pi-daddy 0.25.2 → 0.26.0

package/extensions/delegation-authority.ts

@@ -0,0 +1,12 @@
+import { GovernanceRefusal, refusal } from "../src/refusals.ts";
+import type { GrantsSession } from "./session.ts";
+
+/** Tool definitions may be inspected directly; execution still requires an owner-bound delegation grant. */
+export function assertDelegationAuthority(session: GrantsSession): void {
+  if (!session.ownerBound) {
+    throw new GovernanceRefusal(refusal("CAPABILITY_ESCALATION", "delegation refused: session ownership is not bound yet"));
+  }
+  if (!session.mayDelegate) {
+    throw new GovernanceRefusal(refusal("CAPABILITY_ESCALATION", "delegation refused: this session does not hold tool:delegate"));
+  }
+}

package/extensions/delegation.ts

@@ -30,6 +30,7 @@ import { type GrantsSession } from "./session.ts";
 import { newDelegationOccurrence } from "./execution-occurrence.ts";
 import { correlationShape as buildCorrelationShape } from "./correlation-shape.ts";
 import { completePrimary } from "./primary-shadow.ts";
+import { assertDelegationAuthority } from "./delegation-authority.ts";
 
 /**
  * Wire a set of children to pi's partial-result channel — ADR-0032.
@@ -121,14 +122,13 @@ export interface DelegationRegistration {
 
 
 /**
- * Register `delegate` and `delegate_all` — but only if this session may delegate.
+ * Register delegation definitions at owner-bound session_start.
  *
- * The conditional is the whole of S-5: an unconditionally-registered `delegate` appears in every child's
- * ceiling, so a delegator without it was told every single agent type "requires tool:delegate".
+ * Pi exposes factory registrations before `bindExtensions()`, so this timing keeps the pre-start surface
+ * empty. Owner reconciliation precedes registration and activation, so a holder without `tool:delegate`
+ * remains a leaf at every dispatch boundary.
  */
 export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession): DelegationRegistration {
-  if (!session.mayDelegate) return { refreshSpawnable: () => {} };
-
   /**
    * Definitions this session is actually authorised to spawn (ADR-0017), for the tool description.
    *
@@ -142,9 +142,8 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
   /**
    * **R-39.** This used to be computed once, right here, and it was always `[]`.
    *
-   * `registerDelegationTools` is called synchronously from the extension factory, while
-   * `session.definitions` is only populated in the `session_start` hook — which fires afterwards. So every
-   * model in every governed session was told `Available: none.` and did the reasonable thing: it used
+   * `registerDelegationTools` runs at `session_start`, before that hook loads definitions. So every model
+   * in every governed session was told `Available: none.` and did the reasonable thing: it used
    * `delegate({tools})`, the path with no operator-authored instructions, no `agent:` prerequisite, no body
    * digest on the record, and no `always` approval available. **ADR-0017 and ADR-0019 bought expressiveness
    * the model was structurally prevented from using**, and every dialog was a `<delegate>` dialog again.
@@ -230,6 +229,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       "sub-agent must itself delegate further; withhold it to make the sub-agent a leaf.",
     parameters: delegateParams,
     async execute(_toolCallId, params, signal, onUpdate, ctx) {
+      assertDelegationAuthority(session);
       // ADR-0032: one child, same block. `_onUpdate` was discarded here, so a delegation showed the bare word
       // `delegate` for up to DEFAULT_TIMEOUT_MS — twenty minutes by default.
       const progress = progressReporter(session, [params.agent ?? "delegate"], onUpdate as never);
@@ -302,6 +302,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       "completion=primary with a 1-based primary returns that result while shadows remain owned/accounted.",
     parameters: delegateAllParams,
     async execute(_toolCallId, params, signal, onUpdate, ctx) {
+      assertDelegationAuthority(session);
       const children = params.children ?? [],primaryMode=params.completion==="primary";
       if(primaryMode!==Number.isInteger(params.primary)||primaryMode&&(params.primary!<1||params.primary!>children.length))throw new GovernanceRefusal(refusal("FANOUT_EXCEEDED","primary fan-out requires one in-range 1-based primary"));
       if(primaryMode&&session.variantRuns.size>=128)throw new GovernanceRefusal(refusal("FANOUT_EXCEEDED","primary/shadow accounting capacity exhausted"));

