opensec-pi-subagents 0.20.0 → 0.20.2

package/CHANGELOG.md

@@ -7,44 +7,90 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.20.0] - 2026-10-04
+## [0.20.2] - 2026-10-16
 
-First public release of OpenSec's Bun build, under the Apache License 2.0 (upstream notices in NOTICE). The code is
-that of the Bun build below; the package is renamed `opensec-pi-subagents` and installs with
-`pi-bolt install npm:opensec-pi-subagents`.
+### Changed
+
+- **Every project is trusted again by default**, as before 0.20.1: subagents load a project's `.pi` extensions and settings, and the extension uses its agents, skills, workflows and `subagents.json`, whatever Pi decided for the folder. To follow Pi's project trust decision instead (0.20.1's behaviour), set `"projectTrust": "pi"` in the global `~/.pi/agent/subagents.json`.
 
-## [0.19.5] - 2026-10-03 (Bun build)
+## [0.20.1] - 2026-10-16
 
 ### Fixed
-- **Schedules longer than ~24.8 days** fired every millisecond (or at once for `+30d` / far ISO times), each fire spawning an agent past `maxConcurrent`. Long delays now run on chained timers; intervals must be at least 1 minute (capped at `3650d`), and a fire is skipped while the job's previous agent is still queued or running.
-- **Worktree work lost** when `git status` or `rev-parse` timed out or failed: the worktree is now removed only when status succeeded, was empty and HEAD is unchanged; anything else keeps it and names its path. Preservation commits run with `commit.gpgsign=false`; worktrees live in a private `0700` temp dir.
-- **Quitting during a worktree agent** no longer strands its changes: shutdown waits (up to 15 s) for stopped agents to save them. A failed agent's result now says where its changes went.
-- **Stopping an agent before its session existed** was lost and the agent ran to completion; it is now aborted before the first prompt.
-- **`ext:` tool narrowing** is now enforced on Pi 1.0 deferred/codemode tool-to-tool calls too.
-- `get_subagent_result` with `wait: true` no longer reports "still running" while the worktree is being created.
-- A corrupt schedule file is kept as `.corrupt` instead of overwritten; the scheduler re-checks the session after croner loads.
-- **Workflows:** an async expression in `meta` could freeze Pi forever (also while the call was still streaming); the call-line name cache grew with every streamed prefix (~1 GB for a 95 KB script); a `log()` flood crashed progress handling; children of a finished run kept running; a paused run could be resumed while alive; script paths that are not regular files (FIFO, `/dev/zero`) blocked or exhausted memory; schema `pattern`s with nested quantifiers are refused; top-level script errors name the script line.
+
+- **Resume.** A finished, stopped or failed agent stays resumable by the model as long as its session file exists, not 10 minutes: the Agent tool, `@handle`, nested and workflow `agent({resume})` reopen it from the file under the same id, with its own model, thinking level, working directory, worktree and `isolated` setting. Agents are rebuilt after a restart, `/resume`, `/fork` or `/reload`. A worktree agent resumes in its worktree, recreated from its branch. `max_turns`, grace turns and the tool watchdog apply to resumed runs. Foreground results give the model the agent id. A resume waits for a stopped run to finish.
+- **Stopping.** An agent whose tool ignores the abort signal is still stopped: its slot is freed and queued agents start, a foreground call returns, and the watchdog gives up on it instead of waiting forever. Agents stopped while queued or while their worktree is made complete like any other stop.
+- **Crashes.** An `@mention` racing `/new`, `/resume` or `/reload`, an error in a completion handler, and scheduler fires can no longer end Pi's process; the schedule lock no longer blocks Pi.
+- **Project trust.** Subagents follow Pi's decision about a project folder: in an untrusted folder they load none of its extensions or settings, and the extension ignores its agents, skills, workflows and `subagents.json`. A project agent that replaces a built-in is shown.
+- **Explore and Plan** are read-only by their tools (`read`, `grep`, `find`, `ls`), not only by their prompt.
