pi-better-harness 0.12.2 → 0.12.3

package/node_modules/pi-better-background-tasks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-background-tasks",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Pi extension for durable background shell tasks, watchers, logs, and status inspection.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-background-tasks/src/shared-sandbox-core.ts

@@ -228,10 +228,7 @@ const CREDENTIAL_LOCATIONS = [
     ".docker/config.json", ".npmrc", ".netrc", ".git-credentials", ".pi/agent/auth.json",
 ] as const;
 
-/**
- * Credential stores added by the broad-write profile. They are never readable
- * or writable there, whatever the Stored credentials row says.
- */
+/** Credential stores added to the Stored credentials row by the broad-write profile. */
 const BROAD_CREDENTIAL_LOCATIONS = [
     "Library/Keychains", ".claude/.credentials.json", ".claude.json", ".gnupg",
     ".codex/auth.json", ".cargo/credentials.toml", ".cargo/credentials", ".pgpass", ".config/rclone",
@@ -386,10 +383,7 @@ function compile(
     return {
         writableRoot, denyWrite, home: policy.home,
         ...(policy.permissions && {
-            // The broad-write profile's credential deny list is not optional.
-            permissions: broadMode
-                ? { ...policy.permissions, storedCredentials: "off" as const }
-                : { ...policy.permissions },
+            permissions: { ...policy.permissions },
             credentialPaths: broadMode ? broadCredentialPaths(policy.home, seams) : credentialFilePaths(policy.home, seams),
             compatibilityWrite,
             runtimeWrite,
@@ -598,7 +592,7 @@ export function evaluateReadAccess(
     const permissions = policy.permissions;
     if (!permissions) return { allowed: true, path };
     if (policy.broad) {
-        const denied = isCredential(path, policy) ||
+        const denied = (isCredential(path, policy) && permissions.storedCredentials === "off") ||
             (permissions.projectFiles === "off" && contains(policy.writableRoot, path));
         return denied ? { allowed: false, path, reason: "read-denied" } : { allowed: true, path };
     }
@@ -652,7 +646,8 @@ function evaluateBroadWrite(
     for (const denied of [...policy.denyWrite, ...broad.codePaths]) {
         if (contains(denied, path)) return { allowed: false, path, reason: "write-denied", deniedBy: denied };
     }
-    if (isCredential(path, policy)) return { allowed: false, path, reason: "permission-denied" };
+    if (isCredential(path, policy)) return canWrite(policy.permissions!.storedCredentials)
+        ? { allowed: true, path } : { allowed: false, path, reason: "permission-denied" };
     if (policy.runtimeWrite?.some((root) => contains(root, path))) return { allowed: true, path };
     if (contains(policy.writableRoot, path)) {
         return canWrite(policy.permissions!.projectFiles)
@@ -808,7 +803,8 @@ export function resetRecoverySnapshotClock(): void {
 }
 
 function broadProtectedPaths(policy: CompiledSandboxWritePolicy, broad: CompiledBroadWrite): string[] {
-    return [...policy.denyWrite, ...(policy.credentialPaths ?? []), ...broad.codePaths,
+    return [...policy.denyWrite,
+        ...(policy.permissions?.storedCredentials === "read-write" ? [] : policy.credentialPaths ?? []), ...broad.codePaths,
         ...(!canWrite(policy.permissions?.projectFiles) ? [policy.writableRoot] : [])];
 }
 
