pi-better-harness 0.41.0 → 0.41.2

package/node_modules/pi-better-goal/README.md

@@ -19,11 +19,12 @@ Use `pi-better-goal` when a Pi session should keep an explicit objective visible
 - A compact goal widget that does not replace Pi's footer.
 - Background activity tracking for subagents and other registered providers.
 - A progress-aware follow-up loop with ten identical no-progress retries and linear backoff (60s through 600s by default), followed by a sticky hold recoverable with `/goal resume` or `alt+g`. Conversation, changed callback results, and background drains do not reopen an exhausted hold. Delays saturate at Node's timer limit, and observed background drains reset non-held progress before callback turns can cancel the wake. Pi's network retry policy remains independent.
+- Permission failure reports remain available to the agent as diagnostic evidence. They do not pause Goal or require a one-turn `/goal resume` release. The agent can retry, wait, or continue other authorized work; tool and sandbox permissions remain enforced independently. Repeated unchanged work still reaches the ordinary no-progress hold. Legacy permission-paused goals resume normally with `/goal resume` or `alt+g`.
 - An observable-progress stall state for active goals.
 
 ## Optional Harness-Owned Outcome & Todo
 
-When `pi-better-harness` is installed, its optional **Outcome & Todo** runtime owns the session's structured outcome and checklist. Goal keeps its own objective, clocks, pause and permission holds, workflow gates, background wake behavior, and continuation policy; it also sends lifecycle requests to the Harness runtime so a bound outcome starts, pauses, resumes, and completes with the Goal. When the runtime is present, Goal stops adding its own active-objective text to avoid duplicating the Harness-owned outcome, whether Outcome & Todo is enabled or off.
+When `pi-better-harness` is installed, its optional **Outcome & Todo** runtime owns the session's structured outcome and checklist. Goal keeps its own objective, clocks, pauses, workflow gates, background wake behavior, and continuation policy; it also sends lifecycle requests to the Harness runtime so a bound outcome starts, pauses, resumes, and completes with the Goal. When the runtime is present, Goal stops adding its own active-objective text to avoid duplicating the Harness-owned outcome, whether Outcome & Todo is enabled or off.
 
 `/goal` does not install, enable, or configure Outcome & Todo. Install Harness and enable **Outcome & Todo** in `/harness-settings` if you want that shared outcome and checklist. Without Harness, this package keeps its standalone prompts and behavior unchanged. The stored Goal objective remains the raw original trigger (for example, a bound command invocation) so `/goal resume` can re-enter the work; it is not the authoritative business outcome when Harness owns one.
 

package/node_modules/pi-better-goal/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-goal",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Pi extension for goal tracking with background-aware continuation.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-goal/src/goal-state.ts

@@ -66,7 +66,16 @@ function isGoalStatus(value: unknown): value is GoalStatus {
 }
 
 function isPauseReason(value: unknown): value is GoalPauseReason {
-  return value === "interrupt" || value === "permission-blocker" || value === "handback";
+  return value === "interrupt" || value === "handback";
+}
+
+/**
+ * Goals persisted by older releases can carry `permission-blocker`. Reports no
+ * longer pause a goal, so such a goal resumes like `/goal pause` (human-only
+ * `/goal resume` or alt+g); loading grants no permission and rewrites nothing.
+ */
+function normalizedPauseReason(value: unknown): GoalPauseReason | undefined {
+  return isPauseReason(value) ? value : undefined;
 }
 
 function isGoalLike(value: unknown): value is GoalLike {
@@ -119,12 +128,13 @@ function normalizeGoal(goal: GoalLike): GoalSnapshot {
   const now = unixSeconds();
   const createdAt = typeof goal.createdAt === "number" ? goal.createdAt : now;
   const updatedAt = typeof goal.updatedAt === "number" ? goal.updatedAt : createdAt;
+  const pauseReason = goal.status === "paused" ? normalizedPauseReason(goal.pauseReason) : undefined;
   return {
     goalId: goal.goalId,
     objective: goal.objective,
     ...(isCommandBinding(goal.command) ? { command: goal.command } : {}),
     status: goal.status,
-    ...(goal.status === "paused" && isPauseReason(goal.pauseReason) ? { pauseReason: goal.pauseReason } : {}),
+    ...(pauseReason ? { pauseReason } : {}),
     tokenBudget: typeof goal.tokenBudget === "number" ? goal.tokenBudget : null,
     usage: {
       tokensUsed: typeof goal.usage?.tokensUsed === "number" ? goal.usage.tokensUsed : 0,

package/node_modules/pi-better-goal/src/index.ts

@@ -29,7 +29,7 @@ import {
   type GoalEntrySource,
 } from "./goal-state.js";
 import { continuationEvidence, type ContinuationEvidence } from "./continuation.js";
-import { currentPermissionHold, logicalPermissionBlockerKey, MAX_PERMISSION_BLOCKERS, MAX_PERMISSION_RECORDS, permissionHoldRecord, permissionInstruction, permissionRecord, reportedPermissionBlockers, reportedPermissionGap, type PermissionHold } from "./permission-hold.js";
+import { currentPermissionHold, logicalPermissionBlockerKey, MAX_PERMISSION_BLOCKERS, MAX_PERMISSION_RECORDS, permissionGapRecord, permissionHoldRecord, reportedPermissionBlockers, reportedPermissionGap, type PermissionHold } from "./permission-hold.js";
 import { publishGoalGuidance } from "./prompt.js";
 import { observeGoalStall } from "./stall.js";
 import {
@@ -103,7 +103,6 @@ export function agentResumable(goal: GoalSnapshot | null, conversationalResume =
 
