pi-legion 2.0.3 → 3.0.0

package/src/extension/timing.ts

@@ -0,0 +1,391 @@
+/**
+ * Subagent timing slash command (`/legion timing`).
+ *
+ * Reuses summary.ts duration resolution + session parse (via aggregateSubagentRuns
+ * / parseSessionFile). Zero schema change — wall from spawnedAt/retiredAt|now,
+ * generation from ParsedSession.generationMs, other = max(0, wall − gen).
+ */
+
+import * as path from "node:path";
+import type {
+	ExtensionAPI,
+	ExtensionCommandContext,
+} from "@earendil-works/pi-coding-agent";
+import { parseSessionFile } from "../shared/session.ts";
+import type { ChildRecord, RunRecord, TaskState } from "../shared/types.ts";
+import {
+	RunStore,
+	pickChildByName,
+} from "../runs/store.ts";
+import { sendSlashText, type LegionSubcommand } from "./slash.ts";
+import {
+	aggregateSubagentRuns,
+	formatDuration,
+	type SummaryChild,
+	type SummarySession,
+	type SubagentSummary,
+} from "./summary.ts";
+import { breakdown } from "../shared/timing-breakdown.ts";
+
+export { breakdown } from "../shared/timing-breakdown.ts";
+
+const TIMING_USAGE = "Usage: /legion timing [--json] [<name>]";
+
+export interface TimingChild {
+	name: string;
+	role: string;
+	state: TaskState;
+	/** Still in a running lifecycle state (working/blocked/awaiting). */
+	live: boolean;
+	wall_ms: number;
+	/** Session-derived model generation wall; null when no turn data. */
+	generation_ms: number | null;
+	/** max(0, wall − gen); null when generation_ms unavailable. Coarse bucket. */
+	other_ms: number | null;
+	turns: number | null;
+	startedAtMs: number | null;
+	endedAtMs: number | null;
+	/** True when wall_ms tracks the live clock (retiredAt absent + running). */
+	liveWall: boolean;
+}
+
+export interface TimingReport {
+	children: TimingChild[];
+	/** Earliest spawn → latest end across children with known endpoints. */
+	span_ms: number | null;
+	sum_wall_ms: number;
+	cwd?: string;
+}
+
+export interface TimingFormatOptions {
+	cwd?: string;
+	json?: boolean;
+}
+
+function sessionHasTurns(
+	session: SummarySession | undefined,
+): session is SummarySession {
+	return Boolean(session && session.turns.length > 0);
+}
+
+/** Map one SummaryChild (already duration-resolved) into a timing row. */
+export function timingChildFromSummary(child: SummaryChild): TimingChild {
+	const generation_ms = sessionHasTurns(child.session)
+		? child.session.generationMs
+		: null;
+	const parts = breakdown(child.durationMs, generation_ms);
+	return {
+		name: child.child.name,
+		role: child.role,
+		state: child.child.state,
+		live: child.running,
+		wall_ms: parts.wall_ms,
+		generation_ms: parts.generation_ms,
+		other_ms: parts.other_ms,
+		turns: child.turns,
+		startedAtMs: child.startedAtMs,
+		endedAtMs: child.endedAtMs,
+		liveWall: child.liveDuration,
+	};
+}
+
+/**
+ * Build a timing report from the same aggregation path as `/legion summary`.
+ * Children are sorted by startedAt (unknowns last), then name.
