pi-crew 0.11.6 → 0.11.8

package/src/runtime/live-session/live-session-runtime.ts

@@ -322,6 +322,29 @@ function modelFromRegistry(modelRegistry: unknown, modelId: string | undefined):
 	}
 }
 
+/**
+ * R3-12: resolve pi-crew's fallback chain into pi SDK `scopedModels` entries.
+ *
+ * SDK semantics (pi-coding-agent docs/sdk.md; dist/core/agent-session.js):
+ * `scopedModels` bounds the session's CYCLING scope and what extensions see
+ * through `getScopedModels` — it is NOT a hard access gate (`setModel` still
+ * accepts any credentialed model), so binding the fallback chain cannot break
+ * a legitimate user/model override. Candidates that don't resolve in the
+ * registry are skipped; an empty result means the caller passes NO option so
+ * pi keeps its default scope (all available models) — the "explicit
+ * non-empty" guard from the R3 spec.
+ */
+export function resolveScopedSessionModels(modelRegistry: unknown, candidates: readonly string[]): Array<{ model: unknown }> {
+	const scoped: Array<{ model: unknown }> = [];
+	for (const candidate of candidates) {
+		const model = modelFromRegistry(modelRegistry, candidate);
+		if (!model || typeof model !== "object") continue;
+		if (scoped.some((entry) => entry.model === model)) continue;
+		scoped.push({ model });
+	}
+	return scoped;
+}
+
 /**
  * Round 18: when agent declares `model: false`, the inherited `parentModel`
  * (= `ctx.model` from Pi runtime, set via `team-tool.ts:541/655`) is the
@@ -793,6 +816,12 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 		// H1.a: teamRole.thinking takes precedence over agent.thinking.
 		const effectiveThinking = input.teamRoleThinking ?? input.agent.thinking;
 
+		// R3-12: bind the live session's model scope to pi-crew's fallback chain
+		// so model cycling (and the extension-visible scope) cannot drift outside
+		// the candidates the routing gate approved. Only bound when the chain
+		// resolves to at least one registry model (explicit non-empty guard).
+		const scopedSessionModels = resolveScopedSessionModels(input.modelRegistry, modelRouting.candidates);
+
 		// G1: Build custom tools (submit_result + irc)
 		const submitResultTool = createSubmitResultTool((result) => {
 			customToolYieldResult = result;
@@ -819,6 +848,8 @@ export async function runLiveSessionTask(input: LiveSessionSpawnInput): Promise<
 			...(input.modelRegistry ? { modelRegistry: input.modelRegistry } : {}),
 			...(resolvedModel ? { model: resolvedModel } : {}),
 			...(effectiveThinking ? { thinkingLevel: effectiveThinking } : {}),
+			// R3-12: cycling/visibility scope = the fallback chain (see helper).
+			...(scopedSessionModels.length > 0 ? { scopedModels: scopedSessionModels } : {}),
 			customTools,
 		});
 		session = created.session;

