pi-better-harness 0.15.3 → 0.17.0

package/node_modules/pi-better-goal/README.md

@@ -17,7 +17,7 @@ Use `pi-better-goal` when a Pi session should keep an explicit objective visible
 - Background work that finishes while an `ask_user_question` is pending is handed to the agent right after the answer.
 - A compact goal widget that does not replace Pi's footer.
 - Background activity tracking for subagents and other registered providers.
-- A progress-aware follow-up loop with ten identical no-progress retries and linear backoff (30s through 300s by default), followed by a hold recoverable with `/goal resume`. Delays saturate at Node's timer limit, and observed background drains reset progress before callback turns can cancel the wake. Pi's network retry policy remains independent.
+- A progress-aware follow-up loop with ten identical no-progress retries and linear backoff (60s through 600s by default), followed by a hold recoverable with `/goal resume`. Delays saturate at Node's timer limit, and observed background drains reset progress before callback turns can cancel the wake. Pi's network retry policy remains independent.
 - An observable-progress stall state for active goals.
 
 ## Skill-Owned Workflows

package/node_modules/pi-better-goal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-goal",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Pi extension for goal tracking with background-aware continuation.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-goal/src/index.ts

@@ -50,7 +50,7 @@ import {
 } from "./types.js";
 
 const POLL_INTERVAL_MS = 2_000;
-const DEFAULT_IDLE_CONTINUATION_DELAY_MS = 30_000;
+const DEFAULT_IDLE_CONTINUATION_DELAY_MS = 60_000;
 const DEFAULT_MAX_NO_PROGRESS_RETRIES = 10;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
 const WAKE_DISABLED =
@@ -124,7 +124,7 @@ function parseDurationEnv(raw: string | undefined, fallback: number): number {
 
 /**
  * Linear backoff for no-progress retries: each identical outcome waits one more
- * grace period than the last (30s, 60s, 90s, ... by default).
+ * grace period than the last (60s, 120s, 180s, ... by default).
  */
 export function idleContinuationDelay(noProgressRetries: number, baseMs = IDLE_CONTINUATION_DELAY_MS): number {
   return Math.min(MAX_TIMER_DELAY_MS, baseMs * (1 + Math.max(0, noProgressRetries)));

package/node_modules/pi-better-sandbox/README.md

@@ -11,7 +11,8 @@ pi install npm:pi-better-sandbox
 Either way you keep starting Pi the way you always have — `pi`. There is
 no launcher or wrapper command. Main starts inactive; Subagents start confined.
 Open `/sandbox` to change either column, or use `/sandbox on` for the current
-Main session. **Save as defaults** persists both profiles.
+Main session. Edits apply immediately and are saved to the current session branch.
+**Ctrl+S** saves both profiles as defaults for new sessions.
 
 ```text
 Sandbox permissions               Main             Subagents
@@ -31,8 +32,7 @@ Network access                    -                On
     > [x] @juicesharp/rpiv-web-tools  2/2
     > [ ] <other installed package>  0/1
 
-↑↓ Select row   ←→ Select column / expand / collapse   Enter Fold   Space Change
-Save as defaults
+↑↓ Select · ←→ Column/fold · Space Toggle · ctrl+s Save default · Enter Fold · Esc Back
 ```
 
 **Subagents · Tools** picks the extension tools a confined subagent may use:
@@ -56,7 +56,7 @@ are; the count is selected/total. Right expands a group. Left collapses a group,
 or moves from a child to its parent and collapses it. Enter folds the selected
 group. Space on a group selects all children when none or only some are selected,
 or deselects them all when all are selected. Every toggle applies on one Space;
-saving looser defaults still needs a second Enter. Only individual tool
+Ctrl+S saves defaults and reports anything loosened. Only individual tool
 entries are saved, never a package/provider wildcard or the open/closed state.
 