 /** Footer status for a paused goal, telling the user how to resume it. */
 export function pausedGoalStatus(goal: GoalSnapshot, conversationalResume = true): string {
-  if (goal.pauseReason === "permission-blocker") return "goal held: permission blocker · /goal resume (one retry)";
   return agentResumable(goal, conversationalResume) ? 'goal paused · say "go" or /goal resume' : "goal paused · /goal resume";
 }
 
@@ -111,9 +110,11 @@ function pausedGoalPrompt(goal: GoalSnapshot, conversationalResume: boolean, inc
   return [
     goal.pauseReason === "handback"
       ? `Pi Better Goal is paused because its workflow handed back unfinished work for the user's answer.${includeObjective ? ` Goal: ${goal.objective}` : ""}`
-      : `Pi Better Goal is paused because the user pressed escape.${includeObjective ? ` Goal: ${goal.objective}` : ""}`,
+      : goal.pauseReason === "interrupt"
+        ? `Pi Better Goal is paused because the user pressed escape.${includeObjective ? ` Goal: ${goal.objective}` : ""}`
+        : `Pi Better Goal is paused.${includeObjective ? ` Goal: ${goal.objective}` : ""}`,
     "Treat the user's messages as ordinary conversation: answer them, but do not continue the goal's work until it is resumed.",
-    conversationalResume ? GOAL_RESUME_RULE : "Only the user can resume this goal, with /goal resume or alt+g. A conversational go-ahead does not resume it.",
+    agentResumable(goal, conversationalResume) ? GOAL_RESUME_RULE : "Only the user can resume this goal, with /goal resume or alt+g. A conversational go-ahead does not resume it.",
   ].join("\n");
 }
 
@@ -260,8 +261,8 @@ function formatGoal(
     `Status: ${goal.status}`,
     ...(goal.pauseReason ? [`Pause reason: ${goal.pauseReason}`] : []),
     ...(permissions?.blockers.length ? [
-      `Permission hold: ${permissions.blockers.length} scope(s); ${permissions.recordCount} history records; retry ${permissions.retryPending ? "released once" : "held"}`,
-      ...(permissions.saturated ? ["Permission observation incomplete: history/scope limit reached; release refused."] : []),
+      `Permission diagnostics: ${permissions.blockers.length} scope(s); ${permissions.recordCount} history records`,
+      ...(permissions.saturated ? ["Permission observation incomplete: history/scope limit reached. Diagnostics only; continuation is unaffected."] : []),
     ] : []),
     `Token budget: ${budget}`,
     `Tokens used: ${goal.usage.tokensUsed}`,
@@ -396,13 +397,6 @@ export default function (pi: ExtensionAPI): void {
   };
 
   const setGoal = (goal: GoalSnapshot, ctx: ExtensionContext, source: GoalEntrySource): void => {
-    const permissionHold = currentPermissionHold(ctx, goal.goalId);
-    if (goal.status === "paused" && permissionHold.blockers.length > 0) {
-      if (permissionHold.retryPending && permissionHold.recordCount < MAX_PERMISSION_RECORDS) {
-        pi.appendEntry(EXTENSION_NAME, permissionRecord(goal.goalId, "permission-retry-finished"));
-      }
-      goal = { ...goal, pauseReason: "permission-blocker" };
-    }
     executionGeneration += 1;
     lastAgentEvidence = null;
     const previous = getGoal(ctx);
@@ -458,9 +452,7 @@ export default function (pi: ExtensionAPI): void {
     }
     const held = currentContinuationState(ctx, goal.goalId)?.blocked === true;
     setGoal(goalWithStatus(goal, "paused", undefined, held ? undefined : "interrupt"), ctx, "runtime");
-    notifyGoal(ctx, currentPermissionHold(ctx, goal.goalId).blockers.length > 0
-      ? "Goal remains permission-held. Use /goal resume or alt+g for one same-scope retry."
-      : preferences.conversationalResume && !held
+    notifyGoal(ctx, preferences.conversationalResume && !held
       ? 'Goal paused. Say "go" to resume it, or use /goal resume.'
       : "Goal paused. Use /goal resume or alt+g to resume it.");
   };
@@ -530,18 +522,6 @@ export default function (pi: ExtensionAPI): void {
       return { ok: false, message: blocker };
     }
     const goal = held ? current : goalWithStatus(current, "active");
-    const permissions = currentPermissionHold(ctx, current.goalId);
-    if (current.pauseReason === "permission-blocker" && permissions.blockers.length === 0) {
-      return { ok: false, message: "Permission hold evidence is unavailable. The goal stays held; inspect the report before replacing this goal explicitly." };
-    }
-    if (permissions.blockers.length > 0) {
-      if (source === "tool" || permissions.saturated) {
-        return { ok: false, message: permissions.saturated
-          ? "Permission hold history is full. The goal stays held; inspect it and create a new goal explicitly if needed."
-          : "Only /goal resume or alt+g can release one permission retry." };
-      }
-      pi.appendEntry(EXTENSION_NAME, permissionRecord(current.goalId, "permission-release"));
-    }
     // Resuming a skill-bound goal is explicit re-entry into its workflow: rebind the owner the
     // goal was created with (released by a handback) before the continuation runs.
     const owner = goalWorkflowOwner(current);
@@ -579,11 +559,8 @@ export default function (pi: ExtensionAPI): void {
     if (!boundCommandReady(goal, ctx)) return;
     clearIdleContinuation();
     continuationQueuedFor = goal.goalId;
-    const permissions = currentPermissionHold(ctx, goal.goalId);
-    if (permissions.blockers.length === 0) resetContinuationState(goal);
-    sendGoalContinuation(goal, permissions.blockers.length > 0
-      ? `${continuationPrompt(goal, getWorkflow(ctx))}\n\n${permissionInstruction(permissions)}`
-      : continuationPrompt(goal, getWorkflow(ctx)), "continuation");
+    resetContinuationState(goal);
+    sendGoalContinuation(goal, continuationPrompt(goal, getWorkflow(ctx)), "continuation");
   };
 
