pi-delegation-policy 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.18.0 - 2026-10-08
+
+### Fixed
+
+- Restore the ContextShunt reader with `pi-subagents` `0.76.1`. The reader accepts only that build's launch contract: the packaged profile, the prompt runtime as its only extension, no inherited global context, no required child extensions, and the child's Intercom bridge off. Any other build fails closed with `reader-unavailable` before a request is sent.
+
+### Changed
+
+- Ask the main agent not to paste workflow scripts, child briefs, or other internal orchestration material into the chat. Scripts stay in private files and are launched by path. The instruction applies to normal, aggressive, and orchestrator intensities; delegation off still injects nothing.
+
+### Compatibility and limits
+
+- Breaking for the reader: `pi-subagents` `0.69.0` no longer works with it and returns `reader-unavailable`. Upgrade the external executor to `0.76.1`. The extension's Pi minimum, `0.87.1`, is unchanged.
+- Verified only on Pi `1.1.0` with `pi-subagents` `0.76.1`, in an offline loopback harness with a synthetic provider. Pi `0.87.1` is not verified for the reader, and no real provider was used.
+- A child that loads a permission extension is rejected, so the reader returns `reader-unavailable`. This path was not exercised with pi-subagents permission rules.
+
 ## 0.17.0 - 2026-10-07
 
 ### Added

package/README.md

@@ -5,7 +5,7 @@ models to use for Small, Medium, Large, and the optional Visual Design and Advis
 subagent runner: it never routes, supervises, or collects the results of delegated work.
 
 > **Docs:** [yivas.github.io/pi-delegation-policy](https://yivas.github.io/pi-delegation-policy/).
-> Version **0.17.0** requires Pi `0.87.1` or later (`>=0.87.1`); it re-applies its marked policy block in the final provider payload.
+> Version **0.18.0** requires Pi `0.87.1` or later (`>=0.87.1`); it re-applies its marked policy block in the final provider payload.
 > Version `0.14.1` supports Pi `0.84.3` or later (`>=0.84.3`).
 >
 > Independent Advisor mode and its companion file are available from version `0.17.0`.
@@ -14,7 +14,7 @@ subagent runner: it never routes, supervises, or collects the results of delegat
 ## Install
 
 ```bash
-pi install npm:pi-delegation-policy@0.17.0
+pi install npm:pi-delegation-policy@0.18.0
 # restart Pi, or run /reload
 ```
 
@@ -163,8 +163,10 @@ one bounded line or byte range. Errors, structured results, images, binaries, mi
 unknown tool contracts stay unchanged, and nothing is launched from a hook. The reader keys
 `readerEnabled`, `readerRole`, and `answerMaxBytes` control the optional
 `context_shunt_delegate`/`context_shunt_recover` pair, which needs `enforce`, an active delegation
-intensity, a valid configuration, and a compatible external executor (protocol `0.69.0` is the
-verified one). Delegation `off` suspends the layer.
+intensity, a valid configuration, and a compatible external executor. The only verified executor is
+`pi-subagents` `0.76.1` on Pi `1.1.0`; Pi `0.87.1`, the declared minimum, is not verified for the
+reader. Other executor builds, including `0.69.0`, fail closed with `reader-unavailable`. Delegation
+`off` suspends the layer.
 
 The [limits and privacy reference](https://yivas.github.io/pi-delegation-policy/limits-and-privacy/)
 states the caps, the answer contract, and what one request sends.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Scope
 