 Defaults: `apply_patch`, `web_fetch`, and `web_search` on; everything else off.
@@ -123,7 +123,7 @@ Write, those paths are also protected from removal and renaming.
 Space applies every change immediately, including higher permission levels,
 capabilities switched on, and a sandbox switched off. `ctrl+s` saves the
 defaults from any row on the first press, and the note names anything that
-loosened. Enter on the Save row still saves. The focused
+loosened. Enter only folds tool groups; it never saves defaults. The focused
 row has a full-width background and bold text; the selected Main/Subagents cell
 also uses inverse styling. No model
 tool can change these settings. Other rows toggle Off/On. Detail cells under an
@@ -319,7 +319,7 @@ in your rule set but is held out in that project, with a message saying so.
 Nothing is migrated on disk. A saved `pi-better-sandbox-permissions.json` keeps
 its values: a saved `read-write` is now shown as Write & delete, and a saved
 Subagents Outside project = Read stays Read. Only a fresh configuration, or
-**Save as defaults** after you choose Write, uses the new Subagents default. To
+**Ctrl+S** after you choose Write, uses the new Subagents default. To
 adopt it, open `/sandbox`, set Subagents → Outside project to Write, and save.
 
 `~/.pi/agent/sandbox.json` (`filesystem.allowWrite`, `allowRead`,
@@ -328,12 +328,19 @@ package never reads it, and it has no effect on the harness.
 
 ## Lifecycle
 
-The foreground sandbox is inactive by default. Session overrides do not survive
-startup, new session, resume, fork, or reload. Save as defaults writes both
+The foreground sandbox is inactive by default. Permission edits, including
+Sandbox switches and `/sandbox on|off`, auto-persist as Pi custom entries on the
+current session branch, not as global defaults. Resume, fork, reload and session
+tree navigation restore the latest policy on the active branch. A branch with
+no permission entry and a new session inherit saved global settings. Invalid
+persisted session policy fails closed rather than falling back to defaults.
+Ctrl+S writes both
 profiles to `~/.pi/agent/extensions/pi-better-sandbox-permissions.json` (or the
 corresponding `$PI_CODING_AGENT_DIR`). Existing activation preferences in
 `pi-better-sandbox-preferences.json` migrate when no profile file exists.
 `/sandbox default on|off` remains available and updates Main's saved switch.
+Failed default saves leave the current session's edits intact. Write-deny rules
+retain their separate global persistence through `/sandbox deny` and `/sandbox rules`.
 
 Toggles apply to operations launched after the change. A command already running
 keeps the policy it launched with.

package/node_modules/pi-better-sandbox/commands.ts

@@ -55,8 +55,8 @@ const DISABLE_TITLE = "Disable the foreground write sandbox?";
 
 const DISABLE_MESSAGE = [
     "The built-in bash, write, and edit tools and user-entered ! / !! commands",
-    "will run with normal host write access for the rest of this session. The",
-    "next session applies your persisted foreground sandbox default.",
+    "will run with normal host write access on this session branch, including",
+    "after resume or reload. New sessions apply your saved sandbox default.",
 ].join("\n");
 
 const NO_UI_REJECTION =
@@ -80,6 +80,8 @@ export type SandboxCommandDeps = {
     onStateChange: (status: ForegroundSandboxStatus) => void;
     /** Persist a default and apply it to the current session. */
     setDefault: (enabled: boolean) => ForegroundSandboxStatus;
+    /** Persist the session change before mutating enforcement. */
+    setSessionEnabled?: (enabled: boolean) => ForegroundSandboxStatus;
     openPermissions?: (ctx: ExtensionCommandContext) => Promise<void>;
 };
 
