oira666_pi-subagent 0.5.0 → 0.5.2

package/README.md

@@ -2,7 +2,7 @@
 
 Delegate tasks to agents running in separate Pi processes. Each worker has its own context and saved session. The parent receives its final text and usage statistics, not its reasoning or tool transcript.
 
-Requires Pi 0.85.1 or newer, using the `@earendil-works` SDK packages.
+Requires Pi 0.87.1 or newer, using the `@earendil-works` SDK packages.
 
 ## Install
 
@@ -18,6 +18,34 @@ To remove it:
 pi remove npm:oira666_pi-subagent
 ```
 
+## Extension controls
+
+Exclude extensions from child agents without changing which extensions the parent loads:
+
+```bash
+PI_SUBAGENT_EXCLUDE_EXTENSIONS="oira666_pi-free-swarm,@scope/other-package,./local-extension.ts" pi
+```
+
+The originally requested hyphenated name is also supported. Use `env` because most shells cannot assign hyphenated variable names directly:
+
+```bash
+env 'PI-SUBAGENT-EXCLUDE-EXTENSIONS=oira666_pi-free-swarm' pi
+```
+
+Both variables accept comma-separated lists; whitespace and empty entries are ignored, and the two lists are combined. Entries match a package source, package name (including `npm:@scope/name@version`, ignoring the version), or an extension file/directory path. Automatic and settings-listed extension paths use the nearest owning `package.json` after resolving symlinks; loose hooks do not inherit the current workspace's or Pi configuration directory's package name. Relative paths resolve from the worker's working directory; `~/` and symlinks are supported. Commas inside paths are not supported. These variables are inherited by nested workers.
+
+When a list is nonempty, the runner discovers enabled extensions without executing them, then launches the child with `--no-extensions` and explicit paths for every remaining extension, including authentication providers. This covers automatic user/project extensions and forwarded `-e` sources. An original `--no-extensions` still suppresses automatic extensions. Project resources are included only when the parent's live context trusts that working directory; unknown trust fails closed. The same trust decision is passed to the child. With no exclusions, launch behavior is unchanged and no extra discovery runs.
+
+Discovery does not install packages or edit settings. Remote explicit `-e` sources must already be installed in Pi's user package location (or its supported legacy global npm location); temporary-only and project-only remote installs must first be installed there or passed as local paths. If Pi leaves a directory unresolved, pass its entry-point file explicitly so file exclusions cannot be bypassed by directory loading. Missing or invalid sources fail the launch rather than falling back to unfiltered loading. Pi's offline mode skips missing automatic packages, as usual. Filtering controls extension entry points, not code imported by an allowed extension, and the allowlist is a launch-time snapshot until the next delegation.
+
+Disable this entire extension, including its tools, commands, flags, providers, and event handlers:
+
+```bash
+PI_SUBAGENT_DISABLED=1 pi
+```
+
+`true` (case-insensitive) also disables it; `PI-SUBAGENT-DISABLED` is an equivalent alias. Other values leave it enabled. The setting applies to the current process and is inherited by children. It is separate from child-extension exclusions, which do not disable anything in the parent. Restart Pi or reload extensions after changing the process environment.
+
 ## Launch and resume
 
 ```json
@@ -75,7 +103,7 @@ See [configuration](docs/configuration.md) for frontmatter, layer restrictions,
 
 Collapsed results show each child's name, task, status, and most recent activity anywhere in its subtree. `Ctrl+O` expands the newest call from memory without reading historical transcripts.
 
-`/subagent-expand <name>` opens a saved worker transcript. With no name, it opens a searchable picker. Name completion is fuzzy.
+`/subagent-expand <name>` opens a saved worker transcript. With no name, it opens a searchable picker. Name completion is fuzzy. Each task or resume shows its actual provider/model and thinking level from the worker's session, not the parent's settings. Missing historical metadata appears as `unknown`.
 
