pi-background-tasks 2.1.4 → 2.3.0

package/src/core/delegate/runner.ts

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { canonicalJson } from '../attested-pi-run.js';
 import { replaceFileDurable } from '../durable-fs.js';
+import { resolveAnthropicAttributionExtensionPath } from '../anthropic-attribution-path.js';
 import { join } from 'node:path';
 import { DelegateArtifactStore, discardDelegateArtifactRoot } from './artifacts.js';
 import {
@@ -20,6 +21,7 @@ import { verifyDelegateResultPackage, type VerifiedDelegateResult } from './resu
 import {
   DelegateError,
   type DelegateAutoDeliverMode,
+  type DelegateExtensionMode,
   type DelegateResultPackageV1,
 } from './types.js';
 import type { DelegateTaskFacts, DelegateTaskOutcome } from '../common.js';
@@ -48,7 +50,9 @@ export interface PrepareDelegateLaunchInput extends DelegatePreflightInput {
   cwd: string;
   sessionId: string | undefined;
   autoDeliver: DelegateAutoDeliverMode;
+  extensionMode: DelegateExtensionMode;
   childExtensionPath?: string | undefined;
+  attributionExtensionPath?: string | undefined;
   env?: NodeJS.ProcessEnv | undefined;
   now?: (() => Date) | undefined;
 }
@@ -68,6 +72,22 @@ export async function prepareDelegateLaunch(
   // its child guard must refuse rather than spawn an unguarded child.
   const childExtensionPath =
     input.childExtensionPath ?? resolveDelegateChildExtensionPath();
+  let attributionExtensionPath: string | undefined;
+  if (input.route.provider === 'anthropic') {
+    try {
+      attributionExtensionPath =
+        input.attributionExtensionPath ?? resolveAnthropicAttributionExtensionPath();
+    } catch (error) {
+      throw new DelegateError(
+        `Anthropic delegate attribution extension could not be resolved: ${error instanceof Error ? error.message : String(error)}`,
+        {
+          code: 'delegate_isolation_unsupported',
+          childCreated: false,
+          remediation: ['Reinstall the package; Anthropic delegates require attribution.'],
+        },
+      );
+    }
+  }
 
   const preflight = preflightDelegateLaunch(input);
 
@@ -78,6 +98,7 @@ export async function prepareDelegateLaunch(
     sessionId: input.sessionId,
     childSessionId: preflight.childSessionId,
     childSessionDir: '',
+    extensionMode: input.extensionMode,
     route: input.route,
     limits: preflight.limits,
     seedSha256: preflight.seed.sha256,
@@ -107,9 +128,11 @@ export async function prepareDelegateLaunch(
     const argv = buildDelegateChildArgv({
       route: input.route,
       capability: input.capability,
+      extensionMode: input.extensionMode,
       childSessionId: preflight.childSessionId,
       childSessionDir: childSessionDirAbs,
       childExtensionPath,
+      attributionExtensionPath,
       systemPrompt: preflight.childSystemPrompt,
     });
     const env = delegateChildEnv(
@@ -138,6 +161,7 @@ export async function prepareDelegateLaunch(
         family: preflight.plan.route.family,
         rate_source: preflight.plan.route.rate_source,
       },
+      extensionMode: input.extensionMode,
       autoDeliver: input.autoDeliver,
     };
     const stdinBytes = Buffer.from(preflight.childPrompt, 'utf8');