@@ -89,6 +91,7 @@ export function createSandboxCommandHandler({
     denyRules,
     onStateChange,
     setDefault,
+    setSessionEnabled,
     openPermissions,
 }: SandboxCommandDeps) {
     return async function handleSandboxCommand(
@@ -112,7 +115,12 @@ export function createSandboxCommandHandler({
         }
 
         if (subcommand === "on") {
-            const status = controller.enable();
+            let status: ForegroundSandboxStatus;
+            try { status = setSessionEnabled ? setSessionEnabled(true) : controller.enable(); }
+            catch (error) {
+                ctx.ui.notify(`Sandbox state unchanged: ${error instanceof Error ? error.message : String(error)}`, "error");
+                return;
+            }
             onStateChange(status);
             ctx.ui.notify(
                 status.state === "enabled"
@@ -140,7 +148,12 @@ export function createSandboxCommandHandler({
                 ctx.ui.notify("Foreground sandbox left on.", "info");
                 return;
             }
-            const status = controller.disable();
+            let status: ForegroundSandboxStatus;
+            try { status = setSessionEnabled ? setSessionEnabled(false) : controller.disable(); }
+            catch (error) {
+                ctx.ui.notify(`Sandbox state unchanged: ${error instanceof Error ? error.message : String(error)}`, "error");
+                return;
+            }
             onStateChange(status);
             ctx.ui.notify(
                 "Foreground sandbox OFF for this session. Shell commands can now write anywhere.",

package/node_modules/pi-better-sandbox/index.ts

@@ -38,6 +38,7 @@ import { writeSandboxDefault } from "./preferences.ts";
 import { readPermissionSettings, writePermissionSettings } from "./permission-settings.ts";
 import { defaultSandboxPermissions, describeLoosening, type SandboxPermissionSettings } from "./permissions.ts";
 import { openPermissionsPage } from "./permissions-page.ts";
+import { appendSessionPermissions, readSessionPermissions } from "./session-permissions.ts";
 
 import { footerTone, formatFooterStatus } from "./status.ts";
 import { ForegroundSandboxController, type ForegroundSandboxStatus } from "./state.ts";
@@ -98,9 +99,7 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
     // `/sandbox deny ...` and the `/sandbox rules` page.
     const denyRules = new DenyRuleManager({ controller, onStateChange: announce });
 
-    pi.on("session_start", (_event, ctx: ExtensionContext) => {
-        shellPath = resolveShellPath(ctx.cwd);
-        boundary.register(ctx.cwd);
+    const restorePermissions = (ctx: ExtensionContext): void => {
         paintFooter = (status) => {
             ctx.ui.setStatus(
                 FOOTER_KEY,
@@ -108,11 +107,14 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
             );
         };
 
-        // Re-read saved profiles on each session. Malformed policy blocks protected
-        // operations rather than silently widening a restricted session.
+        // Session policy takes precedence over global defaults. Never skip an
+        // invalid latest entry to recover an older, potentially broader policy.
         let settings = defaultSandboxPermissions();
+        let hasSessionPolicy = false;
         try {
-            settings = readPermissionSettings();
+            const sessionPermissions = readSessionPermissions(ctx);
+            hasSessionPolicy = sessionPermissions !== undefined;
+            settings = sessionPermissions ?? readPermissionSettings();
         } catch (error) {
             controller.beginSession(ctx.cwd, true);
             const message = `Sandbox permissions could not be loaded: ${error instanceof Error ? error.message : String(error)}`;
@@ -130,7 +132,7 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
             .map((tool) => tool.sourceInfo?.path).filter((path): path is string => typeof path === "string" && isAbsolute(path))
             .map(runtimeCodeRoot));
         controller.setPermissionSettings(settings);
-        controller.applyDefault(settings.main.enabled);
+        if (!hasSessionPolicy) controller.applyDefault(settings.main.enabled);
 
         // Then the rules are re-read and re-resolved, because the same global
         // template set means different absolute paths in a different project.
@@ -154,7 +156,14 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
                 status.state === "disabled" ? "info" : "warning",
             );
         }
+    };
+
+    pi.on("session_start", (_event, ctx) => {
+        shellPath = resolveShellPath(ctx.cwd);
+        boundary.register(ctx.cwd);
+        restorePermissions(ctx);
     });
+    pi.on("session_tree", (_event, ctx) => restorePermissions(ctx));
 
