pi-crew 0.11.4 → 0.11.6

package/src/runtime/goal-workflow/dynamic-workflow-context.ts

@@ -32,6 +32,7 @@ import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import type { TeamRunManifest } from "../../state/types.ts";
 import type { TeamConfig } from "../../teams/team-config.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
+import { safeAbort } from "../../utils/safe-abort.ts";
 import { cleanupAgentWorktreeAsync, prepareAgentWorktreeAsync } from "../../worktree/worktree-manager.ts";
 import type { DwfCheckpointState } from "../dwf-state-store.ts";
 import { parsePiJsonOutput } from "../output/pi-json-output.ts";
@@ -40,6 +41,7 @@ import { executeWithRetry } from "../recovery/retry-executor.ts";
 import { runWorker } from "../run-worker.ts";
 import { mapConcurrent } from "../scheduling/parallel-utils.ts";
 import { Semaphore } from "../scheduling/semaphore.ts";
+import { estimateTokens } from "../task-runner/prompt-builder.ts";
 import { renderPlanTemplate } from "./plan-templates.ts";
 
 export interface AgentCallOpts {
@@ -102,6 +104,34 @@ export interface WorkflowBudget {
 	remaining(): number;
 }
 
+/** SDD-3 W-C G13: default cap on ctx.agent() invocations per DWF run.
+ *
+ * Rationale: the largest real workflows observed (distill pipelines, adaptive
+ * plans) use ~10-40 agent calls; 200 gives ≥5× headroom so a legitimate run
+ * never trips it. Cost-wise 200 calls × ~5k tokens/call bounds a no-budget run
+ * to roughly a million tokens — an explainable blast radius. For real spawns
+ * the 30-min script timeout usually binds first; this cap's job is the
+ * no-budget runaway class, which previously had NO bound on the number of
+ * spawned steps and died only via the blind timeout (upgrade plan §2 G13). */
+export const DEFAULT_MAX_AGENT_CALLS = 200;
+
+/** SDD-3 W-C G13: structured termination error thrown when the agent-call cap trips.
+ * Propagates out of ctx.agent() (and therefore out of the .dwf.ts script unless
+ * the script catches it) so the runner fails the run with a structured reason
+ * (dwf.failed) instead of waiting out the blind script timeout. */
+export class DwfAgentCallCapError extends Error {
+	/** Effective cap that was tripped. */
+	readonly limit: number;
+	/** Completed agent() invocations when the cap tripped. */
+	readonly used: number;
+	constructor(limit: number, used: number) {
+		super(`dynamic workflow agent-call cap reached (${used}/${limit} calls; raise the run's maxAgentCalls to allow more)`);
+		this.name = "DwfAgentCallCapError";
+		this.limit = limit;
+		this.used = used;
+	}
+}
+
 export interface WorkflowCtx {
 	cwd: string;
 	runId: string;
@@ -181,6 +211,10 @@ export interface MakeWorkflowCtxOptions {
 	modelOverride?: string;
 	/** round-14 P1-2: per-workflow token budget. null/undefined = unbounded. */
 	tokenBudget?: number | null;
+	/** SDD-3 W-C G13: cap on ctx.agent() invocations (new spawns AND cached
+	 *  replays) per run. null/undefined = DEFAULT_MAX_AGENT_CALLS — a run is
+	 *  always bounded even with no tokenBudget configured. */
+	maxAgentCalls?: number | null;
 	/** round-14 P1-5: typed workflow arguments (sourced from manifest.args). Defaults to {}. */
 	args?: unknown;
 	/** round-18 P2-3: checkpoint state to hydrate ctx with on resume. When provided,
@@ -252,6 +286,20 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 	const concurrency = Math.max(1, opts.concurrency ?? 4);
 	const semaphore = new Semaphore(concurrency);
 	let finalResult: { artifactPath: string; meta?: Record<string, unknown> } | undefined;
+	// SDD-3 W-C G13: effective agent-call cap. Always ≥ 1 — omitting every knob
+	// still leaves the run bounded (default DEFAULT_MAX_AGENT_CALLS). A cap error
+	// aborts capController below so in-flight children are killed and pipeline()
+	// rethrows the cap error instead of swallowing it into a null item.
+	const maxAgentCalls =
+		typeof opts.maxAgentCalls === "number" && Number.isFinite(opts.maxAgentCalls) && opts.maxAgentCalls >= 1
+			? Math.floor(opts.maxAgentCalls)
+			: DEFAULT_MAX_AGENT_CALLS;
+	const capController = new AbortController();
+	// G13: combine the caller's signal with the cap controller so EITHER source