package/src/runtime/model/model-scope.ts

@@ -11,11 +11,34 @@
  *   - defaultSubagentModel / parentModel-inherited out-of-scope
  *     → WARNING + runs anyway (soft warn, same as frontmatter).
  *
- * Pattern semantics match pi's `--models` CLI / `enabledModels` allowlist:
- *   - `"anthropic/claude-opus-4-5"` — exact match (case-insensitive).
- *   - `"claude-*"`, `"*sonnet*"`, `"github-copilot/*"` — glob (single `*`).
- *   - Any other string — case-insensitive substring fallback (pi's
- *     `tryMatchModel` behavior, model-resolver.ts).
+ * Pattern semantics mirror pi 1.0.0's canonical `resolveModelScopeFromModels()`
+ * (SDK `core/model-resolver.js:204-270`) and `parseModelPattern()` (:155-200) —
+ * R3-20 alignment (docs/reviews/pi-1.0.0-deep-learn-r3-2026-10-03.md §R3b.3):
+ *   - Optional `:<thinking>` suffix (`off|minimal|low|medium|high|xhigh|max`,
+ *     case-sensitive) is stripped from patterns AND resolved model ids before
+ *     matching, so `anthropic/claude-sonnet-5:high` in enabledModels no longer
+ *     falsely rejects the plain model id (hard-error bug).
+ *   - A pattern containing ANY of `*`, `?`, `[` is a glob, translated with
+ *     minimatch semantics (`*`/`?` do not cross `/`, `[...]`/`[!...]` classes,
+ *     whole-segment `**` crosses separators), anchored + case-insensitive.
+ *   - Globs are tried against BOTH the configured `provider/id` form and the
+ *     bare model id (after the first `/`), mirroring
+ *     `minimatch(fullId, p) || minimatch(id, p)` — so `gpt-5*` matches
+ *     `openai/gpt-5-mini`.
+ *   - Non-glob patterns fall back to case-insensitive substring, progressively
+ *     stripping trailing colon suffixes (mirrors parseModelPattern's
+ *     recursion: valid levels become thinking hints, invalid ones are
+ *     recursed through with a warning — membership still follows the prefix).
+ *
+ * Why reimplement instead of importing the canonical matcher: the SDK does
+ * NOT export `resolveModelScopeFromModels` from the package root (runtime-
+ * verified: only `resolveModelScopeWithDiagnostics` is exported, and it needs
+ * a live async `ModelRuntime` + catalog I/O). This gate is synchronous and
+ * this module is pure by design, so an exact-semantics reimplementation is
+ * the only import-compatible option. Residual divergence (documented, not
+ * fixable string-level): canonical fuzzy also matches model display `name`s
+ * (`model-resolver.js:114-115`), which requires the catalog — display-name-
+ * only patterns (e.g. `"Claude Opus 4.5"`) stay unmatched here.
  *
  * This module is pure (no I/O, no globals). Reading the actual
  * `enabledModels` from pi's settings is the caller's job (instantiate
@@ -41,37 +64,134 @@ export interface ModelScopeCheck {
 }
 