     pi.on("session_shutdown", () => {
         controller.dispose();
@@ -167,11 +176,18 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
             controller,
             denyRules,
             onStateChange: announce,
+            setSessionEnabled: (enabled) => {
+                const settings = controller.permissionSettings() ?? defaultSandboxPermissions();
+                settings.main.enabled = enabled;
+                appendSessionPermissions(pi, settings);
+                return enabled ? controller.enable() : controller.disable();
+            },
             setDefault: (enabled) => {
                 const settings = controller.permissionSettings() ?? defaultSandboxPermissions();
                 settings.main.enabled = enabled;
                 writePermissionSettings(settings);
                 writeSandboxDefault(enabled ? "on" : "off");
+                appendSessionPermissions(pi, settings);
                 return controller.setPermissionSettings(settings);
             },
             openPermissions: async (ctx) => {
@@ -179,9 +195,12 @@ export default function piBetterSandbox(pi: ExtensionAPI): void {
                     getConfig: () => controller.permissionSettings() ?? defaultSandboxPermissions(),
                     // Trusted-tool candidates: what this Pi has actually registered, by owning package.
                     discoverTools: () => discoverTrustedTools(pi.getAllTools?.() ?? []),
-                    change: (settings) => announce(controller.setPermissionSettings(settings)),
+                    change: (settings) => {
+                        appendSessionPermissions(pi, settings);
+                        announce(controller.setPermissionSettings(settings));
+                    },
                     save: (settings) => writePermissionSettings(settings),
-                    // Persisting a looser default needs a second, explicit Enter.
+                    // Report every capability loosened by saving these defaults.
                     loosening: (settings) => {
                         let previous: SandboxPermissionSettings;
                         try { previous = readPermissionSettings(); } catch { previous = defaultSandboxPermissions(); }

package/node_modules/pi-better-sandbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-sandbox",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Pi extension with independent Main and Subagents permission profiles, file guards, and OS sandbox enforcement.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-sandbox/permissions-page.ts

@@ -124,7 +124,7 @@ export function createPermissionsPage(
     const itemKey = (item: ToolItem) => item.kind === "group" ? item.id
         : item.kind === "guarded" ? "apply_patch" : JSON.stringify([item.name, item.package]);
     let items = toolItems();
-    const saveRow = () => rows.length + items.length;
+    const lastRow = () => rows.length + items.length - 1;
     let row = 0;
     let column = 0;
     let busy = false;
@@ -136,7 +136,7 @@ export function createPermissionsPage(
     }
 
     async function change(): Promise<void> {
-        if (!settings || busy || row === saveRow()) return;
+        if (!settings || busy) return;
         const next = snapshot(settings);
         if (row >= rows.length) {
             const item = items[row - rows.length]!;
@@ -173,15 +173,14 @@ export function createPermissionsPage(
         busy = true;
         try {
             await handlers.change(snapshot(next));
-            const selected = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
-            const wasSave = row === saveRow();
+            const selected = row >= rows.length ? items[row - rows.length] : undefined;
             const successors = selected ? items.slice(row - rows.length + 1).map(itemKey) : [];
             settings = next;
             items = toolItems();
             const index = selected ? items.findIndex((item) => itemKey(item) === itemKey(selected)) : -1;
             const successor = successors.map((key) => items.findIndex((item) => itemKey(item) === key)).find((at) => at >= 0);
-            row = wasSave ? saveRow() : index >= 0 ? rows.length + index
-                : successor !== undefined ? rows.length + successor : Math.min(row, saveRow());
+            row = index >= 0 ? rows.length + index
+                : successor !== undefined ? rows.length + successor : Math.min(row, lastRow());
             message = "";
             isError = false;
             requestRender();
@@ -215,7 +214,7 @@ export function createPermissionsPage(
     }
 