 | Key | Action |
 | --- | --- |

package/config.ts

@@ -30,6 +30,77 @@ function readConfig(filePath: string): Record<string, unknown> {
   }
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+let tempFileCounter = 0;
+
+/** Add the explicit default without allowing a failed write to change runtime behavior. */
+function persistSmartDecisionFallback(config: Record<string, unknown>, filePath: string): void {
+  const smartDecision = config["smart-decision"];
+  if (!isRecord(smartDecision) || Object.hasOwn(smartDecision, "fallback")) return;
+
+  smartDecision.fallback = true;
+  let tempPath: string | undefined;
+  let ownsTemp = false;
+  try {
+    // Replace the target rather than a symlink that points to it.
+    const targetPath = fs.realpathSync(filePath);
+    // Re-read immediately before writing so unrelated edits made since the initial load survive.
+    // Retrying also makes concurrent nested-worker migrations converge without clobbering one another.
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const source = fs.readFileSync(targetPath, "utf8");
+      const latest = JSON.parse(source) as unknown;
+      if (!isRecord(latest)) return;
+      const latestSmartDecision = latest["smart-decision"];
+      if (!isRecord(latestSmartDecision)) return;
+      if (Object.hasOwn(latestSmartDecision, "fallback")) {
+        smartDecision.fallback = latestSmartDecision.fallback;
+        return;
+      }
+
+      latestSmartDecision.fallback = true;
+      const mode = fs.statSync(targetPath).mode & 0o7777;
+      const candidatePath = path.join(
+        path.dirname(targetPath),
+        `.${path.basename(targetPath)}.${process.pid}.${tempFileCounter++}.tmp`,
+      );
+      const fd = fs.openSync(candidatePath, "wx", mode);
+      tempPath = candidatePath;
+      ownsTemp = true;
+      try {
+        fs.writeFileSync(fd, `${JSON.stringify(latest, null, 2)}\n`, "utf8");
+        fs.fchmodSync(fd, mode);
+        fs.fsyncSync(fd);
+      } finally {
+        fs.closeSync(fd);
+      }
+
+      if (fs.readFileSync(targetPath, "utf8") !== source) {
+        fs.unlinkSync(tempPath);
+        tempPath = undefined;
+        ownsTemp = false;
+        continue;
+      }
+      fs.renameSync(tempPath, targetPath);
+      tempPath = undefined;
+      ownsTemp = false;
+      return;
+    }
+    throw new Error("config changed during fallback migration");
+  } catch {
+    if (ownsTemp && tempPath) {
+      try {
+        fs.unlinkSync(tempPath);
+      } catch {
+        // Best-effort cleanup. Do not expose filesystem errors or configuration contents.
+      }
+    }
+    console.warn("[pi-subagent] Failed to save the default smart-decision fallback.");
+  }
+}
+
 function readToolPrompts(config: Record<string, unknown>, filePath: string): Record<string, string> {
   const toolPrompts = config["tool-prompts"];
   if (toolPrompts === undefined) return {};
@@ -85,6 +156,7 @@ export function loadPiSubagentsConfig(cwd?: string, includeProject = false): PiS
   let smartDecision: SmartDecisionConfig | undefined;
   for (const filePath of new Set(paths)) {
     const config = readConfig(filePath);
+    persistSmartDecisionFallback(config, filePath);
     Object.assign(toolPrompts, readToolPrompts(config, filePath));
     if (Object.hasOwn(config, "smart-decision")) {
       smartDecision = parseSmartDecisionConfig(config["smart-decision"]);

package/docs/configuration.md

@@ -80,7 +80,7 @@ Replace the example choices with models available in your Pi installation. Each
 - `enabled` must be `true`. Missing settings, disabled settings, or an empty model list leave existing behavior unchanged and make no Jev requests.
 - `model` selects the decision model, not the worker model. `jev` maps to TypeSafe's `jev-latest`; explicit TypeSafe model IDs also work.
 - `api_key` is your TypeSafe API key. Worker providers still need their own Pi credentials.
-- `fallback` defaults to `true`. If selection fails, a short warning is written and the worker uses the original launch settings. Set it to `false` to return a tool error without launching the affected worker. This covers network errors, the 10-second request timeout, API errors, invalid answers, and invalid enabled configuration. Cancellation cancels the task instead of falling back.
+- `fallback` defaults to `true`. When a loaded `smart-decision` object omits it, the extension adds `"fallback": true` and saves that configuration file at runtime. Existing values, including `false`, are left untouched. Untrusted project files are never changed. If saving fails, a warning is emitted and the runtime default still applies. If selection fails, a short warning is written and the worker uses the original launch settings. Set it to `false` to return a tool error without launching the affected worker. This covers network errors, the 10-second request timeout, API errors, invalid answers, and invalid enabled configuration. Cancellation cancels the task instead of falling back.
 