+	// (external abort OR cap trip) reaches runWorker and ctx.signal consumers.
+	// AbortSignal.any is available since Node 20.3 (project requires Node 22+);
+	// an already-aborted input yields an already-aborted combined signal.
+	const ctxSignal = AbortSignal.any([opts.signal, capController.signal]);
 	// round-18 P2-3: agent invocation counter. Hydrated from a resumed checkpoint so a
 	// resumed run keeps an accurate count; incremented in agent()'s finally block.
 	let agentCount = opts.resumedState ? opts.resumedState.agentCount : 0;
@@ -290,7 +338,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 		cwd: manifest.cwd,
 		runId: manifest.runId,
 		goal: manifest.goal,
-		signal: opts.signal,
+		signal: ctxSignal,
 		semaphore,
 		async agent(call: AgentCallOpts): Promise<AgentResult> {
 			await semaphore.acquire();
@@ -299,10 +347,42 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 			// regardless of which return/throw path is taken.
 			let worktreePath: string | undefined;
 			let worktreeBranch: string | undefined;
-			// BDG-2: declared before the try so the catch block can un-reserve on failure.
-			const ESTIMATE = 4096;
+			// BDG-2 + G14 (SDD-3): content-based reserve estimate — replaces the flat
+			// ESTIMATE=4096. estimateTokens() (chars/4, the in-tree heuristic exported
+			// from runtime/task-runner/prompt-builder.ts — the same estimator
+			// pre-execution.ts uses) runs over the call's prompt + optional
+			// systemPrompt override, floored at 512 tokens for the fixed per-call
+			// overhead (schema/JSON directive, artifact headers) not present in the
+			// prompt string. Short calls stop over-reserving; very long prompts
+			// reserve proportionally so N concurrent calls cannot blow past the
+			// budget between reserve and the post-run adjust. Every BDG-2 site
+			// below (check/reserve/un-reserve/adjust/refund) uses THIS value, so
+			// refund always matches what was reserved.
+			const estimate = Math.max(512, estimateTokens((call.prompt?.length ?? 0) + (call.systemPrompt?.length ?? 0)));
 			let reserved = false;
 			try {
+				// SDD-3 W-C G13: agent-call cap — the structured bound for no-budget runs.
+				// Checked BEFORE the PERS-1 cache lookup on purpose: cached replays are
+				// free but must still count, so a spin loop over the same prompt cannot
+				// bypass the cap (the default 200 leaves ≥5× headroom over the largest
+				// real workflows, so resume replays never trip it legitimately). Counts
+				// completed invocations; up to concurrency-1 extra calls may already be
+				// in flight when it trips (they are killed by the cap abort below).
+				if (agentCount >= maxAgentCalls) {
+					// Durable record (dwf.log is the registered workflow-log event type).
+					appendEvent(manifest.eventsPath, {
+						type: "dwf.log",
+						runId: manifest.runId,
+						data: {
+							message: `agent-call cap reached: ${agentCount}/${maxAgentCalls} — terminating workflow (raise maxAgentCalls to allow more)`,
+							limit: maxAgentCalls,
+							used: agentCount,
+						},
+					});
+					// Kill in-flight children + make pipeline()/gatherReplies() see the abort.
+					safeAbort(capController, "dwf-agent-call-cap");
+					throw new DwfAgentCallCapError(maxAgentCalls, agentCount);
+				}
 				// PERS-1: per-agent-call idempotency. Compute a deterministic call ID
 				// from the call arguments and check if this call was already completed
 				// (e.g. during a previous run before a crash). If so, return the cached
@@ -327,7 +407,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				// BDG-2: reserve-then-adjust budget. Before spawning, estimate the cost and
 				// reserve it by adding to wfState.spent. This prevents N concurrent calls from
 				// all seeing the same remaining budget and overspending.
-				if (budget.total !== null && budget.remaining() < ESTIMATE) {
+				if (budget.total !== null && budget.remaining() < estimate) {
 					return {
 						ok: false,
 						text: "",
@@ -336,7 +416,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 					};
 				}
 				// Reserve the estimate before spawning.
-				wfState.spent += ESTIMATE;
+				wfState.spent += estimate;
 				reserved = true;
 