package/src/core/delegate/seed.ts

@@ -22,6 +22,7 @@ import {
   type DelegateContextPolicyDescriptor,
   type DelegateConversationProjection,
   type DelegateLedgerV1,
+  type DelegateExtensionMode,
   type DelegateLimits,
   type DelegatePinnedRoute,
   type DelegateSeedV1,
@@ -34,6 +35,7 @@ export interface BuildDelegateSeedOptions {
   toolCallId: string | undefined;
   directive: string;
   capability: DelegateCapability;
+  extensionMode: DelegateExtensionMode;
   route: DelegatePinnedRoute;
   limits: DelegateLimits;
 }
@@ -167,6 +169,7 @@ export function buildDelegateSeed(
     launch_nonce: options.launchNonce,
     cwd: ctx.cwd,
     capability: options.capability,
+    extension_mode: options.extensionMode,
     route: options.route,
     parent_system_prompt: ctx.getSystemPrompt(),
     parent_leaf_id: snapshot.leafId,
@@ -296,6 +299,14 @@ function rebuildSeed(record: Record<PropertyKey, unknown>, taskId: string): Dele
       taskId,
     });
   }
+  const extensionMode = requireString(record, 'extension_mode', taskId);
+  if (extensionMode !== 'isolated' && extensionMode !== 'ambient') {
+    throw new DelegateError(`delegate seed extension mode ${extensionMode} is not recognised`, {
+      code: 'seed_hash_mismatch',
+      childCreated: true,
+      taskId,
+    });
+  }
   const routeRecord = requireRecord(record, 'route', taskId);
   const routeOrigin = requireString(routeRecord, 'origin', taskId);
   if (routeOrigin !== 'parent_current' && routeOrigin !== 'explicit') {
@@ -378,6 +389,7 @@ function rebuildSeed(record: Record<PropertyKey, unknown>, taskId: string): Dele
     launch_nonce: requireString(record, 'launch_nonce', taskId),
     cwd: requireString(record, 'cwd', taskId),
     capability,
+    extension_mode: extensionMode,
     route,
     parent_system_prompt: requireString(record, 'parent_system_prompt', taskId),
     parent_leaf_id: parentLeafId,

package/src/core/delegate/types.ts

@@ -12,14 +12,14 @@ import type {
   ProjectionEntry,
 } from '../context/visible-conversation-v2.js';
 
-export const DELEGATE_SEED_SCHEMA_VERSION = 'pi-background-tasks.delegate-seed.v1' as const;
+export const DELEGATE_SEED_SCHEMA_VERSION = 'pi-background-tasks.delegate-seed.v2' as const;
 export const DELEGATE_LEDGER_SCHEMA_VERSION = 'pi-background-tasks.delegate-ledger.v1' as const;
 export const DELEGATE_RESULT_PACKAGE_SCHEMA_VERSION =
   'pi-background-tasks.delegate-result.v1' as const;
 export const DELEGATE_RECEIPT_SCHEMA_VERSION = 'pi-background-tasks.delegate-receipt.v1' as const;
 export const DELEGATE_BUDGET_PLAN_SCHEMA_VERSION =
   'pi-background-tasks.delegate-budget-plan.v2' as const;
-export const DELEGATE_MANIFEST_SCHEMA_VERSION = 'pi-background-tasks.delegate-manifest.v1' as const;
+export const DELEGATE_MANIFEST_SCHEMA_VERSION = 'pi-background-tasks.delegate-manifest.v2' as const;
 
 /**
  * Delegate's own context policy id. It shares the frozen
@@ -35,6 +35,13 @@ export const DELEGATE_RESULT_TOOL_NAME = 'bg_result';
 export const DELEGATE_CAPABILITIES = ['inspect'] as const;
 export type DelegateCapability = (typeof DELEGATE_CAPABILITIES)[number];
 
+/**
+ * Controls only Pi's ambient extension discovery for delegate children.
+ * Tool and project-resource restrictions remain independently enforced.
+ */
+export const DELEGATE_EXTENSION_MODES = ['isolated', 'ambient'] as const;
+export type DelegateExtensionMode = (typeof DELEGATE_EXTENSION_MODES)[number];
+
 export const DELEGATE_AUTO_DELIVER_MODES = ['never', 'when_small', 'always'] as const;
 export type DelegateAutoDeliverMode = (typeof DELEGATE_AUTO_DELIVER_MODES)[number];
 