 /**
- * Convert a glob pattern with `*` wildcards into a RegExp.
- * Escape all regex meta-characters except `*`, which becomes `.*`.
- * Anchored (^...$) and case-insensitive.
+ * Valid `:<thinking>` level names — mirrors pi's `VALID_THINKING_LEVELS`
+ * (SDK `cli/args.js`). Matched case-sensitively, exactly like the canonical
+ * `isValidThinkingLevel()`, so OpenRouter-style ids (`foo:exacto`) and
+ * mistyped levels (`:HIGH`) are NOT treated as thinking suffixes.
+ */
+const VALID_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
+
+function isValidThinkingLevel(level: string): boolean {
+	return (VALID_THINKING_LEVELS as readonly string[]).includes(level);
+}
+
+/**
+ * Strip one trailing VALID `:<thinking>` suffix — the canonical glob-branch
+ * rule (model-resolver.js:214-222). Invalid suffixes are left in place here;
+ * the fuzzy branch strips them progressively instead (parseModelPattern
+ * recursion) — see matchesModelPattern.
+ */
+function stripValidThinkingSuffix(value: string): string {
+	const colonIdx = value.lastIndexOf(":");
+	if (colonIdx === -1) return value;
+	return isValidThinkingLevel(value.substring(colonIdx + 1)) ? value.substring(0, colonIdx) : value;
+}
+
+/** Does the pattern contain glob characters? Canonical test: `*`, `?` or `[`. */
+function hasGlobChars(pattern: string): boolean {
+	return pattern.includes("*") || pattern.includes("?") || pattern.includes("[");
+}
+
+/** Escape a literal character for use in a RegExp body. */
+function escapeRegExpChar(ch: string): string {
+	return /[.+^${}()|[\]\\]/.test(ch) ? `\\${ch}` : ch;
+}
+
+/**
+ * Convert a glob pattern into an anchored, case-insensitive RegExp with
+ * minimatch semantics (canonical uses `minimatch(p, { nocase: true })`):
+ *   - `*`  → `[^/]*` (any run of non-separator chars; does NOT cross `/`)
+ *   - `?`  → `[^/]` (exactly one non-separator char)
+ *   - `[...]` / `[!...]` / `[^...]` → character class (both `!` and `^` negate)
+ *   - `[` without a closing `]` → literal `[`
+ *   - a whole-segment run of `**` → `.*` (crosses separators, but still
+ *     requires the preceding `/` — `anthropic/**` does not match `anthropic`)
+ *   - everything else → regex-escaped literal
  */
 export function patternToRegExp(pattern: string): RegExp {
-	const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-	return new RegExp(`${escaped.replace(/\*/g, ".*")}`, "i");
+	let out = "^";
+	for (let i = 0; i < pattern.length; i++) {
+		const ch = pattern[i];
+		if (ch === "*") {
+			let end = i;
+			while (end < pattern.length && pattern[end] === "*") end++;
+			const wholeSegment = (i === 0 || pattern[i - 1] === "/") && (end === pattern.length || pattern[end] === "/");
+			out += end - i >= 2 && wholeSegment ? ".*" : "[^/]*";
+			i = end - 1;
+		} else if (ch === "?") {
+			out += "[^/]";
+		} else if (ch === "[") {
+			const closing = pattern.indexOf("]", i + 1);
+			let inner = closing === -1 ? "" : pattern.substring(i + 1, closing);
+			let negated = false;
+			if (inner.startsWith("!") || inner.startsWith("^")) {
+				negated = true;
+				inner = inner.substring(1);
+			}
+			if (closing === -1 || inner.length === 0) {
+				// Unmatched `[` (or empty class `[]`/`[!]`) → literal, like minimatch.
+				out += "\\[";
+			} else {
+				let cls = "";
+				for (const c of inner) {
+					if (c === "\\") cls += "\\\\";
+					else if (c === "]") cls += "\\]";
+					else cls += c;
+				}
+				out += `[${negated ? "^" : ""}${cls}]`;
+				i = closing;
+			}
+		} else {
+			out += escapeRegExpChar(ch);
+		}
+	}
+	return new RegExp(`${out}$`, "i");
 }
 
 /**
  * Does a model id match a single allowlist pattern?
- * Semantics (in order):
- *   1. Exact case-insensitive match.
- *   2. Glob match (pattern contains `*`).
- *   3. Case-insensitive substring match (pi's fallback).
+ * Mirrors the canonical `resolveModelScopeFromModels()` per-pattern flow:
+ *   - Glob branch (pattern contains `*`, `?` or `[`): strip one VALID
+ *     `:<thinking>` suffix, try the exact reference first, then match the
+ *     glob against BOTH the configured string and its bare-id form
+ *     (`minimatch(fullId, p) || minimatch(id, p)`, model-resolver.js:228-232).
+ *   - Fuzzy branch (parseModelPattern): substring match, progressively
+ *     stripping trailing colon suffixes until a hit or no colon remains.
  * Returns true on first hit; false otherwise.
  */
 export function matchesModelPattern(modelId: string, pattern: string): boolean {
 	if (!modelId || !pattern) return false;
-	const id = modelId.trim();
-	const pat = pattern.trim();
-	if (!id || !pat) return false;
-	if (id.toLowerCase() === pat.toLowerCase()) return true;
-	if (pat.includes("*")) {
+	const rawId = modelId.trim();
+	const rawPat = pattern.trim();
+	if (!rawId || !rawPat) return false;
+	// Canonical compares thinking-less base ids: pi-crew's resolved candidates
+	// keep their `:high` suffix (splitThinkingSuffix), and user patterns may
+	// carry one — strip valid suffixes from BOTH sides before matching.
+	const id = stripValidThinkingSuffix(rawId);
+	// Bare-id form = everything after the FIRST `/` (the provider segment);
+	// openrouter-style ids can themselves contain slashes.
+	const bareId = id.includes("/") ? id.substring(id.indexOf("/") + 1) : id;
+	if (hasGlobChars(rawPat)) {
+		const glob = stripValidThinkingSuffix(rawPat);
+		if (id.toLowerCase() === glob.toLowerCase() || bareId.toLowerCase() === glob.toLowerCase()) {
+			return true;
+		}
 		try {
-			return patternToRegExp(pat).test(id);
+			const re = patternToRegExp(glob);
+			return re.test(id) || re.test(bareId);
 		} catch {
 			return false;
 		}
 	}
-	return id.toLowerCase().includes(pat.toLowerCase());
+	let pat = rawPat;
+	for (;;) {
+		// Substring over the configured form is a superset of canonical's
+		// exact-then-substring over the same string, so verdicts agree.
+		if (id.toLowerCase().includes(pat.toLowerCase())) return true;
+		const colonIdx = pat.lastIndexOf(":");
+		if (colonIdx === -1) return false;
+		pat = pat.substring(0, colonIdx);
+	}
 }
 