 				const agentConfig = resolveAgentForRole(call.role, {
@@ -399,14 +479,14 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 					skillPaths: undefined, // skills resolved via agent config + team-role plumbing
 					maxTurns: call.maxTurns,
 					graceTurns: call.graceTurns,
-					signal: opts.signal,
+					signal: ctxSignal,
 					artifactsRoot: manifest.artifactsRoot,
 					runId: manifest.runId,
 					role: call.role ?? call.agent,
 				});
 				if (childResult.exitCode !== 0 || childResult.error) {
 					// BDG-2: un-reserve the estimate on spawn failure.
-					wfState.spent -= ESTIMATE;
+					wfState.spent -= estimate;
 					reserved = false;
 					return {
 						ok: false,
@@ -418,8 +498,8 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				const parsed = parsePiJsonOutput(childResult.stdout);
 				// round-14 P1-2: accumulate this run's token usage into the workflow budget.
 				// BDG-2: adjust the reserve — subtract the estimate, add the actual usage.
-				// This correctly reduces spent when actualUsage < ESTIMATE.
-				wfState.spent += (parsed.usage?.input ?? 0) + (parsed.usage?.output ?? 0) - ESTIMATE;
+				// This correctly reduces spent when actualUsage < estimate.
+				wfState.spent += (parsed.usage?.input ?? 0) + (parsed.usage?.output ?? 0) - estimate;
 				reserved = false;
 				let text = childResult.rawFinalText || parsed.finalText || "";
 				// Round-11 test fix: parsePiJsonOutput only extracts text from pi event stream
@@ -468,7 +548,11 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				};
 			} catch (error) {
 				// BDG-2: un-reserve the estimate on failure (only if still reserved).
-				if (reserved) wfState.spent -= ESTIMATE;
+				if (reserved) wfState.spent -= estimate;
+				// SDD-3 W-C G13: cap errors must TERMINATE the script with the
+				// structured reason — degrading to ok:false would let scripts (and the
+				// review()/retry()/pipeline fallbacks) swallow the cap and keep looping.
+				if (error instanceof DwfAgentCallCapError) throw error;
 				logInternalError("dynamic-workflow-context.agent", error, `runId=${manifest.runId}`);
 				return {
 					ok: false,
@@ -534,7 +618,9 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 					try {
 						value = await stage(value as TResult, item, index);
 					} catch (error) {
-						if (opts.signal.aborted) throw error;
+						// G13: ctxSignal is aborted on cap trip — rethrow so the structured cap
+						// error terminates the workflow instead of degrading to a null item.
+						if (ctxSignal.aborted) throw error;
 						ctx.log(`pipeline[${index}] failed: ${error instanceof Error ? error.message : String(error)}`);
 						return null;
 					}
@@ -669,7 +755,7 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 				const got = inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 				if (got.length >= messageIds.length) return got;
 				await new Promise((r) => setTimeout(r, 500));
-				if (opts.signal.aborted) return inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
+				if (ctxSignal.aborted) return inbox.filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 			}
 			return readMailbox(manifest, "inbox").filter((m) => m.replyTo && messageIds.includes(m.replyTo));
 		},
@@ -767,6 +853,12 @@ export function makeWorkflowCtx(manifest: TeamRunManifest, opts: MakeWorkflowCtx
 		get: () => agentCount,
 		enumerable: false,
 	});
+	// SDD-3 W-C G13: effective run limits are read-only from the runner (mirrors
+	// __agentCount). Exposed so getWorkflowLimits() can report the effective cap.
+	Object.defineProperty(ctx, "__limits", {
+		get: () => ({ maxAgentCalls }),
+		enumerable: false,
+	});
 	// PERS-1: completedAgentCalls is read-only from the runner; the agent() method
 	// is the only writer. Exposed so getWorkflowCheckpoint() can include it.
 	Object.defineProperty(ctx, "__completedAgentCalls", {
@@ -806,6 +898,13 @@ export function getWorkflowLogs(ctx: WorkflowCtx): string[] | undefined {
 	return (ctx as unknown as { __logs?: string[] }).__logs;
 }
 
