pi-crew 0.10.2 → 0.10.3

package/src/runtime/live-session/live-session-runtime.ts

@@ -1,5 +1,3 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
 import { resolveToolPolicy } from "../../agents/agent-config.ts";
 import type { CrewRuntimeConfig } from "../../config/config.ts";
@@ -11,6 +9,7 @@ import type { TeamRunManifest, TeamTaskState, UsageState } from "../../state/typ
 import { logInternalError } from "../../utils/internal-error.ts";
 import { redactSecrets } from "../../utils/redaction.ts";
 import type { WorkflowStep } from "../../workflows/workflow-config.ts";
+import { BoundedTail } from "../compaction/compact-stages/bounded-tail.ts";
 import { createIrcTool } from "../custom-tools/irc-tool.ts";
 import { createSubmitResultTool } from "../custom-tools/submit-result-tool.ts";
 import { buildMcpProxyFromSession } from "../mcp-proxy.ts";
@@ -28,7 +27,13 @@ import { readEnabledModelsPatterns } from "../model/model-scope.ts";
 import { isLiveSessionRuntimeAvailable } from "../model/runtime-resolver.ts";
 import { awaitRuntimeWarmup } from "../model/runtime-warmup.ts";
 import { liveAgentContext, registerLiveAgentModel, unregisterLiveAgentModel } from "../model/session-model.ts";
-import { eventToSidechainType, sidechainOutputPath, writeSidechainEntry } from "../output/sidechain-output.ts";
+import {
+	appendBatchedJsonlLine,
+	eventToSidechainType,
+	flushPendingSidechainWrites,
+	sidechainOutputPath,
+	writeSidechainEntry,
+} from "../output/sidechain-output.ts";
 // NOTE: buildMemoryBlock is intentionally NOT imported here. The agent memory
 // block is injected via renderTaskPrompt().full (the USER prompt), which is
 // shared by both the child-pi path (no system prompt) and the live-session
@@ -60,7 +65,7 @@ import {
 	trackLiveAgentTurnEnd,
 	updateLiveAgentStatus,
 } from "./live-agent-manager.ts";
-import { subscribeLiveControlRealtime } from "./live-control-realtime.ts";
+import { hasLiveControlRealtimeListeners, subscribeLiveControlRealtime } from "./live-control-realtime.ts";
 import { buildExtensionBridge } from "./live-extension-bridge.ts";
 import { collectLiveSessionHealth, formatLiveSessionDiagnostics } from "./live-session-health.ts";
 
@@ -178,20 +183,13 @@ type LiveSessionLike = {
 
 function appendTranscript(filePath: string | undefined, event: unknown): void {
 	if (!filePath) return;
-	// Fire-and-forget async write to avoid blocking the event loop.
-	// Transcript writes are best-effort telemetry — callers do not need to await.
-	void appendTranscriptAsync(filePath, event);
-}
-
-/** Async version of appendTranscript — fire-and-forget for non-blocking writes. */
-async function appendTranscriptAsync(filePath: string, event: unknown): Promise<void> {
-	try {
-		await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
-		const content = `${JSON.stringify(redactSecrets(event))}\n`;
-		await fs.promises.appendFile(filePath, content, "utf-8");
-	} catch (error) {
-		logInternalError("live-session.transcript-write-failed", error as Error, `path=${filePath}`);
-	}
+	// Task 26 (2026-08-24): serialize + redact at queue time, then route
+	// through the shared 50ms batched JSONL writer (one mkdir + appendFileSync
+	// per path per window instead of one async mkdir+appendFile PER streaming
+	// event). child-pi-transcript's batched writer is not generic over plain
+	// paths (ChildPiRunInput + artifactsRoot containment + re-redaction), so
+	// the identical map lives in sidechain-output.ts.
+	appendBatchedJsonlLine(filePath, `${JSON.stringify(redactSecrets(event))}\n`);
 }
 