package/extensions/grants.ts

@@ -38,16 +38,13 @@ import { grantsCommand } from "./grants-command.ts";
 import { runInit } from "./init-command.ts";
 import { planWithApprovals } from "./run-delegation.ts";
 import { createGrantsSession, loadProjectDefinitions, type GrantsSession } from "./session.ts";
+import { bindReloadLifecycle } from "./reload-environment.ts";
+import { reconcileActiveDelegationTools } from "./delegation-activation.ts";
 import { resolveExecutor } from "./executor-session.ts";
 import { reportSessionStart } from "./session-report.ts";
 import { SPAWN_TOOLS, tripwireReason } from "./tripwire.ts";
 import { reportGrantStoreRefusal } from "./grant-store-refusal.ts";
-import {
-  defaultDashboardPaths,
-  offerDashboardHandshake,
-  openDashboardCommand,
-} from "../src/dashboard-handshake.ts";
-
+import { defaultDashboardPaths, offerDashboardHandshake, openDashboardCommand } from "../src/dashboard-handshake.ts";
 import { associateOrdinaryHost, ordinaryChildrenFor } from "../src/ordinary-children.ts";
 import { loadDeclaredWork } from "../src/work-command.ts";
 import { createDailyDashboardSession } from "./daily-dashboard-session.ts";
@@ -62,7 +59,6 @@ export default function (pi: ExtensionAPI) {
       return undefined;
     }
   })();
-
   const session = createGrantsSession(extensionPath);
   associateOrdinaryHost(pi,session);
   const dailyHost=createDailyDashboardSession({ordinary:()=>ordinaryChildrenFor(pi),declared:()=>session.declaredWork,rebind:state=>{session.declaredWork=state;},cwd:()=>session.cwd,env:process.env,author:"local-operator"});
@@ -70,14 +66,20 @@ export default function (pi: ExtensionAPI) {
   const dashboardPaths = defaultDashboardPaths(
     process.env.PI_CODING_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent"),
   );
-
-  // Filled in by `registerDelegationTools` at the bottom of this function. A holder rather than a reordering,
-  // because the hooks below have to be registered before the tools and both need to call it — the tool
-  // schemas describe which definitions are spawnable, and nothing knows that until a hook has run (R-39).
+  // Definitions are registered only after owner-bound session_start. Until then there is no delegation
+  // dispatch surface; afterwards this callback refreshes their model-facing spawnable-definition text.
   const delegation = { refreshSpawnable: () => {} };
   const publishedDailyWork: PublishedDailyWork = {};
 
   pi.on("session_start", async (_event, ctx) => {
+    // Real SDK contexts always supply SessionManager. The fallback keeps lightweight wiring fixtures
+    // isolated; it cannot carry state into another extension instance.
+    const owner = (ctx as { sessionManager?: object }).sessionManager ?? session;
+    const reload = bindReloadLifecycle(owner, session.reloadLifecycle);
+    session.reconcileEnvironment(reload.environment, reload.lifecycle);
+    session.ownerBound = true;
+    delegation.refreshSpawnable = registerDelegationTools(pi, session).refreshSpawnable;
+    reconcileActiveDelegationTools(pi, session);
     session.cwd = ctx.cwd;
     // A routed child changes cwd. Publishing a relative ledger string unchanged therefore fragments one
     // execution tree across workspaces. Resolve it once at the root's actual pi cwd; descendants inherit
@@ -250,7 +252,9 @@ export default function (pi: ExtensionAPI) {
    * `exit` remains the backstop. SIGKILL still orphans panes, exactly as R-62 records, and no signal handler is
    * installed here for the reason R-62 gives: it would turn pi's "interrupt this turn" into "exit pi".
    */
-  pi.on("session_shutdown", async () => { await dailyHost.close().catch(() => undefined); });
+  pi.on("session_shutdown", async () => {
+    await dailyHost.close().catch(() => undefined);
+  });
 
   pi.on("agent_settled", async () => {
     try {
@@ -341,15 +345,6 @@ export default function (pi: ExtensionAPI) {
     return { block: true, reason };
   });
 
-  // Governed delegation. Unlike the tripwire above this PROVISIONS: the grant is an argument, so the
-  // orchestrator hands each child exactly the capabilities it should have. Registered only when this
-  // session may delegate, so withholding `tool:delegate` genuinely makes a session a leaf.
-  //
-  // Registration necessarily happens HERE, before any hook has run, so the tools cannot yet know which
-  // definitions exist — hence `refreshSpawnable`, called from both hooks above once they do. R-39 is what
-  // happens without it: every model in every governed session is told `Available: none`.
-  delegation.refreshSpawnable = registerDelegationTools(pi, session).refreshSpawnable;
-
   pi.registerCommand("grants", {
     ...grantsCommand,
     // Built per invocation and spelled out field by field, rather than passing the session whole: what a

