oira666_pi-subagent 0.5.1 → 0.5.2

package/README.md

@@ -2,7 +2,7 @@
 
 Delegate tasks to agents running in separate Pi processes. Each worker has its own context and saved session. The parent receives its final text and usage statistics, not its reasoning or tool transcript.
 
-Requires Pi 0.85.1 or newer, using the `@earendil-works` SDK packages.
+Requires Pi 0.87.1 or newer, using the `@earendil-works` SDK packages.
 
 ## Install
 
@@ -18,6 +18,34 @@ To remove it:
 pi remove npm:oira666_pi-subagent
 ```
 
+## Extension controls
+
+Exclude extensions from child agents without changing which extensions the parent loads:
+
+```bash
+PI_SUBAGENT_EXCLUDE_EXTENSIONS="oira666_pi-free-swarm,@scope/other-package,./local-extension.ts" pi
+```
+
+The originally requested hyphenated name is also supported. Use `env` because most shells cannot assign hyphenated variable names directly:
+
+```bash
+env 'PI-SUBAGENT-EXCLUDE-EXTENSIONS=oira666_pi-free-swarm' pi
+```
+
+Both variables accept comma-separated lists; whitespace and empty entries are ignored, and the two lists are combined. Entries match a package source, package name (including `npm:@scope/name@version`, ignoring the version), or an extension file/directory path. Automatic and settings-listed extension paths use the nearest owning `package.json` after resolving symlinks; loose hooks do not inherit the current workspace's or Pi configuration directory's package name. Relative paths resolve from the worker's working directory; `~/` and symlinks are supported. Commas inside paths are not supported. These variables are inherited by nested workers.
+
+When a list is nonempty, the runner discovers enabled extensions without executing them, then launches the child with `--no-extensions` and explicit paths for every remaining extension, including authentication providers. This covers automatic user/project extensions and forwarded `-e` sources. An original `--no-extensions` still suppresses automatic extensions. Project resources are included only when the parent's live context trusts that working directory; unknown trust fails closed. The same trust decision is passed to the child. With no exclusions, launch behavior is unchanged and no extra discovery runs.
+
+Discovery does not install packages or edit settings. Remote explicit `-e` sources must already be installed in Pi's user package location (or its supported legacy global npm location); temporary-only and project-only remote installs must first be installed there or passed as local paths. If Pi leaves a directory unresolved, pass its entry-point file explicitly so file exclusions cannot be bypassed by directory loading. Missing or invalid sources fail the launch rather than falling back to unfiltered loading. Pi's offline mode skips missing automatic packages, as usual. Filtering controls extension entry points, not code imported by an allowed extension, and the allowlist is a launch-time snapshot until the next delegation.
+
+Disable this entire extension, including its tools, commands, flags, providers, and event handlers:
+
+```bash
+PI_SUBAGENT_DISABLED=1 pi
+```
+
+`true` (case-insensitive) also disables it; `PI-SUBAGENT-DISABLED` is an equivalent alias. Other values leave it enabled. The setting applies to the current process and is inherited by children. It is separate from child-extension exclusions, which do not disable anything in the parent. Restart Pi or reload extensions after changing the process environment.
+
 ## Launch and resume
 
 ```json

package/extension/contracts.ts

@@ -1,5 +1,5 @@
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
-import type { Context, SimpleStreamOptions } from "@earendil-works/pi-ai";
+import type { TranscriptContext, SimpleStreamOptions } from "@earendil-works/pi-ai";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { SubagentDetails } from "../types.js";
 