 /**

package/src/runtime/model/pi-args.ts

@@ -2,10 +2,15 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentConfig } from "../../agents/agent-config.ts";
+import { getCrewEnvBool } from "../../config/env-vars.ts";
 import { atomicWriteFile } from "../../state/atomic-write.ts";
 import { hasRunStateLayout, packageRoot, userPiRoot } from "../../utils/paths.ts";
+import { PI_NO_MCP_FLOOR, piVersionAtLeast } from "../child-pi/pi-version.ts";
 
-const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
+// U4 (pi 1.0.4 adoption): pi's CLI documents 7 thinking levels (docs/cli.md:70);
+// `max` completes the surface — frontmatter `thinking: max` previously fell
+// back to Pi's default via isValidThinkingLevel.
+const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 // FIX (2026-07-02): use packageRoot() instead of import.meta.url-relative path.
 // The previous path.resolve(path.dirname(fileURLToPath(import.meta.url)),
 // "..", "prompt", "prompt-runtime.ts") was correct in source but BROKEN
@@ -40,6 +45,24 @@ export interface BuildPiWorkerArgsInput {
 	agent: AgentConfig;
 	model?: string;
 	sessionEnabled?: boolean;
+	/** W2 (session-file recovery): deterministic pi session id for this worker
+	 *  (`--session-id`, SDK ≥ 0.76.0 — below pi-crew's tested host floor 0.99.2,
+	 *  so emitted unconditionally when set; no capability gate). Same id across
+	 *  retries appends to one session file (SDK §R2.2) — cross-attempt resume. */
+	sessionId?: string;
+	/** W2 (session-file recovery): directory for this worker's session JSONL
+	 *  (`--session-dir`, SDK ≥ 0.30.0). Run-scoped per-worker dir, e.g.
+	 *  `<artifactsRoot>/sessions/<taskId>/` — lives and dies with run artifacts. */
+	sessionDir?: string;
+	/** R3-15 (Pi 1.0.0 deep-learn r3): worker task id for the human-facing
+	 *  session display name — emits `--name crew-<taskId>` (cli.md:100, `-n/--name`
+	 *  "Sets the session display name"). Cosmetic only: W2's deterministic
+	 *  --session-id stays the machine-readable correlation key. Emitted inside
+	 *  the sessionEnabled block (a name labels a persisted session; under
+	 *  --no-session nothing persists). NOT stripped for surface TUI panes — a
+	 *  display name is not headless-only, it labels the pane's session too
+	 *  (child-pi.ts stripHeadlessOnlyFlags stays untouched). */
+	taskId?: string;
 	maxDepth?: number;
 	skillPaths?: string[];
 	env?: NodeJS.ProcessEnv;
@@ -47,6 +70,34 @@ export interface BuildPiWorkerArgsInput {
 	role?: string;
 	/** Per-role thinking override (teamRole.thinking). Takes precedence over agent.thinking. */
 	thinkingOverride?: string;
+	/** R3-1 (Pi 1.0.0 deep-learn round 3): run-static worker header (Protocol
+	 *  block, mailbox contract, workspace structure, runtime context) riding the
+	 *  `--append-system-prompt` channel instead of the user-message concatenation.
+	 *  Compaction summarizes the user-message span (compaction.md:150-160) but the
+	 *  system prompt survives intact — the parts that must NEVER be lost move here.
+	 *  Task text + dependency context stay in the user message (they SHOULD be
+	 *  summarizable). Final append order: builtin → agent.systemPrompt (if any,
+	 *  honoring its declared replace/append mode) → this header. Probe-verified
+	 *  2026-10-04 (/tmp/pi-r3impl): the append channel and AGENTS.md discovery
+	 *  (project_context section) coexist in one system message. */
+	systemPromptAppend?: string;
+	/** R3-19/D5 (hermetic worker spawns): pass `--no-extensions` on the worker
+	 *  argv. Resolved via resolveHermeticWorkers — env
+	 *  PI_CREW_HERMETIC_WORKERS beats this beats default TRUE. Explicit `-e
+	 *  prompt-runtime` (pushed unconditionally below), agent `extensions:`
+	 *  declarations, and `--skill` flags are unaffected (cli.md:186-191:
+	 *  explicit -e and --skill survive --no-extensions/--no-skills). */
+	hermeticWorkers?: boolean;
+	/** U9 (pi 1.0.4 version floor): the HOST pi binary's version as probed by
+	 *  `pi --version` (probePiVersion — single-flight memoized per process,
+	 *  injectable exec seam, never rejects), or null when unknown (probe
+	 *  failed/timed out/unparseable). PURE INPUT — the builder NEVER spawns:
+	 *  the async spawn path (runChildPi) awaits the memoized probe upstream and
+	 *  threads the resolved string|null down through here. Drives the
+	 *  version-gated flags registered in child-pi/pi-version.ts (`--no-mcp` at
+	 *  the 1.0.4 floor, parity spawns only); unknown/below-floor conservatively
+	 *  emits NOTHING — a pre-floor host's strict parser rejects unknown flags. */
+	piVersion?: string | null;
 }
 