     function fold(open?: boolean): void {
-        const item = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
+        const item = row >= rows.length ? items[row - rows.length] : undefined;
         const id = item?.kind === "group" ? item.id : item?.kind === "trusted" && open === false ? item.group : undefined;
         if (!id) return;
         if (open ?? !expanded.has(id)) expanded.add(id);
@@ -234,22 +233,20 @@ export function createPermissionsPage(
                 row = Math.max(0, row - 1);
                 requestRender();
             } else if (matchesKey(data, Key.down)) {
-                row = Math.min(saveRow(), row + 1);
+                row = Math.min(lastRow(), row + 1);
                 requestRender();
             } else if (matchesKey(data, Key.left)) {
-                if (row >= rows.length && row < saveRow()) fold(false);
+                if (row >= rows.length) fold(false);
                 else column = 0;
                 requestRender();
             } else if (matchesKey(data, Key.right)) {
-                if (row >= rows.length && row < saveRow()) fold(true);
+                if (row >= rows.length) fold(true);
                 else column = 1;
                 requestRender();
             } else if (matchesKey(data, Key.space)) {
                 void change();
             } else if (matchesKey(data, "ctrl+s")) {
                 void save();
-            } else if (matchesKey(data, Key.enter) && row === saveRow()) {
-                void save();
             } else if (matchesKey(data, Key.enter)) {
                 fold();
             }
@@ -315,13 +312,13 @@ export function createPermissionsPage(
                 output.push(theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}  Trusted (runs outside the file rules)`, w, "")),
                     theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}    No other extension tools are installed.`, w, "")));
             }
-            output.push("", line("Save as defaults", "", "", row === saveRow()));
+            output.push("");
             const selected = row < rows.length ? rows[row]!.key : undefined;
-            const tool = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
+            const tool = row >= rows.length ? items[row - rows.length] : undefined;
             const contextual = tool ? (tool.kind === "guarded" ? GUARDED_HINT : TRUSTED_HINT)
                 : selected && settings ? cellHint(selected, settings[columns[column]!]) : undefined;
             for (const hint of [
-                "↑↓ Select · ←→ Column/fold · Space Toggle · ctrl+s Save · Enter Fold · Esc Back",
+                "↑↓ Select · ←→ Column/fold · Space Toggle · ctrl+s Save default · Enter Fold · Esc Back",
                 "Changes apply to new launches. Background tasks follow their launcher.",
                 "Stored credentials: known files only; excludes OS vaults and environment tokens.",
                 "Trusted tools run outside the file rules.",

package/node_modules/pi-better-sandbox/session-permissions.ts

@@ -0,0 +1,24 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { parseSandboxPermissions, type SandboxPermissionSettings } from "./permissions.ts";
+
+export const SESSION_PERMISSION_ENTRY = "pi-better-sandbox-permissions";
+
+/** Only the active branch contributes policy; the newest entry must validate. */
+export function readSessionPermissions(ctx: ExtensionContext): SandboxPermissionSettings | undefined {
+    const entry = [...ctx.sessionManager.getBranch()].reverse().find((entry) =>
+        entry.type === "custom" && entry.customType === SESSION_PERMISSION_ENTRY);
+    if (!entry || entry.type !== "custom") return undefined;
+    const data = entry.data as { version?: unknown; permissions?: unknown } | undefined;
+    if (!data || data.version !== 1) throw new Error("Unsupported sandbox session permissions version.");
+    // Session snapshots have always included Tools. Unlike old global files,
+    // an incomplete snapshot must not gain the default trusted-tool grants.
+    if (!data.permissions || typeof data.permissions !== "object" ||
+        (data.permissions as { subagentTools?: unknown }).subagentTools === undefined) {
+        throw new Error("Sandbox session permissions require explicit subagent tool settings.");
+    }
+    return parseSandboxPermissions(data.permissions);
+}
+
+export function appendSessionPermissions(pi: ExtensionAPI, settings: SandboxPermissionSettings): void {
+    pi.appendEntry(SESSION_PERMISSION_ENTRY, { version: 1, permissions: parseSandboxPermissions(settings) });
+}