package/extensions/reload-environment.ts

@@ -0,0 +1,63 @@
+import { GRANT_ENV_KEYS } from "../src/propagation.ts";
+
+/** The root baseline and latest child publication for one real Pi session owner. */
+export interface ReloadLifecycle { root: Record<string, string | undefined>; published?: Record<string, string | undefined> }
+type SessionOwner = object;
+
+interface ReloadState {
+  owners: WeakMap<SessionOwner, ReloadLifecycle>;
+  latestChildPublication?: { lifecycle: ReloadLifecycle; environment: Record<string, string | undefined> };
+}
+const RELOAD_STATE = Symbol.for("pi-daddy.reload-environment.v1");
+function state(): ReloadState {
+  const global = globalThis as typeof globalThis & { [key: symbol]: ReloadState | undefined };
+  return global[RELOAD_STATE] ?? (global[RELOAD_STATE] = { owners: new WeakMap() });
+}
+
+function snapshot(): Record<string, string | undefined> {
+  return Object.fromEntries(GRANT_ENV_KEYS.map(key => [key, process.env[key]]));
+}
+function same(left: Record<string, string | undefined>, right: Record<string, string | undefined>): boolean {
+  return GRANT_ENV_KEYS.every(key => left[key] === right[key]);
+}
+function withRoot(root: Record<string, string | undefined>): NodeJS.ProcessEnv {
+  return { ...process.env, ...root };
+}
+
+/** Factory-time state is provisional: ExtensionAPI is recreated before the stable session owner is known. */
+export function beginExtensionLifecycle(): { environment: NodeJS.ProcessEnv; lifecycle: ReloadLifecycle } {
+  return { environment: process.env, lifecycle: { root: snapshot() } };
+}
+
+/**
+ * Bind an extension lifecycle to Pi's stable owner at session_start.
+ *
+ * A matching latest publication is child state from a known owner, not an explicit replacement for this
+ * owner. An unmatched environment change is an explicit root replacement for THIS owner only.
+ */
+export function bindReloadLifecycle(owner: SessionOwner, provisional: ReloadLifecycle): {
+  lifecycle: ReloadLifecycle;
+  environment: NodeJS.ProcessEnv;
+} {
+  const holder = state();
+  const existing = holder.owners.get(owner);
+  if (!existing) {
+    holder.owners.set(owner, provisional);
+    return { lifecycle: provisional, environment: withRoot(provisional.root) };
+  }
+
+  const current = snapshot();
+  if (!holder.latestChildPublication || !same(current, holder.latestChildPublication.environment)) {
+    // No pi-daddy lifecycle published what is currently in process.env, so this is an explicit change to
+    // this owner's root rather than another bound session's child state.
+    existing.root = current;
+  }
+  return { lifecycle: existing, environment: withRoot(existing.root) };
+}
+
+/** Publish only parent-level child state, and retain which owner made the process-global publication. */
+export function rememberChildPublication(lifecycle: ReloadLifecycle): void {
+  const environment = snapshot();
+  lifecycle.published = environment;
+  state().latestChildPublication = { lifecycle, environment };
+}

package/extensions/session-environment.ts

@@ -0,0 +1,45 @@
+import { parseInherited } from "../src/approval.ts";
+import { DELEGATE_CAPABILITY } from "../src/delegate.ts";
+import { budgetFromEnv } from "../src/fanout.ts";
+import { WILDCARD } from "../src/pi-tools.ts";
+import {
+  depthConfig, deriveOwnGrant, gatedFromEnv, ENV_APPROVED, ENV_DEPTH, ENV_EXECUTION_ID, ENV_FANOUT,
+  ENV_GATED, ENV_GRANT, ENV_LEDGER, ENV_MAX_DEPTH, ENV_PARENT_ID, parseList,
+} from "../src/propagation.ts";
+import { storedGrantSessionState } from "./stored-grant-session.ts";
+import { chooseExecutor, ENV_HERDR } from "../src/executor.ts";
+import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/model-preflight.ts";
+import type { ReloadLifecycle } from "./reload-environment.ts";
+import type { GrantsSession } from "./session.ts";
+
+/** Rebuild every authority-bearing factory input once session_start identifies its real SDK owner. */
+export function reconcileSessionEnvironment(
+  session: GrantsSession, environment: NodeJS.ProcessEnv, lifecycle: ReloadLifecycle,
+): void {
+  const grantRaw = environment[ENV_GRANT];
+  const stored = storedGrantSessionState(grantRaw, session.storeCwd);
+  const bounds = depthConfig(environment[ENV_DEPTH], environment[ENV_MAX_DEPTH]);
+  const ledgerRaw = environment[ENV_LEDGER];
+  session.ledgerFromEnvironment = ledgerRaw !== undefined;
+  session.governed = stored.governed;
+  session.inherited = stored.inherited;
+  session.depth = bounds.depth;
+  session.maxDepth = bounds.maxDepth;
+  session.malformedBounds = bounds.malformed;
+  session.gated = session.governed ? gatedFromEnv(environment[ENV_GATED]) : parseList(environment[ENV_GATED]);
+  session.ledgerPath = ledgerRaw !== undefined ? ledgerRaw : stored.defaultLedger;
+  session.executor = chooseExecutor(environment[ENV_HERDR], null);
+  session.ownSpawnId = environment[ENV_PARENT_ID]?.trim() || `d${session.depth}`;
+  session.ownExecutionId = environment[ENV_EXECUTION_ID]?.trim() || undefined;
+  session.fanoutBudget = budgetFromEnv(environment[ENV_FANOUT]);
+  session.mayDelegate = !session.governed || session.inherited.includes(DELEGATE_CAPABILITY) || session.inherited.includes(WILDCARD);
+  session.allowUnresolvedModels = environment[ENV_ALLOW_UNRESOLVED_MODELS] === "1";
+  session.reloadLifecycle = lifecycle;
+  session.inheritedApprovals = parseInherited(environment[ENV_APPROVED]);
+  session.ownGrant = deriveOwnGrant(session.inherited, null);
+  session.observed = false;
+  session.observedTools = null;
+  session.modelResolutionCache.clear();
+  if (stored.refusal) session.grantStoreRefusal = stored.refusal;
+  else delete session.grantStoreRefusal;
+}