 function asRecord(value: unknown): Record<string, unknown> | undefined {
@@ -630,6 +628,9 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			message: event,
 			cwd: input.task.cwd,
 		});
+		// Task 26: the mock path returns before the try/finally below, so drain
+		// the batched writers here — tests read these files right after return.
+		flushPendingSidechainWrites();
 		if (isCurrent()) input.onEvent?.(event);
 		const stdout = `Mock live-session success for ${input.agent.name}${inherited}`;
 		if (isCurrent()) input.onOutput?.(stdout);
@@ -678,7 +679,13 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 	let unsubscribe: (() => void) | undefined;
 	let unsubscribeControlRealtime: (() => void) | undefined;
 	let controlTimer: ReturnType<typeof setInterval> | undefined;
-	let stdout = "";
+	// PERF (2026-08-24): unbounded string concat re-copies the whole transcript
+	// on every chunk; bounded tail keeps whatever the consumer actually reads.
+	// Consumer sizing: stdout becomes parsedOutput.finalText + the
+	// results/{taskId}.txt artifact — the same downstream consumers the
+	// child-pi path already caps at maxCaptureBytes (512 KiB) via BoundedTail,
+	// so we match that cap for parity (this is NOT a tail-only preview).
+	const stdoutTail = new BoundedTail();
 	let jsonEvents = 0;
 	const collectedJsonEvents: Record<string, unknown>[] | undefined = yieldEnabled ? [] : undefined;
 	const maxCollectedJsonEvents = 1000;
@@ -898,9 +905,18 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			});
 		});
 		await pollControl();
-		controlTimer = setInterval(() => {
-			if (isCurrent()) void pollControl();
-		}, 500);
+		// PERF (2026-08-24): each poll does existsSync + readFileSync + JSON.parse
+		// of the whole control JSONL. With a realtime subscription active for this
+		// agent, in-process control requests (team-tool / cross-extension RPC
+		// publish) are delivered immediately and the poll only covers cross-process
+		// writers → 1000ms. Without realtime, the file poll is the sole delivery
+		// path → keep the faster 500ms cadence.
+		controlTimer = setInterval(
+			() => {
+				if (isCurrent()) void pollControl();
+			},
+			hasLiveControlRealtimeListeners() ? 1000 : 500,
+		);
 		let turnCount = 0;
 		let softLimitReached = false;
 		const maxTurns = input.runtimeConfig?.maxTurns;
@@ -953,7 +969,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 					input.onEvent?.(event);
 					const text = [...eventText(event), ...finalAssistantText(event)].join("\n");
 					if (text.trim()) {
-						stdout += `${text}\n`;
+						stdoutTail.push(`${text}\n`);
 						streamOut?.write(text + "\n");
 						trackLiveAgentResponseText(agentId, text);
 						input.onOutput?.(text);
@@ -1034,7 +1050,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 				return {
 					available: true,
 					exitCode: 1,
-					stdout: stdout.trim(),
+					stdout: stdoutTail.value().trim(),
 					stderr: msg,
 					jsonEvents,
 					error: msg,
@@ -1050,7 +1066,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			data: {
 				elapsedMs: Date.now() - promptStart,
 				jsonEvents,
-				outputLength: stdout.length,
+				outputLength: stdoutTail.value().length,
 			},
 		});
 
@@ -1171,7 +1187,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		return {
 			available: true,
 			exitCode: 0,
-			stdout: stdout.trim(),
+			stdout: stdoutTail.value().trim(),
 			stderr: created.modelFallbackMessage ?? "",
 			jsonEvents,
 			usage,
@@ -1205,7 +1221,7 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		return {
 			available: true,
 			exitCode: 1,
-			stdout: stdout.trim(),
+			stdout: stdoutTail.value().trim(),
 			stderr: message,
 			jsonEvents,
 			error: message,
@@ -1220,6 +1236,10 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		// H6: Unsubscribe listeners FIRST before clearing timer to prevent race
 		unsubscribe?.();
 		unsubscribeControlRealtime?.();
+		// Task 26 (2026-08-24): drain the batched sidechain/transcript writers
+		// now that no more session events can enqueue, so callers that read the
+		// files right after this task settles see complete content.
+		flushPendingSidechainWrites();
 		// Round 27 (BUG 4): remove the named abort listener to avoid leaking it
 		// on the shared AbortSignal across many live-session tasks.
 		if (onSignalAbort) input.signal?.removeEventListener("abort", onSignalAbort);

