pi-daddy 0.43.1 → 0.44.0

package/extensions/context-staging.ts

@@ -16,7 +16,9 @@
  * shape, a missing result indistinguishable from an empty one, and the child would have no way to know.
  */
 import { randomUUID } from "node:crypto";
-import { closeSync, mkdirSync, openSync, readSync, realpathSync, rmSync, statSync } from "node:fs";
+import { mkdirSync, realpathSync, rmSync, statSync } from "node:fs";
+import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
+import { readBoundedTextSync } from "../src/kernel/bounded-read-sync.ts";
 import { isAbsolute, relative, resolve } from "node:path";
 import {
   CONTEXT_RANK,
@@ -31,6 +33,8 @@ import {
 export interface ParentSession {
   getSessionFile(): string | undefined;
   getEntries(): Array<{ id: string; type: string }>;
+  /** Public Pi active leaf-to-root ancestry API; unavailable is not an empty conversation. */
+  getBranch?(): Array<{ id: string; type: string }>;
 }
 
 export interface StagingInput {
@@ -86,7 +90,10 @@ export function createHandoffStager(input: StagingInput) {
       for (const path of granted.files ?? [])
         sections.push({ ...readSection(input.cwd, path), keepRank: CONTEXT_RANK.file });
     if (granted.mode === "pruned") {
-      const all = parentTurns(input.parentSession);
+      const branch = parentTurns(input.parentSession);
+      const all = branch.turns;
+      if (branch.unavailable)
+        sections.push({ label: "parent turns — incomplete", body: branch.unavailable, keepRank: CONTEXT_RANK.summary });
       const selection = selectPrunedTurns(all, {
         ...(granted.turns !== undefined ? { turns: granted.turns } : {}),
         ...(granted.files !== undefined ? { files: granted.files } : {}),
@@ -113,7 +120,7 @@ export function createHandoffStager(input: StagingInput) {
           keepRank: (matched.has(turn.id) ? CONTEXT_RANK.fileMatchedTurn : CONTEXT_RANK.recentTurn) + index,
         });
       });
-      if (chosen.length === 0)
+      if (chosen.length === 0 && !branch.unavailable)
         sections.push({ label: "parent turns", body: "(no turn of your parent's session matched the selection)" });
     }
 
@@ -193,43 +200,31 @@ function readSection(cwd: string, path: string): ContextSection {
   if (within.startsWith("..") || within === "" || isAbsolute(within))
     return refuse("outside this session's working directory");
   try {
-    const stats = statSync(absolute);
-    // A FIFO satisfies `statSync` and then never returns from a read, which would block the whole pi session with
-    // no watchdog — and the path is model-supplied, so it is reachable rather than theoretical.
-    if (!stats.isFile()) return refuse("not a regular file");
-    const note = stats.size > MAX_FILE_BYTES ? ` (first ${MAX_FILE_BYTES} of ${stats.size} bytes)` : "";
-    return { label: `${path}${note}`, body: readBounded(absolute, MAX_FILE_BYTES) };
+    const read = readBoundedTextSync(absolute, {
+      maxBytes: MAX_FILE_BYTES,
+      prefix: true,
+      confinedRoot: root,
+    });
+    const note = read.truncated ? " (incomplete: bounded file prefix)" : "";
+    return { label: `${path}${note}`, body: read.text };
   } catch (error) {
+    if (error instanceof BoundedReadCleanupError) throw error;
     return { label: path, body: `(could not be read: ${error instanceof Error ? error.message : String(error)})` };
   }
 }
 
-/**
- * Read at most `budget` BYTES, without pulling the rest of the file into the parent first.
- *
- * `readFileSync(...).slice(budget)` reads the whole file and then slices by UTF-16 code units, so a large file in
- * the repository stalled the parent and the "(first N of M bytes)" label was wrong for any multi-byte content.
- */
-function readBounded(path: string, budget: number): string {
-  const handle = openSync(path, "r");
+/** Canonical active branch includes shared ancestry and excludes alternate descendants. */
+function parentTurns(session?: ParentSession): { turns: PrunableTurn[]; unavailable?: string } {
   try {
-    const buffer = Buffer.alloc(budget);
-    const read = readSync(handle, buffer, 0, budget, 0);
-    return new TextDecoder("utf-8", { fatal: false }).decode(buffer.subarray(0, read)).replace(/\uFFFD+$/, "");
-  } finally {
-    closeSync(handle);
-  }
-}
-
-/** The parent's message turns, reduced to what the selection rule needs. Never pi's own types past this point. */
-function parentTurns(session?: ParentSession): PrunableTurn[] {
-  if (!session) return [];
-  try {
-    return session
-      .getEntries()
-      .filter((entry) => entry.type === "message")
-      .map((entry) => ({ id: entry.id, text: JSON.stringify((entry as { message?: unknown }).message ?? entry) }));
-  } catch {
-    return [];
+    if (!session?.getBranch) throw new Error("active branch API is unavailable");
+    const entries = session.getBranch();
+    if (!Array.isArray(entries)) throw new Error("active branch did not return entries");
+    return {
+      turns: entries
+        .filter((entry) => entry.type === "message")
+        .map((entry) => ({ id: entry.id, text: JSON.stringify((entry as { message?: unknown }).message ?? entry) })),
+    };
+  } catch (error) {
+    return { turns: [], unavailable: `(active branch unavailable; context is incomplete: ${String(error)})` };
   }
 }