+ */
+export function buildTimingReport(
+	summary: SubagentSummary,
+	options: { cwd?: string } = {},
+): TimingReport {
+	const children: TimingChild[] = [];
+	for (const group of summary.groups) {
+		for (const child of group.children) {
+			children.push(timingChildFromSummary(child));
+		}
+	}
+	children.sort((a, b) => {
+		if (a.startedAtMs === null && b.startedAtMs === null) {
+			return a.name.localeCompare(b.name);
+		}
+		if (a.startedAtMs === null) return 1;
+		if (b.startedAtMs === null) return -1;
+		return a.startedAtMs - b.startedAtMs || a.name.localeCompare(b.name);
+	});
+
+	const started = children
+		.map((c) => c.startedAtMs)
+		.filter((v): v is number => v !== null);
+	const ended = children
+		.map((c) => c.endedAtMs)
+		.filter((v): v is number => v !== null);
+	const span_ms =
+		started.length > 0 && ended.length > 0
+			? Math.max(0, Math.max(...ended) - Math.min(...started))
+			: null;
+	const sum_wall_ms = children.reduce((sum, c) => sum + c.wall_ms, 0);
+
+	return {
+		children,
+		span_ms,
+		sum_wall_ms,
+		...(options.cwd
+			? { cwd: options.cwd }
+			: summary.cwd
+				? { cwd: summary.cwd }
+				: {}),
+	};
+}
+
+function formatMsCell(
+	ms: number | null,
+	opts: { live?: boolean } = {},
+): string {
+	if (ms === null) return "—";
+	const rendered = formatDuration(ms);
+	return opts.live ? `${rendered}+` : rendered;
+}
+
+function formatOptionalMs(ms: number | null): string {
+	return ms === null ? "—" : formatDuration(ms);
+}
+
+function formatTurns(turns: number | null): string {
+	return turns === null ? "—" : String(turns);
+}
+
+/** Human table for all children + optional concurrency footer. */
+export function formatTimingTable(
+	report: TimingReport,
+	options: TimingFormatOptions = {},
+): string {
+	if (report.children.length === 0) {
+		const cwd = options.cwd ?? report.cwd ?? process.cwd();
+		return `No subagent runs under ${cwd}.\nLaunch children with the subagent tool to see timing here.`;
+	}
+
+	const lines = [
+		`Subagent timing — ${report.children.length} children`,
+		"",
+		"| name | state | wall | gen | other | turns |",
+		"|---|---|---|---|---|---|",
+	];
+	for (const child of report.children) {
+		const wall =
+			child.startedAtMs === null
+				? "—"
+				: formatMsCell(child.wall_ms, { live: child.liveWall });
+		lines.push(
+			`| ${child.name} | ${child.state} | ${wall} | ${formatOptionalMs(child.generation_ms)} | ${formatOptionalMs(child.other_ms)} | ${formatTurns(child.turns)} |`,
+		);
+	}
+
+	if (report.span_ms !== null && report.children.length > 0) {
+		const ratio =
+			report.span_ms > 0
+				? (report.sum_wall_ms / report.span_ms).toFixed(2)
+				: "—";
+		lines.push(
+			"",
+			`span ${formatDuration(report.span_ms)} · sum wall ${formatDuration(report.sum_wall_ms)} · concurrency ~${ratio}×`,
+		);
+	}
+	return lines.join("\n");
+}
+
+/** Single-child detail (same口径 as summary detail, timing-focused). */
+export function formatTimingDetail(child: TimingChild, run: RunRecord): string {
+	const title = `${child.name} — ${child.role}`;
+	const lines = [
+		title,
+		`  state: ${child.state}${child.live ? " (live)" : ""}`,
+		`  run: ${run.runId}`,
+	];
+	const wall =
+		child.startedAtMs === null
+			? "—"
+			: formatMsCell(child.wall_ms, { live: child.liveWall });
+	lines.push(`  wall: ${wall}`);
+	lines.push(`  generation: ${formatOptionalMs(child.generation_ms)}`);
+	lines.push(
+		`  other: ${formatOptionalMs(child.other_ms)} (wall − gen; not precise wait/tool)`,
+	);
+	lines.push(`  turns: ${formatTurns(child.turns)}`);
+	return lines.join("\n");
+}
+
+function childToJson(child: TimingChild): Record<string, unknown> {
+	return {
+		name: child.name,
+		role: child.role,
+		state: child.state,
+		live: child.live,
+		wall_ms: child.wall_ms,
+		generation_ms: child.generation_ms,
+		other_ms: child.other_ms,
+		turns: child.turns,
+	};
+}
+
+export function formatTimingJson(
+	report: TimingReport,
+	detail?: { child: TimingChild; run: RunRecord },
+): string {
+	if (detail) {
+		return JSON.stringify(
+			{
+				...childToJson(detail.child),
+				runId: detail.run.runId,
+			},
+			null,
+			2,
+		);
+	}
+	return JSON.stringify(
+		{
+			children: report.children.map(childToJson),
+			span_ms: report.span_ms,
