pi-better-harness 0.41.0 → 0.41.1

package/node_modules/pi-better-subagents/docs/usage.md

@@ -146,7 +146,10 @@ Each attempt gets a new run id, log, timing record, and capacity slot while the
 native session id and history stay the same. The launch recipe preserves the
 worker's role, tools, skill exposure, model, and workspace, including uncommitted
 changes. Repeating a launch-only option is accepted only with the saved value;
-a different `skills` list is refused rather than silently dropped.
+a different `skills` list is refused rather than silently dropped. A continuation
+whose frozen tool loadout can no longer be admitted (for example its trusted
+package is gone) is refused before anything is spawned, instead of reopening the
+saved conversation with different tools.
 
 A run stopped with `subagent_stop` (status `killed`) can be continued the same
 way. Stopping ends that execution, not the saved conversation or its
@@ -522,11 +525,15 @@ chosen in `/sandbox` → Subagents · Tools
   name is refused. A single extension file with no package manifest is loaded
   and admitted by itself, never its directory. Known network tool names
   (`web_fetch`, `web_search`, `firecrawl_scrape`, `firecrawl_extract`, `mcp`, `mcpScript`, `remote_bash`, and any `mcp__*` name) are refused while Network access is Off; this is a name list, not a
-  network sandbox. A ticked tool whose package can't be found is refused at launch. Ticked tools
-  join the default tool list; an explicit `tools` list still decides.
-
-Other tools are disabled in confined children and listed in launch output with
-the reason. The launch line shows what was admitted, for example
+  network sandbox. A ticked tool whose package can't be found is left out of a
+  default loadout and reported with its reason in the launch output; an explicit
+  `tools` request for a tool the task boundary cannot provide refuses the launch.
+  Ticked tools join the default tool list; an explicit `tools` list still decides.
+
+Other tools are disabled in confined children. One that only joined the default
+loadout is omitted from the child and listed in launch output with the reason;
+one the caller named in `tools` refuses the launch with the reason. The launch
+line shows what was admitted, for example
 `Runtime: isolated · guarded apply_patch · trusted web_fetch (@juicesharp/rpiv-web-tools)`.
 Provider extensions are trusted runtime code; arbitrary extension tools are not
 admitted merely because their names were requested. Confined children disable project

package/node_modules/pi-better-subagents/index.ts

@@ -62,7 +62,7 @@ import { resolveExtensions, extensionArgs } from "./extensions.ts";
 import { prepareTaskRuntime, applyDirectApplicationLoadout, RUN_APPLICATION, SDK_BUILTIN_TOOLS } from "./task-policy.ts";
 import { canonicalizePath, takeRecoverySnapshot } from "./shared-sandbox-core.ts";
 import { TASK_BUILTINS } from "./shared-task-sandbox.ts";
-import { APPLY_PATCH, describeTaskTools, planTaskTools } from "./subagent-tools.ts";
+import { APPLY_PATCH, describeTaskTools, planTaskTools, selectEffectiveTaskTools } from "./subagent-tools.ts";
 import {
     announceExecutionAdapter, observeSandboxPermissions, resolveCommandSettings, resolveSubagentPermissions,
 } from "./permission-policy.ts";
@@ -2574,13 +2574,51 @@ export default function (pi: ExtensionAPI) {
                 }).tools.join(",");
             }
             const bridgeToolNames = new Set<string>(bridgeEnabled ? bridgePlan.tools : []);
+            // A bridge tool the supervisor withholds (no production schema, clean,
+            // excluded) explains itself better than extension admission would.
+            const withheldBridgeReasons = new Map<string, string>(bridgePlan.withheld.map((tool) => [tool.name, tool.reason]));
+            // Candidates for the task-tool plan: exclusions and bridge-supplied
+            // names never reach extension admission.
+            const plannedTools = allow.split(",").filter((name) => name && !requestedExcludes.has(name) && !bridgeToolNames.has(name));
             const taskTools = sandboxEnabled ? planTaskTools({
-                requested: allow.split(",").filter((name) => name && !requestedExcludes.has(name) && !bridgeToolNames.has(name)),
+                requested: plannedTools,
                 settings: permissionPlan.tools, network: permissionPlan.permissions?.network ?? true,
                 processAccess: permissionPlan.permissions?.processAccess ?? "off",
                 builtins: [...TASK_BUILTINS, "codemode"], registered: pi.getAllTools?.() ?? [],
                 toolExtensions: cfg.toolExtensions, resolvePath: resolveExtensionPath,
             }) : undefined;
+            // One effective selection feeds the task policy, child preflight, worker
+            // bridge and frozen recipe, so a refused tool cannot leak into any of them
+            // (#669). A name this attempt requires - the caller's explicit `tools`, or a
+            // continuation's frozen loadout - refuses the launch instead of narrowing it;
+            // an inherited default is dropped from the child with the reason.
+            const requiredToolNames = new Set(requestedTools === undefined
+                ? []
+                : requestedTools.split(",").map((name) => name.trim()).filter(Boolean));
+            const toolSelection = taskTools
+                ? selectEffectiveTaskTools({
+                    tools: allow.split(",").filter(Boolean), plan: taskTools, required: requiredToolNames,
+                })
+                : undefined;
+            if (toolSelection?.required.length) {
+                const detail = toolSelection.required
+                    .map((tool) => `${tool.name} (${withheldBridgeReasons.get(tool.name) ?? tool.reason})`).join(", ");
+                throw resume
+                    ? new ContinuationError(
+                        `Cannot continue ${resume.prior.id}: its frozen launch requires tool(s) this parent can no longer provide: ${detail}. ` +
+                        `Launch a new run instead of continuing this conversation.`,
+                    )
+                    : new Error(
+                        `Requested tool(s) are not available in the task sandbox: ${detail}. ` +
+                        `Remove them from the tools list, or make them available in /sandbox (Subagents · Tools); nothing was launched.`,
+                    );
+            }
+            if (toolSelection) {
+                if (plannedTools.length > 0 && toolSelection.tools.length === 0) {
+                    throw new Error(`No requested tool has a verified task sandbox adapter: ${toolSelection.refused.map((tool) => `${tool.name} (${withheldBridgeReasons.get(tool.name) ?? tool.reason})`).join(", ")}.`);
+                }
+                allow = toolSelection.tools.join(",");
+            }
             const dependencyOptions = {
                 model, virtual: (() => {
                     const slash = model?.indexOf("/") ?? -1;
@@ -2671,15 +2709,10 @@ export default function (pi: ExtensionAPI) {
                 p.prompt,
             ];
 