@@ -110,6 +117,7 @@ export interface DelegateSeedV1 {
   launch_nonce: string;
   cwd: string;
   capability: DelegateCapability;
+  extension_mode: DelegateExtensionMode;
   route: DelegatePinnedRoute;
   parent_system_prompt: string;
   parent_leaf_id: string | null;

package/src/core/fusion/config.ts

@@ -5,7 +5,7 @@ import { getAgentDir } from '@earendil-works/pi-coding-agent';
 import type { Api, Model } from '@earendil-works/pi-ai';
 import { isJsonObject, parseJsonText, type JsonObject } from '../common.js';
 import { replaceFileDurable } from '../durable-fs.js';
-import { CLAUDE_CODE_200K_SUBSCRIPTION_CONTEXT_WINDOW } from './anthropic-attribution.js';
+import { CLAUDE_CODE_200K_SUBSCRIPTION_CONTEXT_WINDOW } from '../anthropic-attribution.js';
 import {
   FUSION_MODEL_CONFIG_SCHEMA_VERSION,
   FusionError,

package/src/core/fusion/pi-child.ts

@@ -1,8 +1,7 @@
 import { spawn as nodeSpawn, type SpawnOptions } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { constants, existsSync, readFileSync } from 'node:fs';
+import { constants, existsSync } from 'node:fs';
 import { open } from 'node:fs/promises';
-import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
@@ -73,6 +72,7 @@ import {
   resolvePiLaunch,
   type PiLaunchDependencies,
 } from '../pi-launch.js';
+import { resolveAnthropicAttributionExtensionPath } from '../anthropic-attribution-path.js';
 
 // The response cap now applies to one final full answer, not cumulative Pi JSON events.
 export const FUSION_CHILD_STDOUT_LIMIT_BYTES = 32 * 1024 * 1024;
@@ -274,21 +274,6 @@ export function fusionPiChildEnv(
   return out;
 }
 
-export function resolveFusionAnthropicAttributionExtensionPath(
-  moduleUrl = import.meta.url,
-  pathExists: (path: string) => boolean = existsSync,
-): string {
-  const modulePath = fileURLToPath(moduleUrl);
-  const extension = modulePath.endsWith('.ts')
-    ? 'anthropic-attribution.ts'
-    : 'anthropic-attribution.js';
-  const candidate = resolve(dirname(modulePath), extension);
-  if (!pathExists(candidate)) {
-    throw new Error(`Fusion Anthropic attribution extension is missing: ${candidate}`);
-  }
-  return candidate;
-}
-
 export function resolveFusionChildExtensionPath(
   moduleUrl = import.meta.url,
   pathExists: (path: string) => boolean = existsSync,
@@ -303,109 +288,10 @@ export function resolveFusionChildExtensionPath(
 }
 
 /**
- * Provider whose children require the Anthropic system-prompt sanitizer.
- *
- * Pi's own system prompt contains documentation lines that Anthropic rejects, so a
- * Claude child launched without the sanitizer fails at the provider rather than
- * producing an answer. The parent session loads the sanitizer through ordinary
- * extension discovery, but Fusion children run with `--no-extensions` for
- * isolation and therefore inherit nothing; the sanitizer must be re-supplied
- * explicitly per child.
+ * Provider whose isolated children require the package-owned attribution and
+ * exact-match system-prompt sanitization extension.
  */
 export const FUSION_SANITIZED_PROVIDER = 'anthropic';
-export const FUSION_ANTHROPIC_SANITIZER_PACKAGE = '@ravshansbox/pi-anthropic-sps';
-const FUSION_ANTHROPIC_SANITIZER_MANIFEST = `${FUSION_ANTHROPIC_SANITIZER_PACKAGE}/package.json`;
-
-export interface FusionSanitizerDependencies {
-  resolvePackageJson?: ((specifier: string) => string) | undefined;
-  readManifest?: ((path: string) => string) | undefined;
-  pathExists?: ((path: string) => boolean) | undefined;
-}
-
-function manifestExtensionEntry(manifestText: string, manifestPath: string): string {
-  let parsed: unknown;
-  try {
-    parsed = parseJsonText(manifestText);
-  } catch (error) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  if (!isJsonObject(parsed)) {
-    throw new FusionError(`Anthropic sanitizer manifest ${manifestPath} must be an object`, {
-      code: 'orchestration_failed',
-      childCreated: false,
-    });
-  }
-  const pi = parsed['pi'];
-  if (!isJsonObject(pi)) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} has no "pi" section declaring its extension`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  const extensions = pi['extensions'];
-  if (!Array.isArray(extensions) || extensions.length === 0) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} declares no pi.extensions entries`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  const [entry] = extensions;
-  if (typeof entry !== 'string' || entry.trim().length === 0) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} pi.extensions[0] must be a non-blank string`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  return entry;
-}
-
-/**
- * Resolve the sanitizer extension file shipped by the sanitizer package.
- *
- * The package intentionally publishes no `main`/`exports`, so the entry cannot be
- * required directly; its manifest is resolved and the declared `pi.extensions[0]`
- * path is joined against the package root. Every failure is loud: a Claude child
- * launched without the sanitizer would fail at the provider with a far less
- * actionable error, so silently omitting it is never correct.
- */
-export function resolveAnthropicSanitizerExtensionPath(
-  dependencies: FusionSanitizerDependencies = {},
-): string {
-  const resolvePackageJson =
-    dependencies.resolvePackageJson ?? createRequire(import.meta.url).resolve;
-  const readManifest = dependencies.readManifest ?? ((path: string) => readFileSync(path, 'utf8'));
-  const pathExists = dependencies.pathExists ?? existsSync;
-  let manifestPath: string;
-  try {
-    manifestPath = resolvePackageJson(FUSION_ANTHROPIC_SANITIZER_MANIFEST);
-  } catch (error) {
-    throw new FusionError(
-      `Anthropic sanitizer package ${FUSION_ANTHROPIC_SANITIZER_PACKAGE} could not be resolved: ${error instanceof Error ? error.message : String(error)}. Claude children cannot be launched without it.`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  let manifestText: string;
-  try {
-    manifestText = readManifest(manifestPath);
-  } catch (error) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} could not be read: ${error instanceof Error ? error.message : String(error)}`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  const entry = manifestExtensionEntry(manifestText, manifestPath);
-  const extensionPath = resolve(dirname(manifestPath), entry);
-  if (!pathExists(extensionPath)) {
-    throw new FusionError(
-      `Anthropic sanitizer extension is missing: ${extensionPath} (declared by ${manifestPath})`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  return extensionPath;
-}
 