package/extensions/session.ts

@@ -37,6 +37,7 @@ import {
   ENV_LEDGER,
   ENV_MAX_DEPTH,
   ENV_PARENT_ID,
+  GRANT_ENV_KEYS,
   parseList,
 } from "../src/propagation.ts";
 import type { Capability } from "../src/resolve.ts";
@@ -49,6 +50,8 @@ import { storedGrantSessionState } from "./stored-grant-session.ts";
 import { nativeSessionRootFromEnv, type NativeSessionHost } from "../src/native-session-target.ts";
 import { ENV_ALLOW_UNRESOLVED_MODELS } from "../src/model-preflight.ts";
 import type { DeclaredWorkState } from "../src/work-command.ts";
+import { beginExtensionLifecycle, rememberChildPublication, type ReloadLifecycle } from "./reload-environment.ts";
+import { reconcileSessionEnvironment } from "./session-environment.ts";
 /**
  * Run governed children in herdr panes instead of captured child processes.
  *
@@ -93,14 +96,15 @@ export interface GrantsSession extends NativeSessionHost {
    */
   governed: boolean;
   /** The upper bound handed down by the delegator, before this session's own tools are observed. */
-  readonly inherited: Capability[];
-  readonly depth: number;
-  readonly maxDepth: number;
+  inherited: Capability[];
+  depth: number;
+  maxDepth: number;
   /** Bound variables that could not be read as non-negative integers — spawning is disabled, loudly. */
-  readonly malformedBounds: string[];
-  readonly gated: Capability[];
+  malformedBounds: string[];
+  gated: Capability[];
   /** Resolved against the actual pi cwd at session start, then inherited verbatim by every descendant. */
   ledgerPath?: string;
+  ledgerFromEnvironment: boolean;
   /**
    * Which executor runs this session's children — ADR-0031.
    *
@@ -114,15 +118,17 @@ export interface GrantsSession extends NativeSessionHost {
    */
   executor: ExecutorChoice;
   /** This session's readable logical ledger identity; children descend from it (F8). */
-  readonly ownSpawnId: string;
+  ownSpawnId: string;
   /** Unique identity when this session is itself a governed child; roots have no governed parent. */
-  readonly ownExecutionId?: string;
+  ownExecutionId?: string;
   /** Descendants this subtree may still create — the cardinality bound ADR-0008 never had. */
-  readonly fanoutBudget: number;
-  /** Whether `delegate` / `delegate_all` are registered at all (S-5). Decided on the INHERITED grant. */
-  readonly mayDelegate: boolean;
+  fanoutBudget: number;
+  /** Whether delegation tools are active. Reconciled against the owner-bound root at session_start. */
+  mayDelegate: boolean;
+  /** True only after session_start binds this instance to ctx.sessionManager. */
+  ownerBound: boolean;
   /** Operator escape hatch for custom model resolution. Exact `1`, read once for the session. */
-  readonly allowUnresolvedModels: boolean;
+  allowUnresolvedModels: boolean;
   /** Results from pi's synchronous model catalogue, shared by every delegation in this session. */
   readonly modelResolutionCache: Map<string, boolean>;
   /** Path to this extension, so a child granted `tool:delegate` can delegate in turn. */
@@ -130,7 +136,8 @@ export interface GrantsSession extends NativeSessionHost {
   declaredWork?: DeclaredWorkState; // Explicit operator selection; absence leaves execution visibly unbound.
   /** Primary-return fan-outs retained by this original session; bounded and human-readable via /grants variants. */
   readonly variantRuns: Map<string, VariantRunAccounting>;
-
+  /** Root identity keyed to ctx.sessionManager once session_start supplies it. */
+  reloadLifecycle: ReloadLifecycle;
   /** Approval keys approved for this session. In memory only — this dies with the process. */
   readonly sessionApprovals: Set<string>;
   /** Exact bindings for correlated approvals; these never inherit across a delegation boundary. */
@@ -143,10 +150,9 @@ export interface GrantsSession extends NativeSessionHost {
    * needs `session.definitions`, which does not exist until `session_start` — and this object is built
    * before any hook has run.
    */
-  readonly inheritedApprovals: Map<string, string | undefined>;
+  inheritedApprovals: Map<string, string | undefined>;
   /** ONE single-flight queue for the whole session — see `obtainApprovals` for why it lives here. */
   readonly approvalGateFor: ReturnType<typeof createApprovalGateProvider>;
-
   /** Set at `session_start`; `process.cwd()` until then. */
   cwd: string;
   /** This session's own grant. Starts as the inherited upper bound, tightened once tools are observed. */
@@ -194,7 +200,7 @@ export interface GrantsSession extends NativeSessionHost {
    */
   readonly storeCwd: string;
   /** Invalid stored state fails closed and is reported/ledgered during session_start. */
-  readonly grantStoreRefusal?: { reason: GrantStoreRefusalReason; path: string };
+  grantStoreRefusal?: { reason: GrantStoreRefusalReason; path: string };
   /**
    * Adopt the project choice made DURING the session — grant plus optional default ledger — without restart.
    *
@@ -207,6 +213,7 @@ export interface GrantsSession extends NativeSessionHost {
    * widen its own session's ceiling by calling something.
    */
   adoptGrant(grant: Capability[], projectLedger?: string): void;
+  reconcileEnvironment(environment: NodeJS.ProcessEnv, lifecycle: ReloadLifecycle): void;
 }
 