+/** SDD-3 W-C G13: read the effective run limits (runner-only; not part of the public
+ *  ctx surface). Mirrors getWorkflowFinalResult/getWorkflowPhaseState — exposed for
+ *  tests and diagnostics so the default cap is observable without dispatching calls. */
+export function getWorkflowLimits(ctx: WorkflowCtx): { maxAgentCalls: number } | undefined {
+	return (ctx as unknown as { __limits?: { maxAgentCalls: number } }).__limits;
+}
+
 /** round-18 P2-3: snapshot the current DWF checkpoint state (runner-only; not part of the public
  *  ctx surface). Mirrors getWorkflowFinalResult/getWorkflowPhaseState. The runner relies on the
  *  `onCheckpoint` callback for accurate per-agent-call checkpoints (it captures the closure value

package/src/runtime/goal-workflow/dynamic-workflow-runner.ts

@@ -55,6 +55,12 @@ export interface RunDynamicWorkflowInput {
 	modelOverride?: string;
 	/** round-14 P1-2: per-workflow token budget. Overrides workflow.maxTokenBudget. */
 	tokenBudget?: number;
+	/** SDD-3 W-C G13: cap on ctx.agent() invocations. Overrides
+	 *  workflow.maxAgentCalls; unset/invalid → DEFAULT_MAX_AGENT_CALLS.
+	 *  Accepts stringified numbers (schema Union numeric-string branch; the
+	 *  team-tool loose-numeric coercion list is owned by team-tool.ts, so this
+	 *  boundary coerces defensively). */
+	maxAgentCalls?: number | string;
 }
 
 export interface RunDynamicWorkflowResult {
@@ -152,6 +158,16 @@ async function loadWorkflowModule(scriptPath: string): Promise<DynamicWorkflowSc
 	return fn as DynamicWorkflowScript;
 }
 
+/** SDD-3 W-C G13: resolve the effective agent-call cap from the runner input /
+ *  workflow config. Accepts the schema's stringified-number form; anything
+ *  non-finite or < 1 falls back to the ctx default (DEFAULT_MAX_AGENT_CALLS). */
+function resolveMaxAgentCalls(value: number | string | undefined | null): number | undefined {
+	if (value === undefined || value === null || value === "") return undefined;
+	const n = typeof value === "number" ? value : Number(value);
+	if (!Number.isFinite(n) || n < 1) return undefined;
+	return Math.floor(n);
+}
+
 /**
  * Run the dynamic workflow script. Loads it, builds the ctx, executes, and returns
  * {manifest, tasks} with the manifest updated to a terminal status + result artifact.
@@ -216,6 +232,9 @@ export async function runDynamicWorkflow(input: RunDynamicWorkflowInput): Promis
 		team: input.team,
 		modelOverride: input.modelOverride,
 		tokenBudget: input.tokenBudget ?? workflow.maxTokenBudget,
+		// SDD-3 W-C G13: explicit input wins over workflow config; both unset →
+		// ctx falls back to DEFAULT_MAX_AGENT_CALLS (a run is always bounded).
+		maxAgentCalls: resolveMaxAgentCalls(input.maxAgentCalls ?? workflow.maxAgentCalls),
 		args: manifest.args,
 		resumedState,
 		// round-18 P2-3: checkpoint after each ctx.agent() call so a crash between calls

package/src/runtime/live-session/live-agent-manager.ts

@@ -186,6 +186,37 @@ function safeDisposeLiveSession(handle: LiveAgentHandle): void {
 	}
 }
 