-            const piBin = resolvePiBinary();
             const selectedTools = allow.split(",").filter((name) => name && !excludes.has(name));
-            const unavailable = taskTools?.refused.filter((tool) => selectedTools.includes(tool.name)) ?? [];
-            const unavailableTools = unavailable.map((tool) => tool.name);
-            if (sandboxEnabled && selectedTools.length && unavailableTools.length === selectedTools.length) {
-                throw new Error(`No requested tool has a verified task sandbox adapter: ${unavailable.map((tool) => `${tool.name} (${tool.reason})`).join(", ")}.`);
-            }
+            const dropped = toolSelection?.dropped ?? [];
             const taskRuntime = sandboxEnabled && requestedSandboxDir ? prepareTaskRuntime({
-                root: requestedSandboxDir, controlDir: join(runDir(id), "control"), piBin,
+                root: requestedSandboxDir, controlDir: join(runDir(id), "control"),
                 tools: selectedTools,
                 permissions: permissionPlan.permissions && { ...permissionPlan.permissions, ...commandSettings },
                 applyPatch: taskTools?.applyPatch === true,
@@ -2708,7 +2741,7 @@ export default function (pi: ExtensionAPI) {
                     try { ctx.ui?.notify?.(`Subagent ${id}: recovery snapshot failed (run continues): ${outcome.detail}`, "warning"); } catch { /* ignore */ }
                 });
             }
-            const cmd = taskRuntime ? { file: taskRuntime.file, fileArgs: [...taskRuntime.fileArgs, ...args] } : { file: process.execPath, fileArgs: [join(selfDir(), "child-runtime.mjs"), piBin, ...args] };
+            const cmd = taskRuntime ? { file: taskRuntime.file, fileArgs: [...taskRuntime.fileArgs, ...args] } : { file: process.execPath, fileArgs: [join(selfDir(), "child-runtime.mjs"), resolvePiBinary(), ...args] };
             const sandboxDir = taskRuntime ? requestedSandboxDir : undefined;
 
             // Reservations prevent competing admissions, but do not grandfather
@@ -2945,7 +2978,7 @@ export default function (pi: ExtensionAPI) {
                     : resolution.specs.length
                     ? `Runtime: isolated · extensions ${resolution.specs.join(", ")}\n`
                     : `Runtime: isolated · built-in tools only\n`;
-            const warn = (unavailable.length ? `Task sandbox: ${unavailable.map((tool) => `${tool.name} disabled (${tool.reason})`).join("; ")}.\n` : "") +
+            const warn = (dropped.length ? `Task sandbox: ${dropped.map((tool) => `${tool.name} disabled (${withheldBridgeReasons.get(tool.name) ?? tool.reason})`).join("; ")}.\n` : "") +
                 (!sandboxEnabled && resolution.unmapped.length
                 ? `NOTE: no extension mapped for ${resolution.unmapped.join(", ")} — ` +
                   `${resolution.unmapped.length > 1 ? "these tools" : "this tool"} will NOT exist in the child. ` +

package/node_modules/pi-better-subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-subagents",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Pi extension for detached, sandboxed subagent runs that keep the foreground session free.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-subagents/subagent-tools.ts