@@ -7,7 +7,7 @@ export type ResumeModel = NonNullable<ExtensionContext["model"]>;
 export type ResumeModelRegistry = ExtensionContext["modelRegistry"];
 export type SessionContext = ExtensionContext;
 export type StreamOptions = SimpleStreamOptions;
-export type ProviderContext = Context;
+export type ProviderContext = TranscriptContext;
 export type ProgressUpdate = AgentToolResult<SubagentDetails>;
 
 export function isRecord(value: unknown): value is Record<string, unknown> {

package/extension/execution.ts

@@ -46,6 +46,7 @@ export async function executeSingle(
   try {
     result = await runAgentSubprocess({
       cwd: defaultCwd,
+      projectTrusted: state.latestSessionCtx?.cwd === defaultCwd && state.latestSessionCtx.isProjectTrusted(),
       agents,
       agentName,
       task,
@@ -149,7 +150,12 @@ export async function executeParallel(
           updateLatestBroadcastTargets(state, undefined);
         }
       },
-      { ...extras, namesFile: state.currentNamesFile || undefined, smartDecision: state.smartDecision },
+      {
+        ...extras,
+        namesFile: state.currentNamesFile || undefined,
+        smartDecision: state.smartDecision,
+        projectTrusted: state.latestSessionCtx?.cwd === defaultCwd && state.latestSessionCtx.isProjectTrusted(),
+      },
     );
   } finally {
     for (const id of taskIds.values()) state.activeSubagents.delete(id);

package/extension/provider.ts

@@ -127,7 +127,11 @@ export function registerResumeProvider(state: ExtensionState): void {
         if (plans.length > 0 && phase === "tool" && triggerMatches) {
           resume.phase = "final";
           const toolCalls = plans.map((plan, index) =>
-            fauxToolCall(SUBAGENT_TOOL_NAME, { tasks: plan.tasks }, { id: `resume_subagent_${Date.now()}_${index}` }),
+            fauxToolCall(
+              SUBAGENT_TOOL_NAME,
+              { tasks: plan.tasks.map((task) => ({ ...task })) },
+              { id: `resume_subagent_${Date.now()}_${index}` },
+            ),
           );
           resumeCore.setResponses([() => fauxAssistantMessage(toolCalls, { stopReason: "toolUse" })]);
           const stream = resumeCore.streamSimple(model, context, options);

package/index.ts

@@ -1,4 +1,5 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { subagentDisabled } from "./runner/extension-policy.js";
 import { registerSessionEvents } from "./extension/events.js";
 import { registerSubagentExpandCommand } from "./extension/expand-command.js";
 import { registerPromptHook } from "./extension/prompt-hook.js";
@@ -12,6 +13,7 @@ export { getSubagentsToolDescription } from "./extension/prompts.js";
 export { collectCombinedUsageStatusLine, collectLiveUsageSummary } from "./extension/usage.js";
 
 export default function (pi: ExtensionAPI): void {
+  if (subagentDisabled()) return;
   pi.registerFlag("subagent-max-depth", {
     description: "Maximum allowed subagent delegation depth (default: 3).",
     type: "string",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oira666_pi-subagent",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Subagent extension for Pi coding agent. Delegate tasks to specialized agents.",
   "type": "module",
   "main": "index.ts",
@@ -61,20 +61,20 @@
     "check": "npm run typecheck && npm run format:check && npm run check:size && npm test"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "^0.85.1",
-    "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
-    "@earendil-works/pi-tui": "^0.85.1",
+    "@earendil-works/pi-agent-core": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1",
     "@types/node": "^25.2.3",
     "prettier": "^3.9.6",
     "tsx": "^4.23.13",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.85.1",
-    "@earendil-works/pi-ai": ">=0.85.1",
-    "@earendil-works/pi-coding-agent": ">=0.85.1",
-    "@earendil-works/pi-tui": ">=0.85.1"
+    "@earendil-works/pi-agent-core": ">=0.87.1",
+    "@earendil-works/pi-ai": ">=0.87.1",
+    "@earendil-works/pi-coding-agent": ">=0.87.1",
+    "@earendil-works/pi-tui": ">=0.87.1"
   },
   "peerDependenciesMeta": {
     "@earendil-works/pi-agent-core": {

package/runner/arguments.ts

@@ -3,6 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../agents.js";
 import { SUBAGENT_FALLBACK_MODEL_ENV } from "./constants.js";
+import { childExtensionArgs, excludedExtensions } from "./extension-policy.js";
 function resolveExtensionArg(value: string): string {
   if (!value) return value;
   if (value.startsWith("npm:") || value.startsWith("git:")) return value;
@@ -202,6 +203,12 @@ function parseInheritedCliArgs(argv: string[]): InheritedCliArgs {
 /** Cached once — process.argv is immutable at runtime */
 const _inheritedCliArgs = parseInheritedCliArgs(process.argv);
 