-This project is a local Pi extension. It stores delegation policy data, model identifiers, and any configured per-role thinking policy in global defaults and session entries; it does not store the thinking level chosen for an individual run. ContextShunt is off by default. When explicitly enforced, it may keep a known successful text result in a private, session-only temporary file to serve bounded recovery; the file has an opaque ID, quota, cancellation check, and an absolute 30-minute TTL from creation. Cleanup is scheduled while the process is active and runs at shutdown, but crashes or OS suspension can delay deletion. It does not store credentials and makes no network request of its own; when one of its explicit tools asks an external executor to answer a bounded question, that executor performs the call.
+This project is a local Pi extension. It stores delegation policy data, model identifiers, and any configured per-role thinking policy in global defaults and session entries; it does not store the thinking level chosen for an individual run. ContextShunt is off by default. When explicitly enforced, it may keep a known successful text result in a private, session-only temporary file to serve bounded recovery; the file has an opaque ID, quota, cancellation check, and an absolute 30-minute TTL from creation. Cleanup is scheduled while the process is active and runs at shutdown, but crashes or OS suspension can delay deletion. It does not store credentials and makes no network request of its own; when one of its explicit tools asks an external executor to answer a bounded question, that executor performs the call. The reader accepts only the verified `pi-subagents` 0.76.1 launch contract; any other build fails closed before a request is sent.
 
 ContextShunt is not a sandbox or a worker bridge. It preserves permissions and backends, does not inspect files before tool authorization, and leaves errors, structured/mixed results, images, binaries, invalid inputs, and unknown contracts unchanged. One-time exceptions are user-authorized, short-lived, bound to one call and immutable input snapshot, and capped by declared lines plus real returned UTF-8 bytes. The policy guides the main agent. It cannot guarantee that another system will follow a configured role or thinking choice. Review local configuration before using it.
 
@@ -20,4 +20,4 @@ Include the affected version or commit, operating system, Pi version, reproducti
 
 ## Supported versions
 
-Only the latest published version is supported. Version `0.17.0` requires Pi `0.87.1` or later; version `0.14.1` requires Pi `0.84.3` or later.
+Only the latest published version is supported. Version `0.18.0` requires Pi `0.87.1` or later; version `0.14.1` requires Pi `0.84.3` or later.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-delegation-policy",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "private": false,
   "description": "A Pi extension for configurable delegation intensity and exact subagent role model references.",
   "type": "module",

package/src/agent-launch.ts

@@ -5,7 +5,7 @@ export const LAUNCH_PREFLIGHT_TIMEOUT_MS = 5_000;
 export const LAUNCH_TERMINAL_TIMEOUT_MS = 120_000;
 
 const PACKAGE_NAME = "pi-delegation-policy";
-/** `pi-subagents` 0.69.0 `src/api/preflight.ts` and `src/shared/launch-contract.ts`. */
+/** `pi-subagents` 0.76.1 `src/api/preflight.ts` and `src/shared/launch-contract.ts`. */
 const LAUNCH_CONTRACT_VERSION = 3;
 const DEFINITION_PROJECTION_VERSION = 2;
 const SHA256_LOWER_HEX = /^[0-9a-f]{64}$/;
@@ -48,6 +48,11 @@ export type AgentLaunchPreflight = (input: unknown) => Promise<unknown>;
 