package/src/runtime/manifest-cache.ts

@@ -29,6 +29,16 @@ interface CachedManifest {
 	mtimeMs: number;
 	size: number;
 	loadedAtMs: number;
+	/**
+	 * PERF (task-23a): timestamp of the last real statSync of this manifest.
+	 * parseManifestIfChanged() skips the stat entirely while the entry is
+	 * younger than the stat TTL (default 250ms), so back-to-back list() /
+	 * listActive() scans do not re-stat every manifest on every 500ms list
+	 * TTL expiry. Bounded staleness: a manifest change is picked up at most
+	 * statTtlMs late on the scan path (watcher-driven refreshes bypass this
+	 * with forceStat).
+	 */
+	statCheckedAtMs: number;
 }
 
 interface CachedList {
@@ -41,9 +51,16 @@ export interface ManifestCacheOptions {
 	debounceMs?: number;
 	watch?: boolean;
 	maxEntries?: number;
+	/**
+	 * PERF (task-23a): how long a cached manifest skips re-statting on scan
+	 * (default 250ms). Exposed mainly so tests can pin the window
+	 * deterministically.
+	 */
+	statTtlMs?: number;
 }
 
 const DEFAULT_TTL_MS = 500;
+const DEFAULT_STAT_TTL_MS = 250;
 
 interface ParsedEntry {
 	runId: string;
@@ -101,13 +118,30 @@ function validateManifestForRoot(root: string, runId: string, manifest: TeamRunM
 	}
 }
 
-function parseManifestIfChanged(root: string, runId: string, filePath: string, previous?: CachedManifest): CachedManifest | undefined {
+function parseManifestIfChanged(
+	root: string,
+	runId: string,
+	filePath: string,
+	previous?: CachedManifest,
+	forceStat = false,
+	statTtlMs = DEFAULT_STAT_TTL_MS,
+): CachedManifest | undefined {
+	if (!forceStat && previous && Date.now() - previous.statCheckedAtMs < statTtlMs) {
+		// PERF (task-23a): stat'ed very recently and not forcibly invalidated —
+		// the stat (and any parse behind it) cannot have changed the verdict.
+		// This bounds per-scan stat cost to ~1/statTtlMs per manifest instead
+		// of one per list() TTL expiry.
+		return previous;
+	}
 	let stat: fs.Stats;
 	try {
 		stat = fs.statSync(filePath);
 	} catch {
 		return undefined;
 	}
+	if (previous) {
+		previous.statCheckedAtMs = Date.now();
+	}
 	if (previous && previous.mtimeMs === stat.mtimeMs && previous.size === stat.size) {
 		// P1-9: the manifest file is unchanged, so its recorded paths and their
 		// containment verdict are unchanged too — skip the ~10-syscall
@@ -123,6 +157,7 @@ function parseManifestIfChanged(root: string, runId: string, filePath: string, p
 		mtimeMs: stat.mtimeMs,
 		size: stat.size,
 		loadedAtMs: Date.now(),
+		statCheckedAtMs: Date.now(),
 	};
 }
 
@@ -135,25 +170,54 @@ function listRunRoots(cwd: string): string[] {
 	return [...roots];
 }
 