 /**
@@ -238,7 +245,10 @@ export async function loadProjectDefinitions(session: GrantsSession, cwd: string
   session.catalog = await session.catalogReady;
 }
 
-export function createGrantsSession(extensionPath: string | undefined): GrantsSession {
+export function createGrantsSession(extensionPath: string | undefined, lifecycle?: ReloadLifecycle): GrantsSession {
+  const started = lifecycle ? undefined : beginExtensionLifecycle();
+  const activeLifecycle = lifecycle ?? started!.lifecycle;
+  const environment = lifecycle ? process.env : started!.environment;
   // Governance is opt-in: with PI_GRANTS_GRANT unset AND no stored grant for this directory, the session
   // holds the wildcard and nothing is blocked. This extension must never silently tighten a normal
   // workflow.
@@ -252,22 +262,21 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
   // and therefore before `ctx` exists. That ordering is forced by S-5: whether `delegate` is registered at
   // all is decided here, and a grant arriving later could not inform it. `session_start` re-checks the two
   // against each other and says so if they differ, which is the only case this can get wrong.
-  const grantRaw = process.env[ENV_GRANT];
+  const grantRaw = environment[ENV_GRANT];
   const storeCwd = process.cwd();
   // One root-only store read supplies both decisions made by `/grants init`. A child always has ENV_GRANT,
   // so it cannot activate a ledger merely because its routed cwd happens to have a v2 store (ADR-0037).
   const storedState = storedGrantSessionState(grantRaw, storeCwd);
   const { governed, inherited, refusal: grantStoreRefusal } = storedState;
-  const ledgerRaw = process.env[ENV_LEDGER];
+  const ledgerRaw = environment[ENV_LEDGER];
   // Capture provenance before publishChildEnv writes this session's derived default into process.env. A later
   // `/grants init` for ctx.cwd must not mistake our own publication for an operator override.
   const ledgerFromEnvironment = ledgerRaw !== undefined;
   const storedLedger = storedState.defaultLedger;
   // G7 / A-S4 + B-I4: strict, three-way parsing that fails CLOSED. A malformed bound used to yield
   // `NaN`, and every comparison against `NaN` is false, so depth limiting switched itself off.
-  const bounds = depthConfig(process.env[ENV_DEPTH], process.env[ENV_MAX_DEPTH]);
+  const bounds = depthConfig(environment[ENV_DEPTH], environment[ENV_MAX_DEPTH]);
   const { depth, maxDepth } = bounds;
-
   const emptyCatalog = makeCatalog([]);
 