 Each fresh launch and actual resume sends the agent definition's system prompt, the assigned task, and the candidate descriptions to `https://api.typesafe.ai/v1/systemone`. Jev must select a configured candidate. Its provider, model, and thinking level override the parent model and agent frontmatter for that run. The parent's explicit `--provider` and `--api-key` are not forwarded when a Jev choice is applied. Startup retries reuse the choice. Finished results reused without launching a process make no request.
 

package/extension/contracts.ts

@@ -1,5 +1,5 @@
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
-import type { Context, SimpleStreamOptions } from "@earendil-works/pi-ai";
+import type { TranscriptContext, SimpleStreamOptions } from "@earendil-works/pi-ai";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { SubagentDetails } from "../types.js";
 
@@ -7,7 +7,7 @@ export type ResumeModel = NonNullable<ExtensionContext["model"]>;
 export type ResumeModelRegistry = ExtensionContext["modelRegistry"];
 export type SessionContext = ExtensionContext;
 export type StreamOptions = SimpleStreamOptions;
-export type ProviderContext = Context;
+export type ProviderContext = TranscriptContext;
 export type ProgressUpdate = AgentToolResult<SubagentDetails>;
 
 export function isRecord(value: unknown): value is Record<string, unknown> {

package/extension/execution.ts

@@ -46,6 +46,7 @@ export async function executeSingle(
   try {
     result = await runAgentSubprocess({
       cwd: defaultCwd,
+      projectTrusted: state.latestSessionCtx?.cwd === defaultCwd && state.latestSessionCtx.isProjectTrusted(),
       agents,
       agentName,
       task,
@@ -149,7 +150,12 @@ export async function executeParallel(
           updateLatestBroadcastTargets(state, undefined);
         }
       },
-      { ...extras, namesFile: state.currentNamesFile || undefined, smartDecision: state.smartDecision },
+      {
+        ...extras,
+        namesFile: state.currentNamesFile || undefined,
+        smartDecision: state.smartDecision,
+        projectTrusted: state.latestSessionCtx?.cwd === defaultCwd && state.latestSessionCtx.isProjectTrusted(),
+      },
     );
   } finally {
     for (const id of taskIds.values()) state.activeSubagents.delete(id);

package/extension/provider.ts

@@ -127,7 +127,11 @@ export function registerResumeProvider(state: ExtensionState): void {
         if (plans.length > 0 && phase === "tool" && triggerMatches) {
           resume.phase = "final";
           const toolCalls = plans.map((plan, index) =>
-            fauxToolCall(SUBAGENT_TOOL_NAME, { tasks: plan.tasks }, { id: `resume_subagent_${Date.now()}_${index}` }),
+            fauxToolCall(
+              SUBAGENT_TOOL_NAME,
+              { tasks: plan.tasks.map((task) => ({ ...task })) },
+              { id: `resume_subagent_${Date.now()}_${index}` },
+            ),
           );
           resumeCore.setResponses([() => fauxAssistantMessage(toolCalls, { stopReason: "toolUse" })]);
           const stream = resumeCore.streamSimple(model, context, options);

package/index.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { subagentDisabled } from "./runner/extension-policy.js";
 import { registerSessionEvents } from "./extension/events.js";
 import { registerSubagentExpandCommand } from "./extension/expand-command.js";
 import { registerPromptHook } from "./extension/prompt-hook.js";
@@ -12,6 +13,7 @@ export { getSubagentsToolDescription } from "./extension/prompts.js";
 export { collectCombinedUsageStatusLine, collectLiveUsageSummary } from "./extension/usage.js";
 