 export interface BuildPiWorkerArgsResult {
@@ -90,6 +141,17 @@ export function resolveCrewMaxDepth(inputMaxDepth?: number, env: NodeJS.ProcessE
 	return DEFAULT_MAX_CREW_DEPTH;
 }
 
+/**
+ * R3-19/D5 (hermetic worker spawns): resolution order mirrors
+ * resolveSessionRecoveryEnabled — env PI_CREW_HERMETIC_WORKERS beats the
+ * explicit config/runtime value beats default TRUE.
+ */
+export function resolveHermeticWorkers(explicit?: boolean): boolean {
+	const env = getCrewEnvBool("PI_CREW_HERMETIC_WORKERS");
+	if (env !== undefined) return env;
+	return explicit ?? true;
+}
+
 export function checkCrewDepth(
 	inputMaxDepth?: number,
 	env: NodeJS.ProcessEnv = process.env,
@@ -265,6 +327,22 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 	// never sets it, so it can never be matched as a sub-agent.
 	const args = ["--mode", "json", "-p"];
 	if (input.sessionEnabled === false) args.push("--no-session");
+	// W2 (session-file recovery): deterministic session identity so a worker
+	// that dies without a final assistant event (exitCode null / killed) can
+	// have its last COMPLETE assistant turn tail-recovered from the session
+	// JSONL (child-pi.ts settle path → session-recovery.ts). Both flags are
+	// SDK-era flags older than the tested host floor (fact pack §1: session-id
+	// 0.76.0, session-dir 0.30.0 < 0.99.2) → unconditional add, same as the
+	// existing --no-session/--model emissions. Skipped when sessions are off —
+	// under --no-session pi persists nothing, the flags would be meaningless.
+	if (input.sessionEnabled !== false) {
+		if (input.sessionId) args.push("--session-id", input.sessionId);
+		if (input.sessionDir) args.push("--session-dir", input.sessionDir);
+		// R3-15: human-facing display name — `crew-<taskId>` makes crew workers
+		// distinguishable in pi's session picker (flag predates nothing: -n/--name
+		// is a long-standing CLI flag, cli.md:100 — no capability gate needed).
+		if (input.taskId) args.push("--name", `crew-${input.taskId}`);
+	}
 
 	const resolvedModel = input.model ?? input.agent.model;
 	// H1.a: teamRole.thinking (passed as thinkingOverride) takes precedence over agent.thinking.
@@ -278,8 +356,13 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		args.push("--thinking", effectiveThinking);
 	}
 