+/**
+ * WI-5 (SDD-4): last-resort kill for process-backed live sessions.
+ *
+ * terminateLiveAgent used to rely ONLY on session.abort()/dispose(). For
+ * in-process SDK sessions that is sufficient (nothing to signal), but a
+ * session handle that wraps a worker process and exposes `pid` (the same
+ * property evictStaleLiveAgentHandles already reads for liveness) can
+ * survive abort() — abort cancels the in-flight request, not the process —
+ * leaking a live worker process after terminate. Real child-pi workers never
+ * register here (they are killed via killProcessPid from the runner SIGTERM
+ * cascade, cancel/lifecycle asyncPid kill, and the stale reconciler); this
+ * covers registered handles that DO expose a worker pid. Guarded best-effort:
+ * skip non-numeric/self pids and already-dead processes; killProcessPid does
+ * the SIGTERM→SIGKILL escalation on the process group.
+ */
+async function killLiveSessionProcessIfAlive(handle: LiveAgentHandle): Promise<void> {
+	try {
+		const session = handle.session as Record<string, unknown> | undefined;
+		const pid = session?.pid;
+		if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0 || pid === process.pid) return;
+		if (!checkProcessLiveness(pid).alive) return;
+		// child-pi-kill is only needed on the terminate/cleanup path — keep it off
+		// the registration/render hot path (same pattern as background-runner).
+		// LAZY: dynamic import keeps child-pi-kill off the hot registration path.
+		const { killProcessPid } = await import("../child-pi/child-pi-kill.ts");
+		killProcessPid(pid);
+	} catch (error) {
+		logInternalError("live-agent-manager.kill-process", error, `agentId=${handle.agentId}`);
+	}
+}
+
 export function disposeLiveAgentSession(agentIdOrTaskId: string): void {
 	const handle = getLiveAgent(agentIdOrTaskId);
 	if (!handle) return;
@@ -226,6 +257,10 @@ export async function terminateLiveAgent(
 		safeDisposeLiveSession(handle);
 		liveAgents.delete(handle.agentId); // Move AFTER abort completes to prevent race
 		invalidateSortedLiveAgents();
+		// WI-5 (SDD-4): if the session still backs a live worker process that
+		// abort()/dispose() failed to stop, signal it last so terminate cannot
+		// leak the worker. No-op for in-process SDK sessions (no numeric pid).
+		await killLiveSessionProcessIfAlive(handle);
 	}
 	return handle;
 }