   function clearIdleContinuation(): void {
@@ -606,7 +583,6 @@ export default function (pi: ExtensionAPI): void {
     if (WAKE_DISABLED || !preferences.autoContinue || !isPokeable(goal) || continuationQueuedFor === goal.goalId) {
       return;
     }
-    if (currentPermissionHold(ctx, goal.goalId).blockers.length > 0) return;
     if (currentContinuationState(ctx, goal.goalId)?.blocked) {
       return;
     }
@@ -637,7 +613,6 @@ export default function (pi: ExtensionAPI): void {
       if (WAKE_DISABLED || !preferences.autoContinue || execution !== executionGeneration || wake !== wakeGeneration) return false;
       const current = currentGoalSnapshot(ctx);
       return isPokeable(current) && current.goalId === goalId &&
-        currentPermissionHold(ctx, goalId).blockers.length === 0 &&
         !currentContinuationState(ctx, goalId)?.blocked &&
         continuationQueuedFor !== goalId && !isForegroundBusy(ctx);
     };
@@ -703,8 +678,7 @@ export default function (pi: ExtensionAPI): void {
     const goal = currentGoalSnapshot(ctx);
     const wakePlan = planBackgroundDrainWake(backgroundDrainTracker, goal, snapshot);
     backgroundDrainTracker = wakePlan.nextTracker;
-    if (isPokeable(goal) && wakePlan.wakeSignature && currentPermissionHold(ctx, goal.goalId).blockers.length === 0 &&
-        !currentContinuationState(ctx, goal.goalId)?.blocked) {
+    if (isPokeable(goal) && wakePlan.wakeSignature && !currentContinuationState(ctx, goal.goalId)?.blocked) {
       // Persist external progress now: a foreground/callback turn may cancel its delayed wake.
       clearIdleContinuation();
       resetContinuationState(goal);
@@ -878,7 +852,6 @@ export default function (pi: ExtensionAPI): void {
     if ((request.owner.goalId ?? null) !== (goal?.goalId ?? null)) { held("Owning Goal is no longer current"); return; }
     if (goal && !preferences.autoContinue) { held("Goal automatic continuation is disabled"); return; }
     if (goal && !isPokeable(goal)) { held("Goal is not active"); return; }
-    if (goal && currentPermissionHold(ctx, goal.goalId).blockers.length) { held("Goal has an active permission hold"); return; }
     if (goal && currentContinuationState(ctx, goal.goalId)?.blocked) { held("Goal continuation requires human resume"); return; }
     if (goal && !boundCommandReady(goal, ctx)) { held("Bound workflow is not ready"); return; }
     const workflow = getWorkflow(ctx);
@@ -889,7 +862,7 @@ export default function (pi: ExtensionAPI): void {
       const latest = getGoal(ctx);
       if ((request.owner!.goalId ?? null) !== (latest?.goalId ?? null)) { held("Owning Goal changed during resume admission"); return; }
       if (latest && !preferences.autoContinue) { held("Goal automatic continuation is disabled"); return; }
-      if (latest && (!isPokeable(latest) || currentPermissionHold(ctx, latest.goalId).blockers.length || currentContinuationState(ctx, latest.goalId)?.blocked)) {
+      if (latest && (!isPokeable(latest) || currentContinuationState(ctx, latest.goalId)?.blocked)) {
         held("Goal became held during resume admission"); return;
       }
       if (!gate.ok) { held(gate.reason); return; }
@@ -903,7 +876,6 @@ export default function (pi: ExtensionAPI): void {
         if ((request.owner!.goalId ?? null) !== (active?.goalId ?? null)) return false;
         if (JSON.stringify(getWorkflow(ctx)) !== JSON.stringify(workflow)) return false;
         return !active || (preferences.autoContinue && isPokeable(active)
-          && !currentPermissionHold(ctx, active.goalId).blockers.length
           && !currentContinuationState(ctx, active.goalId)?.blocked && boundCommandReady(active, ctx));
       };
       reply({ allowed: true, revision, isCurrent });
@@ -1263,10 +1235,6 @@ export default function (pi: ExtensionAPI): void {
       notifyGoal(ctx, error instanceof Error ? error.message : String(error), "error");
     }
     const restoredGoal = getGoal(ctx);
-    if (restoredGoal?.status === "active" && currentPermissionHold(ctx, restoredGoal.goalId).blockers.length > 0) {
-      // A persisted release is not a replayable dispatch ticket after reload.
-      setGoal(goalWithStatus(restoredGoal, "paused", undefined, "permission-blocker"), ctx, "runtime");
-    }
     if (restoredGoal?.status === "active" && !restoredGoal.command && skillCommandName(restoredGoal.objective)) {
       setGoal(goalWithStatus(restoredGoal, "paused"), ctx, "runtime");
       notifyGoal(ctx, "Goal paused: invoke its skill directly before resuming.", "error");
@@ -1336,8 +1304,7 @@ export default function (pi: ExtensionAPI): void {
     // A paused goal stays paused while the user talks: the message is ordinary
     // conversation. Only /goal resume, the hotkey, or goal_resume resume it.
     const goal = getGoal(ctx);
-    if (goal?.status === "active" && currentPermissionHold(ctx, goal.goalId).blockers.length === 0 &&
-        !currentContinuationState(ctx, goal.goalId)?.blocked) {
+    if (goal?.status === "active" && !currentContinuationState(ctx, goal.goalId)?.blocked) {
       executionGeneration += 1;
       clearIdleContinuation();
       lastAgentEvidence = null;
@@ -1354,17 +1321,8 @@ export default function (pi: ExtensionAPI): void {
     const harnessPresent = requestTaskContext(pi, "inspect", goal).enabled !== undefined;
     const snapshot = await publishSnapshot(ctx);
     if (!snapshot) return;
-    const permissions = goal ? currentPermissionHold(ctx, goal.goalId) : null;
-    const permissionPrompt = permissions && goal?.status !== "complete" &&
-      (permissions.blockers.length > 0 || goal?.pauseReason === "permission-blocker")
-      ? permissionInstruction({ ...permissions, retryPending: permissions.retryPending && goal?.status === "active" }) +
-        (permissions.blockers.length === 0 ? "\nBlocker evidence is unavailable. Stay held; do not invent a retry scope." : "") : "";
-    // A held goal overrides workflow ownership without invoking or invalidating that workflow.
-    if (permissionPrompt && goal?.status === "paused") {
-      return publishGoalGuidance(event, permissionPrompt);
-    }
-    const pausedInstruction = permissionPrompt || (goal?.status === "paused" && (goal.pauseReason === "interrupt" || goal.pauseReason === "handback")
-      ? pausedGoalPrompt(goal, preferences.conversationalResume, !harnessPresent) : "");
+    const pausedInstruction = goal?.status === "paused"
+      ? pausedGoalPrompt(goal, preferences.conversationalResume, !harnessPresent) : "";
     if (!isPokeable(goal) && !owner) {
       return publishGoalGuidance(event, pausedInstruction);
     }
@@ -1392,9 +1350,7 @@ export default function (pi: ExtensionAPI): void {
       return publishGoalGuidance(
         event,
         pausedInstruction &&
-          `${pausedInstruction}\n` + (permissionPrompt
-            ? "These permission constraints override the workflow instructions below.\n\n"
-            : "While the goal is paused, this overrides the workflow instructions below: do not advance the workflow until the goal is resumed.\n\n"),
+          `${pausedInstruction}\n` + "While the goal is paused, this overrides the workflow instructions below: do not advance the workflow until the goal is resumed.\n\n",
         `Active workflow: ${owner.name} (${owner.path}). Its task plan owns planning and the parent is a coordinator, not a product-code implementer. Follow the workflow instructions below, including on resumed turns:\n\n${instructions}`,
         isPokeable(goal) && (harnessPresent
           ? "Complete the goal only after the workflow completion audit."
@@ -1416,13 +1372,11 @@ export default function (pi: ExtensionAPI): void {
         heldInstruction,
         backgroundInstruction.trim(),
         questionInstruction.trim(),
-        permissionPrompt,
       );
     }
     return publishGoalGuidance(
       event,
       `Pi Better Goal active objective: ${goal.objective}. ${heldInstruction || "Keep working through clear low-risk next steps, and mark complete only after an evidence-backed completion audit."}${backgroundInstruction}${questionInstruction}`,
-      permissionPrompt,
     );
   });
 