-	// D5 (spec v0.7 §6): default loadout = FULL session (như main session).
-	// --no-extensions/--no-skills/--tools CHỈ xuất hiện khi agent .md khai explicit.
+	// D5 (spec v0.7 §6): default loadout = FULL session (như main session) —
+	// --no-skills/--tools CHỈ xuất hiện khi agent .md khai explicit. R3-19/D5
+	// reversal (2026-10-04): extension discovery is now hermetic by default
+	// (--no-extensions below, off-switch runtime.hermeticWorkers / env
+	// PI_CREW_HERMETIC_WORKERS) — the ambient package stack cost ~1.37s/spawn
+	// and leaked 8 direct-exposure MCP tools + 5 host tools into every worker
+	// (probe C §R3b.6: 431ms vs 1806ms to first stdout record).
 	// "message" MUST stay in CONTROL_TOOLS: it is registered by prompt-runtime
 	// behind the PI_CREW_MSG_ENABLED dormant-env gate (child-pi-spawn.ts sets it
 	// unconditionally), but pi's --tools allowlist filters the tool SURFACE — a
@@ -311,8 +394,40 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		// B2 (fix round 1): `disallowedTools:` frontmatter is a
 		// declaration-driven denylist (opt-in like `tools:`) — NOT the
 		// role-based policy D5 removed.
-		const disallowed = (input.agent.disallowedTools ?? []).map((t) => t.trim()).filter(Boolean);
-		if (disallowed.length > 0) args.push("--exclude-tools", [...new Set(disallowed)].join(","));
+		// U2-lite (pi 1.0.4 `--tools` semantics drift): on 1.0.4, `--tools` no
+		// longer cuts MCP — ambient MCP servers stay connected on parity
+		// (NON-hermetic) spawns. Fold `mcp__*` into the exclude list to restore
+		// the pre-1.0.4 MCP cut. Kept OUT of hermetic spawns: --no-extensions
+		// already disables builtin:mcp (hermetic spawns are MCP-clean — the
+		// conflict verdict in docs/reviews/pi-1.0.4-upgrade-notes-2026-10-06.md),
+		// and the default loadout pins !--exclude-tools
+		// (test/unit/runtime/model/pi-args-loadout.test.ts). Cross-version-safe:
+		// on pre-1.0.4 hosts the `mcp__*` pattern matches no literal tool name
+		// → benign no-op. ONE flag value only — pi's strict parser rejects a
+		// duplicate --exclude-tools flag, so declared disallowedTools merge
+		// comma-sep ahead of the pattern. Stays inside the else of disableTools:
+		// `--no-tools` already locks the whole tool surface, an extra cut would
+		// be dead weight. Surface TUI panes strip argv flags after build
+		// (child-pi.ts stripHeadlessOnlyFlags), so this cut never reaches them.
+		const disallowed = new Set((input.agent.disallowedTools ?? []).map((t) => t.trim()).filter(Boolean));
+		const paritySpawn = !resolveHermeticWorkers(input.hermeticWorkers);
+		if (paritySpawn) disallowed.add("mcp__" + "*");
+		if (disallowed.size > 0) args.push("--exclude-tools", [...disallowed].join(","));
+		// U9 (version floor, registry PI_NO_MCP_FLOOR in child-pi/pi-version.ts;
+		// flag doc cli.md:198): parity spawn on a host pi >= 1.0.4 ALSO passes
+		// `--no-mcp` — "no servers connect, and there are no MCP tools or /mcp",
+		// strictly stronger than the mcp__* tool-cut above (servers never even
+		// handshake). Below the floor / unknown (null) / malformed piVersion →
+		// NO flag: pi's strict option parser rejects unknown flags with a
+		// nonzero exit, so guessing wrong would break every parity spawn. The
+		// mcp__* fold STAYS alongside — it is the cross-version-safe baseline
+		// (pre-1.0.4 hosts have no --no-mcp to lean on). Hermetic spawns never
+		// reach here (--no-extensions already makes them MCP-clean). Kept inside
+		// the else of disableTools like the fold (--no-tools already locks the
+		// whole surface). Surface TUI panes KEEP the flag — stripHeadlessOnlyFlags
+		// only strips --no-approve/--no-extensions, same treatment as
+		// --exclude-tools: parity semantics must not depend on spawn mode.
+		if (paritySpawn && piVersionAtLeast(input.piVersion, PI_NO_MCP_FLOOR)) args.push("--no-mcp");
 	}
 	// prompt-runtime extension luôn nạp (hạ tầng phối hợp — không phải cắt xén).
 	args.push("--extension", PROMPT_RUNTIME_EXTENSION_PATH);
@@ -332,7 +447,13 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 	const excluded = new Set((input.agent.excludeExtensions ?? []).map((name) => path.basename(name).toLowerCase()));
 	declaredExtensions = declaredExtensions.filter((ext) => !excluded.has(path.basename(ext).toLowerCase()));
 	for (const ext of declaredExtensions) args.push("--extension", ext);
-	// KHÔNG còn --no-extensions (extension discovery hoạt động như main session).
+	// R3-19/D5: hermetic spawns — disable discovered/configured/built-in
+	// extensions on worker argv. cli.md:186-187: "Explicit -e paths still
+	// load" — the unconditional prompt-runtime push above and the agent
+	// `extensions:` declarations below survive; --skill flags are a separate
+	// gate. Default ON (resolveHermeticWorkers); surface TUI panes strip the
+	// flag (child-pi.ts stripHeadlessOnlyFlags).
+	if (resolveHermeticWorkers(input.hermeticWorkers)) args.push("--no-extensions");
 	if (input.agent.inheritSkills === false) args.push("--no-skills");
 	for (const skillPath of input.skillPaths ?? []) args.push("--skill", skillPath);
 