   const session: GrantsSession = {
@@ -281,41 +290,41 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
     // did. Inside a session the operator already chose to govern, handing a child `bash` hands it an
     // ungoverned-descendant escape hatch, and doing that silently is what changes here.
     // `PI_GRANTS_GATED=""` turns the default off; absent and empty are deliberately distinguishable.
-    gated: governed ? gatedFromEnv(process.env[ENV_GATED]) : parseList(process.env[ENV_GATED]),
+    gated: governed ? gatedFromEnv(environment[ENV_GATED]) : parseList(environment[ENV_GATED]),
     // Presence wins, including an explicitly empty value for a one-run opt-out. The store is eligible only
     // when ENV_GRANT was absent above, preserving the environment as the child's single authority channel.
     ledgerPath: ledgerRaw !== undefined ? ledgerRaw : storedLedger,
+    ledgerFromEnvironment,
     // The un-probed reading. `resolveExecutor` replaces it at session start; until then a `1` already reads as
     // a refusal, which is the safe direction — a delegation that somehow ran before the probe would refuse
     // rather than quietly use the wrong executor.
-    executor: chooseExecutor(process.env[ENV_HERDR], null),
+    executor: chooseExecutor(environment[ENV_HERDR], null),
     // `ownSpawnId` comes from the parent (F8), so ids form one tree across process boundaries instead of
     // every level restarting at `d0` and the ledger becoming unjoinable.
-    ownSpawnId: process.env[ENV_PARENT_ID]?.trim() || `d${depth}`,
-    ownExecutionId: process.env[ENV_EXECUTION_ID]?.trim() || undefined,
+    ownSpawnId: environment[ENV_PARENT_ID]?.trim() || `d${depth}`,
+    ownExecutionId: environment[ENV_EXECUTION_ID]?.trim() || undefined,
     // The cardinality bound ADR-0008 never had: it attenuates downward like depth, so a subtree can never
     // create more descendants than its root was given — with no shared state, no lock and no counter file.
-    fanoutBudget: budgetFromEnv(process.env[ENV_FANOUT]),
+    fanoutBudget: budgetFromEnv(environment[ENV_FANOUT]),
     /**
      * Review finding S-5, fixed. The comment on the tools has always claimed conditional registration; the
      * call was unconditional, `DELEGATE_CAPABILITY` was imported and never used, and "withhold it and the
      * child is a leaf" was simply untrue on this path.
      *
-     * Decided on the INHERITED grant rather than `ownGrant`, because registration happens at load time,
-     * before any tools are observed. An ungoverned session registers it as before.
+     * Provisional before owner binding; session_start recomputes it from that owner's root before activation.
      */
     mayDelegate: !governed || inherited.includes(DELEGATE_CAPABILITY) || inherited.includes(WILDCARD),
-    allowUnresolvedModels: process.env[ENV_ALLOW_UNRESOLVED_MODELS] === "1",
+    ownerBound: false,
+    allowUnresolvedModels: environment[ENV_ALLOW_UNRESOLVED_MODELS] === "1",
     nativeSessionRoot: nativeSessionRootFromEnv(process.env),
     modelResolutionCache: new Map<string, boolean>(),
     extensionPath,
     variantRuns: new Map(),
-
+    reloadLifecycle: activeLifecycle,
     sessionApprovals: new Set<string>(),
     sessionApprovalBindings: new Map<string, ApprovalBinding>(),
-    inheritedApprovals: parseInherited(process.env[ENV_APPROVED]),
+    inheritedApprovals: parseInherited(environment[ENV_APPROVED]),
     approvalGateFor: createApprovalGateProvider(),
-
     cwd: process.cwd(),
     ownGrant: deriveOwnGrant(inherited, null),
     observed: false,
@@ -323,7 +332,6 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
     definitions: new Map<string, SkillDefinition>(),
     catalog: emptyCatalog,
     catalogReady: Promise.resolve(emptyCatalog),
-
     delegationContext: async (approved?: InheritableApproval[]) => ({
       ownGrant: session.ownGrant,
       depth: session.depth,
@@ -360,12 +368,13 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
       session.ownGrant = grant;
       // An environment ledger remains the explicit answer. Otherwise init's v2 choice becomes live now,
       // before publishChildEnv gives the same absolute path to descendants.
-      if (!ledgerFromEnvironment && projectLedger !== undefined) {
+      if (!session.ledgerFromEnvironment && projectLedger !== undefined) {
         session.ledgerPath = projectLedger;
       }
       session.publishChildEnv();
     },
 