 export default function (pi: ExtensionAPI): void {
+  if (subagentDisabled()) return;
   pi.registerFlag("subagent-max-depth", {
     description: "Maximum allowed subagent delegation depth (default: 3).",
     type: "string",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oira666_pi-subagent",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Subagent extension for Pi coding agent. Delegate tasks to specialized agents.",
   "type": "module",
   "main": "index.ts",
@@ -61,20 +61,20 @@
     "check": "npm run typecheck && npm run format:check && npm run check:size && npm test"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "^0.85.1",
-    "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
-    "@earendil-works/pi-tui": "^0.85.1",
+    "@earendil-works/pi-agent-core": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1",
     "@types/node": "^25.2.3",
     "prettier": "^3.9.6",
     "tsx": "^4.23.13",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.85.1",
-    "@earendil-works/pi-ai": ">=0.85.1",
-    "@earendil-works/pi-coding-agent": ">=0.85.1",
-    "@earendil-works/pi-tui": ">=0.85.1"
+    "@earendil-works/pi-agent-core": ">=0.87.1",
+    "@earendil-works/pi-ai": ">=0.87.1",
+    "@earendil-works/pi-coding-agent": ">=0.87.1",
+    "@earendil-works/pi-tui": ">=0.87.1"
   },
   "peerDependenciesMeta": {
     "@earendil-works/pi-agent-core": {

package/runner/arguments.ts

@@ -3,6 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../agents.js";
 import { SUBAGENT_FALLBACK_MODEL_ENV } from "./constants.js";
+import { childExtensionArgs, excludedExtensions } from "./extension-policy.js";
 function resolveExtensionArg(value: string): string {
   if (!value) return value;
   if (value.startsWith("npm:") || value.startsWith("git:")) return value;
@@ -202,6 +203,12 @@ function parseInheritedCliArgs(argv: string[]): InheritedCliArgs {
 /** Cached once — process.argv is immutable at runtime */
 const _inheritedCliArgs = parseInheritedCliArgs(process.argv);
 
+export async function resolveChildExtensionArgs(cwd: string, projectTrusted?: boolean): Promise<string[] | undefined> {
+  const excludes = excludedExtensions();
+  if (excludes.length === 0) return undefined;
+  return childExtensionArgs(_inheritedCliArgs.extensionArgs, cwd, projectTrusted, excludes);
+}
+
 export function resolveSubagentModel(agentModel?: string, currentParentModel?: string): string | undefined {
   // The active parent model is authoritative. Agent frontmatter is retained as
   // a compatibility fallback only for callers that cannot supply live context.
@@ -219,6 +226,7 @@ export function buildPiArgs(
   fallbackModelOverride?: string,
   rawPrompt = false,
   selection?: { provider: string; model: string; thinking: string },
+  extensionArgsOverride?: string[],
 ): { args: string[]; prompt: string } {
   // A Jev-selected provider must not inherit a conflicting provider or its CLI credential.
   const proxyArgs = selection
@@ -227,7 +235,15 @@ export function buildPiArgs(
           !["--provider", "--api-key"].includes(arg) && !["--provider", "--api-key"].includes(args[index - 1]),
       )
     : _inheritedCliArgs.alwaysProxy;
-  const args: string[] = ["--mode", "rpc", ..._inheritedCliArgs.extensionArgs, ...proxyArgs];
+  const args: string[] = [
+    "--mode",
+    "rpc",
+    ...(extensionArgsOverride ? [] : _inheritedCliArgs.extensionArgs),
+    ...proxyArgs,
+  ];
+  // Keep the resolved trust decision after forwarded startup flags. Extension filtering
+  // must never interpret another flag's value (such as a prompt or credential) as a flag.
+  if (extensionArgsOverride) args.push(...extensionArgsOverride);
 
   if (sessionDir) args.push("--session-dir", sessionDir);
   if (resumeSession) args.push("--continue");