@@ -1472,31 +1426,22 @@ export default function (pi: ExtensionAPI): void {
     const incomplete = reportedPermissionGap(pi, event.toolName, event.details);
     if (reports.length === 0 && !incomplete) return;
     let hold = currentPermissionHold(ctx, goal.goalId);
-    let changed = false;
     for (const blocker of reports) {
       const previous = hold.blockers.find((item) => logicalPermissionBlockerKey(item) === logicalPermissionBlockerKey(blocker));
-      if (!hold.retryPending && previous && JSON.stringify(previous) === JSON.stringify(blocker)) continue;
+      if (previous && JSON.stringify(previous) === JSON.stringify(blocker)) continue;
       if (hold.saturated || (!previous && hold.blockers.length >= MAX_PERMISSION_BLOCKERS)) {
         if (!hold.saturated && hold.recordCount < MAX_PERMISSION_RECORDS) {
-          pi.appendEntry(EXTENSION_NAME, permissionRecord(goal.goalId, "permission-gap"));
+          pi.appendEntry(EXTENSION_NAME, permissionGapRecord(goal.goalId));
         }
         break;
       }
       pi.appendEntry(EXTENSION_NAME, permissionHoldRecord(goal.goalId, blocker));
-      changed = true;
       hold = currentPermissionHold(ctx, goal.goalId);
     }
     if (incomplete && !hold.saturated && hold.recordCount < MAX_PERMISSION_RECORDS) {
-      pi.appendEntry(EXTENSION_NAME, permissionRecord(goal.goalId, "permission-gap"));
-      changed = true;
-      hold = currentPermissionHold(ctx, goal.goalId);
-    }
-    if (hold.retryPending && hold.recordCount < MAX_PERMISSION_RECORDS) {
-      pi.appendEntry(EXTENSION_NAME, permissionRecord(goal.goalId, "permission-retry-finished"));
+      pi.appendEntry(EXTENSION_NAME, permissionGapRecord(goal.goalId));
     }
-    if (!changed && goal.status === "paused" && goal.pauseReason === "permission-blocker") return;
-    setGoal(goalWithStatus(goal, "paused", undefined, "permission-blocker"), ctx, "runtime");
-    notifyGoal(ctx, "Goal held for a permission blocker. /goal resume or alt+g releases one same-scope retry.", "warning");
+    // Diagnostics only: the goal keeps running and continuation is unchanged.
   });
 