+// PERF (2026-08-24, task-23b): list()/listActive() re-readdir'd every run
+// root on each 500ms TTL expiry. A runs root's own mtimeMs only changes when
+// direct entries (run dirs) are added/removed/renamed — exactly and only when
+// the listing must refresh — so the fully-mapped ParsedEntry[] is cached
+// against it. Manifest rewrites happen one level down (inside a run dir) and
+// never touch the root's mtime; they are picked up by the per-run stat in
+// parseManifestIfChanged. Caching the MAPPED entries (not just the raw names)
+// also skips the manifestPathForRun resolution (realpath + O_NOFOLLOW
+// ancestor walk, ~10 syscalls per run) for unchanged listings: an unchanged
+// root now costs a single statSync instead of existsSync + readdir + N walks.
+const DIR_LIST_CACHE_MAX_ROOTS = 64;
+const dirListCache = new Map<string, { mtimeMs: number; entries: ParsedEntry[] }>();
+
 function collectRoots(root: string): ParsedEntry[] {
-	if (!fs.existsSync(root)) return [];
+	let mtimeMs: number;
+	try {
+		mtimeMs = fs.statSync(root).mtimeMs;
+	} catch {
+		return [];
+	}
+	const cached = dirListCache.get(root);
+	if (cached && cached.mtimeMs === mtimeMs) {
+		return cached.entries;
+	}
 	let entries: string[];
 	try {
 		entries = fs.readdirSync(root);
 	} catch {
 		return [];
 	}
-	return entries
+	const mapped = entries
 		.filter((entry) => entry.length > 0 && isSafePathId(entry))
 		.map((entry) => ({
 			runId: entry,
 			path: manifestPathForRun(root, entry),
 		}))
 		.filter((entry): entry is ParsedEntry => entry.path !== undefined);
+	// Bounded growth: the map is module-scoped and shared across cache
+	// instances (tests, multi-project sessions); roots are few, but stale
+	// tempdir roots from finished tests would otherwise linger forever.
+	if (dirListCache.size >= DIR_LIST_CACHE_MAX_ROOTS) dirListCache.clear();
+	dirListCache.set(root, { mtimeMs, entries: mapped });
+	return mapped;
 }
 
 export function createManifestCache(cwd: string, options: ManifestCacheOptions = {}): ManifestCache {
 	const ttlMs = options.debounceMs ?? DEFAULT_TTL_MS;
+	const statTtlMs = options.statTtlMs ?? DEFAULT_STAT_TTL_MS;
 	const maxEntries = options.maxEntries ?? DEFAULT_CACHE.manifestMaxEntries;
 	const roots = listRunRoots(cwd);
 	const manifestIndex = new Map<string, CachedManifest>();
@@ -198,7 +262,7 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 		const activeEntry = activeRunEntries().find((entry) => entry.runId === runId);
 		if (activeEntry) {
 			const activeRoot = path.dirname(activeEntry.stateRoot);
-			const parsed = parseManifestIfChanged(activeRoot, runId, activeEntry.manifestPath, cached);
+			const parsed = parseManifestIfChanged(activeRoot, runId, activeEntry.manifestPath, cached, false, statTtlMs);
 			if (parsed) {
 				manifestIndex.set(runId, parsed);
 				return parsed;
@@ -207,7 +271,7 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 		for (const root of rootsToCheck) {
 			const manifestPath = manifestPathForRun(root, runId);
 			if (!manifestPath) continue;
-			const parsed = parseManifestIfChanged(root, runId, manifestPath, cached);
+			const parsed = parseManifestIfChanged(root, runId, manifestPath, cached, false, statTtlMs);
 			if (parsed) {
 				if (!cached || parsed.mtimeMs !== cached.mtimeMs || parsed.size !== cached.size) {
 					manifestIndex.set(runId, parsed);
@@ -223,13 +287,21 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 	}
 