 export type AgentLaunchModules = Readonly<{
   resolveSubagentLaunchContract: AgentLaunchPreflight;
+  /**
+   * Runtime extension paths that `pi-subagents` gives a profile with no tools and no extensions.
+   * The contract must report exactly these, so a relabeled or added extension fails closed.
+   */
+  profileRuntimeExtensions: () => readonly string[];
   requestEvent: string;
   startedEvent: string;
   responseEvent: string;
@@ -165,16 +170,24 @@ export function createDefaultAgentLaunchLoader(
   loadModule: DynamicModuleLoader = (specifier) => import(specifier),
 ): () => Promise<AgentLaunchModules | undefined> {
   return () =>
-    Promise.all([loadModule("pi-subagents/preflight"), loadModule("pi-subagents/delegation")])
-      .then(([preflight, delegation]) => {
-        if (!isRecord(preflight) || !isRecord(delegation)) return undefined;
+    Promise.all([
+      loadModule("pi-subagents/preflight"),
+      loadModule("pi-subagents/delegation"),
+      loadModule("pi-subagents/child-tool-plan"),
+    ])
+      .then(([preflight, delegation, childToolPlan]) => {
+        if (!isRecord(preflight) || !isRecord(delegation) || !isRecord(childToolPlan)) {
+          return undefined;
+        }
         const resolveLaunchContract = preflight.resolveSubagentLaunchContract;
+        const resolvePiLaunchToolPlan = childToolPlan.resolvePiLaunchToolPlan;
         const requestEvent = delegation.SUBAGENT_DELEGATION_REQUEST_EVENT;
         const startedEvent = delegation.SUBAGENT_DELEGATION_STARTED_EVENT;
         const responseEvent = delegation.SUBAGENT_DELEGATION_RESPONSE_EVENT;
         const cancelEvent = delegation.SUBAGENT_DELEGATION_CANCEL_EVENT;
         if (
           typeof resolveLaunchContract !== "function" ||
+          typeof resolvePiLaunchToolPlan !== "function" ||
           requestEvent !== DELEGATION_EVENTS.request ||
           startedEvent !== DELEGATION_EVENTS.started ||
           responseEvent !== DELEGATION_EVENTS.response ||
@@ -184,8 +197,18 @@ export function createDefaultAgentLaunchLoader(
         }
         const resolveSubagentLaunchContract: AgentLaunchPreflight = async (input) =>
           resolveLaunchContract(input);
+        // The same public resolver the child launch uses, given the profile's own inputs. Its
+        // runtime list depends only on the installed package unless permissions, fast mode or
+        // fanout are requested, and the profile requests none of them.
+        const profileRuntimeExtensions = (): readonly string[] =>
+          resolvePiLaunchToolPlan({
+            tools: [],
+            extensions: [],
+            structuredOutput: true,
+          }).runtimeExtensions;
         return {
           resolveSubagentLaunchContract,
+          profileRuntimeExtensions,
           requestEvent,
           startedEvent,
           responseEvent,
@@ -216,6 +239,7 @@ function createPreflightInput<Request extends AgentLaunchRequest, Value>(
     ...(definition.result.variant === "structured"
       ? { outputSchema: definition.result.buildSchema(request) }
       : {}),
+    intercomBridge: { mode: "off" },
     skill: false,
     runId: requestId,
   };
@@ -226,6 +250,7 @@ function validateLaunchContract<Request extends AgentLaunchRequest, Value>(
   request: Request,
   active: Pick<ActiveRun<Value>, "requestId" | "host">,
   definition: AgentLaunchDefinition<Request, Value>,
+  modules: AgentLaunchModules,
 ): value is AgentLaunchContract {
   try {
     if (!isRecord(value) || value.ok !== true || !isRecord(value.contract)) return false;
@@ -267,8 +292,12 @@ function validateLaunchContract<Request extends AgentLaunchRequest, Value>(
       contract.model !== resolvedModel ||
       contract.thinking !== request.model.thinking ||
       contract.systemPromptMode !== "replace" ||
+      contract.inheritGlobalContext !== false ||
       contract.inheritProjectContext !== false ||
-      contract.inheritSkills !== false
+      contract.inheritSkills !== false ||
+      !isRecord(contract.intercomBridge) ||
+      contract.intercomBridge.active !== false ||
+      contract.intercomBridge.mode !== "off"
     )
       return false;
 
@@ -292,6 +321,7 @@ function validateLaunchContract<Request extends AgentLaunchRequest, Value>(
       !exactStrings(contract.tools.effectiveMcpTools, []) ||
       !exactStrings(contract.tools.toolExtensionPaths, []) ||
       !exactStrings(contract.tools.configuredExtensions, []) ||
+      !exactStrings(contract.tools.requiredExtensionIds, []) ||
       contract.tools.disableAmbientExtensions !== true ||
       contract.tools.fanoutAuthorized !== false ||
       "capabilityCeiling" in contract.tools ||
@@ -301,7 +331,8 @@ function validateLaunchContract<Request extends AgentLaunchRequest, Value>(
       !contract.tools.runtimeExtensions.every(
         (extension) => typeof extension === "string" && extension.length > 0,
       ) ||
-      !exactStrings(contract.tools.extensionArgs, contract.tools.runtimeExtensions)
+      !exactStrings(contract.tools.runtimeExtensions, modules.profileRuntimeExtensions()) ||
+      !exactStrings(contract.tools.extensionArgs, modules.profileRuntimeExtensions())
     )
       return false;
 