package/runner/extension-policy.ts

@@ -0,0 +1,174 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import {
+  DefaultPackageManager,
+  SettingsManager,
+  getAgentDir,
+  type ResolvedResource,
+} from "@earendil-works/pi-coding-agent";
+
+export function excludedExtensions(env: NodeJS.ProcessEnv = process.env): string[] {
+  return [
+    ...new Set(
+      [env["PI-SUBAGENT-EXCLUDE-EXTENSIONS"], env.PI_SUBAGENT_EXCLUDE_EXTENSIONS]
+        .flatMap((value) => (value ?? "").split(","))
+        .map((value) => value.trim())
+        .filter(Boolean),
+    ),
+  ];
+}
+
+export function subagentDisabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return [env.PI_SUBAGENT_DISABLED, env["PI-SUBAGENT-DISABLED"]].some(
+    (value) => value === "1" || value?.toLowerCase() === "true",
+  );
+}
+
+function resolvedPath(value: string, cwd: string): string {
+  const absolute = path.resolve(cwd, value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value);
+  return fs.existsSync(absolute) ? fs.realpathSync(absolute) : absolute;
+}
+
+function npmName(source: string): string | undefined {
+  const spec = source.replace(/^npm:/, "");
+  return /^(?:@[^/\s]+\/)?[^/@\s]+(?:@[^\s]+)?$/.test(spec)
+    ? spec.slice(0, spec.indexOf("@", 1) === -1 ? undefined : spec.indexOf("@", 1))
+    : undefined;
+}
+
+function manifestName(directory: string): string | undefined {
+  const parsed: unknown = JSON.parse(fs.readFileSync(path.join(directory, "package.json"), "utf8"));
+  return typeof parsed === "object" && parsed !== null && "name" in parsed && typeof parsed.name === "string"
+    ? parsed.name
+    : undefined;
+}
+
+function packageName(resource: ResolvedResource, cwd: string, agentDir: string): string | undefined {
+  if (resource.metadata.source.startsWith("npm:")) return npmName(resource.metadata.source);
+  if (resource.metadata.origin === "package" && resource.metadata.baseDir) {
+    const base = resolvedPath(resource.metadata.baseDir, cwd);
+    if (fs.existsSync(path.join(base, "package.json"))) return manifestName(base);
+  }
+
+  const resourcePath = resolvedPath(resource.path, cwd);
+  let directory = fs.statSync(resourcePath).isDirectory() ? resourcePath : path.dirname(resourcePath);
+  const boundaries = new Set(
+    [
+      cwd,
+      agentDir,
+      path.join(cwd, ".pi"),
+      path.join(cwd, ".pi/extensions"),
+      path.join(agentDir, "extensions"),
+      os.homedir(),
+    ].map((entry) => resolvedPath(entry, cwd)),
+  );
+  // A loose hook belongs to neither the surrounding workspace nor Pi's config
+  // directory. Resolve symlinks first, and stop at the nearest manifest even if unnamed.
+  while (!boundaries.has(directory) && directory !== path.dirname(directory)) {
+    if (fs.existsSync(path.join(directory, "package.json"))) return manifestName(directory);
+    directory = path.dirname(directory);
+  }
+  return undefined;
+}
+
+function isExcluded(resource: ResolvedResource, excludes: string[], cwd: string, agentDir: string): boolean {
+  const resourcePath = resolvedPath(resource.path, cwd);
+  const name = packageName(resource, cwd, agentDir);
+  return excludes.some((exclude) => {
+    if (
+      (resource.metadata.origin === "package" && exclude === resource.metadata.source) ||
+      (name !== undefined && npmName(exclude) === name)
+    )
+      return true;
+    const excludedPath = resolvedPath(exclude, cwd);
+    return resourcePath === excludedPath || resourcePath.startsWith(`${excludedPath}${path.sep}`);
+  });
+}
+
+function isRemote(source: string): boolean {
+  return /^(?:npm:|git:|https?:\/\/|git@|ssh:)/.test(source);
+}
+
+/** Resolve before loading: filtering Extension objects would already have executed their factories. */
+export async function childExtensionArgs(
+  args: string[],
+  cwd: string,
+  projectTrusted = false,
+  excludes = excludedExtensions(),
+  agentDir = getAgentDir(),
+): Promise<string[]> {
+  if (excludes.length === 0) return args;
+  const rest: string[] = [];
+  const explicit: string[] = [];
+  let noExtensions = false;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "-ne" || arg === "--no-extensions") noExtensions = true;
+    else if (arg === "-e" || arg === "--extension") {
+      const source = args[++index];
+      if (!source) throw new Error("Missing explicit extension source");
+      explicit.push(source);
+    } else if (["-a", "--approve", "-na", "--no-approve"].includes(arg)) {
+      // The live parent's decision is authoritative, not stale startup flags.
+    } else rest.push(arg);
+  }
+  const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
+  if (settingsManager.drainErrors().length > 0) throw new Error("Cannot resolve child extensions: invalid Pi settings");
+  const manager = new DefaultPackageManager({ cwd, agentDir, settingsManager });
+  const automatic = noExtensions ? [] : (await manager.resolve(async () => "error")).extensions;
+  const explicitResources: ResolvedResource[] = [];
+  for (const source of explicit) {
+    let resolved;
+    if (isRemote(source)) {
+      // resolveExtensionSources can install or refresh remote sources. Use the read-only
+      // missing-source policy instead; temporary-only remote installs must be installed normally first.
+      const explicitSettings = SettingsManager.inMemory(
+        {
+          npmCommand: settingsManager.getGlobalSettings().npmCommand,
+          packages: [source],
+        },
+        { projectTrusted: false },
+      );
+      const explicitManager = new DefaultPackageManager({ cwd, agentDir, settingsManager: explicitSettings });
+      if (!explicitManager.getInstalledPath(source, "user")) {
+        throw new Error(`Explicit extension source must be installed before exclusion filtering: ${source}`);
+      }
+      resolved = await explicitManager.resolve(async () => "error");
+      for (const kind of ["extensions", "skills", "prompts", "themes"] as const) {
+        resolved[kind] = resolved[kind].filter(
+          (resource) => resource.metadata.origin === "package" && resource.metadata.source === source,
+        );
+      }
+      if (Object.values(resolved).every((resources) => resources.length === 0)) {
+        throw new Error(`No installed resources match explicit extension source: ${source}`);
+      }
+    } else {
+      const local = resolvedPath(source, cwd);
+      if (!fs.existsSync(local)) throw new Error(`Missing explicit extension source: ${source}`);
+      resolved = await manager.resolveExtensionSources([local], { temporary: true });
+    }
+    explicitResources.push(...resolved.extensions);
+    for (const [kind, flag] of [
+      ["skills", "--skill"],
+      ["prompts", "--prompt-template"],
+      ["themes", "--theme"],
+    ] as const) {
+      for (const resource of resolved[kind]) if (resource.enabled) rest.push(flag, resource.path);
+    }
+  }
+  const kept = new Set<string>();
+  for (const resource of [...explicitResources, ...automatic]) {
+    if (!resource.enabled || isExcluded(resource, excludes, cwd, agentDir)) continue;
+    if (!fs.statSync(resource.path).isFile()) {
+      throw new Error(`Extension source did not resolve to files: ${resource.path}. Pass its entry point explicitly.`);
+    }
+    kept.add(resource.path);
+  }
+  return [
+    ...rest,
+    projectTrusted ? "--approve" : "--no-approve",
+    "--no-extensions",
+    ...[...kept].flatMap((entry) => ["-e", entry]),
+  ];
+}