package/node_modules/pi-better-sandbox/shared-task-sandbox.ts

@@ -6,6 +6,8 @@ const { createBashToolDefinition, createReadToolDefinition, createWriteToolDefin
     createEditToolDefinition, createLocalBashOperations, getShellConfig } = PiCodingAgent;
 import { pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { unlink } from "node:fs/promises";
 import { accessSync, constants, lstatSync, mkdirSync, mkdtempSync, readlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, resolve, sep } from "node:path";
@@ -117,42 +119,51 @@ export function createTaskBashOperations(
             const scratch = plan.policy.runtimeWrite?.[0];
             const taskEnv = { ...process.env, ...options.env,
                 ...(scratch ? { TMPDIR: scratch, TMP: scratch, TEMP: scratch } : {}) };
-            const wrapped = maybeBuildSandboxCommand({
-                policy: plan.policy, profilePath: plan.profilePath,
-                execPath: "/usr/bin/env", execArgs: ["-i", "--", ...Object.entries(taskEnv)
-                    .filter((entry): entry is [string, string] => entry[1] !== undefined)
-                    .map(([key, value]) => `${key}=${value}`), shell.shell, ...shell.args, command],
-            }, { sandboxEnabled: true, explicitSandbox: true });
-            if (!wrapped) throw new Error("Sandbox: no task execution backend is available.");
-            for (const line of wrapped.notices ?? []) options.onData(Buffer.from(`${line}\n`));
             if (options.signal?.aborted) throw new Error("aborted");
             if (options.timeout !== undefined && (!Number.isFinite(options.timeout) || options.timeout <= 0 || options.timeout * 1000 > 2147483647)) {
                 throw new Error("Invalid timeout: must be a positive, supported number of seconds");
             }
-            // No shell or caller-controlled loader environment runs before the boundary.
-            return new Promise((resolve, reject) => {
-                const child = spawn(wrapped.file, wrapped.fileArgs, { cwd, detached: true,
-                    env: { PATH: "/usr/bin:/bin", HOME: plan.policy.home }, stdio: ["ignore", "pipe", "pipe"] });
-                let timedOut = false;
-                const kill = () => { if (child.pid) { try { process.kill(-child.pid, "SIGKILL"); } catch { child.kill("SIGKILL"); } } };
-                const timer = options.timeout === undefined ? undefined : setTimeout(() => { timedOut = true; kill(); }, options.timeout * 1000);
-                if (child.pid) trackDetachedChildPid(child.pid);
-                const cleanup = () => {
-                    if (child.pid) untrackDetachedChildPid(child.pid);
-                    if (timer) clearTimeout(timer);
-                    options.signal?.removeEventListener("abort", kill);
-                };
-                child.stdout.on("data", options.onData);
-                child.stderr.on("data", options.onData);
-                options.signal?.addEventListener("abort", kill, { once: true });
-                if (options.signal?.aborted) kill();
-                void waitForChildProcess(child).then((exitCode: number | null) => {
-                    cleanup();
-                    if (options.signal?.aborted) reject(new Error("aborted"));
-                    else if (timedOut) reject(new Error(`timeout:${options.timeout}`));
-                    else resolve({ exitCode });
-                }, (error: unknown) => { cleanup(); reject(error); });
-            });
+            // A sibling launch must never rewrite a profile another process is reading.
+            const profilePath = `${plan.profilePath}.${randomUUID()}.bash.sb`;
+            try {
+                const wrapped = maybeBuildSandboxCommand({
+                    policy: plan.policy, profilePath,
+                    execPath: "/usr/bin/env", execArgs: ["-i", "--", ...Object.entries(taskEnv)
+                        .filter((entry): entry is [string, string] => entry[1] !== undefined)
+                        .map(([key, value]) => `${key}=${value}`), shell.shell, ...shell.args, command],
+                }, { sandboxEnabled: true, explicitSandbox: true });
+                if (!wrapped) throw new Error("Sandbox: no task execution backend is available.");
+                for (const line of wrapped.notices ?? []) options.onData(Buffer.from(`${line}\n`));
+                if (options.signal?.aborted) throw new Error("aborted");
+                // No shell or caller-controlled loader environment runs before the boundary.
+                return await new Promise<{ exitCode: number | null }>((resolve, reject) => {
+                    const child = spawn(wrapped.file, wrapped.fileArgs, { cwd, detached: true,
+                        env: { PATH: "/usr/bin:/bin", HOME: plan.policy.home }, stdio: ["ignore", "pipe", "pipe"] });
+                    let timedOut = false;
+                    const kill = () => { if (child.pid) { try { process.kill(-child.pid, "SIGKILL"); } catch { child.kill("SIGKILL"); } } };
+                    const timer = options.timeout === undefined ? undefined : setTimeout(() => { timedOut = true; kill(); }, options.timeout * 1000);
+                    if (child.pid) trackDetachedChildPid(child.pid);
+                    const cleanup = () => {
+                        if (child.pid) untrackDetachedChildPid(child.pid);
+                        if (timer) clearTimeout(timer);
+                        options.signal?.removeEventListener("abort", kill);
+                    };
+                    child.stdout.on("data", options.onData);
+                    child.stderr.on("data", options.onData);
+                    options.signal?.addEventListener("abort", kill, { once: true });
+                    if (options.signal?.aborted) kill();
+                    void waitForChildProcess(child).then((exitCode: number | null) => {
+                        cleanup();
+                        if (options.signal?.aborted) reject(new Error("aborted"));
+                        else if (timedOut) reject(new Error(`timeout:${options.timeout}`));
+                        else resolve({ exitCode });
+                    }, (error: unknown) => { cleanup(); reject(error); });
+                });
+            } finally {
+                await unlink(profilePath).catch((error: NodeJS.ErrnoException) => {
+                    if (error.code !== "ENOENT") throw error;
+                });
+            }
         },
     };
 }