 	/**
-	 * NOTE (RT-F10): This function performs a full FS scan + JSON.parse of all
-	 * manifests on every TTL expiry (default 500ms). This is a known performance
-	 * tradeoff: fs.watch provides real-time invalidation (see constructor above)
-	 * so the TTL cache is only consulted when the watcher fires, but the list()
-	 * call itself still re-reads all entries to pick up changes. Incremental
-	 * updates via fs.watch-driven delta tracking are planned for a future
-	 * iteration to avoid the full scan on each expiry.
+	 * NOTE (RT-F10, updated 2026-08-24): the original "full FS scan +
+	 * JSON.parse on every TTL expiry" cost is now layered:
+	 *   1. collectRoots() reuses a cached dir listing keyed by the runs root's
+	 *      own mtimeMs — one statSync per root replaces existsSync + readdir +
+	 *      the per-run manifestPathForRun resolution when no run dir was
+	 *      added/removed/renamed.
+	 *   2. parseManifestIfChanged() skips the per-manifest stat for statTtlMs
+	 *      (default 250ms) after the last check, so scans re-stat each run at
+	 *      most ~4x/sec regardless of how often the list TTL lapses.
+	 *   3. JSON.parse only happens when mtime+size actually changed.
+	 * What remains per 500ms expiry: one stat per runs root, one stat per run
+	 * whose stat TTL lapsed, and the in-memory merge + sort. fs.watch events
+	 * that carry a filename refresh just that run (forceStat) and expire the
+	 * list caches immediately instead of triggering a wholesale refresh (see
+	 * handleWatchEvent below).
 	 */
 	function list(limit = DEFAULT_CACHE.manifestMaxEntries): TeamRunManifest[] {
 		const now = Date.now();
@@ -249,7 +321,7 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 			if (entry.runId.length === 0) continue;
 			let cached = manifestIndex.get(entry.runId);
 			const root = path.dirname(path.dirname(entry.path));
-			const parsed = parseManifestIfChanged(root, entry.runId, entry.path, cached);
+			const parsed = parseManifestIfChanged(root, entry.runId, entry.path, cached, false, statTtlMs);
 			if (parsed) {
 				cached = parsed;
 				manifestIndex.set(entry.runId, cached);
@@ -258,7 +330,11 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 		}
 
 		const runs = [...unique.values()].filter((value): value is CachedManifest => value !== undefined).map((value) => value.manifest);
-		const sorted = runs.sort((a, b) => (b.createdAt ?? "").localeCompare(a.createdAt ?? ""));
+		// PERF (task-23d): ISO-8601 createdAt strings are fixed-width and sort
+		// correctly with plain comparison — no locale machinery per compare.
+		const sorted = runs.sort((a, b) =>
+			(b.createdAt ?? "") < (a.createdAt ?? "") ? -1 : (b.createdAt ?? "") > (a.createdAt ?? "") ? 1 : 0,
+		);
 		const limited = sorted.slice(0, Math.max(0, limit));
 		if (manifestIndex.size > maxEntries) {
 			const removeCount = manifestIndex.size - maxEntries;
@@ -324,7 +400,7 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 			if (entry.runId.length === 0) continue;
 			let cached = manifestIndex.get(entry.runId);
 			const root = path.dirname(path.dirname(entry.path));
-			const parsed = parseManifestIfChanged(root, entry.runId, entry.path, cached);
+			const parsed = parseManifestIfChanged(root, entry.runId, entry.path, cached, false, statTtlMs);
 			if (parsed) {
 				cached = parsed;
 				manifestIndex.set(entry.runId, cached);
@@ -339,12 +415,47 @@ export function createManifestCache(cwd: string, options: ManifestCacheOptions =
 		return running.slice(0, cap);
 	}
 