package/src/runtime/live-session/live-session-runtime.ts

@@ -12,7 +12,7 @@ import type { WorkflowStep } from "../../workflows/workflow-config.ts";
 import { BoundedTail } from "../compaction/compact-stages/bounded-tail.ts";
 import { createIrcTool } from "../custom-tools/irc-tool.ts";
 import { createSubmitResultTool } from "../custom-tools/submit-result-tool.ts";
-import { buildMcpProxyFromSession } from "../mcp-proxy.ts";
+import { g2EnforcementDegradationReason, mcpPermittedForRole, stripMcpExtensions } from "../mcp-proxy.ts";
 import {
 	availableModelInfosFromRegistry,
 	buildConfiguredModelRouting,
@@ -701,6 +701,16 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 
 	try {
 		const agentDir = typeof mod.getAgentDir === "function" ? mod.getAgentDir() : undefined;
+		// G2 (SDD-2 W-B, least-privilege): live-session workers inherit the
+		// parent's MCP servers ONLY when the role is MCP-permitted
+		// (write-capable; read-only/unknown/undefined are default-denied —
+		// see mcpPermittedForRole). pi ≥0.99 loads MCP as a built-in
+		// EXTENSION (`builtin:mcp`, plus any installed replacer such as
+		// pi-mcp-adapter) and the pre-0.99 `enableMCP:false` session option
+		// no longer exists — so enforcement happens HERE, at the resource
+		// loader: the MCP extension(s) are dropped from the child's extension
+		// list for non-permitted roles (no MCP code load, no server connect).
+		const mcpPermitted = mcpPermittedForRole(input.task.role);
 		let resourceLoader: unknown;
 		// F1 (v0.7.9) NOTE: `agent.excludeExtensions` is applied on the
 		// child-pi path (see `pi-args.ts`). The live-session path loads
@@ -718,9 +728,32 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 				noContextFiles: input.runtimeConfig?.inheritContext !== true,
 				systemPromptOverride: () => liveSystemPrompt(input),
 				appendSystemPromptOverride: () => [],
+				// G2: non-permitted roles get the MCP extension(s) stripped.
+				...(mcpPermitted ? {} : { extensionsOverride: stripMcpExtensions }),
 			});
 			await (resourceLoader as { reload?: () => Promise<void> }).reload?.();
 		}
+		// G2 degraded-enforcement warning (security-review follow-up): if the
+		// role is NOT MCP-permitted but the strip above could not be armed (SDK
+		// stopped exporting DefaultResourceLoader, or agentDir unresolvable),
+		// enforcement silently degrades to fail-open — surface it instead of
+		// letting a version drift quietly re-expose the parent's MCP servers.
+		const g2DegradationReason = g2EnforcementDegradationReason({
+			mcpPermitted,
+			resourceLoaderAvailable: Boolean(mod.DefaultResourceLoader && agentDir),
+		});
+		if (g2DegradationReason) {
+			appendEventFireAndForget(input.manifest.eventsPath, {
+				type: "task.mcp_enforcement_degraded",
+				runId: input.manifest.runId,
+				taskId: input.task.id,
+				message: `G2 MCP policy NOT enforced for role "${input.task.role ?? "unknown"}": pi SDK resource loader unavailable (${g2DegradationReason}) — this worker may inherit the parent's MCP servers.`,
+				data: {
+					role: input.task.role ?? null,
+					reason: g2DegradationReason,
+				},
+			});
+		}
 		const effectiveParentModel = resolveParentModelFromRegistry(input.modelRegistry, input.parentModel);
 		const modelRouting = buildConfiguredModelRouting({
 			overrideModel: input.modelOverride,
@@ -759,9 +792,6 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		warnOutOfScopeSoft(modelRouting.scopeVerdict, "live-session.model-out-of-scope");
 		// H1.a: teamRole.thinking takes precedence over agent.thinking.
 		const effectiveThinking = input.teamRoleThinking ?? input.agent.thinking;
-		// Phase 4: MCP proxy — will be determined after session creation
-		// (we check parent's MCP tools and share connections when available)
-		const mcpProxy = buildMcpProxyFromSession([], { shareMcp: true });
 
 		// G1: Build custom tools (submit_result + irc)
 		const submitResultTool = createSubmitResultTool((result) => {
@@ -789,7 +819,6 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			...(input.modelRegistry ? { modelRegistry: input.modelRegistry } : {}),
 			...(resolvedModel ? { model: resolvedModel } : {}),
 			...(effectiveThinking ? { thinkingLevel: effectiveThinking } : {}),
-			...(mcpProxy.enableMcp ? {} : { enableMCP: false }),
 			customTools,
 		});
 		session = created.session;

package/src/runtime/mcp-proxy.ts

@@ -9,15 +9,20 @@
  * Strategy:
  * 1. If the Pi SDK session has MCP tools after bindExtensions → use them directly
  * 2. If not → create proxy custom tools that wrap MCP calls
- * 3. If no MCP config exists → disable MCP in the session
+ * 3. If sharing is not permitted for the role → disable MCP in the session
  *
- * The Pi SDK's `createAgentSession` accepts a `customTools` array for injecting
- * proxy tools. The session also accepts `enableMCP: false` to skip MCP discovery
- * when proxying from the parent.
+ * G2 enforcement note (pi ≥0.99): MCP is now a BUILT-IN EXTENSION
+ * (`builtin:mcp`, reading `mcp.json`) and the pre-0.99 `enableMcp:false`
+ * `createAgentSession` option no longer exists. The runtime enforcement for
+ * a non-permitted role therefore drops the MCP extension(s) from the child's
+ * resource loader (`extensionsOverride` → `stripMcpExtensions` below).
+ * `McpProxyConfig.enableMcp` remains the module's semantic contract: callers
+ * can branch on it while E1 (real parent→child proxying) is unbuilt.
  */
 
 import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
 import type { TSchema } from "@sinclair/typebox";
+import { permissionForRole } from "./role-permission.ts";
 