package/extensions/dashboard-session-server.ts

@@ -75,8 +75,7 @@ async function respond(session: GrantsSession, token: string, line: string): Pro
   return {
     ok: true,
     rows: sessionModelRows(session, [...session.definitions.keys()].sort()),
-    cost: session.episodeCostGate.cost,
-    ceiling: session.episodeCostGate.ceiling,
+    cost: null, // Live complete episode cost is unavailable; retained usage remains in the episode report.
   };
 }
 

package/extensions/definition-describe.ts

@@ -0,0 +1,44 @@
+/** Read-only handshake with the exact immutable definition dispatched by this extension instance. */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { digestDefinition } from "../src/kernel/definitions.ts";
+import { maySpawnDefinition } from "../src/kernel/delegate.ts";
+import type { GrantsSession } from "./session.ts";
+import { assertDelegationAuthority } from "./delegation-authority.ts";
+export function assertDefinitionIdentity(
+  session: GrantsSession,
+  spec: { agent?: string; definitionId?: string },
+): void {
+  const definition = spec.agent ? session.definitions.get(spec.agent) : undefined;
+  if (spec.definitionId !== undefined && (!definition || definition.definitionId !== spec.definitionId))
+    throw Error("definition snapshot changed or is unavailable; call delegate_describe again");
+  if (definition?.binding && !spec.definitionId)
+    throw Error("Principal delegation requires delegate_describe definitionId");
+}
+export function registerDefinitionDescribe(pi: ExtensionAPI, session: GrantsSession): void {
+  pi.registerTool({
+    name: "delegate_describe",
+    label: "Describe a governed definition",
+    description:
+      "Read the exact selected definition identity and Principal binding before delegation. Starts no child and grants nothing.",
+    parameters: Type.Object({ agent: Type.String() }),
+    async execute(_id, params) {
+      assertDelegationAuthority(session);
+      await session.ensureDefinitions?.();
+      if (!maySpawnDefinition(session.ownGrant, params.agent))
+        throw Error("definition is outside this session's grant");
+      const definition = session.definitions.get(params.agent);
+      if (!definition?.definitionId)
+        throw Error("selected definition is unavailable; reload after correcting discovery");
+      const details = {
+        version: 1,
+        agent: params.agent,
+        sourceHash: definition.sourceHash,
+        bodySha256: digestDefinition(definition).sha256,
+        binding: definition.binding ?? null,
+        definitionId: definition.definitionId,
+      };
+      return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details };
+    },
+  });
+}

package/extensions/definition-runtime.ts

@@ -2,8 +2,8 @@
 
 export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
 export type ThinkingLevel = (typeof THINKING_LEVELS)[number];
-export type ModelSource = "explicit" | "session" | "definition" | "global" | "pi";
-export type ThinkingSource = ModelSource | "advisor";
+export type ModelSource = "explicit" | "session" | "definition" | "authored" | "global" | "pi";
+export type ThinkingSource = ModelSource;
 export interface DefinitionRuntimeChoice {
   model?: string;
   thinking?: ThinkingLevel;
@@ -58,36 +58,99 @@ export function resolvedModelOf(value: string | undefined): { provider: string;
     : null;
 }
 