@@ -348,6 +379,7 @@ function requestPayload<Request extends AgentLaunchRequest, Value>(
     thinking: request.model.thinking,
     timeoutMs: LAUNCH_TERMINAL_TIMEOUT_MS,
     artifacts: false,
+    intercomBridge: { mode: "off" },
     skill: false,
     result:
       definition.result.variant === "structured"
@@ -492,7 +524,7 @@ export class AgentLaunch<Request extends AgentLaunchRequest, Value> {
       resolved = undefined;
     }
     if (!this.isLive(active)) return;
-    if (!validateLaunchContract(resolved, request, active, this.definition)) {
+    if (!validateLaunchContract(resolved, request, active, this.definition, modules)) {
       active.settle({ kind: "unavailable" });
       return;
     }

package/src/context-shunt-executor.ts

@@ -19,7 +19,7 @@ import type { SourceSnapshot } from "./context-shunt.ts";
 import type { ReaderAnswer, ReaderThinking } from "./context-shunt-reader.ts";
 
 export const CONTEXT_SHUNT_READER_AGENT_NAME = "pi-delegation-policy.context-shunt-inline-reader";
-export const CONTEXT_SHUNT_READER_PROTOCOL_VERSION = "0.69.0";
+export const CONTEXT_SHUNT_READER_PROTOCOL_VERSION = "0.76.1";
 export const READER_PREFLIGHT_TIMEOUT_MS = LAUNCH_PREFLIGHT_TIMEOUT_MS;
 export const READER_TERMINAL_TIMEOUT_MS = LAUNCH_TERMINAL_TIMEOUT_MS;
 

package/src/prompt.ts

@@ -44,6 +44,9 @@ const LEGACY_OWNERSHIP_POLICY =
 const ORCHESTRATOR_OWNERSHIP_POLICY =
   "In orchestrator, keep global strategy, objectives, critical decisions, coordination, safety, evidence evaluation, final acceptance, and concise synthesis with the main agent. The main agent MUST delegate transferable detailed review and integration mechanics; final responsibility does not permit personal execution except under the named direct-work exceptions.";
 
+const WORKFLOW_DISCLOSURE_POLICY =
+  "Orchestration scripts, workflow code, and child briefs are internal working material, not deliverables for the user. Do not paste or send their source code into the chat. Launch a script by the path of its private file, which the host manages, and report only the results, blockers, and decisions the user needs. Keep any control or visibility the host requires. When the user explicitly asks to inspect code, show what was requested.";
+
 const VISUAL_DESIGN_POLICY = `Visual Design is an optional specialist role. It is optional to configure. Before selecting an ordinary role for each task or phase, evaluate whether Visual Design is configured and all four conditions hold:
 1. the primary acceptance criterion is a visual or user-experience result;
 2. product behavior and data contracts are already defined and remain unchanged;
@@ -292,6 +295,9 @@ ${ROLE_SELECTION_POLICY}
 Ownership and retention:
 ${ownershipPolicy}
 
+Workflow disclosure:
+${WORKFLOW_DISCLOSURE_POLICY}
+
 Enabled ordinary roles: ${enabled.map(roleName).join(", ")}.${disabled.length ? `\nDisabled ordinary roles: ${disabled.map(roleName).join(", ")}.` : ""}
 
 Model preference: ${effective.preference}. ${preferenceGuidance(effective.preference, enabled)}