+    reconcileEnvironment: (environment, lifecycle) => reconcileSessionEnvironment(session, environment, lifecycle),
     publishChildEnv: () => {
       const env = childEnv({
         ownGrant: session.ownGrant,
@@ -378,9 +387,11 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
         // descendants too. Previously it exported its own observed tool surface as their grant.
         governed: session.governed,
       });
+      // Clear omitted fields: another owner's provenance must never reach this session's children.
+      for (const key of GRANT_ENV_KEYS) delete process.env[key];
       for (const [key, value] of Object.entries(env)) process.env[key] = value;
+      rememberChildPublication(session.reloadLifecycle);
     },
   };
-
   return session;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",
@@ -248,6 +248,7 @@
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.check.json",
     "test": "node scripts/unit-tests.ts",
+    "test:dashboard-pty": "if [ \"$(uname -s)\" = Linux ]; then python3 test/dashboard-cli-pty.py; else echo 'dashboard PTY probe requires Unix pty/Unix sockets'; fi",
     "test:integration": "node --test test-integration/*.it.ts",
     "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts",
     "contracts:generate": "node scripts/generate-ledger-v3-contract.ts",

package/src/chain.ts

@@ -156,6 +156,8 @@ export interface ChainStep {
   agent?: string;
   tools?: string[];
   model?: string;
+  /** Requested Pi thinking level; validated by the same schema as delegate/delegate_all. */
+  thinking?: string;
   correlation?: import("./correlation.ts").CorrelationMetadata;
   workspace?: { workspace_id: string; access: import("./workspace.ts").WorkspaceAccess };
 }

package/src/dashboard-cli.ts

@@ -58,6 +58,20 @@ export async function dashboardHostAction(host:DashboardConnection,line:string){
   return host.humanAction(command);
 }
 
+/** A fulfilled host call is not necessarily an applied native effect; keep those facts distinct in the UI. */
+export function dashboardActionFeedback(command:string,outcome:unknown):string{
+  const value=outcome&&typeof outcome==="object"?outcome as {state?:unknown;result?:unknown}:{};
+  const state=typeof value.state==="string"?value.state:"unrecognised host response";
+  if(state==="failed-or-unknown"||state==="readback-only")return `NO ACTION CLAIM: ${command} returned ${state}; inspect/reconcile explicitly.`;
+  if(state!=="acknowledged")return `NOT APPLIED: ${command} returned ${state}.`;
+  const result=value.result&&typeof value.result==="object"?value.result as {application?:unknown}:null;
+  // A retained records[] snapshot has no outer dashboard request correlation. Never select an old receipt.
+  const nativeApplication=typeof result?.application==="string"?result.application:undefined;
+  if(nativeApplication==="applied")return `ACKNOWLEDGED: ${command}; native application applied.`;
+  if(nativeApplication)return `ACKNOWLEDGED: ${command}; native application ${nativeApplication}, so no applied effect is claimed.`;
+  return `ACKNOWLEDGED: ${command}; refreshed state is shown below (no native application claim).`;
+}
+
 function shellQuote(value: string): string {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
@@ -96,14 +110,15 @@ export async function dashboardFrame(options: DashboardFrameOptions): Promise<st
   if(options.connected){
     if(!isDashboardConnection(options.connected))throw Error("original dashboard connection required");
     let view:Awaited<ReturnType<DashboardConnection["frame"]>>;
-    try{view=await options.connected.frame();}catch{return "PI-DADDY — CONNECTED HOST UNAVAILABLE\nNo prior acceptance, presentation or continuity substituted. No action retried.";}
+    try{view=await options.connected.frame();}catch(error){return `PI-DADDY — CONNECTED HOST ERROR\n${error instanceof Error ? error.message : String(error)}\nNo prior acceptance, presentation or continuity substituted. No action retried.`;}
     if(options.dailyJson||options.debriefJson)return JSON.stringify(view);
     const source=view.source as {daily?:Parameters<typeof renderDailyView>[0]}|null;
     const actions=(view.actions as {key:string;label:string}[]|undefined)??[];
-    return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
+    const hostError=typeof view.error==="string"&&view.error?`HOST ERROR — ${view.error}`:null;
+    return ["PI-DADDY — CONNECTED HOST (snapshot; identity/acceptance not authenticated)",hostError,source?.daily?renderDailyView(source.daily,options.width):"Source unavailable; no previous acceptance substituted.",
       view.debrief?renderDebrief(view.debrief as Parameters<typeof renderDebrief>[0],options.width):"Debrief deferred/closed. No implicit presentation or steering.",
-      `Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
-      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].join("\n\n");
+      `Host control ${view.control}; acknowledgement ${view.acknowledgement}. Attention reserved ${view.attention.attentionUsed}/5 (not proof of delivery). Tip ${view.tip}.`,
+      actions.length?`ACTIONS — type one command and Enter\n${actions.map(action=>`  ${action.key} — ${action.label}`).join("\n")}`:"ACTIONS — none currently authorized; refresh never acts."].filter((line):line is string=>Boolean(line)).join("\n\n");
   }
   if (options.debrief || options.debriefJson) {
     if (!isDebriefPresenter(options.debrief)) return "PI-DADDY — DEBRIEF UNAVAILABLE: genuine presenter/host missing";
@@ -213,6 +228,8 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
   }
   const dailyReader = createDailyViewReader();
   let previous = "";
+  let feedback = "";
+  let input: ReturnType<typeof createInterface> | null = null;
   const draw = async (clear: boolean): Promise<void> => {
     const frame = await dashboardFrame({
       cwd,
@@ -223,15 +240,20 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       details: cli.details,
       dailyView, dailyReader, dailyJson: cli.dailyJson, debrief, debriefJson: cli.debriefJson, connected,
     });
-    if (frame === previous && !clear) return;
-    previous = frame;
-    process.stdout.write(clear ? `\u001b]0;PI-DADDY\u0007\u001b[2J\u001b[H${frame}` : `${frame}\n`);
+    const rendered = feedback ? `${frame}\n\n${feedback}` : frame;
+    if (rendered === previous && !clear) return;
+    previous = rendered;
+    const prompt = "COMMAND — type an exact listed key, then Enter (refresh never acts): ";
+    const draft = input?.line ?? "";
+    process.stdout.write(clear ? `\u001b]0;PI-DADDY\u0007\u001b[2J\u001b[H${rendered}\n\n${input ? prompt + draft : ""}` : `${rendered}\n`);
+    if (input) input.setPrompt(prompt);
   };
 