   pi.on("tool_execution_start", async (event, ctx) => {
@@ -1535,16 +1480,6 @@ export default function (pi: ExtensionAPI): void {
     const snapshot = await publishSnapshot(ctx);
     if (!snapshot) return;
     const goal = getGoal(ctx);
-    if (isPokeable(goal)) {
-      const permissions = currentPermissionHold(ctx, goal.goalId);
-      if (permissions.blockers.length > 0) {
-        if (permissions.retryPending && permissions.recordCount < MAX_PERMISSION_RECORDS) {
-          pi.appendEntry(EXTENSION_NAME, permissionRecord(goal.goalId, "permission-retry-finished"));
-        }
-        setGoal(goalWithStatus(goal, "paused", undefined, "permission-blocker"), ctx, "runtime");
-        return;
-      }
-    }
     if (!isPokeable(goal) || snapshot.backgroundRunning) {
       return;
     }

package/node_modules/pi-better-goal/src/permission-hold.ts

@@ -4,6 +4,12 @@ import { dirname, join } from "node:path";
 import { isPermissionBlocker, permissionBlockerKey, type PermissionBlocker } from "./shared-permission-blocker.js";
 import { EXTENSION_NAME } from "./types.js";
 
+/**
+ * Permission failure reports are diagnostics. This ledger records observed
+ * blockers so `/goal` and `get_goal` can show them; it never pauses a goal,
+ * limits resume, suppresses continuation/wakes/audits, or grants permission.
+ * Tool and sandbox enforcement remain the only authority.
+ */
 export const MAX_PERMISSION_BLOCKERS = 32;
 export const MAX_PERMISSION_RECORDS = 128;
 
@@ -13,7 +19,6 @@ export type PermissionRecord =
 
 export interface PermissionHold {
   blockers: PermissionBlocker[];
-  retryPending: boolean;
   recordCount: number;
   saturated: boolean;
 }
@@ -26,10 +31,9 @@ export function logicalPermissionBlockerKey(blocker: PermissionBlocker): string
   });
 }
 
-/** Replay only compact goal-owned authority records, independently of progress resets. */
+/** Replay the goal's compact diagnostic records, independently of progress resets. */
 export function currentPermissionHold(ctx: ExtensionContext, goalId: string): PermissionHold {
   const blockers = new Map<string, PermissionBlocker>();
-  let retryPending = false;
   let recordCount = 0;
   let saturated = false;
   for (const entry of ctx.sessionManager.getBranch()) {
@@ -41,7 +45,6 @@ export function currentPermissionHold(ctx: ExtensionContext, goalId: string): Pe
     if (data.version !== 1 || typeof data.at !== "number" || !Number.isFinite(data.at) ||
         (data.kind === "permission-hold" && !isPermissionBlocker(data.blocker))) {
       saturated = true;
-      retryPending = false;
       recordCount += 1;
       continue;
     }
@@ -49,20 +52,15 @@ export function currentPermissionHold(ctx: ExtensionContext, goalId: string): Pe
       const key = logicalPermissionBlockerKey(data.blocker);
       if (blockers.has(key) || blockers.size < MAX_PERMISSION_BLOCKERS) blockers.set(key, compactBlocker(data.blocker));
       else saturated = true;
-      retryPending = false;
-    } else if (data.kind === "permission-release" && blockers.size > 0) {
-      retryPending = !saturated;
-    } else if (data.kind === "permission-retry-finished") {
-      retryPending = false;
     } else if (data.kind === "permission-gap") {
       saturated = true;
-      retryPending = false;
-    } else continue;
+    }
+    // Legacy release records remain countable history but carry no authority.
     recordCount += 1;
-    // Reserve room to record an incomplete scope and consume an outstanding release.
+    // Reserve room to record an incomplete scope.
     if (recordCount >= MAX_PERMISSION_RECORDS - 2) saturated = true;
   }
-  return { blockers: [...blockers.values()], retryPending, recordCount, saturated };
+  return { blockers: [...blockers.values()], recordCount, saturated };
 }
 
 function compactBlocker(blocker: PermissionBlocker): PermissionBlocker {
@@ -130,21 +128,10 @@ export function reportedPermissionGap(pi: ExtensionAPI, toolName: string, detail
   return typeof omitted === "number" && Number.isSafeInteger(omitted) && omitted > 0;
 }
 
-export function permissionRecord(goalId: string, kind: "permission-release" | "permission-retry-finished" | "permission-gap"): PermissionRecord {
-  return { version: 1, kind, goalId, at: Math.floor(Date.now() / 1000) };
+export function permissionGapRecord(goalId: string): PermissionRecord {
+  return { version: 1, kind: "permission-gap", goalId, at: Math.floor(Date.now() / 1000) };
 }
 