package/runner/options.ts

@@ -17,6 +17,8 @@ export type RunningSubagentStartedCallback = (handle: RunningSubagentHandle) =>
 export interface RunAgentOptions {
   /** Working directory inherited by every subagent process. */
   cwd: string;
+  /** Effective trust for this cwd; absent SDK callers fail closed. */
+  projectTrusted?: boolean;
   /** All available agent configs. */
   agents: AgentConfig[];
   /** Name of the agent to run. */

package/runner/parallel.ts

@@ -40,6 +40,7 @@ export async function executeParallelSubprocess(
     namesFile?: string;
     budgets?: Array<SubagentBudget | undefined>;
     smartDecision?: RunAgentOptions["smartDecision"];
+    projectTrusted?: boolean;
   },
 ): Promise<{
   content: Array<{ type: "text"; text: string }>;
@@ -123,6 +124,7 @@ export async function executeParallelSubprocess(
       try {
         result = await runAgentSubprocess({
           cwd: defaultCwd,
+          projectTrusted: extras?.projectTrusted,
           agents,
           agentName: t.agent,
           task: t.task,

package/runner/single.ts

@@ -7,7 +7,7 @@ import {
   STARTUP_RETRY_BASE_BACKOFF_MS,
 } from "./constants.js";
 import type { RunAgentOptions } from "./options.js";
-import { buildPiArgs } from "./arguments.js";
+import { buildPiArgs, resolveChildExtensionArgs } from "./arguments.js";
 import { writePromptToTempFile, cleanupTempDir, sessionDirExists } from "./files.js";
 import { appendBoundedStderr, priorDescendantUsage, endedWithSyntheticResumeFailure } from "./result.js";
 import { runAttempt } from "./attempt.js";
@@ -112,6 +112,7 @@ export async function runAgentSubprocess(opts: RunAgentOptions): Promise<SingleR
   }
 