@@ -927,7 +923,7 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[.]worktrees/."))`,
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[^/]+-worktrees/."))`,
     );
-    // The fixed deny list overrides every grant above. A rule naming
+    // Write-denied controls and credentials override every broad grant above. A rule naming
     // `file-write-unlink` outranks a `file-write*` wildcard whatever their
     // order (verified on the real kernel), so each protected path also gets an
     // explicit unlink denial; otherwise the removal grants above would reopen it.
@@ -936,8 +932,8 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
     if (!canWrite(permissions.projectFiles)) denyWrite(project);
     for (const path of broad.codePaths) denyWrite(path);
     for (const path of policy.credentialPaths ?? []) {
-        rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
-        denyWrite(path);
+        if (permissions.storedCredentials === "off") rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
+        if (permissions.storedCredentials !== "read-write") denyWrite(path);
     }
     for (const path of policy.denyWrite) denyWrite(path);
     // Renaming an ancestor would move a protected subtree to an unprotected path,
@@ -1350,9 +1346,11 @@ function maskSources(profilePath: string): { directory: string; file: string } {
  * the root is read-only; temp, the workspace, hidden home entries and worktree
  * folders are writable (removal included); ordinary top-level home folders and
  * home itself stay read-only, so sibling repositories cannot even be edited in
- * place there. Credentials are masked by empty mode-000 mounts; code that runs
- * later and caller-denied paths are read-only binds. Every writable bind and
- * protected leaf is a mount point, which Linux refuses to rename. A protected
+ * place there. Off credentials are masked by empty mode-000 mounts, Read
+ * credentials are read-only binds, and Read / write credentials follow the
+ * surrounding broad-write rules. Code that runs later and caller-denied paths
+ * are read-only binds. Every writable bind and protected leaf is a mount point,
+ * which Linux refuses to rename. A protected
  * symlink inside a writable directory (a stow link in `~/.config`) makes that
  * directory read-only with each existing entry bound writable again, so only
  * new top-level entries there are refused.
@@ -1373,14 +1371,15 @@ function buildLinuxBroadCommand(
         throw new Error("Linux bubblewrap cannot separate removal from writing for Project files; use Write & delete or Read.");
     }
     const credentials = policy.credentialPaths ?? [];
+    const protectedCredentials = permissions.storedCredentials === "read-write" ? [] : credentials;
     const writeDenied = [...broad.codePaths, ...policy.denyWrite];
     if (permissions.projectFiles === "read-write" &&
-        [...credentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
+        [...protectedCredentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
         throw new Error("Linux bubblewrap cannot make a project writable inside a protected directory.");
     }
     const list = seams.listDirectory ?? systemListDirectory;
     const exists = (path: string) => (seams.pathExists ?? existsSync)(path);
-    const protectedPaths = [...credentials, ...writeDenied];
+    const protectedPaths = [...protectedCredentials, ...writeDenied];
     const insideProtected = (path: string) => protectedPaths.some((guard) => contains(guard, path));
 
     const writable = new Set<string>();
@@ -1498,7 +1497,10 @@ function buildLinuxBroadCommand(
             readOnly.add(path);
         }
     };
-    for (const path of credentials) guard(path, true);
+    for (const path of credentials) {
+        if (permissions.storedCredentials === "off") guard(path, true);
+        else if (permissions.storedCredentials === "read") guard(path, false);
+    }
     for (const path of writeDenied) guard(path, false);
     if (permissions.projectFiles === "read") readOnly.add(project);
 

package/node_modules/pi-better-plan/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-plan",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Structured execution plans with persistent progress for Pi.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-plan/src/index.ts

@@ -1,6 +1,6 @@
 import { StringEnum } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { Text } from "@earendil-works/pi-tui";
+import { Text, type AutocompleteItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
 import {
@@ -78,6 +78,21 @@ const LEGACY_PLAN_NAV_STATUS_KEY = "pi-better-plan-nav";
 const DELEGATION_MODE_REQUEST = "pi-better-subagents:delegation-mode-request";
 type DelegationMode = "manual" | "adaptive" | "coordinator";
 
+const PLAN_ACTIONS: readonly AutocompleteItem[] = [
+  { value: "clear", label: "clear", description: "Remove the current plan" },
+  { value: "hide", label: "hide", description: "Hide the plan widget" },
+  { value: "show", label: "show", description: "Restore automatic plan display" },
+  { value: "pin auto", label: "pin auto", description: "Use automatic plan pinning" },
+  { value: "pin on", label: "pin on", description: "Keep the plan pinned" },
+  { value: "pin off", label: "pin off", description: "Keep the plan unpinned" },
+];
+
+export function planArgumentCompletions(argumentPrefix: string): AutocompleteItem[] | null {
+  const prefix = argumentPrefix.trimStart().toLowerCase();
+  const matches = PLAN_ACTIONS.filter((action) => action.value.startsWith(prefix));
+  return matches.length > 0 ? [...matches] : null;
+}
+
 function activeDelegationMode(pi: ExtensionAPI): DelegationMode {
   const request: { mode?: string } = {};
   pi.events.emit(DELEGATION_MODE_REQUEST, request);
@@ -396,6 +411,7 @@ export default function planExtension(pi: ExtensionAPI): void {
 
   pi.registerCommand("plan", {
     description: "Inspect, show, hide, clear, or configure the current plan",
+    getArgumentCompletions: planArgumentCompletions,
     handler: async (args, ctx) => {
       const input = args.trim().toLowerCase();
       if (!input) return showFullPlan(ctx);

package/node_modules/pi-better-sandbox/README.md

@@ -20,7 +20,7 @@ Sandbox                           Off              On
 
 Project files                     -                Write & delete
 Outside project                   -                Write
-Stored credentials                -                Off (fixed)
+Stored credentials                -                Read
 Run commands & applications       -                On
 Network access                    -                On
 
@@ -74,15 +74,14 @@ select the row.
 