 export function assertFusionToolPolicyDisjoint(
   allowlist: readonly string[] = FUSION_INSPECT_TOOLS,
@@ -468,11 +354,10 @@ function fusionToolArgv(capability: FusionCapability): string[] {
 export function fusionChildExtensionPaths(
   model: ResolvedFusionModel,
   childExtensionPath: string,
-  resolveSanitizer: () => string = resolveAnthropicSanitizerExtensionPath,
-  resolveAttribution: () => string = resolveFusionAnthropicAttributionExtensionPath,
+  resolveAttribution: () => string = resolveAnthropicAttributionExtensionPath,
 ): readonly string[] {
   if (model.provider !== FUSION_SANITIZED_PROVIDER) return [childExtensionPath];
-  return [resolveAttribution(), resolveSanitizer(), childExtensionPath];
+  return [resolveAttribution(), childExtensionPath];
 }
 
 export function buildFusionPiChildArgv(
@@ -480,13 +365,11 @@ export function buildFusionPiChildArgv(
   systemPrompt: string,
   childExtensionPath = resolveFusionChildExtensionPath(),
   capability: FusionCapability = FUSION_NO_TOOLS_CAPABILITY,
-  resolveSanitizer: () => string = resolveAnthropicSanitizerExtensionPath,
-  resolveAttribution: () => string = resolveFusionAnthropicAttributionExtensionPath,
+  resolveAttribution: () => string = resolveAnthropicAttributionExtensionPath,
 ): string[] {
   const extensionArgs = fusionChildExtensionPaths(
     model,
     childExtensionPath,
-    resolveSanitizer,
     resolveAttribution,
   ).flatMap((path) => ['--extension', path]);
   return [

package/src/core/registry.ts

@@ -58,6 +58,7 @@ import {
   resolvePiLaunch,
   type PiLaunchSpec,
 } from './pi-launch.js';
+import { resolveAnthropicAttributionExtensionPath } from './anthropic-attribution-path.js';
 import {
   runWindowsTaskkill,
   type TaskkillOutcome,
@@ -1234,7 +1235,9 @@ export class BackgroundTaskRegistry {
     if (this.shuttingDown)
       throw new Error('Cannot start an attested Pi task while Pi is shutting down');
 