+export async function resolveChildExtensionArgs(cwd: string, projectTrusted?: boolean): Promise<string[] | undefined> {
+  const excludes = excludedExtensions();
+  if (excludes.length === 0) return undefined;
+  return childExtensionArgs(_inheritedCliArgs.extensionArgs, cwd, projectTrusted, excludes);
+}
+
 export function resolveSubagentModel(agentModel?: string, currentParentModel?: string): string | undefined {
   // The active parent model is authoritative. Agent frontmatter is retained as
   // a compatibility fallback only for callers that cannot supply live context.
@@ -219,6 +226,7 @@ export function buildPiArgs(
   fallbackModelOverride?: string,
   rawPrompt = false,
   selection?: { provider: string; model: string; thinking: string },
+  extensionArgsOverride?: string[],
 ): { args: string[]; prompt: string } {
   // A Jev-selected provider must not inherit a conflicting provider or its CLI credential.
   const proxyArgs = selection
@@ -227,7 +235,15 @@ export function buildPiArgs(
           !["--provider", "--api-key"].includes(arg) && !["--provider", "--api-key"].includes(args[index - 1]),
       )
     : _inheritedCliArgs.alwaysProxy;
-  const args: string[] = ["--mode", "rpc", ..._inheritedCliArgs.extensionArgs, ...proxyArgs];
+  const args: string[] = [
+    "--mode",
+    "rpc",
+    ...(extensionArgsOverride ? [] : _inheritedCliArgs.extensionArgs),
+    ...proxyArgs,
+  ];
+  // Keep the resolved trust decision after forwarded startup flags. Extension filtering
+  // must never interpret another flag's value (such as a prompt or credential) as a flag.
+  if (extensionArgsOverride) args.push(...extensionArgsOverride);
 
   if (sessionDir) args.push("--session-dir", sessionDir);
   if (resumeSession) args.push("--continue");

package/runner/extension-policy.ts

@@ -0,0 +1,174 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import {
+  DefaultPackageManager,
+  SettingsManager,
+  getAgentDir,
+  type ResolvedResource,
+} from "@earendil-works/pi-coding-agent";
+
+export function excludedExtensions(env: NodeJS.ProcessEnv = process.env): string[] {
+  return [
+    ...new Set(
+      [env["PI-SUBAGENT-EXCLUDE-EXTENSIONS"], env.PI_SUBAGENT_EXCLUDE_EXTENSIONS]
+        .flatMap((value) => (value ?? "").split(","))
+        .map((value) => value.trim())
+        .filter(Boolean),
+    ),
+  ];
+}
+
+export function subagentDisabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return [env.PI_SUBAGENT_DISABLED, env["PI-SUBAGENT-DISABLED"]].some(
+    (value) => value === "1" || value?.toLowerCase() === "true",
+  );
+}
+
+function resolvedPath(value: string, cwd: string): string {
+  const absolute = path.resolve(cwd, value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value);
+  return fs.existsSync(absolute) ? fs.realpathSync(absolute) : absolute;
+}
+
+function npmName(source: string): string | undefined {
+  const spec = source.replace(/^npm:/, "");
+  return /^(?:@[^/\s]+\/)?[^/@\s]+(?:@[^\s]+)?$/.test(spec)
+    ? spec.slice(0, spec.indexOf("@", 1) === -1 ? undefined : spec.indexOf("@", 1))
+    : undefined;
+}
+
+function manifestName(directory: string): string | undefined {
+  const parsed: unknown = JSON.parse(fs.readFileSync(path.join(directory, "package.json"), "utf8"));
+  return typeof parsed === "object" && parsed !== null && "name" in parsed && typeof parsed.name === "string"
+    ? parsed.name
+    : undefined;
+}
+
+function packageName(resource: ResolvedResource, cwd: string, agentDir: string): string | undefined {
+  if (resource.metadata.source.startsWith("npm:")) return npmName(resource.metadata.source);
+  if (resource.metadata.origin === "package" && resource.metadata.baseDir) {
+    const base = resolvedPath(resource.metadata.baseDir, cwd);
+    if (fs.existsSync(path.join(base, "package.json"))) return manifestName(base);
+  }
+
+  const resourcePath = resolvedPath(resource.path, cwd);
+  let directory = fs.statSync(resourcePath).isDirectory() ? resourcePath : path.dirname(resourcePath);
+  const boundaries = new Set(
+    [
+      cwd,
+      agentDir,
+      path.join(cwd, ".pi"),
+      path.join(cwd, ".pi/extensions"),
+      path.join(agentDir, "extensions"),
+      os.homedir(),
+    ].map((entry) => resolvedPath(entry, cwd)),
+  );
+  // A loose hook belongs to neither the surrounding workspace nor Pi's config
+  // directory. Resolve symlinks first, and stop at the nearest manifest even if unnamed.
+  while (!boundaries.has(directory) && directory !== path.dirname(directory)) {
+    if (fs.existsSync(path.join(directory, "package.json"))) return manifestName(directory);
+    directory = path.dirname(directory);
+  }
+  return undefined;
+}
+
+function isExcluded(resource: ResolvedResource, excludes: string[], cwd: string, agentDir: string): boolean {
+  const resourcePath = resolvedPath(resource.path, cwd);
+  const name = packageName(resource, cwd, agentDir);
+  return excludes.some((exclude) => {
+    if (
+      (resource.metadata.origin === "package" && exclude === resource.metadata.source) ||
+      (name !== undefined && npmName(exclude) === name)
+    )
+      return true;
+    const excludedPath = resolvedPath(exclude, cwd);
+    return resourcePath === excludedPath || resourcePath.startsWith(`${excludedPath}${path.sep}`);
+  });
+}
+
+function isRemote(source: string): boolean {
+  return /^(?:npm:|git:|https?:\/\/|git@|ssh:)/.test(source);
+}
+
+/** Resolve before loading: filtering Extension objects would already have executed their factories. */
+export async function childExtensionArgs(
+  args: string[],
+  cwd: string,
+  projectTrusted = false,
+  excludes = excludedExtensions(),
+  agentDir = getAgentDir(),
+): Promise<string[]> {
+  if (excludes.length === 0) return args;
+  const rest: string[] = [];
+  const explicit: string[] = [];
+  let noExtensions = false;
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "-ne" || arg === "--no-extensions") noExtensions = true;
+    else if (arg === "-e" || arg === "--extension") {
+      const source = args[++index];
+      if (!source) throw new Error("Missing explicit extension source");
+      explicit.push(source);
+    } else if (["-a", "--approve", "-na", "--no-approve"].includes(arg)) {
+      // The live parent's decision is authoritative, not stale startup flags.
+    } else rest.push(arg);
+  }
+  const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
+  if (settingsManager.drainErrors().length > 0) throw new Error("Cannot resolve child extensions: invalid Pi settings");
+  const manager = new DefaultPackageManager({ cwd, agentDir, settingsManager });
+  const automatic = noExtensions ? [] : (await manager.resolve(async () => "error")).extensions;
+  const explicitResources: ResolvedResource[] = [];
+  for (const source of explicit) {
+    let resolved;
+    if (isRemote(source)) {
+      // resolveExtensionSources can install or refresh remote sources. Use the read-only
+      // missing-source policy instead; temporary-only remote installs must be installed normally first.
+      const explicitSettings = SettingsManager.inMemory(
+        {
+          npmCommand: settingsManager.getGlobalSettings().npmCommand,
+          packages: [source],
+        },
+        { projectTrusted: false },
+      );
+      const explicitManager = new DefaultPackageManager({ cwd, agentDir, settingsManager: explicitSettings });
+      if (!explicitManager.getInstalledPath(source, "user")) {
+        throw new Error(`Explicit extension source must be installed before exclusion filtering: ${source}`);
+      }
+      resolved = await explicitManager.resolve(async () => "error");
+      for (const kind of ["extensions", "skills", "prompts", "themes"] as const) {
+        resolved[kind] = resolved[kind].filter(
+          (resource) => resource.metadata.origin === "package" && resource.metadata.source === source,
+        );
+      }
+      if (Object.values(resolved).every((resources) => resources.length === 0)) {
+        throw new Error(`No installed resources match explicit extension source: ${source}`);
+      }
+    } else {
+      const local = resolvedPath(source, cwd);
+      if (!fs.existsSync(local)) throw new Error(`Missing explicit extension source: ${source}`);
+      resolved = await manager.resolveExtensionSources([local], { temporary: true });
+    }
+    explicitResources.push(...resolved.extensions);
+    for (const [kind, flag] of [
+      ["skills", "--skill"],
+      ["prompts", "--prompt-template"],
+      ["themes", "--theme"],
+    ] as const) {
+      for (const resource of resolved[kind]) if (resource.enabled) rest.push(flag, resource.path);
+    }
+  }
+  const kept = new Set<string>();
+  for (const resource of [...explicitResources, ...automatic]) {
+    if (!resource.enabled || isExcluded(resource, excludes, cwd, agentDir)) continue;
+    if (!fs.statSync(resource.path).isFile()) {
+      throw new Error(`Extension source did not resolve to files: ${resource.path}. Pass its entry point explicitly.`);
+    }
+    kept.add(resource.path);
+  }
+  return [
+    ...rest,
+    projectTrusted ? "--approve" : "--no-approve",
+    "--no-extensions",
+    ...[...kept].flatMap((entry) => ["-e", entry]),
+  ];
+}