 **Outside project = Write** (the Subagents default) lets tasks write across your
 home directory and temp, so tool caches just work with no per-tool setup. It
-keeps one fixed deny list that is not configurable per tool:
+retains fixed protections that are not configurable per tool:
 
-- **Credentials** are neither readable nor writable, whatever the Stored
-  credentials row says: the files listed below plus `~/Library/Keychains`,
+- **Credentials** follow the independent Stored credentials row. The default
+  `Read` setting exposes the files listed below plus `~/Library/Keychains`,
   `~/.claude/.credentials.json`, `~/.claude.json`, `~/.gnupg`,
   `~/.codex/auth.json`, `~/.cargo/credentials(.toml)`, `~/.pgpass`, and
-  `~/.config/rclone`. The table shows
-  "Off (fixed)". Tasks that need git over SSH, `gh`, or cloud CLIs need Outside
-  project = Read or Write & delete.
+  `~/.config/rclone` to confined subagents, while denying writes. Set the row to
+  Off to hide them or Read / write when a CLI must refresh credential state.
 - **Code that runs later** cannot be written, removed, or renamed: shell startup
   files (`.bashrc`, `.zshrc`, `.profile`, and the rest), `~/.config/fish`,
   `~/.gitconfig`, `~/.config/git`, `~/.config/systemd/user`,
@@ -152,8 +151,8 @@ AWS, GitHub CLI, Google Cloud CLI, Azure, Kubernetes, Docker, npm, netrc, Git
 credentials, and Pi's file-based auth. These rules override ordinary file access.
 OS vault services such as Keychain and Secret Service, and tokens inherited in
 environment variables, are excluded. Read / write may be needed by a CLI that
-refreshes a token or updates its credential database. Under Outside project =
-Write, credentials are always Off (see above).
+refreshes a token or updates its credential database. This row applies
+independently of Project files and Outside project.
 
 File and shell operations use the kernel: macOS uses Seatbelt (`sandbox-exec`)
 and Linux uses Bubblewrap (`bwrap`). `read`, `write`, and `edit` keep Pi's normal

package/node_modules/pi-better-sandbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-sandbox",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Pi extension with independent Main and Subagents permission profiles, file guards, and OS sandbox enforcement.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-sandbox/permissions-page.ts

@@ -36,7 +36,6 @@ const fileValues: readonly FileAccess[] = ["off", "read", "write", "read-write"]
 const credentialValues: readonly CredentialAccess[] = ["off", "read", "read-write"];
 const FILE_LABELS: Record<FileAccess, string> = { off: "Off", read: "Read", write: "Write", "read-write": "Write & delete" };
 const CREDENTIAL_LABELS: Record<CredentialAccess, string> = { off: "Off", read: "Read", "read-write": "Read / write" };
-const FIXED_CREDENTIALS = "Outside project = Write always hides credential files; change Outside project to edit this row.";
 
 /** The context line for the highlighted cell, or undefined. */
 function cellHint(key: string, profile: PermissionProfile | undefined): string | undefined {
@@ -47,7 +46,7 @@ function cellHint(key: string, profile: PermissionProfile | undefined): string |
             ? `Write: git and rename-based saves fail ${where} except in worktree folders; set Write & delete if needed.`
             : "Always deletable: temp, hidden ~/.directories and worktree folders (.worktrees/, *-worktrees/).";
     }
-    if (key === "storedCredentials" && profile?.outsideProject === "write") return FIXED_CREDENTIALS;
+    if (key === "storedCredentials") return "Known credential files follow this row independently of Outside project.";
     return undefined;
 }
 const columns = ["main", "subagents"] as const;
@@ -134,12 +133,6 @@ export function createPermissionsPage(
         if (key === "enabled" || key === "commands" || key === "network") {
             next[profile][key] = !next[profile][key];
         } else if (key === "storedCredentials") {
-            if (next[profile].outsideProject === "write") {
-                message = FIXED_CREDENTIALS;
-                isError = false;
-                requestRender();
-                return;
-            }
             const current = next[profile][key];
             next[profile][key] = credentialValues[(credentialValues.indexOf(current) + 1) % credentialValues.length]!;
         } else {
@@ -257,7 +250,7 @@ export function createPermissionsPage(
                 const value = (profile: PermissionProfile): string => {
                     if (entry.key !== "enabled" && !profile.enabled) return "-";
                     if (entry.key === "storedCredentials") {
-                        return profile.outsideProject === "write" ? "Off (fixed)" : CREDENTIAL_LABELS[profile.storedCredentials];
+                        return CREDENTIAL_LABELS[profile.storedCredentials];
                     }
                     const current = profile[entry.key];
                     return typeof current === "boolean" ? (current ? "On" : "Off") : FILE_LABELS[current];

package/node_modules/pi-better-sandbox/shared-sandbox-core.ts

@@ -228,10 +228,7 @@ const CREDENTIAL_LOCATIONS = [
     ".docker/config.json", ".npmrc", ".netrc", ".git-credentials", ".pi/agent/auth.json",
 ] as const;
 