@@ -346,6 +467,45 @@ export function buildPiWorkerArgs(input: BuildPiWorkerArgsInput): BuildPiWorkerA
 		atomicWriteFile(promptPath, input.agent.systemPrompt, { mode: 0o600 });
 		args.push(input.agent.systemPromptMode === "append" ? "--append-system-prompt" : "--system-prompt", promptPath);
 	}
+	// R3-1: run-static header rides its own --append-system-prompt file. pi
+	// parses --system-prompt and --append-system-prompt independently and the
+	// append flag is repeatable (cli/args.js:71-77; appends join with "\n\n" in
+	// argv order), so pushing it AFTER the agent flag yields the required final
+	// order builtin → agent.systemPrompt → run-static header in BOTH modes
+	// (replace mode: agent file replaces builtin, header appends after it;
+	// append mode: two append files in argv order).
+	if (input.systemPromptAppend?.trim()) {
+		if (!tempDir) {
+			const tmpBase = getPiTempBase();
+			tempDir = createSafeTempDir(tmpBase, `pi-crew-${process.pid}-`);
+		}
+		const headerPath = path.join(tempDir, "worker-header.md");
+		atomicWriteFile(headerPath, input.systemPromptAppend, { mode: 0o600 });
+		args.push("--append-system-prompt", headerPath);
+	}
+
+	// D1 (R3-3, pinned 2026-10-04): deterministic project-trust for worker
+	// spawns — `--no-approve` (cli alias -na). The command-line override applies
+	// FIRST in pi's trust resolution (security.md "How Pi chooses a trust
+	// decision"), before any extension, saved decision in ~/.pi/agent/trust.json,
+	// or defaultProjectTrust — so worker behavior no longer varies with the
+	// ambient trust store of the machine (P-C probe: /home/bom/source/my_pi and
+	// /tmp were pre-trusted there). Decision rationale vs the D1 criteria:
+	// (a) no ambient-trust dependency ✓ (CLI override wins);
+	// (b) write capability intact ✓ (security.md:33 — project trust does NOT
+	//     limit what tool calls can access; only startup resource loading is
+	//     gated, so workers still write files in the task cwd);
+	// (c) minimal scope ✓ (declines rather than grants; one command; not
+	//     persisted to trust.json).
+	// AGENTS.md/CLAUDE.md context files load REGARDLESS of project trust
+	// (security.md:57) — probe-verified 2026-10-04 (/tmp/pi-r3impl probe2: the
+	// project_context section is present with --no-approve), so the R3-18
+	// repo-instruction auto-load is preserved. `-a` was rejected: it grants
+	// maximal project trust (loads .pi/mcp.json, .pi/extensions… from untrusted
+	// task cwds) — the opposite of minimal scope, and redundant with the D5
+	// hermetic posture. Surface TUI spawns strip this flag (child-pi.ts
+	// trySurfaceBranch) to keep the interactive trust prompt available.
+	args.push("--no-approve");
 