+- **Worktrees.** Cleanup no longer deletes ignored output, nested repositories or stashes while reporting "no changes"; worktrees left by a crash are committed to a `-recovered` branch; workflows report every child's branch. Gate commands and git calls end their whole process tree on a timeout.
+- **Usage.** Workflow resumes are not counted twice; background, workflow and nested spend reaches the parent.
+
+### Performance
+
+- The widget and fleet list share one refresh timer, which stops while nothing runs; the transcript viewer builds incrementally (500 messages: 85 ms to 0.6 ms a frame without a JIT); the widget formats only the rows it shows; foreground progress is sent once a frame, not per token; per-tool-call scope checks and git environment checks are cached; finished agents' sessions are released 60 s after they settle; transcript writes are batched.
+- Tests clean up their temporary folders.
+
+## [0.19.11] - 2026-10-07
+
+### Fixed
+
+- **The main agent's commands had no time limit either.** Pi's `bash` has no default timeout, so an unbounded `grep -r … /` or a server started in the foreground held the main agent's turn until someone noticed. A main-agent `bash` call that sets no timeout now gets `toolTimeoutSeconds` (default 1200 s, `0` = off) and is killed at it, with the timeout reported to the model. A timeout the main agent supplies, even a longer one, is kept; subagents stay capped at the limit.
+
+## [0.19.10] - 2026-10-07
+
+### Fixed
+
+- **A hung tool call held a subagent forever.** Turn limits only count finished turns, and a turn whose tool never returns (a `find /`, a server that never exits) never finishes, so `max_turns` and the grace turns could not stop it. Subagent `bash` calls now get a timeout (the new `toolTimeoutSeconds` setting, default 1200 s, `0` = off): Pi kills the command's whole process tree and the agent sees the timeout and carries on. Any other tool still running a minute past the limit is stopped by a watchdog and the agent is resumed with a note to split the work into bounded steps, up to 3 times per run (nested `Agent` / workflow calls are exempt). Resumed agents get the same protection.
+
+## [0.19.9] - 2026-10-03
+
+### Fixed
+
+- **No load warning on Pi 1.0.** `@sinclair/typebox` and `typebox` were listed in `dependencies`, which Pi 1.0 reports as host-provided packages that can bypass its extension loader. They are now optional `"*"` peer dependencies (Pi supplies both on 0.87.1 and 1.0) and stay devDependencies for tests and typecheck.
+
+### Changed
+
+- The development pins of `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent` and `@earendil-works/pi-tui` move from 0.84.2 to 1.0.0, so `npm test` and `prepublishOnly` run the e2e tests that need Pi 1.0 APIs.
+
+## [0.19.8] - 2026-10-03
+
+The Node build now carries the same fixes as the Bun build (0.19.5-bun.x).
+
+### Fixed
+- **Workflows:** an async expression in `meta` could freeze Pi for good (also while the call was still streaming); the call-line name cache grew with every streamed prefix (~1 GB for a 95 KB script); a `log()` flood crashed progress handling; children of a finished run kept running; a paused run could be resumed while still alive; script paths that are not regular files (FIFO, `/dev/zero`) blocked or exhausted memory; schema `pattern`s with nested quantifiers are refused; top-level script errors name the script line.
 - **Terminal escapes** (OSC 52 clipboard writes, screen clears, CR) in child output, gate output and logs are stripped before rendering.
-- The agents widget timer is stopped on session shutdown.
+- **`ext:` tool narrowing** is enforced on Pi 1.0 deferred/codemode tool-to-tool calls too.
+- `get_subagent_result` with `wait: true` no longer reports "still running" while the worktree is being created.
+- A corrupt schedule file is kept as `.corrupt` instead of overwritten, and waiting for the schedule lock no longer spins a core.
+- A canceled session switch no longer stops the scheduler; a foreground resume can be stopped.
+- The agents widget timer stops on session shutdown.
+- Refuses to load next to `opensec-pi-swarm` (same tools and events); the first one loaded stays active and the other warns once.
 