-/**
- * Credential stores added by the broad-write profile. They are never readable
- * or writable there, whatever the Stored credentials row says.
- */
+/** Credential stores added to the Stored credentials row by the broad-write profile. */
 const BROAD_CREDENTIAL_LOCATIONS = [
     "Library/Keychains", ".claude/.credentials.json", ".claude.json", ".gnupg",
     ".codex/auth.json", ".cargo/credentials.toml", ".cargo/credentials", ".pgpass", ".config/rclone",
@@ -386,10 +383,7 @@ function compile(
     return {
         writableRoot, denyWrite, home: policy.home,
         ...(policy.permissions && {
-            // The broad-write profile's credential deny list is not optional.
-            permissions: broadMode
-                ? { ...policy.permissions, storedCredentials: "off" as const }
-                : { ...policy.permissions },
+            permissions: { ...policy.permissions },
             credentialPaths: broadMode ? broadCredentialPaths(policy.home, seams) : credentialFilePaths(policy.home, seams),
             compatibilityWrite,
             runtimeWrite,
@@ -598,7 +592,7 @@ export function evaluateReadAccess(
     const permissions = policy.permissions;
     if (!permissions) return { allowed: true, path };
     if (policy.broad) {
-        const denied = isCredential(path, policy) ||
+        const denied = (isCredential(path, policy) && permissions.storedCredentials === "off") ||
             (permissions.projectFiles === "off" && contains(policy.writableRoot, path));
         return denied ? { allowed: false, path, reason: "read-denied" } : { allowed: true, path };
     }
@@ -652,7 +646,8 @@ function evaluateBroadWrite(
     for (const denied of [...policy.denyWrite, ...broad.codePaths]) {
         if (contains(denied, path)) return { allowed: false, path, reason: "write-denied", deniedBy: denied };
     }
-    if (isCredential(path, policy)) return { allowed: false, path, reason: "permission-denied" };
+    if (isCredential(path, policy)) return canWrite(policy.permissions!.storedCredentials)
+        ? { allowed: true, path } : { allowed: false, path, reason: "permission-denied" };
     if (policy.runtimeWrite?.some((root) => contains(root, path))) return { allowed: true, path };
     if (contains(policy.writableRoot, path)) {
         return canWrite(policy.permissions!.projectFiles)
@@ -808,7 +803,8 @@ export function resetRecoverySnapshotClock(): void {
 }
 
 function broadProtectedPaths(policy: CompiledSandboxWritePolicy, broad: CompiledBroadWrite): string[] {
-    return [...policy.denyWrite, ...(policy.credentialPaths ?? []), ...broad.codePaths,
+    return [...policy.denyWrite,
+        ...(policy.permissions?.storedCredentials === "read-write" ? [] : policy.credentialPaths ?? []), ...broad.codePaths,
         ...(!canWrite(policy.permissions?.projectFiles) ? [policy.writableRoot] : [])];
 }
 