package/node_modules/pi-better-sandbox/state.ts

@@ -6,9 +6,8 @@
  * the *effective* status derived from live runtime evidence (which backend this
  * platform actually resolves, not what the package intended).
  *
- * Session overrides are deliberately in-memory only. Every session start —
- * startup, new, resume, fork, reload — calls `beginSession` with the persisted
- * default and clears the previous override.
+ * The extension persists permission snapshots in Pi custom entries and restores
+ * the active branch after `beginSession` resets this in-memory controller.
  */
 
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
@@ -132,7 +131,7 @@ export class ForegroundSandboxController {
 
     /**
      * Capture the canonical launch directory and apply the persisted default.
-     * A session override never survives a new, resumed, forked, or reloaded session.
+     * The extension then restores any permissions on the active session branch.
      */
     beginSession(cwd: string, defaultEnabled = false): ForegroundSandboxStatus {
         const projectRoot = canonicalizePath(cwd, this.#seams);
@@ -156,7 +155,7 @@ export class ForegroundSandboxController {
         return this.status();
     }
 
-    /** Turn protection off for this session only. Never persisted. */
+    /** Turn protection off for this session; persistence belongs to the extension. */
     disable(): ForegroundSandboxStatus {
         this.#sessionOverride = false;
         this.#policyProblem = undefined;

package/node_modules/pi-better-subagents/README.md

@@ -36,10 +36,14 @@ Linux confinement requires a usable `bubblewrap` backend and Pi SDK 0.82.1 or ne
 ## Delegation Modes
 
 `config.json` sets `delegationMode` to `manual`, `adaptive` (default), or
-`coordinator`. `/subagents` displays the active mode, and
-`/subagents mode manual|adaptive|coordinator` changes it for the current
-session without changing config. `/subagents save` writes the current mode as
-the next session's default. The navigator's `main` row opens the same control:
+`coordinator`. `/subagents settings` (or `/subagents`) opens a settings page
+for delegation mode and the concurrent-subagent cap (default 4). Edits apply to
+this session and persist across reloads; Ctrl+S saves both as defaults, and
+Reset to defaults clears
+session overrides. `/subagents mode manual|adaptive|coordinator` and
+`/subagents cap <number>` are command equivalents; `/subagents save` persists
+both. Lowering the cap blocks new single and batch launches without stopping
+running work. The navigator's `main` row retains its mode-only controls:
 `m` cycles the session mode, `ctrl+s` saves that default, and `x`
 does not stop it. Manual delegates only on explicit user or workflow request, even with a
 plan. Adaptive delegates substantial independent work when useful. Coordinator