-    const argv = buildAttestedPiArgv(request);
+    const attributionExtensionPath =
+      request.provider === 'anthropic' ? resolveAnthropicAttributionExtensionPath() : undefined;
+    const argv = buildAttestedPiArgv(request, attributionExtensionPath);
     const attestedPiLaunch = resolvePiLaunch({ platform: this.platform });
     assertWindowsCommandLineWithinLimit(
       attestedPiLaunch,

package/src/delegate-child-extension.ts

@@ -7,6 +7,7 @@ import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import type { Usage } from '@earendil-works/pi-ai';
 import {
   DELEGATE_RECEIPT_SCHEMA_VERSION,
+  DELEGATE_CAPABILITIES,
   type DelegateRouteAttestation,
   type DelegateSeedV1,
   type DelegateSpillReceipt,
@@ -23,8 +24,10 @@ import {
 /**
  * Package-owned delegate child extension.
  *
- * This runs inside the delegate child Pi process and is the only extension it
- * loads. It is responsible for every guarantee that cannot be enforced from the
+ * This runs inside every delegate child Pi process and is the package-owned
+ * child guard. Anthropic routes load attribution first, and ambient mode may
+ * also execute discovered extensions; this guard remains
+ * responsible for every isolation guarantee that cannot be enforced from the
  * parent:
  *
  * - verifying the frozen seed bytes before the first model call;
@@ -289,6 +292,10 @@ export default function delegateChildExtension(pi: ExtensionAPI): void {
     launchNonce: expectedNonce,
   });
 
+  if (!DELEGATE_CAPABILITIES.includes(seed.capability)) {
+    throw new Error(`delegate child cannot enforce capability ${seed.capability}`);
+  }
+
   const state: GuardState = {
     seed,
     artifactDirAbs,

package/src/delegate-extension.ts

@@ -21,6 +21,7 @@ import {
 import {
   DELEGATE_AUTO_DELIVER_MODES,
   DELEGATE_CAPABILITIES,
+  DELEGATE_EXTENSION_MODES,
   DELEGATE_RESULT_TOOL_NAME,
   DELEGATE_TOOL_NAME,
   DelegateError,
@@ -28,6 +29,7 @@ import {
   type DelegateCapability,
   type DelegateDeliveryMode,
   type DelegateBudgetRouteSource,
+  type DelegateExtensionMode,
   type DelegateRoute,
 } from './core/delegate/types.js';
 import {
@@ -67,7 +69,7 @@ const HOOK_EVIDENCE_PATH = fileURLToPath(
   new URL('./core/delegate/hook-contract-evidence.json', import.meta.url),
 );
 
-const DelegateParams = Type.Object(
+export const DelegateParams = Type.Object(
   {
     name: Type.String({
       description: 'Short human-readable task name shown in the bg footer dock. Use 2-6 words.',
@@ -93,6 +95,12 @@ const DelegateParams = Type.Object(
         description: `Capability profile. Only "inspect" (read/search/list, no shell, no writes, no network, no recursion) is supported.`,
       }),
     ),
+    extensionMode: Type.Optional(
+      Type.String({
+        description:
+          'Extension discovery: isolated | ambient. Default isolated. Ambient is for extension-registered providers and executes arbitrary discovered extension code, weakening process isolation.',
+      }),
+    ),
     maxTurns: Type.Optional(
       Type.Number({
         description: `Maximum agent turns. Default ${String(DELEGATE_DEFAULT_MAX_TURNS)}.`,
@@ -142,6 +150,20 @@ const ResultParams = Type.Object(
 type DelegateParamsValue = Static<typeof DelegateParams>;
 type ResultParamsValue = Static<typeof ResultParams>;
 
+const DELEGATE_PARAM_KEYS = new Set([
+  'name',
+  'prompt',
+  'route',
+  'capability',
+  'extensionMode',
+  'maxTurns',
+  'maxToolCalls',
+  'timeoutSeconds',
+  'autoDeliver',
+  'notifyOnCompletion',
+  'triggerOnCompletion',
+]);
+
 export interface DelegateLaunchDetails {
   schema_version: 'pi-background-tasks.delegate-launch.v1';
   task: BgTaskSnapshot;
@@ -151,6 +173,7 @@ export interface DelegateLaunchDetails {
   seed_sha256: string;
   seed_utf8_bytes: number;
   budget: DelegateBudgetRouteSource;
+  extension_mode: DelegateExtensionMode;
   auto_deliver: DelegateAutoDeliverMode;
   notify_on_completion: boolean;
   trigger_on_completion: boolean;
@@ -187,6 +210,7 @@ export interface DelegateResultDetails {
   delivery: DelegateDeliveryMode | 'none';
   route?: { provider: string; model: string } | undefined;
   budget?: DelegateBudgetRouteSource | undefined;
+  extension_mode?: DelegateExtensionMode | undefined;
   answer_bytes?: number | undefined;
   answer_sha256?: string | undefined;
   turns?: number | undefined;
@@ -213,6 +237,15 @@ function requireCapability(value: unknown): DelegateCapability {
   );
 }
 