+/** Parse the complete needed list before evaluating availability. No model/thinking cross product. */
+export function authoredRuntimePreferences(raw: unknown): Required<DefinitionRuntimeChoice>[] {
+  if (raw === undefined) return [];
+  let value = raw;
+  if (typeof value === "string") {
+    const text = value.startsWith("'") && value.endsWith("'") ? value.slice(1, -1) : value;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      throw new Error("runtime-preferences must be a JSON array of model/thinking pairs");
+    }
+  }
+  if (!Array.isArray(value) || value.length > 32)
+    throw new Error("runtime-preferences must contain at most 32 ordered pairs");
+  return value.map((row, index) => {
+    if (
+      !isObject(row) ||
+      Object.keys(row).some((key) => !["model", "thinking"].includes(key)) ||
+      !qualifiedModel(row.model) ||
+      !parseThinkingLevel(row.thinking)
+    ) {
+      throw new Error(`runtime-preferences[${index}] needs an exact provider/model and thinking pair`);
+    }
+    return { model: row.model as string, thinking: row.thinking as ThinkingLevel };
+  });
+}
+
+function qualifiedModel(value: unknown): value is string {
+  return typeof value === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.-]*\/\S+$/.test(value);
+}
+
 export function resolveDefinitionRuntime(input: {
   definition?: string;
   explicit: { model?: string; thinking?: string };
   session: ReadonlyMap<string, DefinitionRuntimeChoice>;
   settings: DefinitionRuntimeSettings;
   piModel?: string;
-  advisorThinking?: string;
+  piThinking?: string;
+  authoredPreferences?: unknown;
+  /** Local, passive evidence only. Undefined means no known reason to reject, not remote health. */
+  unavailable?: (choice: DefinitionRuntimeChoice) => string | undefined;
 }): ResolvedDefinitionRuntime {
   const session = input.definition ? input.session.get(input.definition) : undefined;
-  const definition = input.definition ? input.settings.definitions.get(input.definition) : undefined;
-  const modelCandidates: Array<[string | undefined, ModelSource]> = [
-    [input.explicit.model, "explicit"],
-    [session?.model, "session"],
-    [definition?.model, "definition"],
-    [input.settings.defaults.model, "global"],
-    [input.piModel, "pi"],
-  ];
-  const thinkingCandidates: Array<[string | undefined, ThinkingSource]> = [
-    [input.explicit.thinking, "explicit"],
-    [session?.thinking, "session"],
-    [input.advisorThinking, "advisor"],
-    [definition?.thinking, "definition"],
-    [input.settings.defaults.thinking, "global"],
-  ];
-  const selectedModel = modelCandidates.find(([value]) => value !== undefined) ?? [undefined, "pi" as const];
-  const selectedThinking = thinkingCandidates.find(([value]) => value !== undefined) ?? [undefined, "pi" as const];
-  return {
-    model: selectedModel[0],
-    modelSource: selectedModel[1],
-    thinking: parseThinkingLevel(selectedThinking[0]),
-    thinkingSource: selectedThinking[1],
-  };
+  const project = input.definition ? input.settings.definitions.get(input.definition) : undefined;
+  const fixed = [
+    [input.explicit, "explicit"],
+    [session, "session"],
+    [project, "definition"],
+  ] as const;
+  const model = fixed.find(([choice]) => choice?.model !== undefined);
+  const thinking = fixed.find(([choice]) => choice?.thinking !== undefined);
+  const fixedModel = model?.[0]?.model;
+  const fixedThinking = thinking?.[0]?.thinking;
+  if (fixedModel !== undefined && !qualifiedModel(fixedModel))
+    throw new Error("explicit runtime model needs provider/model");
+  if (fixedThinking !== undefined && !parseThinkingLevel(fixedThinking))
+    throw new Error("explicit runtime thinking is invalid");
+  const result = (candidate: DefinitionRuntimeChoice, source: ModelSource): ResolvedDefinitionRuntime => ({
+    model: fixedModel ?? candidate.model,
+    modelSource: model?.[1] ?? source,
+    thinking: parseThinkingLevel(fixedThinking ?? candidate.thinking),
+    thinkingSource: thinking?.[1] ?? source,
+  });
+  // Only a complete higher-priority pair can leave malformed authored preferences unused.
+  if (fixedModel !== undefined && fixedThinking !== undefined) {
+    const selected = result({}, "pi");
+    const reason = input.unavailable?.(selected);
+    if (reason) throw new Error(reason);
+    return selected;
+  }
+  const preferences = authoredRuntimePreferences(input.authoredPreferences);
+  for (const candidate of preferences) {
+    if (fixedModel !== undefined && candidate.model !== fixedModel) continue;
+    if (fixedThinking !== undefined && candidate.thinking !== fixedThinking) continue;
+    const selected = result(candidate, "authored");
+    if (!input.unavailable?.(selected)) return selected;
+  }
+  // Normal fallback fills only missing fields; an overridden row is never described as authored.
+  const normal = [
+    [input.settings.defaults, "global"],
+    [{ model: input.piModel, thinking: parseThinkingLevel(input.piThinking) }, "pi"],
+  ] as const;
+  let refusal: string | undefined;
+  for (const [candidate, source] of normal) {
+    const selected = result(
+      { model: candidate.model ?? input.piModel, thinking: candidate.thinking ?? parseThinkingLevel(input.piThinking) },
+      source,
+    );
+    // Attribute a field filled from the current session accurately even when another default wins.
+    if (!model && candidate.model === undefined) selected.modelSource = "pi";
+    if (!thinking && candidate.thinking === undefined) selected.thinkingSource = "pi";
+    refusal = input.unavailable?.(selected);
+    if (!refusal) return selected;
+  }
+  throw new Error(refusal ?? "no locally usable configured runtime pair");
 }