalizes @earendil-works/pi-coding-agent
+    // and cannot be imported from LARKIN_CONFIG_DIR.
+    const compiled = globalThis.__LARKIN_COMPILED_PI_SUBAGENTS__;
+    if (compiled) {
+        if (typeof compiled !== "function" && typeof compiled.factory !== "function") {
+            throw new Error("Larkin compiled pi-subagents factory is missing; refusing to start builtin Pi");
+        }
+        return compiled;
     }
     const bundle = bundledPiSubagentExtensionPath(process.env.LARKIN_CONFIG_DIR);
     if (!bundle)
@@ -23,6 +29,24 @@ async function loadBundledPiSubagentExtension() {
         throw new Error("Larkin bounded pi-subagents bundle is invalid; refusing to start builtin Pi");
     return loaded.default;
 }
+function asFn(mod, name) {
+    if (typeof mod === "function")
+        return mod;
+    const fallback = mod?.default;
+    if (typeof fallback === "function")
+        return fallback;
+    throw new Error(`${name} extension factory is missing`);
+}
+function wrapFactory(name, factory) {
+    return async (pi) => {
+        try {
+            await factory(pi);
+        }
+        catch (error) {
+            throw error instanceof Error ? error : new Error(`${name}: ${String(error)}`);
+        }
+    };
+}
 /** Builtin Pi extensions are loaded as code, never through Pi's path/data-URL loader. */
 const bundledSubagentsExtension = async (pi) => {
     const extension = await loadBundledPiSubagentExtension();
@@ -35,12 +59,19 @@ const bundledSubagentsExtension = async (pi) => {
 // so the final sweep can still read AgentManager.getRecord and bridge consumed
 // terminals before manager teardown.
 export const BUILTIN_PI_EXTENSION_FACTORIES = Object.freeze([
-    piSubagentRecordWatchdog,
-    bundledSubagentsExtension,
-    bashTimeoutExtension,
+    wrapFactory("larkin-pi-subagent-watchdog", asFn(piSubagentRecordWatchdog, "larkin-pi-subagent-watchdog")),
+    wrapFactory("larkin-pi-subagents", bundledSubagentsExtension),
+    wrapFactory("larkin-pi-bash-timeout", asFn(bashTimeoutExtension, "larkin-pi-bash-timeout")),
 ]);
 /** Invoke Pi RPC with Larkin's builtin-only extension factories. */
 export async function invokeBuiltinPiRpc(piMain, rest) {
+    if (globalThis.__LARKIN_EMBEDDED_PI_SUBAGENTS_BUNDLE__ && process.env.LARKIN_CONFIG_DIR) {
+        const materialized = materializeEmbeddedPiSubagentBundle(process.env.LARKIN_CONFIG_DIR);
+        if (!materialized)
+            throw new Error("standalone pi-subagents bundle failed to materialize");
+        const supervised = path.join(path.dirname(materialized), "pi-supervised-command.bundle.js");
+        process.env.LARKIN_PI_SUPERVISED_BUNDLE = fs.realpathSync(supervised);
+    }
     await piMain(["--mode", "rpc", ...rest], {
         extensionFactories: [...BUILTIN_PI_EXTENSION_FACTORIES],
     });

package/dist/runtime/pi-subagent-injection.mjs

@@ -17,22 +17,113 @@ import { fileURLToPath } from "node:url";
  * 把 embedded bundle 落盘到 <configDir>/providers/pi/extensions/pi-subagents.bundle.js（0700/0600）。
  * 无 embedded 资产或 configDir 缺失时返回 null。
  */
+function rejectSymlinkPath(target) {
+    let current = path.resolve(target);
+    for (;;) {
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) {
+            throw new Error("bundle path must not contain a symlink");
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+}
+function backupRegularFile(target) {
+    if (!fs.existsSync(target))
+        return null;
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink())
+        throw new Error("bundle target must not be a symlink");
+    return { content: fs.readFileSync(target), mode: stat.mode & 0o777 };
+}
+function restoreRegularFile(target, backup) {
+    if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) {
+        throw new Error("bundle target must not be a symlink");
+    }
+    if (!backup) {
+        if (fs.existsSync(target))
+            fs.unlinkSync(target);
+        return;
+    }
+    fs.writeFileSync(target, backup.content, { mode: backup.mode });
+    fs.chmodSync(target, backup.mode);
+}
 export function materializeEmbeddedPiSubagentBundle(configDir) {
     const embedded = globalThis.__LARKIN_EMBEDDED_PI_SUBAGENTS_BUNDLE__;
+    const supervised = globalThis.__LARKIN_EMBEDDED_PI_SUPERVISED_COMMAND_BUNDLE__;
     if (!embedded || !configDir)
         return null;
-    const dir = path.join(path.resolve(configDir), "providers", "pi", "extensions");
-    const target = path.join(dir, "pi-subagents.bundle.js");
+    if (!supervised)
+        throw new Error("supervised command bundle is missing");
+    const resolvedConfig = path.resolve(configDir);