 export interface McpProxyConfig {
 	/** Whether to enable MCP in the child session. */
@@ -32,11 +37,24 @@ export interface McpProxyConfig {
  * Build MCP proxy configuration for a live-session worker.
  *
  * @param options.parentMcpTools — MCP tool names from the parent session (if available)
- * @param options.shareMcp — Whether to share MCP connections (default: true)
+ * @param options.shareMcp — Whether to share MCP connections. MUST be explicit:
+ *   `true` enables the discovery/proxy paths below; `false` or `undefined`
+ *   denies (security-review follow-up, SDD-2 remediation — the old
+ *   undefined-default fell through to the permissive enable paths).
  */
 export function buildMcpProxyConfig(options: { parentMcpTools?: string[]; shareMcp?: boolean }): McpProxyConfig {
-	if (options.shareMcp === false) {
-		return { enableMcp: true, proxyTools: [], proxyToolNames: [] };
+	if (options.shareMcp !== true) {
+		// G2 (SDD-2 W-B) + remediation hardening: least-privilege contract.
+		// shareMcp must be explicitly opted in — anything else (false OR
+		// undefined) means the child must not discover the parent's MCP
+		// servers AT ALL. The pre-flip behavior returned enableMcp:true for
+		// shareMcp:false (flag inversion), and the pre-hardening default let
+		// an OMITTED flag fall through to the permissive paths — either way
+		// even read-only roles self-discovered every parent MCP server (with
+		// credentials). These helpers currently have no production call
+		// sites; the hardened default exists so a future caller cannot
+		// re-open the gap by forgetting the flag.
+		return { enableMcp: false, proxyTools: [], proxyToolNames: [] };
 	}
 
 	const parentTools = options.parentMcpTools ?? [];
@@ -103,3 +121,88 @@ export function buildMcpProxyFromSession(activeToolNames: string[], options?: {
 		shareMcp: options?.shareMcp,
 	});
 }
+
+/**
+ * G2 (SDD-2 W-B): the role-permission signal that decides `shareMcp` at the
+ * spawn sites. MCP servers carry the parent's credentials and can mutate
+ * state far outside the workspace, so only WRITE-capable roles may discover
+ * them. Read-only roles (explorer/reviewer/security-reviewer/analyst/
+ * critic/planner) are denied; unknown and undefined roles resolve to
+ * read-only via `permissionForRole`'s FIND-12 default-deny and are denied
+ * too. AgentConfig has no `mcp` field — this permission classification is
+ * the existing explicit signal (same source `filterActiveTools` uses).
+ */
+export function mcpPermittedForRole(role: string | undefined): boolean {
+	return permissionForRole(role ?? "") !== "read_only";
+}
+
+/**
+ * Identify the extensions that provide MCP connectivity in pi ≥0.99:
+ * - `builtin:mcp` — the built-in MCP extension (reads `mcp.json`);
+ * - third-party extensions that REPLACE it by registering `/mcp` — pi's own
+ *   docs name `pi-mcp-adapter` as the canonical replacer (docs/mcp.md:
+ *   "replaces the built-in MCP support"). Both must be dropped to actually
+ *   deny MCP; a path-segment match keeps npm-installed and file-path forms.
+ *
+ * KNOWN LIMITATION (security-review follow-up): this is a NAME-based
+ * denylist. A third-party MCP adapter that registers `/mcp` under a
+ * different name is NOT stripped and would re-enable discovery for
+ * non-permitted roles on the live-session path. An allowlist-shaped
+ * extension filter is the root fix — tracked as a follow-up work item
+ * (SDD-2 §13, G2 hardening backlog).
+ */
+export function isMcpExtensionPath(extensionPath: string): boolean {
+	if (extensionPath === "builtin:mcp") return true;
+	return extensionPath.includes("pi-mcp-adapter");
+}
+
+/**
+ * G2 enforcement-degradation detector (security-review follow-up): the
+ * live-session runtime enforces the role MCP policy by stripping MCP
+ * extensions through `DefaultResourceLoader`'s `extensionsOverride` hook.
+ * If the SDK stops exporting `DefaultResourceLoader` (version drift) or the
+ * agent dir cannot be resolved, that strip silently degrades to fail-open
+ * and a non-permitted role would re-inherit every parent MCP server with
+ * no diagnostic. Callers should emit a warning event when this returns a
+ * reason instead of `undefined`.
+ */
+export function g2EnforcementDegradationReason(input: {
+	mcpPermitted: boolean;
+	resourceLoaderAvailable: boolean;
+}): "sdk_loader_missing" | undefined {
+	if (input.mcpPermitted) return undefined;
+	return input.resourceLoaderAvailable ? undefined : "sdk_loader_missing";
+}
+
+/** Structural stand-in for the SDK's `LoadExtensionsResult` (loose typing —
+ * the live-session runtime holds the SDK behind `Record<string, unknown>`). */
+export interface LoadedExtensionsShape {
+	extensions: Array<{ path: string; [key: string]: unknown }>;
+	errors?: unknown;
+	warnings?: Array<{ path: string; warning: string }>;
+	runtime?: unknown;
+	[key: string]: unknown;
+}
+
+/**
+ * `DefaultResourceLoader` `extensionsOverride` hook (G2 enforcement on
+ * pi ≥0.99): drop every MCP-providing extension from the child's extension
+ * list so a non-permitted role neither loads the MCP code nor connects to
+ * any server. Stripped paths are recorded as warnings for diagnostics.
+ */
+export function stripMcpExtensions(base: LoadedExtensionsShape): LoadedExtensionsShape {
+	const kept = base.extensions.filter((extension) => !isMcpExtensionPath(extension.path));
+	if (kept.length === base.extensions.length) return base;
+	const stripped = base.extensions.filter((extension) => isMcpExtensionPath(extension.path));
+	return {
+		...base,
+		extensions: kept,
+		warnings: [
+			...(base.warnings ?? []),
+			...stripped.map((extension) => ({
+				path: extension.path,
+				warning: "stripped by pi-crew G2 role MCP policy (role is not MCP-permitted)",
+			})),
+		],
+	};
+}