 ### Changed
 - Workflow scripts are documented as running with full host access: the vm is not a sandbox.
-- Refuses to load next to another extension built on this code that registers the same tools and events; the first one loaded stays active and the other warns once.
-- A canceled session switch no longer stops the scheduler; a foreground resume is stoppable (fresh abort controller, parent-signal wiring).
+- README: pi-bolt users install with `pi-bolt install npm:@kushalkhemka/opensec-pi-subagents@bun`; note on the `~/.pi/agent` directory shared by pi-bolt and Node Pi.
 
-## [0.19.4] - 2026-10-02 (Bun build)
+## [0.19.7] - 2026-10-03
 
-The Bun build. Same tools, commands, settings and file locations as 0.19.4.
+### Changed
+- Docs: corrected README facts (Pi compatibility verified on Pi 0.87.1 and 1.0.0). No code changes.
+- License: the package is now proprietary (`UNLICENSED`); LICENSE keeps the upstream MIT notice for the included `@tintinweb/pi-subagents` code.
+
+## [0.19.6] - 2026-10-03
 
 ### Changed
-- Ships a prebuilt bundle (`dist-bun/`) with no runtime dependencies: a small ESM loader plus the extension as a CommonJS core loaded with Bun's native `require`, so Pi's loader never transpiles it. `nanoid` is replaced by `crypto.getRandomValues` (same id format), journal keys use `Bun.CryptoHasher` (same keys), croner and the workflow engine and inspector are initialized on first use.
+- Docs: README restyle (logo, install for Node and Bun). No code changes.
+
+## [0.19.5] - 2026-10-03
 
 ### Fixed
-- Scheduling an `Agent` call with a cron expression left a live croner timer behind (validation scheduled a no-op job and never stopped it): `pi -p` never exited, and interactive sessions kept one extra 30 s timer per validation.
-- `@agent` mentions on Pi 1.0: the conversation clone assigned the now read-only `agent.state.systemPrompt`, so every clone failed and every mention fell back to a direct start with a warning. The clone now forces the live prompt per request and carries the conversation as session entries.
-- Subagent transcripts (`.output` files) on Pi 1.0 duplicated the prompt and recorded system messages as `toolResult` entries.
-- Workflow script line numbers in stack traces were one line off on Bun.
-- Worktree isolation deleted an agent's edits when the preservation commit failed (e.g. no git identity configured): the worktree was force-removed and the result reported no changes. The commit is retried with a placeholder author, and work that still cannot be saved keeps its worktree, whose path is named in the result.
+- **Long schedules no longer fire every millisecond.** Timer delays above 2^31-1 ms (about 24.8 days) are clamped to 1 ms, so a `30d` interval spawned an agent every millisecond (each outside the concurrency queue) and a `+30d` or far ISO one-shot fired at once. Schedules now chain timers of at most 24 days. Intervals must be at least `1m` (stored shorter intervals are raised to one minute), intervals and relative delays are capped at `3650d`, and a fire is skipped (`subagents:scheduled` event `skipped`) while the job's previous agent is still running.
+- **Validating a cron schedule no longer leaves a timer running.** Every validation armed a croner job that was never stopped, so `pi -p` never exited once a cron job had been scheduled.
+- **Worktree agents no longer lose their work on a failed cleanup.** With no git identity the preservation commit failed and the worktree was force-removed while reporting no changes; a `git status` or `rev-parse` timeout did the same. The commit now retries with a placeholder author and runs with `commit.gpgsign=false`, and the worktree is removed only when it provably holds nothing; otherwise it is kept and its path reported, also when the agent itself failed. Worktrees are created inside a private (0700) temporary directory.
+- **Quitting waits up to 15 s for stopped worktree agents to save their changes** to a branch, instead of racing the process exit.
+- **A stop that lands before a subagent's session exists is honored.** An abort during startup (or a parent interrupt before a queued agent started) was lost and the agent ran its whole task.
+- **Pi 1.0: `@agent` mentions start the conversation clone again.** Assigning the clone's system prompt threw on Pi 1.0, so every mention fell back to a direct start.
+- **Pi 1.0: subagent transcripts no longer repeat the system prompt or record system messages as tool results.**
 