@@ -927,7 +923,7 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[.]worktrees/."))`,
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[^/]+-worktrees/."))`,
     );
-    // The fixed deny list overrides every grant above. A rule naming
+    // Write-denied controls and credentials override every broad grant above. A rule naming
     // `file-write-unlink` outranks a `file-write*` wildcard whatever their
     // order (verified on the real kernel), so each protected path also gets an
     // explicit unlink denial; otherwise the removal grants above would reopen it.
@@ -936,8 +932,8 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
     if (!canWrite(permissions.projectFiles)) denyWrite(project);
     for (const path of broad.codePaths) denyWrite(path);
     for (const path of policy.credentialPaths ?? []) {
-        rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
-        denyWrite(path);
+        if (permissions.storedCredentials === "off") rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
+        if (permissions.storedCredentials !== "read-write") denyWrite(path);
     }
     for (const path of policy.denyWrite) denyWrite(path);
     // Renaming an ancestor would move a protected subtree to an unprotected path,
@@ -1350,9 +1346,11 @@ function maskSources(profilePath: string): { directory: string; file: string } {
  * the root is read-only; temp, the workspace, hidden home entries and worktree
  * folders are writable (removal included); ordinary top-level home folders and
  * home itself stay read-only, so sibling repositories cannot even be edited in
- * place there. Credentials are masked by empty mode-000 mounts; code that runs
- * later and caller-denied paths are read-only binds. Every writable bind and
- * protected leaf is a mount point, which Linux refuses to rename. A protected
+ * place there. Off credentials are masked by empty mode-000 mounts, Read
+ * credentials are read-only binds, and Read / write credentials follow the
+ * surrounding broad-write rules. Code that runs later and caller-denied paths
+ * are read-only binds. Every writable bind and protected leaf is a mount point,
+ * which Linux refuses to rename. A protected
  * symlink inside a writable directory (a stow link in `~/.config`) makes that
  * directory read-only with each existing entry bound writable again, so only
  * new top-level entries there are refused.
@@ -1373,14 +1371,15 @@ function buildLinuxBroadCommand(
         throw new Error("Linux bubblewrap cannot separate removal from writing for Project files; use Write & delete or Read.");
     }
     const credentials = policy.credentialPaths ?? [];
+    const protectedCredentials = permissions.storedCredentials === "read-write" ? [] : credentials;
     const writeDenied = [...broad.codePaths, ...policy.denyWrite];
     if (permissions.projectFiles === "read-write" &&
-        [...credentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
+        [...protectedCredentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
         throw new Error("Linux bubblewrap cannot make a project writable inside a protected directory.");
     }
     const list = seams.listDirectory ?? systemListDirectory;
     const exists = (path: string) => (seams.pathExists ?? existsSync)(path);
-    const protectedPaths = [...credentials, ...writeDenied];
+    const protectedPaths = [...protectedCredentials, ...writeDenied];
     const insideProtected = (path: string) => protectedPaths.some((guard) => contains(guard, path));
 
     const writable = new Set<string>();
@@ -1498,7 +1497,10 @@ function buildLinuxBroadCommand(
             readOnly.add(path);
         }
     };
-    for (const path of credentials) guard(path, true);
+    for (const path of credentials) {
+        if (permissions.storedCredentials === "off") guard(path, true);
+        else if (permissions.storedCredentials === "read") guard(path, false);
+    }
     for (const path of writeDenied) guard(path, false);
     if (permissions.projectFiles === "read") readOnly.add(project);
 

package/node_modules/pi-better-subagents/README.md

@@ -16,7 +16,7 @@ Use `pi-better-subagents` when you want Pi to launch independent agent work with
 - Explicit tool allowlists for child sessions.
 - Durable logs, result retrieval, and [failure observations](docs/failure-observations.md) independent of lifecycle status. A live child handles its own tool errors; the parent is woken only for actionable incidents, and children can classify handled failures with `failure_disposition`.
 - Live background-work navigator for active runs.
-- Harness-owned run timing: every run gets a soft deadline (30 min, then a wrap-up steer into the child and one parent wake, stopped after 5 min grace), a hard ceiling (90 min), and a no-progress wake (10 min). Override per spawn with `deadline_minutes`, `grace_minutes`, `max_minutes`, `stuck_minutes`, or globally in `config.json` / `PI_SUBAGENT_*_MINUTES`. See [usage notes](docs/usage.md#run-timing-deadline-ceiling-stuck).
+- Harness-owned run timing: every run gets a no-progress wake (10 min), while wall-clock soft deadlines and hard ceilings are opt-in so productive agents are not stopped solely for taking a long time. Configure per spawn with `deadline_minutes`, `grace_minutes`, `max_minutes`, `stuck_minutes`, or globally in `config.json` / `PI_SUBAGENT_*_MINUTES`. See [usage notes](docs/usage.md#run-timing-deadline-ceiling-stuck).
 
 ## Install
 

package/node_modules/pi-better-subagents/index.ts

@@ -17,7 +17,7 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 import * as PiCodingAgent from "@earendil-works/pi-coding-agent";
 import * as PiTui from "@earendil-works/pi-tui";
 import { CustomEditor } from "@earendil-works/pi-coding-agent";
-import { matchesKey, Key, truncateToWidth } from "@earendil-works/pi-tui";
+import { matchesKey, Key, truncateToWidth, type AutocompleteItem } from "@earendil-works/pi-tui";
 import { Type } from "@earendil-works/pi-ai";
 import {
     CLOSE_CONFIRM_STATUS_KEY,
@@ -160,6 +160,18 @@ import {
 } from "./catalog-runtime.ts";
 import { defaultUserRoot, type CatalogSnapshot } from "./catalog-store.ts";
 