package/runner/options.ts

@@ -17,6 +17,8 @@ export type RunningSubagentStartedCallback = (handle: RunningSubagentHandle) =>
 export interface RunAgentOptions {
   /** Working directory inherited by every subagent process. */
   cwd: string;
+  /** Effective trust for this cwd; absent SDK callers fail closed. */
+  projectTrusted?: boolean;
   /** All available agent configs. */
   agents: AgentConfig[];
   /** Name of the agent to run. */

package/runner/parallel.ts

@@ -40,6 +40,7 @@ export async function executeParallelSubprocess(
     namesFile?: string;
     budgets?: Array<SubagentBudget | undefined>;
     smartDecision?: RunAgentOptions["smartDecision"];
+    projectTrusted?: boolean;
   },
 ): Promise<{
   content: Array<{ type: "text"; text: string }>;
@@ -123,6 +124,7 @@ export async function executeParallelSubprocess(
       try {
         result = await runAgentSubprocess({
           cwd: defaultCwd,
+          projectTrusted: extras?.projectTrusted,
           agents,
           agentName: t.agent,
           task: t.task,

package/runner/single.ts

@@ -7,7 +7,7 @@ import {
   STARTUP_RETRY_BASE_BACKOFF_MS,
 } from "./constants.js";
 import type { RunAgentOptions } from "./options.js";
-import { buildPiArgs } from "./arguments.js";
+import { buildPiArgs, resolveChildExtensionArgs } from "./arguments.js";
 import { writePromptToTempFile, cleanupTempDir, sessionDirExists } from "./files.js";
 import { appendBoundedStderr, priorDescendantUsage, endedWithSyntheticResumeFailure } from "./result.js";
 import { runAttempt } from "./attempt.js";
@@ -112,6 +112,7 @@ export async function runAgentSubprocess(opts: RunAgentOptions): Promise<SingleR
   }
 
   try {
+    const extensionArgs = await resolveChildExtensionArgs(opts.cwd, opts.projectTrusted);
     const selection = await selectSmartDecision(
       opts.smartDecision,
       { systemPrompt: agent.systemPrompt, task },
@@ -137,6 +138,7 @@ export async function runAgentSubprocess(opts: RunAgentOptions): Promise<SingleR
       fallbackModel,
       opts.rawPrompt === true,
       selection,
+      extensionArgs,
     );
     const prompt =
       result.budget && readBudget(result.budget).limit > 0