 ## [0.19.2] - 2026-09-26
 

package/NOTICE

@@ -30,29 +30,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
---------------------------------------------------------------------------------
-croner 10.0.1 (https://github.com/hexagon/croner), bundled in dist-bun/core.cjs
-
-The MIT License (MIT)
-
-Copyright (c) 2015-2021 Hexagon <github.com/Hexagon>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-

package/README.md

@@ -68,6 +68,12 @@ Agent({ subagent_type: "Explore", prompt: "Find authentication code", descriptio
 | `/agents` | Inspect and manage agents: live conversations, settings, workflows and scheduled jobs. |
 | `@<agent> <message>` | With agent mentions enabled, sends a message to that agent, for example `@explore check the RPC path`. A finished agent can be resumed. |
 
+### Resuming agents
+
+A finished, stopped or failed agent can be continued with `Agent({ resume: "<id>", prompt: "..." })`: every result ends
+with the agent's ID. It keeps its whole conversation, model, thinking level, working directory and worktree. An agent stays
+resumable as long as its session file exists, also after Pi-Bolt restarts or the session is resumed, forked or reloaded.
+
 ### Custom agents
 
 Put agent definitions in `.pi/agents/<name>.md` in a project, or in the global Pi agents directory.
@@ -109,6 +115,15 @@ locations are those of `@tintinweb/pi-subagents`.
 
 Based on `@tintinweb/pi-subagents` 0.19:
 
+- **0.20.2:** every project is trusted by default, as before 0.20.1. To have subagents follow Pi's project trust decision, set `"projectTrust": "pi"` in `~/.pi/agent/subagents.json`.
+- **0.20.1:**
+  - Resume works for as long as an agent's session file exists, not 10 minutes, and after a restart; worktree agents resume in their worktree; `max_turns` and the tool watchdog apply to resumed runs.
+  - An agent whose tool ignores a stop is still stopped and frees its slot; three ways to crash Pi are fixed.
+  - Explore and Plan are read-only by their tools (`read`, `grep`, `find`, `ls`).
+  - Worktree cleanup no longer loses ignored output, nested repositories or stashes; timed-out gates end their whole process tree.
+  - Much less work per frame: one refresh timer that stops while idle, an incremental transcript viewer, a widget that formats only the rows it shows.
+- **Tool time limits:** `bash` calls of subagents and of the main agent get `toolTimeoutSeconds` (default 1200 s), and a watchdog stops other hung tools.
+
 - **Inheritance and caching:**
   - Agents inherit the parent's model and thinking level.
   - Agent discovery and configuration are cached and revalidated by file metadata.

package/SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-This document explains the security model behind `opensec-pi-subagents` and
+This document explains the security model behind `@kushalkhemka/opensec-pi-subagents` and
 where the boundaries are.
 
 `pi-subagents` is a [pi](https://pi.dev) extension. It spawns and orchestrates
@@ -29,10 +29,10 @@ coding agent and its sub-agents trivially, and this cannot be protected against.
 
 ## Reporting a Vulnerability
 
-If you believe you found a security vulnerability in `opensec-pi-subagents`, please
-report it privately through GitHub's
-[private vulnerability reporting](https://github.com/opensec-git/Pi-Bolt/security/advisories/new),
-not in public issues. Issues that also affect the upstream project may be reported to it as well.
+If you believe you found a security vulnerability in `pi-subagents`, please
+contact the maintainer of `@kushalkhemka/opensec-pi-subagents` privately through
+your existing OpenSec support channel. Do not send fork-specific reports to
+the upstream project or include sensitive details in public issues.
 
 Please include: