pi-background-tasks 2.1.4 → 2.4.0

package/src/core/delegate/launch.ts

@@ -17,6 +17,7 @@ import {
   DELEGATE_TOOL_NAME,
   DelegateError,
   type DelegateCapability,
+  type DelegateExtensionMode,
   type DelegateLimits,
   type DelegatePinnedRoute,
   type DelegateRoute,
@@ -87,7 +88,7 @@ export function resolveDelegateRoute(input: DelegateRouteResolutionInput): Deleg
           childCreated: false,
           remediation: [
             'Name a provider/model pair that appears in the current model registry.',
-            'Omit the route argument to use the parent session\'s current model.',
+            "Omit the route argument to use the parent session's current model.",
           ],
         },
       );
@@ -239,12 +240,23 @@ export function delegateToolsFor(capability: DelegateCapability): readonly strin
   });
 }
 
+function assertDelegateExtensionMode(mode: DelegateExtensionMode): void {
+  if (mode === 'isolated' || mode === 'ambient') return;
+  throw new DelegateError(`bg_delegate extension mode ${String(mode)} is not supported`, {
+    code: 'invalid_arguments',
+    childCreated: false,
+    remediation: ['Use extensionMode "isolated" or "ambient".'],
+  });
+}
+
 export interface DelegateChildArgvInput {
   route: DelegatePinnedRoute;
   capability: DelegateCapability;
+  extensionMode: DelegateExtensionMode;
   childSessionId: string;
   childSessionDir: string;
   childExtensionPath: string;
+  attributionExtensionPath?: string | undefined;
   systemPrompt: string;
 }
 
@@ -252,11 +264,15 @@ export interface DelegateChildArgvInput {
  * Build the child argv.
  *
  * The child gets its own `--session-id` and a task-owned `--session-dir`, so it
- * is structurally incapable of opening or mutating the parent session. Discovery
- * of ambient extensions, skills, prompt templates, themes, and context files is
- * disabled; only the package's own guard extension is loaded explicitly.
+ * is structurally incapable of opening or mutating the parent session. Skills,
+ * prompt templates, themes, and context files are always disabled. Extension
+ * discovery is disabled in isolated mode and deliberately enabled in ambient
+ * mode; ambient extensions execute arbitrary code and are not sandboxed by the
+ * model-visible tool allowlist. The package guard is always explicit; Anthropic
+ * routes first load the package attribution/sanitization extension.
  */
 export function buildDelegateChildArgv(input: DelegateChildArgvInput): string[] {
+  assertDelegateExtensionMode(input.extensionMode);
   const tools = delegateToolsFor(input.capability);
   for (const forbidden of DELEGATE_FORBIDDEN_TOOLS) {
     if (tools.includes(forbidden)) {
@@ -266,6 +282,20 @@ export function buildDelegateChildArgv(input: DelegateChildArgvInput): string[]
       );
     }
   }
+  const extensionPaths =
+    input.route.provider === 'anthropic'
+      ? [
+          input.attributionExtensionPath ??
+            (() => {
+              throw new DelegateError(
+                'Anthropic delegate launch requires the package attribution extension',
+                { code: 'delegate_isolation_unsupported', childCreated: false },
+              );
+            })(),
+          input.childExtensionPath,
+        ]
+      : [input.childExtensionPath];
+
   return [
     '--mode',
     'text',
@@ -279,13 +309,12 @@ export function buildDelegateChildArgv(input: DelegateChildArgvInput): string[]
     tools.join(','),
     '--exclude-tools',
     DELEGATE_FORBIDDEN_TOOLS.join(','),
-    '--no-extensions',
+    ...(input.extensionMode === 'isolated' ? ['--no-extensions'] : []),
     '--no-skills',
     '--no-prompt-templates',
     '--no-themes',
     '--no-context-files',
-    '--extension',
-    input.childExtensionPath,
+    ...extensionPaths.flatMap((path) => ['--extension', path]),
     '--provider',
     input.route.provider,
     '--model',
@@ -351,7 +380,9 @@ export function buildDelegateChildSystemPrompt(seedPathHint: string): string {
     '',
     'You are inspect-only. You can read, search, and list files. You cannot run shell commands, edit or write files, reach the network, or start further delegates. Do not claim to have done so.',
     '',
-    'If a tool result is replaced by a spill receipt, the complete bytes are on disk and nothing was truncated. Use delegate_read_artifact with an exact offset and length when you genuinely need them.',
+    'If a tool result is replaced by a spill receipt, the complete encoded content is on disk and nothing was truncated. Use delegate_read_artifact with an exact offset and length when you genuinely need lossless base64 bytes, then interpret them using the receipt content_format.',
+    '',
+    'The child controls retained context by spilling tool results before they consume protected final-answer runway. A spill is not a failure. If a finalization-runway notice appears, all investigation tools are finished: stop investigating and answer immediately from the evidence already gathered.',
     '',
     'Finish with a single, direct, self-contained answer to the directive. Your final assistant message is the answer that will be returned to the parent.',
   ].join('\n');
@@ -362,6 +393,7 @@ export interface DelegatePreflightInput {
   toolCallId: string | undefined;
   prompt: string;
   capability: DelegateCapability;
+  extensionMode: DelegateExtensionMode;
   route: DelegatePinnedRoute;
   limitOverrides: DelegateLimitOverrides;
   hookEvidence: DelegateHookContractEvidence;
@@ -411,10 +443,9 @@ export function buildDelegateChildPrompt(seedSerialized: string, directive: stri
  * one of these can refuse, and none of them has created a process, a session, or
  * an artifact by the time it does.
  */
-export function preflightDelegateLaunch(
-  input: DelegatePreflightInput,
-): DelegatePreflightResult {
+export function preflightDelegateLaunch(input: DelegatePreflightInput): DelegatePreflightResult {
   assertDelegateHookContract(input.hookEvidence);
+  assertDelegateExtensionMode(input.extensionMode);
   // Validates the capability and proves the tool set contains nothing forbidden.
   delegateToolsFor(input.capability);
   const limits = resolveDelegateLimits(input.route, input.limitOverrides);
@@ -427,16 +458,19 @@ export function preflightDelegateLaunch(
     toolCallId: input.toolCallId,
     directive: input.prompt,
     capability: input.capability,
+    extensionMode: input.extensionMode,
     route: input.route,
     limits,
   });
-  const childSystemPrompt = buildDelegateChildSystemPrompt('the task seed in your first user message');
+  const childSystemPrompt = buildDelegateChildSystemPrompt(
+    'the task seed in your first user message',
+  );
   const childPrompt = buildDelegateChildPrompt(seed.serialized, seed.seed.directive.text);
   const plan = planDelegateAdmission({
     route: input.route,
     // The seed reaches the child inside its prompt, so the admission forecast
     // must measure the prompt that is actually sent, not the seed alone.
-    seedSerialized: childPrompt,
+    childPrompt,
     childSystemPrompt,
     limits,
   });
@@ -454,9 +488,7 @@ export function preflightDelegateLaunch(
 }
 
 /** Task-owned child session directory. Never the parent's session directory. */
-export async function ensureDelegateChildSessionDir(
-  artifactDirAbs: string,
-): Promise<string> {
+export async function ensureDelegateChildSessionDir(artifactDirAbs: string): Promise<string> {
   const dir = join(artifactDirAbs, 'child-session');
   await mkdir(dir, { recursive: true, mode: 0o700 });
   return dir;

package/src/core/delegate/result-package.ts

@@ -247,6 +247,21 @@ function parseAttestations(
   });
 }
 
+function parseSpillContentFormat(
+  value: unknown,
+  taskId: string,
+): DelegateSpillReceipt['content_format'] {
+  if (value === undefined) return undefined;
+  if (
+    value !== 'single_text_utf8' &&
+    value !== 'tool_result_content_json_v1' &&
+    value !== 'opaque_bytes'
+  ) {
+    fail('delegate spill receipt content_format is invalid', 'child_result_invalid', taskId);
+  }
+  return value;
+}
+
 function parseSpillReceipts(value: unknown, taskId: string): readonly DelegateSpillReceipt[] {
   if (!Array.isArray(value))
     fail('delegate result package spilled_artifacts must be an array', 'child_result_invalid', taskId);
@@ -264,6 +279,7 @@ function parseSpillReceipts(value: unknown, taskId: string): readonly DelegateSp
       source_call_index: requireInteger(entry, 'source_call_index', taskId),
       byte_length: requireInteger(entry, 'byte_length', taskId),
       sha256: requireSha256(entry, 'sha256', taskId),
+      content_format: parseSpillContentFormat(entry['content_format'], taskId),
     };
   });
 }

package/src/core/delegate/runner.ts

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { canonicalJson } from '../attested-pi-run.js';
 import { replaceFileDurable } from '../durable-fs.js';
+import { resolveAnthropicAttributionExtensionPath } from '../anthropic-attribution-path.js';
 import { join } from 'node:path';
 import { DelegateArtifactStore, discardDelegateArtifactRoot } from './artifacts.js';
 import {
@@ -20,6 +21,7 @@ import { verifyDelegateResultPackage, type VerifiedDelegateResult } from './resu
 import {
   DelegateError,
   type DelegateAutoDeliverMode,
+  type DelegateExtensionMode,
   type DelegateResultPackageV1,
 } from './types.js';
 import type { DelegateTaskFacts, DelegateTaskOutcome } from '../common.js';
@@ -48,7 +50,9 @@ export interface PrepareDelegateLaunchInput extends DelegatePreflightInput {
   cwd: string;
   sessionId: string | undefined;
   autoDeliver: DelegateAutoDeliverMode;
+  extensionMode: DelegateExtensionMode;
   childExtensionPath?: string | undefined;
+  attributionExtensionPath?: string | undefined;
   env?: NodeJS.ProcessEnv | undefined;
   now?: (() => Date) | undefined;
 }
@@ -68,6 +72,22 @@ export async function prepareDelegateLaunch(
   // its child guard must refuse rather than spawn an unguarded child.
   const childExtensionPath =
     input.childExtensionPath ?? resolveDelegateChildExtensionPath();
+  let attributionExtensionPath: string | undefined;
+  if (input.route.provider === 'anthropic') {
+    try {
+      attributionExtensionPath =
+        input.attributionExtensionPath ?? resolveAnthropicAttributionExtensionPath();
+    } catch (error) {
+      throw new DelegateError(
+        `Anthropic delegate attribution extension could not be resolved: ${error instanceof Error ? error.message : String(error)}`,
+        {
+          code: 'delegate_isolation_unsupported',
+          childCreated: false,
+          remediation: ['Reinstall the package; Anthropic delegates require attribution.'],
+        },
+      );
+    }
+  }
 
   const preflight = preflightDelegateLaunch(input);
 
@@ -78,6 +98,7 @@ export async function prepareDelegateLaunch(
     sessionId: input.sessionId,
     childSessionId: preflight.childSessionId,
     childSessionDir: '',
+    extensionMode: input.extensionMode,
     route: input.route,
     limits: preflight.limits,
     seedSha256: preflight.seed.sha256,
@@ -107,9 +128,11 @@ export async function prepareDelegateLaunch(
     const argv = buildDelegateChildArgv({
       route: input.route,
       capability: input.capability,
+      extensionMode: input.extensionMode,
       childSessionId: preflight.childSessionId,
       childSessionDir: childSessionDirAbs,
       childExtensionPath,
+      attributionExtensionPath,
       systemPrompt: preflight.childSystemPrompt,
     });
     const env = delegateChildEnv(
@@ -137,7 +160,9 @@ export async function prepareDelegateLaunch(
       budget: {
         family: preflight.plan.route.family,
         rate_source: preflight.plan.route.rate_source,
+        conservative_rate_source: preflight.plan.conservative_estimate.rateSource,
       },
+      extensionMode: input.extensionMode,
       autoDeliver: input.autoDeliver,
     };
     const stdinBytes = Buffer.from(preflight.childPrompt, 'utf8');
@@ -176,6 +201,9 @@ export interface EvaluateDelegateTerminalInput {
   /** Terminal status observed by the background task registry. */
   taskStatus: 'completed' | 'failed' | 'killed';
   taskError: string | undefined;
+  /** Real merged child output owned by the background-task registry. */
+  taskOutputPath?: string | undefined;
+  taskOutputAbsPath?: string | undefined;
 }
 
 /**
@@ -227,6 +255,21 @@ async function adjudicateDelegateTerminal(
       recorded?.message ??
       input.taskError ??
       'the delegate child exited without committing a result package';
+    const preserved = ['seed.json', 'budget-plan.json', 'child-terminal.json', 'runtime-budget.json']
+      .filter((name) => existsSync(join(input.artifactDirAbs, name)));
+    if (
+      input.taskOutputPath !== undefined &&
+      input.taskOutputAbsPath !== undefined &&
+      existsSync(input.taskOutputAbsPath)
+    ) {
+      preserved.push(input.taskOutputPath);
+    }
+    const diagnosticTargets = preserved.filter(
+      (name) => name === 'child-terminal.json' || name === 'runtime-budget.json' || name === input.taskOutputPath,
+    );
+    const diagnostic = diagnosticTargets.length === 0
+      ? 'No child terminal record or merged task output exists; inspect the preserved launch artifacts listed above.'
+      : `Inspect the preserved diagnostic evidence: ${diagnosticTargets.join(', ')}.`;
     const error = new DelegateError(
       `bg_delegate produced no committed answer: ${detail}`,
       {
@@ -234,9 +277,9 @@ async function adjudicateDelegateTerminal(
         childCreated: true,
         taskId: input.taskId,
         artifactDir: input.artifactDirAbs,
-        preserved: ['seed.json', 'budget-plan.json', 'child.stdout.txt', 'child.stderr.txt'],
+        preserved,
         remediation: [
-          'Inspect child.stderr.txt and child-terminal.json in the artifact directory.',
+          diagnostic,
           'No partial answer is returned; nothing was truncated to look like success.',
         ],
       },

package/src/core/delegate/seed.ts

@@ -22,6 +22,7 @@ import {
   type DelegateContextPolicyDescriptor,
   type DelegateConversationProjection,
   type DelegateLedgerV1,
+  type DelegateExtensionMode,
   type DelegateLimits,
   type DelegatePinnedRoute,
   type DelegateSeedV1,
@@ -34,6 +35,7 @@ export interface BuildDelegateSeedOptions {
   toolCallId: string | undefined;
   directive: string;
   capability: DelegateCapability;
+  extensionMode: DelegateExtensionMode;
   route: DelegatePinnedRoute;
   limits: DelegateLimits;
 }
@@ -167,6 +169,7 @@ export function buildDelegateSeed(
     launch_nonce: options.launchNonce,
     cwd: ctx.cwd,
     capability: options.capability,
+    extension_mode: options.extensionMode,
     route: options.route,
     parent_system_prompt: ctx.getSystemPrompt(),
     parent_leaf_id: snapshot.leafId,
@@ -296,6 +299,14 @@ function rebuildSeed(record: Record<PropertyKey, unknown>, taskId: string): Dele
       taskId,
     });
   }
+  const extensionMode = requireString(record, 'extension_mode', taskId);
+  if (extensionMode !== 'isolated' && extensionMode !== 'ambient') {
+    throw new DelegateError(`delegate seed extension mode ${extensionMode} is not recognised`, {
+      code: 'seed_hash_mismatch',
+      childCreated: true,
+      taskId,
+    });
+  }
   const routeRecord = requireRecord(record, 'route', taskId);
   const routeOrigin = requireString(routeRecord, 'origin', taskId);
   if (routeOrigin !== 'parent_current' && routeOrigin !== 'explicit') {
@@ -378,6 +389,7 @@ function rebuildSeed(record: Record<PropertyKey, unknown>, taskId: string): Dele
     launch_nonce: requireString(record, 'launch_nonce', taskId),
     cwd: requireString(record, 'cwd', taskId),
     capability,
+    extension_mode: extensionMode,
     route,
     parent_system_prompt: requireString(record, 'parent_system_prompt', taskId),
     parent_leaf_id: parentLeafId,

package/src/core/delegate/types.ts

@@ -12,14 +12,14 @@ import type {
   ProjectionEntry,
 } from '../context/visible-conversation-v2.js';
 
-export const DELEGATE_SEED_SCHEMA_VERSION = 'pi-background-tasks.delegate-seed.v1' as const;
+export const DELEGATE_SEED_SCHEMA_VERSION = 'pi-background-tasks.delegate-seed.v2' as const;
 export const DELEGATE_LEDGER_SCHEMA_VERSION = 'pi-background-tasks.delegate-ledger.v1' as const;
 export const DELEGATE_RESULT_PACKAGE_SCHEMA_VERSION =
   'pi-background-tasks.delegate-result.v1' as const;
 export const DELEGATE_RECEIPT_SCHEMA_VERSION = 'pi-background-tasks.delegate-receipt.v1' as const;
 export const DELEGATE_BUDGET_PLAN_SCHEMA_VERSION =
-  'pi-background-tasks.delegate-budget-plan.v2' as const;
-export const DELEGATE_MANIFEST_SCHEMA_VERSION = 'pi-background-tasks.delegate-manifest.v1' as const;
+  'pi-background-tasks.delegate-budget-plan.v3' as const;
+export const DELEGATE_MANIFEST_SCHEMA_VERSION = 'pi-background-tasks.delegate-manifest.v2' as const;
 
 /**
  * Delegate's own context policy id. It shares the frozen
@@ -35,6 +35,13 @@ export const DELEGATE_RESULT_TOOL_NAME = 'bg_result';
 export const DELEGATE_CAPABILITIES = ['inspect'] as const;
 export type DelegateCapability = (typeof DELEGATE_CAPABILITIES)[number];
 
+/**
+ * Controls only Pi's ambient extension discovery for delegate children.
+ * Tool and project-resource restrictions remain independently enforced.
+ */
+export const DELEGATE_EXTENSION_MODES = ['isolated', 'ambient'] as const;
+export type DelegateExtensionMode = (typeof DELEGATE_EXTENSION_MODES)[number];
+
 export const DELEGATE_AUTO_DELIVER_MODES = ['never', 'when_small', 'always'] as const;
 export type DelegateAutoDeliverMode = (typeof DELEGATE_AUTO_DELIVER_MODES)[number];
 
@@ -57,6 +64,7 @@ export interface DelegatePinnedRoute extends DelegateRoute {
 export interface DelegateBudgetRouteSource {
   family: TokenBudgetFamily;
   rate_source: TokenBudgetRateSource;
+  conservative_rate_source?: TokenBudgetRateSource | undefined;
 }
 
 export interface DelegateContextPolicyDescriptor {
@@ -110,6 +118,7 @@ export interface DelegateSeedV1 {
   launch_nonce: string;
   cwd: string;
   capability: DelegateCapability;
+  extension_mode: DelegateExtensionMode;
   route: DelegatePinnedRoute;
   parent_system_prompt: string;
   parent_leaf_id: string | null;
@@ -184,6 +193,11 @@ export interface DelegateResultPackageV1 {
   spilled_artifacts: readonly DelegateSpillReceipt[];
 }
 
+export type DelegateSpillContentFormat =
+  | 'single_text_utf8'
+  | 'tool_result_content_json_v1'
+  | 'opaque_bytes';
+
 export interface DelegateSpillReceipt {
   schema_version: typeof DELEGATE_RECEIPT_SCHEMA_VERSION;
   artifact: string;
@@ -193,6 +207,11 @@ export interface DelegateSpillReceipt {
   source_call_index: number;
   byte_length: number;
   sha256: string;
+  /**
+   * Encoding of the hashed artifact bytes. Optional only for compatibility
+   * with v1 receipts written before content formats were recorded.
+   */
+  content_format?: DelegateSpillContentFormat | undefined;
 }
 
 export const DELEGATE_ERROR_CODES = [

package/src/core/fusion/config.ts

@@ -5,7 +5,7 @@ import { getAgentDir } from '@earendil-works/pi-coding-agent';
 import type { Api, Model } from '@earendil-works/pi-ai';
 import { isJsonObject, parseJsonText, type JsonObject } from '../common.js';
 import { replaceFileDurable } from '../durable-fs.js';
-import { CLAUDE_CODE_200K_SUBSCRIPTION_CONTEXT_WINDOW } from './anthropic-attribution.js';
+import { CLAUDE_CODE_200K_SUBSCRIPTION_CONTEXT_WINDOW } from '../anthropic-attribution.js';
 import {
   FUSION_MODEL_CONFIG_SCHEMA_VERSION,
   FusionError,

package/src/core/fusion/pi-child.ts

@@ -1,8 +1,7 @@
 import { spawn as nodeSpawn, type SpawnOptions } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { constants, existsSync, readFileSync } from 'node:fs';
+import { constants, existsSync } from 'node:fs';
 import { open } from 'node:fs/promises';
-import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
@@ -73,6 +72,7 @@ import {
   resolvePiLaunch,
   type PiLaunchDependencies,
 } from '../pi-launch.js';
+import { resolveAnthropicAttributionExtensionPath } from '../anthropic-attribution-path.js';
 
 // The response cap now applies to one final full answer, not cumulative Pi JSON events.
 export const FUSION_CHILD_STDOUT_LIMIT_BYTES = 32 * 1024 * 1024;
@@ -274,21 +274,6 @@ export function fusionPiChildEnv(
   return out;
 }
 
-export function resolveFusionAnthropicAttributionExtensionPath(
-  moduleUrl = import.meta.url,
-  pathExists: (path: string) => boolean = existsSync,
-): string {
-  const modulePath = fileURLToPath(moduleUrl);
-  const extension = modulePath.endsWith('.ts')
-    ? 'anthropic-attribution.ts'
-    : 'anthropic-attribution.js';
-  const candidate = resolve(dirname(modulePath), extension);
-  if (!pathExists(candidate)) {
-    throw new Error(`Fusion Anthropic attribution extension is missing: ${candidate}`);
-  }
-  return candidate;
-}
-
 export function resolveFusionChildExtensionPath(
   moduleUrl = import.meta.url,
   pathExists: (path: string) => boolean = existsSync,
@@ -303,109 +288,10 @@ export function resolveFusionChildExtensionPath(
 }
 
 /**
- * Provider whose children require the Anthropic system-prompt sanitizer.
- *
- * Pi's own system prompt contains documentation lines that Anthropic rejects, so a
- * Claude child launched without the sanitizer fails at the provider rather than
- * producing an answer. The parent session loads the sanitizer through ordinary
- * extension discovery, but Fusion children run with `--no-extensions` for
- * isolation and therefore inherit nothing; the sanitizer must be re-supplied
- * explicitly per child.
+ * Provider whose isolated children require the package-owned attribution and
+ * exact-match system-prompt sanitization extension.
  */
 export const FUSION_SANITIZED_PROVIDER = 'anthropic';
-export const FUSION_ANTHROPIC_SANITIZER_PACKAGE = '@ravshansbox/pi-anthropic-sps';
-const FUSION_ANTHROPIC_SANITIZER_MANIFEST = `${FUSION_ANTHROPIC_SANITIZER_PACKAGE}/package.json`;
-
-export interface FusionSanitizerDependencies {
-  resolvePackageJson?: ((specifier: string) => string) | undefined;
-  readManifest?: ((path: string) => string) | undefined;
-  pathExists?: ((path: string) => boolean) | undefined;
-}
-
-function manifestExtensionEntry(manifestText: string, manifestPath: string): string {
-  let parsed: unknown;
-  try {
-    parsed = parseJsonText(manifestText);
-  } catch (error) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  if (!isJsonObject(parsed)) {
-    throw new FusionError(`Anthropic sanitizer manifest ${manifestPath} must be an object`, {
-      code: 'orchestration_failed',
-      childCreated: false,
-    });
-  }
-  const pi = parsed['pi'];
-  if (!isJsonObject(pi)) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} has no "pi" section declaring its extension`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  const extensions = pi['extensions'];
-  if (!Array.isArray(extensions) || extensions.length === 0) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} declares no pi.extensions entries`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  const [entry] = extensions;
-  if (typeof entry !== 'string' || entry.trim().length === 0) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} pi.extensions[0] must be a non-blank string`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  return entry;
-}
-
-/**
- * Resolve the sanitizer extension file shipped by the sanitizer package.
- *
- * The package intentionally publishes no `main`/`exports`, so the entry cannot be
- * required directly; its manifest is resolved and the declared `pi.extensions[0]`
- * path is joined against the package root. Every failure is loud: a Claude child
- * launched without the sanitizer would fail at the provider with a far less
- * actionable error, so silently omitting it is never correct.
- */
-export function resolveAnthropicSanitizerExtensionPath(
-  dependencies: FusionSanitizerDependencies = {},
-): string {
-  const resolvePackageJson =
-    dependencies.resolvePackageJson ?? createRequire(import.meta.url).resolve;
-  const readManifest = dependencies.readManifest ?? ((path: string) => readFileSync(path, 'utf8'));
-  const pathExists = dependencies.pathExists ?? existsSync;
-  let manifestPath: string;
-  try {
-    manifestPath = resolvePackageJson(FUSION_ANTHROPIC_SANITIZER_MANIFEST);
-  } catch (error) {
-    throw new FusionError(
-      `Anthropic sanitizer package ${FUSION_ANTHROPIC_SANITIZER_PACKAGE} could not be resolved: ${error instanceof Error ? error.message : String(error)}. Claude children cannot be launched without it.`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  let manifestText: string;
-  try {
-    manifestText = readManifest(manifestPath);
-  } catch (error) {
-    throw new FusionError(
-      `Anthropic sanitizer manifest ${manifestPath} could not be read: ${error instanceof Error ? error.message : String(error)}`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  const entry = manifestExtensionEntry(manifestText, manifestPath);
-  const extensionPath = resolve(dirname(manifestPath), entry);
-  if (!pathExists(extensionPath)) {
-    throw new FusionError(
-      `Anthropic sanitizer extension is missing: ${extensionPath} (declared by ${manifestPath})`,
-      { code: 'orchestration_failed', childCreated: false },
-    );
-  }
-  return extensionPath;
-}
 
 export function assertFusionToolPolicyDisjoint(
   allowlist: readonly string[] = FUSION_INSPECT_TOOLS,
@@ -468,11 +354,10 @@ function fusionToolArgv(capability: FusionCapability): string[] {
 export function fusionChildExtensionPaths(
   model: ResolvedFusionModel,
   childExtensionPath: string,
-  resolveSanitizer: () => string = resolveAnthropicSanitizerExtensionPath,
-  resolveAttribution: () => string = resolveFusionAnthropicAttributionExtensionPath,
+  resolveAttribution: () => string = resolveAnthropicAttributionExtensionPath,
 ): readonly string[] {
   if (model.provider !== FUSION_SANITIZED_PROVIDER) return [childExtensionPath];
-  return [resolveAttribution(), resolveSanitizer(), childExtensionPath];
+  return [resolveAttribution(), childExtensionPath];
 }
 
 export function buildFusionPiChildArgv(
@@ -480,13 +365,11 @@ export function buildFusionPiChildArgv(
   systemPrompt: string,
   childExtensionPath = resolveFusionChildExtensionPath(),
   capability: FusionCapability = FUSION_NO_TOOLS_CAPABILITY,
-  resolveSanitizer: () => string = resolveAnthropicSanitizerExtensionPath,
-  resolveAttribution: () => string = resolveFusionAnthropicAttributionExtensionPath,
+  resolveAttribution: () => string = resolveAnthropicAttributionExtensionPath,
 ): string[] {
   const extensionArgs = fusionChildExtensionPaths(
     model,
     childExtensionPath,
-    resolveSanitizer,
     resolveAttribution,
   ).flatMap((path) => ['--extension', path]);
   return [

package/src/core/registry.ts

@@ -58,6 +58,7 @@ import {
   resolvePiLaunch,
   type PiLaunchSpec,
 } from './pi-launch.js';
+import { resolveAnthropicAttributionExtensionPath } from './anthropic-attribution-path.js';
 import {
   runWindowsTaskkill,
   type TaskkillOutcome,
@@ -1234,7 +1235,9 @@ export class BackgroundTaskRegistry {
     if (this.shuttingDown)
       throw new Error('Cannot start an attested Pi task while Pi is shutting down');
 
-    const argv = buildAttestedPiArgv(request);
+    const attributionExtensionPath =
+      request.provider === 'anthropic' ? resolveAnthropicAttributionExtensionPath() : undefined;
+    const argv = buildAttestedPiArgv(request, attributionExtensionPath);
     const attestedPiLaunch = resolvePiLaunch({ platform: this.platform });
     assertWindowsCommandLineWithinLimit(
       attestedPiLaunch,