   if (cli.once) {
     await draw(false);
     return;
   }
+  input = debrief || connected ? createInterface({ input: process.stdin, output: process.stdout, terminal: true }) : null;
   await draw(true);
   let drawing = false;
   const redraw = (): void => {
@@ -239,13 +261,16 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
     drawing = true;
     void draw(true).finally(() => { drawing = false; });
   };
-  const input = debrief || connected ? createInterface({ input: process.stdin, terminal: false }) : null;
   let acting = false;
   input?.on("line", line => {
-    if (acting) return;
+    if (acting) return; // never replay a line typed while the prior exact command is still settling.
     acting = true;
-    void (connected?dashboardHostAction(connected,line):debriefAction(debrief!, line)).catch(() => { process.stderr.write("Debrief action refused or acknowledgement unknown; inspect/reconcile explicitly.\n"); })
-      .finally(() => { acting = false; redraw(); });
+    feedback = `COMMAND ${line.trim() || "(empty)"} — applying the displayed exact request…`;
+    void (connected?dashboardHostAction(connected,line):debriefAction(debrief!, line)).then(outcome => {
+      feedback = connected ? dashboardActionFeedback(line.trim() || "command", outcome) : `ACKNOWLEDGED: ${line.trim() || "command"}. Refreshed state is shown below.`;
+    }).catch(error => {
+      feedback = `REJECTED: ${error instanceof Error ? error.message : String(error)}. No command was retried; inspect the refreshed offered keys.`;
+    }).finally(() => { acting = false; redraw(); });
   });
   const timer = setInterval(redraw, DASHBOARD_REFRESH_MS);
   process.on("SIGWINCH", redraw);

package/src/init.ts

@@ -22,7 +22,7 @@
  * for, rather than a grant nobody decided.
  */
 
-import { mkdir, open, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, open, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { agentCapability, workspaceCapability } from "./capabilities.ts";
 import { ceilingForDefinition } from "./definitions.ts";
@@ -372,6 +372,23 @@ async function replace(path: string, content: string, outcome: InitOutcome): Pro
  */
 export async function applyInit(plan: InitPlan, options: { force?: boolean } = {}): Promise<InitOutcome> {
   const outcome: InitOutcome = { written: [], kept: [], failed: [] };
+  const projectPi = join(plan.grantEnvPath, "..");
+  try {
+    // A new project gets a private control directory. Existing operator/Pi state is never chmodded or reused.
+    await mkdir(projectPi, { mode: 0o700 });
+    const created = await lstat(projectPi);
+    if (!created.isDirectory() || created.isSymbolicLink()) throw Error("private .pi directory creation failed");
+  } catch (error) {
+    if ((error as { code?: string }).code !== "EEXIST") {
+      outcome.failed.push({ path: projectPi, error: error instanceof Error ? error.message : String(error) });
+      return outcome;
+    }
+    const existing = await lstat(projectPi);
+    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+      outcome.failed.push({ path: projectPi, error: "existing .pi state is not a directory; it was not followed or changed" });
+      return outcome;
+    }
+  }
   const force = options.force === true;
   for (const skill of plan.skills) {
     if (force) await replace(skill.targetPath, skill.content, outcome);