+const SUBAGENT_MODE_ACTIONS: readonly AutocompleteItem[] = [
+    { value: "mode manual", label: "mode manual", description: "Delegate only when explicitly requested" },
+    { value: "mode adaptive", label: "mode adaptive", description: "Delegate substantial independent work" },
+    { value: "mode coordinator", label: "mode coordinator", description: "Delegate role-owned work by default" },
+];
+
+export function subagentsArgumentCompletions(argumentPrefix: string): AutocompleteItem[] | null {
+    const prefix = argumentPrefix.trimStart().toLowerCase();
+    const matches = SUBAGENT_MODE_ACTIONS.filter((action) => action.value.startsWith(prefix));
+    return matches.length > 0 ? [...matches] : null;
+}
+
 /** The tools this extension registers — excluded from children by default so a
  *  subagent cannot recursively spawn more subagents unless explicitly allowed. */
 const SUBAGENT_TOOLS = [
@@ -1792,7 +1804,7 @@ export default function (pi: ExtensionAPI) {
             "The tools param is both the tool allowlist AND what determines which extensions load in the child (e.g. tools='read,bash,web_fetch' loads only the web-tools package). Ask for the tools the task needs and nothing more; clean:true gives a built-ins-only child. Without an agent or role, pick a model with the model param (e.g. 'xai/grok-4.5@high'); providerless model patterns are resolved by Pi, while provider/model is deterministic and loads mapped provider extensions.",
             ...CATALOG_GUIDELINES,
             "By default the subagent is sandboxed. Human settings in /sandbox control file, credential-file, command, and network permissions; sandbox:false cannot override an enabled human profile. Without published settings, legacy write confinement applies. Set callback:false to finish quietly — then read the result on demand via subagent_result.",
-            "Every run is timed by the harness: a soft deadline (default 30 min) steers the child to wrap up and wakes you once, the run is stopped after grace_minutes (reason deadline), a hard ceiling (default 90 min) stops it without grace (reason ceiling), and no progress for stuck_minutes (default 10) wakes you once (reason stuck). Set deadline_minutes/max_minutes/stuck_minutes to fit the task instead of writing a time limit into the prompt; do not stop a slow child that is still making progress.",
+            "Every run has harness-owned stall detection: no progress for stuck_minutes (default 10) wakes you once without stopping the run. Elapsed-time limits are opt-in: deadline_minutes steers the child to wrap up and later stops it after grace_minutes, while max_minutes stops it without grace. Do not set elapsed-time limits merely because a task may take a while; use them only when the work needs a real wall-clock bound.",
             "Use git_clone_workspace:true when the subagent will mutate Git in a sandbox. The parent prepares a disposable, self-contained clone with a real .git/ directory inside the sandbox root, so linked-worktree metadata outside the sandbox cannot stall the child.",
         ],
         parameters: Type.Object({
@@ -2138,6 +2150,7 @@ export default function (pi: ExtensionAPI) {
         agentOperations.registerCommands(pi);
         pi.registerCommand("subagents", {
             description: "Show or change the current-session delegation mode",
+            getArgumentCompletions: subagentsArgumentCompletions,
             async handler(args, ctx) {
                 const tokens = args.trim().split(/\s+/).filter(Boolean);
                 if (tokens.length === 0) {

package/node_modules/pi-better-subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-subagents",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "Pi extension for detached, sandboxed subagent runs that keep the foreground session free.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-subagents/shared-sandbox-core.ts

@@ -228,10 +228,7 @@ const CREDENTIAL_LOCATIONS = [
     ".docker/config.json", ".npmrc", ".netrc", ".git-credentials", ".pi/agent/auth.json",
 ] as const;
 