 export function permissionHoldRecord(goalId: string, blocker: PermissionBlocker): PermissionRecord {
   return { version: 1, kind: "permission-hold", goalId, blocker: compactBlocker(blocker), at: Math.floor(Date.now() / 1000) };
 }
-
-export function permissionInstruction(hold: PermissionHold): string {
-  return [
-    hold.retryPending
-      ? "The human explicitly released ONE bounded retry of the held operation and scope below. This is not a permission grant or evidence of success."
-      : "The goal is paused for a permission blocker. Answer ordinary questions, but do not advance goal or workflow work. Only /goal resume or alt+g releases one bounded retry; goal_resume cannot release it.",
-    ...hold.blockers.map((blocker) => `- ${blocker.context}: ${blocker.resource}; operation=${blocker.operation}; basis=${blocker.basis}; remoteOutcome=${blocker.remoteOutcome}` +
-      (blocker.runId ? `; runId=${blocker.runId}` : "") + (blocker.policySnapshotId ? `; policySnapshotId=${blocker.policySnapshotId}` : "")),
-    "Keep the same operation and scope. Do not switch to foreground execution, copy credentials, change authentication, or broaden permissions. Changed worker settings require a fresh worker; retain the logical operation identity. Runtime-observed refusals and agent-reported blockers are distinct. Unknown remote outcome is never evidence of success.",
-  ].join("\n");
-}

package/node_modules/pi-better-goal/src/types.ts

@@ -71,12 +71,11 @@ export type GoalStatus = "active" | "paused" | "budgetLimited" | "complete";
  * resume a goal on their own. An `interrupt` pause may be resumed by the agent
  * with `goal_resume` when the user clearly says to proceed. A paused goal
  * without a reason (`/goal pause`, an unavailable command or workflow) resumes
- * only through `/goal resume` or the resume hotkey. `permission-blocker` also
- * requires those human controls, and releases just one same-scope retry while
- * keeping its separate blocker/release history.
+ * only through `/goal resume` or the resume hotkey. Permission failure reports
+ * are diagnostics and never create a pause reason.
  */
-/** Why a goal paused: escape, a permission hold, or a workflow handing back unfinished work for the user's answer. */
-export type GoalPauseReason = "interrupt" | "permission-blocker" | "handback";
+/** Why a goal paused: escape, or a workflow handing back unfinished work for the user's answer. */
+export type GoalPauseReason = "interrupt" | "handback";
 
 export interface GoalUsage {
   tokensUsed: number;

package/node_modules/pi-better-subagents/docs/usage.md

@@ -146,7 +146,10 @@ Each attempt gets a new run id, log, timing record, and capacity slot while the
 native session id and history stay the same. The launch recipe preserves the
 worker's role, tools, skill exposure, model, and workspace, including uncommitted
 changes. Repeating a launch-only option is accepted only with the saved value;
-a different `skills` list is refused rather than silently dropped.
+a different `skills` list is refused rather than silently dropped. A continuation
+whose frozen tool loadout can no longer be admitted (for example its trusted
+package is gone) is refused before anything is spawned, instead of reopening the
+saved conversation with different tools.
 
 A run stopped with `subagent_stop` (status `killed`) can be continued the same
 way. Stopping ends that execution, not the saved conversation or its
@@ -522,11 +525,15 @@ chosen in `/sandbox` → Subagents · Tools
   name is refused. A single extension file with no package manifest is loaded
   and admitted by itself, never its directory. Known network tool names
   (`web_fetch`, `web_search`, `firecrawl_scrape`, `firecrawl_extract`, `mcp`, `mcpScript`, `remote_bash`, and any `mcp__*` name) are refused while Network access is Off; this is a name list, not a
-  network sandbox. A ticked tool whose package can't be found is refused at launch. Ticked tools
-  join the default tool list; an explicit `tools` list still decides.
-
-Other tools are disabled in confined children and listed in launch output with
-the reason. The launch line shows what was admitted, for example
+  network sandbox. A ticked tool whose package can't be found is left out of a
+  default loadout and reported with its reason in the launch output; an explicit
+  `tools` request for a tool the task boundary cannot provide refuses the launch.
+  Ticked tools join the default tool list; an explicit `tools` list still decides.
+
+Other tools are disabled in confined children. One that only joined the default
+loadout is omitted from the child and listed in launch output with the reason;
+one the caller named in `tools` refuses the launch with the reason. The launch
+line shows what was admitted, for example
 `Runtime: isolated · guarded apply_patch · trusted web_fetch (@juicesharp/rpiv-web-tools)`.
 Provider extensions are trusted runtime code; arbitrary extension tools are not
 admitted merely because their names were requested. Confined children disable project