   try {
+    const extensionArgs = await resolveChildExtensionArgs(opts.cwd, opts.projectTrusted);
     const selection = await selectSmartDecision(
       opts.smartDecision,
       { systemPrompt: agent.systemPrompt, task },
@@ -137,6 +138,7 @@ export async function runAgentSubprocess(opts: RunAgentOptions): Promise<SingleR
       fallbackModel,
       opts.rawPrompt === true,
       selection,
+      extensionArgs,
     );
     const prompt =
       result.budget && readBudget(result.budget).limit > 0

package/ui/detail-lines.ts

@@ -93,11 +93,11 @@ export function renderTurnOverviewLines(
   const meta = [
     `Turn ${blockIndex + 1} of ${detail.blocks.length}: ${turnTitle}`,
     block.at ? formatClockTime(block.at) : "",
-    detail.model ?? "",
   ]
     .filter(Boolean)
     .join(" • ");
   out.wrap(meta, "", "dim");
+  out.wrap(`Model: ${block.model ?? "unknown"} • Thinking: ${block.thinkingLevel ?? "unknown"}`, "", "dim");
   out.wrap(`session total: ${usageLine(detail.usage)}`, "", "dim");
   for (const note of detail.notes) out.wrap(note, "", "warning");
 

package/ui/detail-model.ts

@@ -16,6 +16,9 @@ export interface DetailBlock {
   index: number;
   prompt: string;
   at?: number;
+  /** Actual settings recorded for this task or resume, not the parent's model. */
+  model?: string;
+  thinkingLevel?: string;
   events: DetailEvent[];
 }
 
@@ -32,6 +35,7 @@ export interface SubagentDetail {
   name: string;
   agent: string;
   model?: string;
+  thinkingLevel?: string;
   tools?: string[];
   createdAt?: number;
   sessionDir: string;

package/ui/detail-transcript.ts

@@ -1,4 +1,4 @@
-import { sessionFilesIn, readSessionMessages } from "./session.js";
+import { sessionFilesIn, readSessionEntries } from "./session.js";
 export { sessionFilesIn, readSessionMessages } from "./session.js";
 import * as os from "node:os";
 import type { NamesRegistry, SubagentNameRecord } from "../names.js";
@@ -92,23 +92,41 @@ export interface ParsedTranscript {
   blocks: DetailBlock[];
   usage: DetailUsage;
   toolCallCount: number;
+  model?: string;
+  thinkingLevel?: string;
 }
 
 export function parseTranscriptMessages(messages: unknown[]): ParsedTranscript {
   const blocks: DetailBlock[] = [];
   const usage: DetailUsage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, turns: 0 };
   let toolCallCount = 0;
+  let model: string | undefined;
+  let thinkingLevel: string | undefined;
   const pendingTools = new Map<string, Extract<DetailEvent, { type: "tool" }>>();
+  const observedModels = new Set<DetailBlock>();
 
   const currentBlock = (): DetailBlock => {
     if (blocks.length === 0) {
-      blocks.push({ kind: "task", index: 0, prompt: "", events: [] });
+      blocks.push({ kind: "task", index: 0, prompt: "", model, thinkingLevel, events: [] });
     }
     return blocks[blocks.length - 1];
   };
 
   for (const entry of messages) {
     const wrapper = asRecord(entry);
+    if (wrapper.type === "model_change") {
+      if (typeof wrapper.modelId === "string" && wrapper.modelId && wrapper.modelId !== "synthetic-tool-call") {
+        model =
+          typeof wrapper.provider === "string" && wrapper.provider
+            ? `${wrapper.provider}/${wrapper.modelId}`
+            : wrapper.modelId;
+      }
+      continue;
+    }
+    if (wrapper.type === "thinking_level_change") {
+      if (typeof wrapper.thinkingLevel === "string" && wrapper.thinkingLevel) thinkingLevel = wrapper.thinkingLevel;
+      continue;
+    }
     const message = asRecord(wrapper.message);
     const at = parseTimestamp(wrapper.timestamp ?? message.timestamp);
     const role = message.role;
@@ -121,6 +139,8 @@ export function parseTranscriptMessages(messages: unknown[]): ParsedTranscript {
         index,
         prompt,
         at,
+        model,
+        thinkingLevel,
         events: [],
       });
       continue;
@@ -138,6 +158,19 @@ export function parseTranscriptMessages(messages: unknown[]): ParsedTranscript {
       usage.cost += typeof cost === "number" ? cost : Number(asRecord(cost).total) || 0;
 