+    fs.mkdirSync(resolvedConfig, { recursive: true, mode: 0o700 });
+    const canonical = fs.realpathSync(resolvedConfig);
+    const dir = path.join(canonical, "providers", "pi", "extensions");
+    const subTarget = path.join(dir, "pi-subagents.bundle.js");
+    const supTarget = path.join(dir, "pi-supervised-command.bundle.js");
+    const lockPath = path.join(dir, ".materialize.lock");
+    let lock;
     try {
+        rejectSymlinkPath(dir);
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        rejectSymlinkPath(dir);
         fs.chmodSync(dir, 0o700);
-        if (!fs.existsSync(target) || fs.readFileSync(target, "utf8") !== embedded) {
-            const temporary = `${target}.${process.pid}.tmp`;
-            fs.writeFileSync(temporary, embedded, { mode: 0o600, flag: "wx" });
-            fs.renameSync(temporary, target);
-            fs.chmodSync(target, 0o600);
+        lock = fs.openSync(lockPath, "wx", 0o600);
+        const oldSub = backupRegularFile(subTarget);
+        const oldSup = backupRegularFile(supTarget);
+        try {
+            writePrivateBundle(dir, "pi-subagents.bundle.js", embedded);
+            writePrivateBundle(dir, "pi-supervised-command.bundle.js", supervised);
+            return subTarget;
+        }
+        catch (error) {
+            restoreRegularFile(subTarget, oldSub);
+            restoreRegularFile(supTarget, oldSup);
+            throw error;
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes("supervised command bundle is missing"))
+            throw error;
+        return null;
+    }
+    finally {
+        if (lock !== undefined) {
+            try {
+                fs.closeSync(lock);
+            }
+            catch { /* ignore */ }
+            try {
+                fs.unlinkSync(lockPath);
+            }
+            catch { /* ignore */ }
         }
-        return target;
+    }
+}
+function writePrivateBundle(dir, name, embedded) {
+    const target = path.join(dir, name);
+    rejectSymlinkPath(target);
+    if (fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) {
+        throw new Error("bundle target must not be a symlink");
+    }
+    if (!fs.existsSync(target) || fs.readFileSync(target, "utf8") !== embedded) {
+        const temporary = `${target}.${process.pid}.tmp`;
+        fs.writeFileSync(temporary, embedded, { mode: 0o600, flag: "wx" });
+        fs.renameSync(temporary, target);
+    }
+    fs.chmodSync(target, 0o600);
+    return target;
+}
+export function materializeEmbeddedPiSupervisedCommandBundle(dirOrConfig) {
+    const embedded = globalThis.__LARKIN_EMBEDDED_PI_SUPERVISED_COMMAND_BUNDLE__;
+    if (!embedded || !dirOrConfig)
+        return null;
+    const dir = dirOrConfig.endsWith("extensions") ? dirOrConfig : path.join(path.resolve(dirOrConfig), "providers", "pi", "extensions");
+    try {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        fs.chmodSync(dir, 0o700);
+        return writePrivateBundle(dir, "pi-supervised-command.bundle.js", embedded);
     }
     catch {
         return null;
@@ -82,6 +173,7 @@ export function probeExternalPiVersion(piCommand, env) {
  * 重复注册导致 pi 扩展加载 FATAL（pi 对 duplicate tool registration 是硬失败）。
  */
 const BOUNDED_WAIT_CAPABILITY = "larkin-pi-subagents-bounded-wait-v1";
+const SUPERVISED_COMMAND_CAPABILITY = "larkin-pi-supervised-command-v1";
 function userPiSubagentsWaitCapability(env) {
     const agentDir = env.PI_CODING_AGENT_DIR || path.join(env.HOME || process.env.HOME || "", ".pi", "agent");
     try {
@@ -116,7 +208,8 @@ function userPiSubagentsWaitCapability(env) {
         const capabilityFiles = extensions.map((entry) => path.resolve(installedRoot, entry));
         const hasCapability = capabilityFiles.every((file) => {
             try {
-                return fs.readFileSync(file, "utf8").includes(BOUNDED_WAIT_CAPABILITY);
+                const source = fs.readFileSync(file, "utf8");
+                return source.includes(BOUNDED_WAIT_CAPABILITY) && source.includes(SUPERVISED_COMMAND_CAPABILITY);
             }
             catch {
                 return false;
@@ -143,7 +236,7 @@ export function resolvePiSubagentExtensionArg(input, probeVersion = () => probeE
         if (!userPiSubagentsHasBoundedWaitCapability(input.env)) {
             throw new Error("[larkin] WARNING: refusing external Pi because the user-installed " +
                 "pi-subagents extension is unbounded or unverifiable; remove it or install " +
-                "a version advertising larkin-pi-subagents-bounded-wait-v1.");
+                "a version advertising larkin-pi-subagents-bounded-wait-v1 and larkin-pi-supervised-command-v1.");
         }
         return null;
     }