package/node_modules/pi-better-subagents/index.ts

@@ -62,7 +62,7 @@ import { resolveExtensions, extensionArgs } from "./extensions.ts";
 import { prepareTaskRuntime, applyDirectApplicationLoadout, RUN_APPLICATION, SDK_BUILTIN_TOOLS } from "./task-policy.ts";
 import { canonicalizePath, takeRecoverySnapshot } from "./shared-sandbox-core.ts";
 import { TASK_BUILTINS } from "./shared-task-sandbox.ts";
-import { APPLY_PATCH, describeTaskTools, planTaskTools } from "./subagent-tools.ts";
+import { APPLY_PATCH, describeTaskTools, planTaskTools, selectEffectiveTaskTools } from "./subagent-tools.ts";
 import {
     announceExecutionAdapter, observeSandboxPermissions, resolveCommandSettings, resolveSubagentPermissions,
 } from "./permission-policy.ts";
@@ -2574,13 +2574,51 @@ export default function (pi: ExtensionAPI) {
                 }).tools.join(",");
             }
             const bridgeToolNames = new Set<string>(bridgeEnabled ? bridgePlan.tools : []);
+            // A bridge tool the supervisor withholds (no production schema, clean,
+            // excluded) explains itself better than extension admission would.
+            const withheldBridgeReasons = new Map<string, string>(bridgePlan.withheld.map((tool) => [tool.name, tool.reason]));
+            // Candidates for the task-tool plan: exclusions and bridge-supplied
+            // names never reach extension admission.
+            const plannedTools = allow.split(",").filter((name) => name && !requestedExcludes.has(name) && !bridgeToolNames.has(name));
             const taskTools = sandboxEnabled ? planTaskTools({
-                requested: allow.split(",").filter((name) => name && !requestedExcludes.has(name) && !bridgeToolNames.has(name)),
+                requested: plannedTools,
                 settings: permissionPlan.tools, network: permissionPlan.permissions?.network ?? true,
                 processAccess: permissionPlan.permissions?.processAccess ?? "off",
                 builtins: [...TASK_BUILTINS, "codemode"], registered: pi.getAllTools?.() ?? [],
                 toolExtensions: cfg.toolExtensions, resolvePath: resolveExtensionPath,
             }) : undefined;
+            // One effective selection feeds the task policy, child preflight, worker
+            // bridge and frozen recipe, so a refused tool cannot leak into any of them
+            // (#669). A name this attempt requires - the caller's explicit `tools`, or a
+            // continuation's frozen loadout - refuses the launch instead of narrowing it;
+            // an inherited default is dropped from the child with the reason.
+            const requiredToolNames = new Set(requestedTools === undefined
+                ? []
+                : requestedTools.split(",").map((name) => name.trim()).filter(Boolean));
+            const toolSelection = taskTools
+                ? selectEffectiveTaskTools({
+                    tools: allow.split(",").filter(Boolean), plan: taskTools, required: requiredToolNames,
+                })
+                : undefined;
+            if (toolSelection?.required.length) {
+                const detail = toolSelection.required
+                    .map((tool) => `${tool.name} (${withheldBridgeReasons.get(tool.name) ?? tool.reason})`).join(", ");
+                throw resume
+                    ? new ContinuationError(
+                        `Cannot continue ${resume.prior.id}: its frozen launch requires tool(s) this parent can no longer provide: ${detail}. ` +
+                        `Launch a new run instead of continuing this conversation.`,
+                    )
+                    : new Error(
+                        `Requested tool(s) are not available in the task sandbox: ${detail}. ` +
+                        `Remove them from the tools list, or make them available in /sandbox (Subagents · Tools); nothing was launched.`,
+                    );
+            }
+            if (toolSelection) {
+                if (plannedTools.length > 0 && toolSelection.tools.length === 0) {
+                    throw new Error(`No requested tool has a verified task sandbox adapter: ${toolSelection.refused.map((tool) => `${tool.name} (${withheldBridgeReasons.get(tool.name) ?? tool.reason})`).join(", ")}.`);
+                }
+                allow = toolSelection.tools.join(",");
+            }
             const dependencyOptions = {
                 model, virtual: (() => {
                     const slash = model?.indexOf("/") ?? -1;
@@ -2671,15 +2709,10 @@ export default function (pi: ExtensionAPI) {
                 p.prompt,
             ];
 
-            const piBin = resolvePiBinary();
             const selectedTools = allow.split(",").filter((name) => name && !excludes.has(name));
-            const unavailable = taskTools?.refused.filter((tool) => selectedTools.includes(tool.name)) ?? [];
-            const unavailableTools = unavailable.map((tool) => tool.name);
-            if (sandboxEnabled && selectedTools.length && unavailableTools.length === selectedTools.length) {
-                throw new Error(`No requested tool has a verified task sandbox adapter: ${unavailable.map((tool) => `${tool.name} (${tool.reason})`).join(", ")}.`);
-            }
+            const dropped = toolSelection?.dropped ?? [];
             const taskRuntime = sandboxEnabled && requestedSandboxDir ? prepareTaskRuntime({
-                root: requestedSandboxDir, controlDir: join(runDir(id), "control"), piBin,
+                root: requestedSandboxDir, controlDir: join(runDir(id), "control"),
                 tools: selectedTools,
                 permissions: permissionPlan.permissions && { ...permissionPlan.permissions, ...commandSettings },
                 applyPatch: taskTools?.applyPatch === true,
@@ -2708,7 +2741,7 @@ export default function (pi: ExtensionAPI) {
                     try { ctx.ui?.notify?.(`Subagent ${id}: recovery snapshot failed (run continues): ${outcome.detail}`, "warning"); } catch { /* ignore */ }
                 });
             }
-            const cmd = taskRuntime ? { file: taskRuntime.file, fileArgs: [...taskRuntime.fileArgs, ...args] } : { file: process.execPath, fileArgs: [join(selfDir(), "child-runtime.mjs"), piBin, ...args] };
+            const cmd = taskRuntime ? { file: taskRuntime.file, fileArgs: [...taskRuntime.fileArgs, ...args] } : { file: process.execPath, fileArgs: [join(selfDir(), "child-runtime.mjs"), resolvePiBinary(), ...args] };
             const sandboxDir = taskRuntime ? requestedSandboxDir : undefined;
 