@@ -90,6 +90,49 @@ export function planTaskTools(options: {
     return plan;
 }
 
+/** One effective child tool list and what the plan refused, split by who asked for it. */
+export interface EffectiveTaskToolSelection {
+    /** The child tool list: refused names are absent, so policy, preflight and recipe agree. */
+    tools: string[];
+    /** Requested names the plan refuses, each with an actionable reason. */
+    refused: { name: string; reason: string }[];
+    /** Refused names this attempt requires (explicit request or frozen recipe): the launch must fail. */
+    required: { name: string; reason: string }[];
+    /** Refused names that only came from the default/inherited loadout: dropped with a warning. */
+    dropped: { name: string; reason: string }[];
+}
+
+/**
+ * The single effective tool selection every downstream authority reads (ADR 0009).
+ *
+ * A refused tool never reaches the task policy, the child preflight, the worker
+ * bridge or the frozen launch recipe: the child cannot register it, so listing it
+ * only makes the parent announce a tool the child then dies without (#669).
+ *
+ * Who asked matters. A name this attempt requires - an explicit `tools` request,
+ * or a continuation's frozen loadout - stops the launch, because silently
+ * narrowing it would change what the caller (or the saved conversation) asked
+ * for. An inherited default is dropped from the child instead, with the reason.
+ */
+export function selectEffectiveTaskTools(options: {
+    /** Candidate loadout after the confinement adjustments. */
+    tools: readonly string[];
+    plan: TaskToolPlan;
+    /** Names this attempt requires; absent means the whole loadout is implicit. */
+    required?: ReadonlySet<string>;
+}): EffectiveTaskToolSelection {
+    const refused = options.plan.refused.filter((tool) => options.tools.includes(tool.name));
+    const refusedNames = new Set(refused.map((tool) => tool.name));
+    const required = refused.filter((tool) => options.required?.has(tool.name) === true);
+    const requiredNames = new Set(required.map((tool) => tool.name));
+    return {
+        tools: options.tools.filter((name) => !refusedNames.has(name)),
+        refused,
+        required,
+        dropped: refused.filter((tool) => !requiredNames.has(tool.name)),
+    };
+}
+
 /** "apply_patch (guarded) · web_fetch, web_search (trusted)" for the launch Runtime line. */
 export function describeTaskTools(plan: TaskToolPlan): string | undefined {
     const parts = [

package/node_modules/pi-better-subagents/task-policy.ts

@@ -172,7 +172,7 @@ export function parseTaskPolicy(value: unknown): TaskPolicy {    if (!value || t
 }
 
 export function prepareTaskRuntime(options: {
-    root: string; controlDir: string; tools: readonly string[]; piBin: string;
+    root: string; controlDir: string; tools: readonly string[]; piBin?: string;
     permissions?: SandboxPermissions & Partial<CommandSettings>; extensionPaths?: readonly string[]; runtimeRoots?: readonly string[];
     applyPatch?: boolean; extensionTools?: readonly TaskExtensionTool[];
 }): { file: string; fileArgs: string[]; policy: TaskPolicy; policyPath: string } {
@@ -194,7 +194,9 @@ export function prepareTaskRuntime(options: {
     mkdirSync(controlDir, { recursive: true });
     const sdkEntry = canonicalizePath(join(PiCodingAgent.getPackageDir(), "dist", "index.js"));
     const cliPaths = ["cli.js", join("bundle", "cli.js")].map((entry) => canonicalizePath(join(PiCodingAgent.getPackageDir(), "dist", entry)));
-    if (!cliPaths.includes(canonicalizePath(options.piBin))) {
+    // The guarded runtime invokes this SDK directly. PATH may name a managed
+    // shell launcher, so only validate a CLI when the caller explicitly pins one.
+    if (options.piBin !== undefined && !cliPaths.includes(canonicalizePath(options.piBin))) {
         throw new Error("Task sandbox requires the active Pi SDK CLI; a different pi executable is on PATH.");
     }
     const ownEntry = fileURLToPath(import.meta.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-harness",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "description": "Pi extension bundle for a write sandbox, subagents, background tasks, SSH, goals, model routing, and Outcome & Todo.",
   "license": "MIT",
   "type": "module",
@@ -63,7 +63,7 @@
     "pi-ollama-cloud": "0.13.1",
     "pi-better-sandbox": "0.14.1",
     "pi-better-ssh": "0.1.4",
-    "pi-better-subagents": "0.28.0",
+    "pi-better-subagents": "0.28.1",
     "proper-lockfile": "^4.1.2",
     "shell-quote": "1.12.0",
     "smol-toml": "1.9.0",