+	// PERF (task-23c): the runs-root watcher reports the direct child that
+	// changed in `filename` (a run dir added/removed/renamed — the watcher is
+	// non-recursive, so manifest rewrites one level down never reach it).
+	// Refresh ONLY that run — forceStat bypasses the statTtlMs skip so a
+	// just-checked run still re-stats — and expire the list caches so the
+	// next list()/listActive() re-collects roots and re-sorts. Events without
+	// a usable filename (null, Buffer, non-run-id names like ".DS_Store")
+	// fall back to the wholesale debounced refresh.
+	function handleWatchEvent(root: string, filename: string | Buffer | null): void {
+		if (typeof filename !== "string" || !isSafePathId(filename)) {
+			scheduleListRefresh();
+			return;
+		}
+		const manifestPath = manifestPathForRun(root, filename);
+		if (manifestPath) {
+			const parsed = parseManifestIfChanged(
+				root,
+				filename,
+				manifestPath,
+				manifestIndex.get(filename),
+				/* forceStat */ true,
+				statTtlMs,
+			);
+			if (parsed) {
+				manifestIndex.set(filename, parsed);
+			} else {
+				// Run dir (or its manifest) is gone — drop the cached entry so
+				// the next scan does not serve a stale manifest.
+				manifestIndex.delete(filename);
+			}
+		}
+		listCache.clear();
+		invalidateListActive();
+	}
+
 	if (options.watch ?? true) {
 		for (const root of roots) {
 			const watcher = watchWithErrorHandler(
 				root,
-				() => {
-					scheduleListRefresh();
+				(_eventType, filename) => {
+					handleWatchEvent(root, filename);
 				},
 				() => {
 					scheduleListRefresh();

package/src/runtime/model/pi-args.ts

@@ -2,7 +2,6 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
-import { resolveToolPolicy } from "../../agents/agent-config.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
 import { packageRoot, userPiRoot } from "../../utils/paths.ts";
 
@@ -17,7 +16,9 @@ const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
 // dist/ entry points.
 const PROMPT_RUNTIME_EXTENSION_PATH = path.join(packageRoot(), "src", "prompt", "prompt-runtime.ts");
 const TASK_ARG_LIMIT = 8000;
-const DEFAULT_MAX_CREW_DEPTH = 2;
+// D8 spec v0.7 — nested mở (default 4 depth levels: child→child→child→child);
+// cap giữ để chống runaway recursion từ config lỗi hoặc intentional abuse.
+const DEFAULT_MAX_CREW_DEPTH = 4;
 
 // Track every temp dir created in this process so we can clean them up
 // even if the parent is killed before child-pi.ts cleanup runs.
@@ -278,71 +279,57 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		args.push("--thinking", effectiveThinking);
 	}
 