 	// G3 (SDD-2 W-B, spill-always): task text NEVER rides argv — argv is
 	// world-readable via /proc/<pid>/cmdline, leaking task content (and any

package/src/runtime/peer-dep.ts

@@ -69,6 +69,9 @@ let cachedResolve: ResolvedPeerDep | undefined | null = null;
 let cachedModule: PeerDepModule | undefined;
 let primingPromise: Promise<PeerDepModule> | undefined;
 
+/** Warn-once guard for the legacy-fork resolution notice (W6/P2-4, 2026-10-03). */
+let forkResolutionWarned = false;
+
 /**
  * Build the ordered list of "resolution bases" — paths to seed
  * `createRequire(...).resolve()` from. Node walks UP `node_modules` from each
@@ -212,6 +215,24 @@ function tryResolveFrom(base: string): ResolvedPeerDep | undefined {
 	}
 }
 
+/**
+ * W6/P2-4 (pi 1.0.0 adoption wave, 2026-10-03): the @mariozechner fork stopped
+ * publishing (npm latest 0.73.1, 2026-05-07) and sits outside the
+ * @earendil-works semver guarantees, but resolution code + tests still
+ * deliberately support it (Windows global installs, issue #33) and there is
+ * no install-base evidence it is unused — kept, not removed. Warn once per
+ * process so installs relying on it know to migrate to the canonical package.
+ */
+function warnIfForkResolved(name: string): void {
+	if (name !== "@mariozechner/pi-coding-agent" || forkResolutionWarned) return;
+	forkResolutionWarned = true;
+	console.warn(
+		`[pi-crew] notice: resolved the legacy peer dependency "${name}" (fork last published 0.73.1, 2026-05-07). ` +
+			`The canonical package is "@earendil-works/pi-coding-agent"; pi-crew keeps the fork for compatibility, ` +
+			`but support may be removed in a future release.`,
+	);
+}
+
 /** Resolve the peer dep install dir + ESM entry URL. Memoized (sync). */
 export function resolvePeerDep(): ResolvedPeerDep | undefined {
 	if (cachedResolve !== null) return cachedResolve ?? undefined;
@@ -225,6 +246,7 @@ export function resolvePeerDep(): ResolvedPeerDep | undefined {
 	for (const base of bases) {
 		const found = tryResolveFrom(base);
 		if (found) {
+			warnIfForkResolved(found.name);
 			cachedResolve = found;
 			return found;
 		}
@@ -234,6 +256,7 @@ export function resolvePeerDep(): ResolvedPeerDep | undefined {
 	for (const base of peerDepNpmGlobalBases()) {
 		const found = tryResolveFrom(base);
 		if (found) {
+			warnIfForkResolved(found.name);
 			cachedResolve = found;
 			return found;
 		}
@@ -317,4 +340,5 @@ export function __resetPeerDepCacheForTest(): void {
 	cachedResolve = null;
 	cachedModule = undefined;
 	primingPromise = undefined;
+	forkResolutionWarned = false;
 }