-/**
- * Credential stores added by the broad-write profile. They are never readable
- * or writable there, whatever the Stored credentials row says.
- */
+/** Credential stores added to the Stored credentials row by the broad-write profile. */
 const BROAD_CREDENTIAL_LOCATIONS = [
     "Library/Keychains", ".claude/.credentials.json", ".claude.json", ".gnupg",
     ".codex/auth.json", ".cargo/credentials.toml", ".cargo/credentials", ".pgpass", ".config/rclone",
@@ -386,10 +383,7 @@ function compile(
     return {
         writableRoot, denyWrite, home: policy.home,
         ...(policy.permissions && {
-            // The broad-write profile's credential deny list is not optional.
-            permissions: broadMode
-                ? { ...policy.permissions, storedCredentials: "off" as const }
-                : { ...policy.permissions },
+            permissions: { ...policy.permissions },
             credentialPaths: broadMode ? broadCredentialPaths(policy.home, seams) : credentialFilePaths(policy.home, seams),
             compatibilityWrite,
             runtimeWrite,
@@ -598,7 +592,7 @@ export function evaluateReadAccess(
     const permissions = policy.permissions;
     if (!permissions) return { allowed: true, path };
     if (policy.broad) {
-        const denied = isCredential(path, policy) ||
+        const denied = (isCredential(path, policy) && permissions.storedCredentials === "off") ||
             (permissions.projectFiles === "off" && contains(policy.writableRoot, path));
         return denied ? { allowed: false, path, reason: "read-denied" } : { allowed: true, path };
     }
@@ -652,7 +646,8 @@ function evaluateBroadWrite(
     for (const denied of [...policy.denyWrite, ...broad.codePaths]) {
         if (contains(denied, path)) return { allowed: false, path, reason: "write-denied", deniedBy: denied };
     }
-    if (isCredential(path, policy)) return { allowed: false, path, reason: "permission-denied" };
+    if (isCredential(path, policy)) return canWrite(policy.permissions!.storedCredentials)
+        ? { allowed: true, path } : { allowed: false, path, reason: "permission-denied" };
     if (policy.runtimeWrite?.some((root) => contains(root, path))) return { allowed: true, path };
     if (contains(policy.writableRoot, path)) {
         return canWrite(policy.permissions!.projectFiles)
@@ -808,7 +803,8 @@ export function resetRecoverySnapshotClock(): void {
 }
 
 function broadProtectedPaths(policy: CompiledSandboxWritePolicy, broad: CompiledBroadWrite): string[] {
-    return [...policy.denyWrite, ...(policy.credentialPaths ?? []), ...broad.codePaths,
+    return [...policy.denyWrite,
+        ...(policy.permissions?.storedCredentials === "read-write" ? [] : policy.credentialPaths ?? []), ...broad.codePaths,
         ...(!canWrite(policy.permissions?.projectFiles) ? [policy.writableRoot] : [])];
 }
 
@@ -927,7 +923,7 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[.]worktrees/."))`,
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[^/]+-worktrees/."))`,
     );
-    // The fixed deny list overrides every grant above. A rule naming
+    // Write-denied controls and credentials override every broad grant above. A rule naming
     // `file-write-unlink` outranks a `file-write*` wildcard whatever their
     // order (verified on the real kernel), so each protected path also gets an
     // explicit unlink denial; otherwise the removal grants above would reopen it.
@@ -936,8 +932,8 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
     if (!canWrite(permissions.projectFiles)) denyWrite(project);
     for (const path of broad.codePaths) denyWrite(path);
     for (const path of policy.credentialPaths ?? []) {
-        rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
-        denyWrite(path);
+        if (permissions.storedCredentials === "off") rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
+        if (permissions.storedCredentials !== "read-write") denyWrite(path);
     }
     for (const path of policy.denyWrite) denyWrite(path);
     // Renaming an ancestor would move a protected subtree to an unprotected path,
@@ -1350,9 +1346,11 @@ function maskSources(profilePath: string): { directory: string; file: string } {
  * the root is read-only; temp, the workspace, hidden home entries and worktree
  * folders are writable (removal included); ordinary top-level home folders and
  * home itself stay read-only, so sibling repositories cannot even be edited in
- * place there. Credentials are masked by empty mode-000 mounts; code that runs
- * later and caller-denied paths are read-only binds. Every writable bind and
- * protected leaf is a mount point, which Linux refuses to rename. A protected
+ * place there. Off credentials are masked by empty mode-000 mounts, Read
+ * credentials are read-only binds, and Read / write credentials follow the
+ * surrounding broad-write rules. Code that runs later and caller-denied paths
+ * are read-only binds. Every writable bind and protected leaf is a mount point,
+ * which Linux refuses to rename. A protected
  * symlink inside a writable directory (a stow link in `~/.config`) makes that
  * directory read-only with each existing entry bound writable again, so only
  * new top-level entries there are refused.
@@ -1373,14 +1371,15 @@ function buildLinuxBroadCommand(
         throw new Error("Linux bubblewrap cannot separate removal from writing for Project files; use Write & delete or Read.");
     }
     const credentials = policy.credentialPaths ?? [];
+    const protectedCredentials = permissions.storedCredentials === "read-write" ? [] : credentials;
     const writeDenied = [...broad.codePaths, ...policy.denyWrite];
     if (permissions.projectFiles === "read-write" &&
-        [...credentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
+        [...protectedCredentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
         throw new Error("Linux bubblewrap cannot make a project writable inside a protected directory.");
     }
     const list = seams.listDirectory ?? systemListDirectory;
     const exists = (path: string) => (seams.pathExists ?? existsSync)(path);
-    const protectedPaths = [...credentials, ...writeDenied];
+    const protectedPaths = [...protectedCredentials, ...writeDenied];
     const insideProtected = (path: string) => protectedPaths.some((guard) => contains(guard, path));
 