             // Reservations prevent competing admissions, but do not grandfather
@@ -2945,7 +2978,7 @@ export default function (pi: ExtensionAPI) {
                     : resolution.specs.length
                     ? `Runtime: isolated · extensions ${resolution.specs.join(", ")}\n`
                     : `Runtime: isolated · built-in tools only\n`;
-            const warn = (unavailable.length ? `Task sandbox: ${unavailable.map((tool) => `${tool.name} disabled (${tool.reason})`).join("; ")}.\n` : "") +
+            const warn = (dropped.length ? `Task sandbox: ${dropped.map((tool) => `${tool.name} disabled (${withheldBridgeReasons.get(tool.name) ?? tool.reason})`).join("; ")}.\n` : "") +
                 (!sandboxEnabled && resolution.unmapped.length
                 ? `NOTE: no extension mapped for ${resolution.unmapped.join(", ")} — ` +
                   `${resolution.unmapped.length > 1 ? "these tools" : "this tool"} will NOT exist in the child. ` +

package/node_modules/pi-better-subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-subagents",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Pi extension for detached, sandboxed subagent runs that keep the foreground session free.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-subagents/subagent-tools.ts

@@ -90,6 +90,49 @@ export function planTaskTools(options: {
     return plan;
 }
 
+/** One effective child tool list and what the plan refused, split by who asked for it. */
+export interface EffectiveTaskToolSelection {
+    /** The child tool list: refused names are absent, so policy, preflight and recipe agree. */
+    tools: string[];
+    /** Requested names the plan refuses, each with an actionable reason. */
+    refused: { name: string; reason: string }[];
+    /** Refused names this attempt requires (explicit request or frozen recipe): the launch must fail. */
+    required: { name: string; reason: string }[];
+    /** Refused names that only came from the default/inherited loadout: dropped with a warning. */
+    dropped: { name: string; reason: string }[];
+}
+
+/**
+ * The single effective tool selection every downstream authority reads (ADR 0009).
+ *
+ * A refused tool never reaches the task policy, the child preflight, the worker
+ * bridge or the frozen launch recipe: the child cannot register it, so listing it
+ * only makes the parent announce a tool the child then dies without (#669).
+ *
+ * Who asked matters. A name this attempt requires - an explicit `tools` request,
+ * or a continuation's frozen loadout - stops the launch, because silently
+ * narrowing it would change what the caller (or the saved conversation) asked
+ * for. An inherited default is dropped from the child instead, with the reason.
+ */
+export function selectEffectiveTaskTools(options: {
+    /** Candidate loadout after the confinement adjustments. */
+    tools: readonly string[];
+    plan: TaskToolPlan;
+    /** Names this attempt requires; absent means the whole loadout is implicit. */
+    required?: ReadonlySet<string>;
+}): EffectiveTaskToolSelection {
+    const refused = options.plan.refused.filter((tool) => options.tools.includes(tool.name));
+    const refusedNames = new Set(refused.map((tool) => tool.name));
+    const required = refused.filter((tool) => options.required?.has(tool.name) === true);
+    const requiredNames = new Set(required.map((tool) => tool.name));
+    return {
+        tools: options.tools.filter((name) => !refusedNames.has(name)),
+        refused,
+        required,
+        dropped: refused.filter((tool) => !requiredNames.has(tool.name)),
+    };
+}
+
 /** "apply_patch (guarded) · web_fetch, web_search (trusted)" for the launch Runtime line. */
 export function describeTaskTools(plan: TaskToolPlan): string | undefined {
     const parts = [

package/node_modules/pi-better-subagents/task-policy.ts

@@ -172,7 +172,7 @@ export function parseTaskPolicy(value: unknown): TaskPolicy {    if (!value || t
 }
 
 export function prepareTaskRuntime(options: {
-    root: string; controlDir: string; tools: readonly string[]; piBin: string;
+    root: string; controlDir: string; tools: readonly string[]; piBin?: string;
     permissions?: SandboxPermissions & Partial<CommandSettings>; extensionPaths?: readonly string[]; runtimeRoots?: readonly string[];
     applyPatch?: boolean; extensionTools?: readonly TaskExtensionTool[];
 }): { file: string; fileArgs: string[]; policy: TaskPolicy; policyPath: string } {
@@ -194,7 +194,9 @@ export function prepareTaskRuntime(options: {
     mkdirSync(controlDir, { recursive: true });
     const sdkEntry = canonicalizePath(join(PiCodingAgent.getPackageDir(), "dist", "index.js"));
     const cliPaths = ["cli.js", join("bundle", "cli.js")].map((entry) => canonicalizePath(join(PiCodingAgent.getPackageDir(), "dist", entry)));
-    if (!cliPaths.includes(canonicalizePath(options.piBin))) {
+    // The guarded runtime invokes this SDK directly. PATH may name a managed
+    // shell launcher, so only validate a CLI when the caller explicitly pins one.
+    if (options.piBin !== undefined && !cliPaths.includes(canonicalizePath(options.piBin))) {
         throw new Error("Task sandbox requires the active Pi SDK CLI; a different pi executable is on PATH.");
     }
     const ownEntry = fileURLToPath(import.meta.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-harness",
-  "version": "0.41.0",
+  "version": "0.41.2",
   "description": "Pi extension bundle for a write sandbox, subagents, background tasks, SSH, goals, model routing, and Outcome & Todo.",
   "license": "MIT",
   "type": "module",
@@ -58,12 +58,12 @@
   },
   "dependencies": {
     "pi-better-background-tasks": "0.14.2",
-    "pi-better-goal": "0.12.2",
+    "pi-better-goal": "0.12.3",
     "pi-better-model-router": "0.1.4",
     "pi-ollama-cloud": "0.13.1",
     "pi-better-sandbox": "0.14.1",
     "pi-better-ssh": "0.1.4",
-    "pi-better-subagents": "0.28.0",
+    "pi-better-subagents": "0.28.1",
     "proper-lockfile": "^4.1.2",
     "shell-quote": "1.12.0",
     "smol-toml": "1.9.0",