-	// Apply role-based tool restrictions (from role-tools.ts)
-	// F1 unify (v0.8.0): the tool policy is resolved by the shared
-	// `resolveToolPolicy` helper (same code as the live-session path), so the
-	// two spawn paths agree. Before this, child-pi used role-config
-	// authoritative and ignored `agent.disallowedTools`; live-session used
-	// frontmatter authoritative and ignored role-config. Now:
-	//   - allowlist precedence is source-aware (builtin → role authoritative;
-	//     user/project → frontmatter authoritative)
-	//   - denylist is additive (role excludeTools + agent disallowedTools merged)
-	const policy = resolveToolPolicy(input.agent, input.role);
-	const explicitTools = policy.tools;
-	const excludeTools = policy.excludeTools;
-
-	// §0c C6: agent.disableTools (Pi `--no-tools`) fully disables all tools. Used by
-	// capability-locked agents (e.g. the goal-judge) that must have NO agency.
-	// MUST come before any --tools/--exclude-tools so it wins (Pi applies last-wins).
-	// An empty `tools:[]` is INSUFFICIENT because the length-check below skips it.
+	// D5 (spec v0.7 §6): default loadout = FULL session (như main session).
+	// --no-extensions/--no-skills/--tools CHỈ xuất hiện khi agent .md khai explicit.
+	const CONTROL_TOOLS = ["ask", "delegate"] as const;
 	if (input.agent.disableTools === true) {
-		args.push("--no-tools");
+		args.push("--no-tools"); // capability-locked agents giữ hành vi (goal-judge)
 	} else {
-		if (explicitTools?.length) args.push("--tools", explicitTools.join(","));
-		if (excludeTools?.length) args.push("--exclude-tools", excludeTools.join(","));
-	}
-	// Always add --no-extensions before --extension to prevent user extensions from being auto-loaded.
-	// User extensions in ~/.pi/agent/extensions/ may fail due to missing dependencies.
-	args.push("--no-extensions");
-	if (input.agent.extensions !== undefined) {
-		// F1 (v0.7.9): apply `excludeExtensions` denylist (case-insensitive
-		// basename match) BEFORE the trusted PROMPT_RUNTIME_EXTENSION_PATH is
-		// prepended. The prompt-runtime is a pi-crew internal and is never
-		// excludable. Unknown names in the denylist are tolerated (logged
-		// would be nice but this path is sync and minimal — keeping parity
-		// with the rest of the agent loader's best-effort semantics).
-		const excluded = new Set((input.agent.excludeExtensions ?? []).map((name) => path.basename(name).toLowerCase()));
-		let allowed = input.agent.extensions.filter((ext) => !excluded.has(path.basename(ext).toLowerCase()));
-		// SEC-1: Defense-in-depth — deny untrusted project-sourced extensions
-		// unless explicitly trusted via PI_CREW_TRUST_PROJECT_AGENT_EXTENSIONS=1.
-		// Even if parseAgentFile missed the strip (e.g., agent was constructed
-		// at runtime), buildPiWorkerArgs must never emit --extension
-		// <attacker-path> for a project / project-pi agent. Both `project`
-		// (.crew/agents/) and `project-pi` (.pi/agents/) are repo-adjacent /
-		// untrusted sources. Only the trusted PROMPT_RUNTIME_EXTENSION_PATH is
-		// allowed through.
-		const extEnv = input.env ?? process.env;
-		if (
-			(input.agent.source === "project" || input.agent.source === "project-pi") &&
-			extEnv.PI_CREW_TRUST_PROJECT_AGENT_EXTENSIONS !== "1"
-		) {
-			allowed = allowed.filter((ext) => path.resolve(ext) === path.resolve(PROMPT_RUNTIME_EXTENSION_PATH));
+		// AgentConfig.tools is string[] (parseToolsField normalizes the
+		// frontmatter CSV), but inline/runtime-constructed agents may still
+		// carry the raw CSV string — normalize both.
+		const rawTools: unknown = input.agent.tools;
+		const declared =
+			typeof rawTools === "string"
+				? rawTools
+						.split(",")
+						.map((t) => t.trim())
+						.filter(Boolean)
+				: Array.isArray(rawTools)
+					? rawTools.map((t) => String(t).trim()).filter(Boolean)
+					: [];
+		if (declared.length > 0) {
+			const allow = new Set<string>([...declared, ...CONTROL_TOOLS]);
+			args.push("--tools", [...allow].join(","));
 		}
-		// ADR-5 §8 (governed nesting, T3/WP-5 step 8): every spawn this builder
-		// produces runs at depth > 0 (workers are depth 1, delegate grandchildren
-		// are 2+; currentCrewDepth(base)+1 is ALWAYS >= 1) — the extension list
-		// is an unconditional ALLOWLIST: only the trusted
-		// PROMPT_RUNTIME_EXTENSION_PATH passes, REGARDLESS OF SOURCE. User-sourced
-		// agent declarations can no longer inject extensions into sub-agents
-		// (SEC-1's project-only strip left user/builtin declarations unfiltered —
-		// the audit's untested hole). The denylist + SEC-1 strip above remain as
-		// defense-in-depth; the allowlist is authoritative.
-		allowed = [];
-		for (const extension of [PROMPT_RUNTIME_EXTENSION_PATH, ...allowed]) args.push("--extension", extension);
-	} else {
-		args.push("--extension", PROMPT_RUNTIME_EXTENSION_PATH);
+		// declared rỗng → KHÔNG truyền --tools (full default toolset — pattern
+		// buildSubagentToolAllowlist của pi-interactive-subagents index.ts:809-811).
+		// B2 (fix round 1): `disallowedTools:` frontmatter is a
+		// declaration-driven denylist (opt-in like `tools:`) — NOT the
+		// role-based policy D5 removed.
+		const disallowed = (input.agent.disallowedTools ?? []).map((t) => t.trim()).filter(Boolean);
+		if (disallowed.length > 0) args.push("--exclude-tools", [...new Set(disallowed)].join(","));
+	}
+	// prompt-runtime extension luôn nạp (hạ tầng phối hợp — không phải cắt xén).
+	args.push("--extension", PROMPT_RUNTIME_EXTENSION_PATH);
+	// SEC-1 (fix round 1): DECLARED extensions from untrusted sources
+	// (project / project-pi / dynamic) are stripped unless the operator opts
+	// in via PI_CREW_TRUST_PROJECT_AGENT_EXTENSIONS=1. Auto-discovery stays
+	// open (D5) — this only filters explicit `extensions:` declarations.
+	const extEnv = input.env ?? process.env;
+	const untrustedSource = input.agent.source === "project" || input.agent.source === "project-pi" || input.agent.source === "dynamic";
+	let declaredExtensions = input.agent.extensions ?? [];
+	if (untrustedSource && extEnv.PI_CREW_TRUST_PROJECT_AGENT_EXTENSIONS !== "1") {
+		declaredExtensions = [];
 	}
-	if (!input.agent.inheritSkills) args.push("--no-skills");
+	// F1 (v0.7.9): excludeExtensions denylist (case-insensitive basename
+	// match) applies to the declared list AFTER the SEC-1 strip. The
+	// prompt-runtime is a pi-crew internal and is never excludable.
+	const excluded = new Set((input.agent.excludeExtensions ?? []).map((name) => path.basename(name).toLowerCase()));
+	declaredExtensions = declaredExtensions.filter((ext) => !excluded.has(path.basename(ext).toLowerCase()));
+	for (const ext of declaredExtensions) args.push("--extension", ext);
+	// KHÔNG còn --no-extensions (extension discovery hoạt động như main session).
+	if (input.agent.inheritSkills === false) args.push("--no-skills");
 	for (const skillPath of input.skillPaths ?? []) args.push("--skill", skillPath);
 