     const writable = new Set<string>();
@@ -1498,7 +1497,10 @@ function buildLinuxBroadCommand(
             readOnly.add(path);
         }
     };
-    for (const path of credentials) guard(path, true);
+    for (const path of credentials) {
+        if (permissions.storedCredentials === "off") guard(path, true);
+        else if (permissions.storedCredentials === "read") guard(path, false);
+    }
     for (const path of writeDenied) guard(path, false);
     if (permissions.projectFiles === "read") readOnly.add(project);
 

package/node_modules/pi-better-subagents/timing.ts

@@ -1,5 +1,5 @@
 /**
- * Harness-owned run timing: a soft deadline with grace, a hard ceiling, and
+ * Harness-owned run timing: optional elapsed-time limits and default-on
  * no-progress (stuck) detection for every subagent run.
  *
  * Timeout control belongs to the harness, not to the prompt or the skill that
@@ -22,9 +22,10 @@
  * with null/absent optional fields treated alike as in #336). A successful
  * `edit`/`write`, a `git commit`, and a success directly after a failure always
  * count, even when repeated. Re-reading the same file or re-running the same
- * command with the same arguments does not. Time spent waiting on a running tool call does not count toward
- * the stuck window, so a child in the middle of a 20-minute test run is not
- * stuck; a hung command is bounded by the deadline and the ceiling instead.
+ * command with the same arguments does not. Time spent waiting on a running
+ * tool call does not count toward the stuck window, so a child in the middle
+ * of a 20-minute test run is not stuck. A caller that needs to bound a
+ * possibly hung command can opt into a ceiling.
  */
 
 import { createHash } from "node:crypto";
@@ -34,9 +35,9 @@ export type TimingReason = TimingStopReason | "stuck";
 
 /** Built-in defaults, in minutes. `0` disables that control. */
 export const DEFAULT_TIMING_MINUTES = Object.freeze({
-    deadline: 30,
+    deadline: 0,
     grace: 5,
-    max: 90,
+    max: 0,
     stuck: 10,
 });
 
@@ -151,9 +152,9 @@ export function resolveRunTiming(input: {
 // ---- tool parameters -------------------------------------------------------
 
 const TIMING_DESCRIPTIONS = {
-    deadline_minutes: "Soft deadline in minutes (default 30; 0 = none; null or omitted = inherit: in a batch job the shared value, otherwise the default). At the deadline the child is told to stop starting new work, commit what is done, and report, and you get one wake. Grace starts when the message reaches the child (after its current tool call); if it has not finished by then, the harness stops it with reason deadline.",
+    deadline_minutes: "Optional soft deadline in minutes (default: none; 0 = none; null or omitted = inherit: in a batch job the shared value, otherwise the default). At the deadline the child is told to stop starting new work, commit what is done, and report, and you get one wake. Grace starts when the message reaches the child (after its current tool call); if it has not finished by then, the harness stops it with reason deadline.",
     grace_minutes: "Minutes after the wrap-up message reaches the child before the run is stopped (default 5; null or omitted = inherit).",
-    max_minutes: "Hard ceiling in minutes (default 90; 0 = none; null or omitted = inherit). The run is stopped at once, without grace, with reason ceiling.",
+    max_minutes: "Optional hard ceiling in minutes (default: none; 0 = none; null or omitted = inherit). The run is stopped at once, without grace, with reason ceiling.",
     stuck_minutes: "No-progress window in minutes (default 10; 0 = off; null or omitted = inherit). Progress is any successful tool call that is not an exact repeat of an earlier one (same tool, same arguments); edits, writes, commits, and a success after a failure always count. Time inside a running tool call does not count. Wakes you once per stuck spell; never stops the run.",
 } as const;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-harness",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Pi extension bundle for a write sandbox, subagents, background tasks, SSH, goals, and structured plans.",
   "license": "MIT",
   "type": "module",
@@ -50,12 +50,12 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "pi-better-background-tasks": "0.6.1",
+    "pi-better-background-tasks": "0.6.2",
     "pi-better-goal": "0.5.0",
-    "pi-better-plan": "0.5.0",
-    "pi-better-sandbox": "0.7.2",
+    "pi-better-plan": "0.5.1",
+    "pi-better-sandbox": "0.7.3",
     "pi-better-ssh": "0.1.1",
-    "pi-better-subagents": "0.9.2",
+    "pi-better-subagents": "0.9.3",
     "smol-toml": "1.9.0",
     "yaml": "^2.9.1"
   },