       const block = currentBlock();
+      // Legacy transcripts may have messages but no model-change entries.
+      if (typeof message.model === "string" && message.model && message.model !== "synthetic-tool-call") {
+        const actualModel =
+          typeof message.provider === "string" && message.provider
+            ? `${message.provider}/${message.model}`
+            : message.model;
+        if (!observedModels.has(block)) {
+          block.model = actualModel;
+          block.thinkingLevel = thinkingLevel;
+          observedModels.add(block);
+        }
+        model = actualModel;
+      }
       for (const rawPart of Array.isArray(message.content) ? message.content : []) {
         const part = asRecord(rawPart);
         if (part.type === "thinking" && typeof part.thinking === "string") {
@@ -188,7 +221,7 @@ export function parseTranscriptMessages(messages: unknown[]): ParsedTranscript {
     }
   }
 
-  return { blocks, usage, toolCallCount };
+  return { blocks, usage, toolCallCount, model, thinkingLevel };
 }
 
 export function buildSubagentDetail(record: SubagentNameRecord, options: { sessionDir?: string } = {}): SubagentDetail {
@@ -200,11 +233,15 @@ export function buildSubagentDetail(record: SubagentNameRecord, options: { sessi
   let blocks: DetailBlock[] = [];
   let usage: DetailUsage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, turns: 0 };
   let toolCallCount = 0;
+  let model: string | undefined;
+  let thinkingLevel: string | undefined;
 
   if (!sessionFile) {
     notes.push(`No session transcript found in ${shortenPath(sessionDir)}`);
   } else {
-    const parsed = parseTranscriptMessages(readSessionMessages(sessionFile));
+    const parsed = parseTranscriptMessages(readSessionEntries(sessionFile));
+    model = parsed.model;
+    thinkingLevel = parsed.thinkingLevel;
     blocks = parsed.blocks;
     usage = parsed.usage;
     toolCallCount = parsed.toolCallCount;
@@ -214,7 +251,7 @@ export function buildSubagentDetail(record: SubagentNameRecord, options: { sessi
   }
 
   if (blocks.length === 0 && record.task) {
-    blocks = [{ kind: "task", index: 0, prompt: record.task, at: record.createdAt, events: [] }];
+    blocks = [{ kind: "task", index: 0, prompt: record.task, at: record.createdAt, model, thinkingLevel, events: [] }];
   }
   if (blocks.length > 0 && !blocks[0].prompt && record.task) {
     blocks[0].prompt = record.task;
@@ -223,7 +260,8 @@ export function buildSubagentDetail(record: SubagentNameRecord, options: { sessi
   return {
     name: record.name,
     agent: record.agent,
-    model: record.model,
+    model,
+    thinkingLevel,
     tools: record.tools,
     createdAt: record.createdAt,
     sessionDir,

package/ui/session.ts

@@ -18,8 +18,8 @@ export function sessionFilesIn(sessionDir: string): string[] {
   }
 }
 
-export function readSessionMessages(file: string): unknown[] {
-  const messages: unknown[] = [];
+export function readSessionEntries(file: string): Record<string, unknown>[] {
+  const messages: Record<string, unknown>[] = [];
   let raw: string;
   try {
     raw = fs.readFileSync(file, "utf8");
@@ -34,7 +34,11 @@ export function readSessionMessages(file: string): unknown[] {
     } catch {
       continue;
     }
-    if (entry?.type === "message" && entry.message) messages.push(entry);
+    messages.push(entry);
   }
   return messages;
 }
+
+export function readSessionMessages(file: string): unknown[] {
+  return readSessionEntries(file).filter((entry) => entry.type === "message" && entry.message);
+}