 	let tempDir: string | undefined;
@@ -380,12 +367,14 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 			// main session (the lesson from an accidental `kill` of a live main session).
 			PI_CREW_KIND: "subagent",
 			PI_CREW_INHERIT_PROJECT_CONTEXT: input.agent.inheritProjectContext ? "1" : "0",
-			PI_CREW_INHERIT_SKILLS: input.agent.inheritSkills ? "1" : "0",
+			// B1 (fix round 1): match the argv `=== false` semantics — undefined
+			// inheritSkills means INHERIT (D5 default), not "0".
+			PI_CREW_INHERIT_SKILLS: input.agent.inheritSkills === false ? "0" : "1",
 			PI_CREW_DEPTH: String(parentDepth + 1),
 			PI_CREW_MAX_DEPTH: String(maxDepth),
 			PI_CREW_ROLE: input.agent.name,
 			PI_TEAMS_INHERIT_PROJECT_CONTEXT: input.agent.inheritProjectContext ? "1" : "0",
-			PI_TEAMS_INHERIT_SKILLS: input.agent.inheritSkills ? "1" : "0",
+			PI_TEAMS_INHERIT_SKILLS: input.agent.inheritSkills === false ? "0" : "1",
 			PI_TEAMS_DEPTH: String(parentDepth + 1),
 			PI_TEAMS_MAX_DEPTH: String(maxDepth),
 			PI_TEAMS_ROLE: input.agent.name,