package/src/runtime/model/pi-args.ts

@@ -15,7 +15,6 @@ const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
 // find pi-crew's package.json and works correctly from both src/ and
 // dist/ entry points.
 const PROMPT_RUNTIME_EXTENSION_PATH = path.join(packageRoot(), "src", "prompt", "prompt-runtime.ts");
-const TASK_ARG_LIMIT = 8000;
 // D8 spec v0.7 — nested mở (default 4 depth levels: child→child→child→child);
 // cap giữ để chống runaway recursion từ config lỗi hoặc intentional abuse.
 const DEFAULT_MAX_CREW_DEPTH = 4;
@@ -348,17 +347,21 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		args.push(input.agent.systemPromptMode === "append" ? "--append-system-prompt" : "--system-prompt", promptPath);
 	}
 
-	if (input.task.length > TASK_ARG_LIMIT) {
-		if (!tempDir) {
-			const tmpBase = getPiTempBase();
-			tempDir = createSafeTempDir(tmpBase, `pi-crew-${process.pid}-`);
-		}
-		const taskPath = path.join(tempDir, "task.md");
-		atomicWriteFile(taskPath, input.task, { mode: 0o600 });
-		args.push(`@${taskPath}`);
-	} else {
-		args.push(`Task: ${input.task}`);
+	// G3 (SDD-2 W-B, spill-always): task text NEVER rides argv — argv is
+	// world-readable via /proc/<pid>/cmdline, leaking task content (and any
+	// secrets embedded in prompts) to every local user/process scanner.
+	// EVERY task, regardless of length, is spilled to an owner-only (0600)
+	// task.md inside pi-crew's temp dir and passed as a `@<path>` inclusion
+	// arg. The pre-G3 short-argv branch (task <= 8000 → `Task: ...` positional)
+	// is removed; the file content is the RAW task text (same contract the
+	// long-task path always had — no `Task: ` prefix).
+	if (!tempDir) {
+		const tmpBase = getPiTempBase();
+		tempDir = createSafeTempDir(tmpBase, `pi-crew-${process.pid}-`);
 	}
+	const taskPath = path.join(tempDir, "task.md");
+	atomicWriteFile(taskPath, input.task, { mode: 0o600 });
+	args.push(`@${taskPath}`);
 
 	const env = input.env ?? process.env;
 	const parentDepth = currentCrewDepth(env);