+function requireExtensionMode(value: unknown): DelegateExtensionMode {
+  if (value === undefined) return 'isolated';
+  if (value === 'isolated' || value === 'ambient') return value;
+  throw new DelegateError(
+    `bg_delegate extensionMode must be one of ${DELEGATE_EXTENSION_MODES.join(', ')}`,
+    { code: 'invalid_arguments', childCreated: false },
+  );
+}
+
 function requireAutoDeliver(value: unknown): DelegateAutoDeliverMode {
   if (value === undefined) return 'never';
   if (value === 'never' || value === 'when_small' || value === 'always') return value;
@@ -308,13 +341,15 @@ export function registerDelegateExtension(
     name: DELEGATE_TOOL_NAME,
     label: 'Background Delegate',
     description:
-      'Launch one background Pi agent seeded with a frozen projection of the current conversation, then return a launch receipt immediately. The child has its own session, a route pinned at launch that is never substituted, and read-only tools. Retrieve its verified answer with bg_result.',
+      'Launch one background Pi agent seeded with a frozen projection of the current conversation, then return a launch receipt immediately. The child has its own session, a route pinned at launch that is never substituted, and read-only tools. Extension discovery is isolated by default; ambient mode supports extension-registered providers but executes arbitrary discovered extension code. Retrieve its verified answer with bg_result.',
     promptSnippet:
       'Delegate an investigation to a background agent that already has this conversation as context',
     promptGuidelines: [
       'Use bg_delegate when work should continue in the background and the worker needs what you already know: it is seeded with a projection of this conversation.',
       'The prompt is authoritative. State exactly what you want investigated and what the answer should contain.',
-      'The delegate is inspect-only: it can read, search, and list files, but cannot run shell commands, edit or write files, use the network, or delegate further.',
+      'The delegate is inspect-only at the model-visible tool boundary: it can read, search, and list files, but cannot run shell commands, edit or write files, use the network, or delegate further.',
+      'Extension discovery is isolated by default. Use extensionMode:"ambient" only when the pinned provider is registered by an ambient user/project extension.',
+      'Ambient mode executes arbitrary discovered extension code in the child process. Tool allowlists do not sandbox extension code, so ambient mode weakens inspect-only process isolation.',
       'Facts that exist only inside omitted tool output are not available to the delegate. Restate such findings in the prompt.',
       'bg_delegate returns immediately. Do not poll; retrieve the answer with bg_result after the terminal notification arrives.',
     ],
@@ -325,6 +360,13 @@ export function registerDelegateExtension(
           code: 'invalid_arguments',
           childCreated: false,
         });
+      const unknownKeys = Object.keys(args).filter((key) => !DELEGATE_PARAM_KEYS.has(key));
+      if (unknownKeys.length > 0) {
+        throw new DelegateError(
+          `bg_delegate contains unsupported key(s): ${unknownKeys.sort().join(', ')}`,
+          { code: 'invalid_arguments', childCreated: false },
+        );
+      }
       const name = args['name'];
       const prompt = args['prompt'];
       if (typeof name !== 'string' || name.trim().length === 0)
@@ -341,6 +383,7 @@ export function registerDelegateExtension(
       const route = requireRoute(args['route']);
       if (route !== undefined) prepared.route = route;
       prepared.capability = requireCapability(args['capability']);
+      prepared.extensionMode = requireExtensionMode(args['extensionMode']);
       prepared.autoDeliver = requireAutoDeliver(args['autoDeliver']);
       const maxTurns = optionalPositiveInteger(args['maxTurns'], 'maxTurns');
       if (maxTurns !== undefined) prepared.maxTurns = maxTurns;
@@ -356,6 +399,7 @@ export function registerDelegateExtension(
     },
     async execute(toolCallId, params, _signal, _onUpdate, ctx) {
       const capability = requireCapability(params.capability);
+      const extensionMode = requireExtensionMode(params.extensionMode);
       const autoDeliver = requireAutoDeliver(params.autoDeliver);
       const hookEvidence = await loadEvidence();
       const route = resolveDelegateRoute({
@@ -385,6 +429,7 @@ export function registerDelegateExtension(
         toolCallId,
         prompt: params.prompt,
         capability,
+        extensionMode,
         route,
         limitOverrides: {
           maxTurns: params.maxTurns,
@@ -423,6 +468,7 @@ export function registerDelegateExtension(
         seed_sha256: prepared.facts.seedSha256,
         seed_utf8_bytes: prepared.preflight.plan.seed_utf8_bytes,
         budget: prepared.facts.budget,
+        extension_mode: extensionMode,
         auto_deliver: autoDeliver,
         notify_on_completion: launchOptions.notifyOnCompletion,
         trigger_on_completion: launchOptions.triggerOnCompletion,
@@ -437,6 +483,7 @@ export function registerDelegateExtension(
             `Seed: ${String(prepared.preflight.plan.seed_utf8_bytes)} bytes, sha256 ${prepared.facts.seedSha256}`,
             `Estimator: family ${prepared.facts.budget.family}, source ${prepared.facts.budget.rate_source.source}, rate ${String(prepared.facts.budget.rate_source.effective_rate_bytes_per_token_x100)}/100 B/tok + ${String(prepared.facts.budget.rate_source.affine_f_tokens)} tokens${prepared.facts.budget.rate_source.warning === null ? '' : `; warning: ${prepared.facts.budget.rate_source.warning}`}`,
             `Capability: ${capability} (read/search/list only)`,
+            `Extension mode: ${extensionMode}${extensionMode === 'ambient' ? ' — WARNING: arbitrary discovered extension code executes in the child; the tool allowlist does not sandbox it, so inspect-only process isolation is weakened.' : ' (ambient extension discovery disabled)'}`,
             `Limits: ${String(prepared.preflight.limits.max_turns)} turns, ${String(prepared.preflight.limits.max_tool_calls)} tool calls, ${String(prepared.preflight.limits.timeout_seconds)}s`,
             `Auto-deliver: ${autoDeliver}`,
             launchOptions.notifyOnCompletion
@@ -458,7 +505,7 @@ export function registerDelegateExtension(
     renderResult(result, _options, theme) {
       const details = result.details;
       return new Text(
-        `${theme.fg('success', '✓ delegated')} ${theme.fg('accent', details.task.id)}\n${theme.fg('dim', `route ${details.route.qualified_id} · seed ${String(details.seed_utf8_bytes)}B · ${details.artifact_dir}`)}`,
+        `${theme.fg('success', '✓ delegated')} ${theme.fg('accent', details.task.id)}\n${theme.fg('dim', `route ${details.route.qualified_id} · extensions ${details.extension_mode} · seed ${String(details.seed_utf8_bytes)}B · ${details.artifact_dir}`)}`,
         0,
         0,
       );
@@ -633,6 +680,7 @@ export function registerDelegateExtension(
           delivery: 'none',
           artifact_dir: facts.artifactDir,
           budget: facts.budget,
+          extension_mode: facts.extensionMode,
         };
         return {
           content: textContent(
@@ -686,6 +734,7 @@ export function registerDelegateExtension(
         delivery: decision.mode,
         route: verified.package.route,
         budget: facts.budget,
+        extension_mode: facts.extensionMode,
         answer_bytes: verified.package.answer.byte_length,
         answer_sha256: verified.package.answer.sha256,
         turns: verified.package.turns,