+			sum_wall_ms: report.sum_wall_ms,
+			...(report.span_ms !== null && report.span_ms > 0
+				? {
+						concurrency_ratio: Number(
+							(report.sum_wall_ms / report.span_ms).toFixed(4),
+						),
+					}
+				: {}),
+		},
+		null,
+		2,
+	);
+}
+
+function parseTimingArgs(
+	args: string,
+):
+	| { ok: true; json: boolean; name?: string }
+	| { ok: false; message: string } {
+	const tokens = args.trim().split(/\s+/).filter(Boolean);
+	let json = false;
+	let name: string | undefined;
+	for (const token of tokens) {
+		if (token === "--json") {
+			if (json) return { ok: false, message: TIMING_USAGE };
+			json = true;
+			continue;
+		}
+		if (token.startsWith("-")) return { ok: false, message: TIMING_USAGE };
+		if (name !== undefined) return { ok: false, message: TIMING_USAGE };
+		name = token;
+	}
+	return { ok: true, json, ...(name ? { name } : {}) };
+}
+
+function sessionMapFor(runs: readonly RunRecord[]): Map<string, SummarySession> {
+	const sessions = new Map<string, SummarySession>();
+	for (const run of runs) {
+		for (const child of run.children) {
+			if (child.sessionFile) {
+				sessions.set(child.sessionFile, parseSessionFile(child.sessionFile));
+			}
+		}
+	}
+	return sessions;
+}
+
+function timingCompletions(
+	prefix: string,
+	cwd: string,
+): Array<{ value: string; label: string }> | null {
+	const trimmed = prefix.trimStart();
+	if (trimmed.startsWith("--") && !trimmed.includes(" ")) {
+		return "--json".startsWith(trimmed)
+			? [{ value: "--json", label: "--json" }]
+			: [];
+	}
+	const json = /^--json\s+/.test(trimmed);
+	const namePrefix = json ? trimmed.replace(/^--json\s+/, "") : prefix.trim();
+	if (namePrefix.includes(" ")) return null;
+	const store = new RunStore({ rootDir: path.join(cwd, ".pi-subagents") });
+	const names = new Set<string>();
+	for (const run of store.listRuns()) {
+		for (const child of run.children) names.add(child.name);
+	}
+	return [...names]
+		.filter((name) => name.startsWith(namePrefix))
+		.sort((a, b) => a.localeCompare(b))
+		.map((name) => ({
+			value: json ? `--json ${name}` : name,
+			label: name,
+		}));
+}
+
+function notifyUnknownChild(
+	ctx: ExtensionCommandContext,
+	name: string,
+): void {
+	ctx.ui.notify(
+		`unknown child: ${name} (no run under ${ctx.cwd}/.pi-subagents). Child records are scoped to the cwd they were launched from — pass the same cwd used for launch.`,
+		"error",
+	);
+}
+
+function findTimingChild(
+	report: TimingReport,
+	summary: SubagentSummary,
+	name: string,
+): { timing: TimingChild; run: RunRecord; child: ChildRecord } | null {
+	const picked = pickChildByName(summary.runs, name);
+	if (!picked) return null;
+	const timing = report.children.find((c) => c.name === picked.child.name);
+	if (!timing) return null;
+	return { timing, run: picked.run, child: picked.child };
+}
+
+/** Build the `/legion timing [--json] [<name>]` handler. */
+export function createTimingCommand(pi: ExtensionAPI): LegionSubcommand {
+	let completionCwd = process.cwd();
+	return {
+		description: "Show wall / generation / other timing for subagent children",
+		getArgumentCompletions: (prefix) => timingCompletions(prefix, completionCwd),
+		handler: async (args, ctx) => {
+			completionCwd = ctx.cwd;
+			const parsed = parseTimingArgs(args);
+			if (parsed.ok === false) {
+				ctx.ui.notify(parsed.message, "error");
+				return;
+			}
+			const store = new RunStore({
+				rootDir: path.join(ctx.cwd, ".pi-subagents"),
+			});
+			const runs = store.listRuns();
+			const sessions = sessionMapFor(runs);
+			const now = Date.now();
+			const summary = aggregateSubagentRuns(runs, { now, sessions });
+			const report = buildTimingReport(summary, { cwd: ctx.cwd });
+
+			if (parsed.name) {
+				const found = findTimingChild(report, summary, parsed.name);
+				if (!found) {
+					notifyUnknownChild(ctx, parsed.name);
+					return;
+				}
+				sendSlashText(
+					pi,
+					parsed.json
+						? formatTimingJson(report, {
+								child: found.timing,
+								run: found.run,
+							})
+						: formatTimingDetail(found.timing, found.run),
+				);
+				return;
+			}
+
+			sendSlashText(
+				pi,
+				parsed.json
+					? formatTimingJson(report)
+					: formatTimingTable(report, { cwd: ctx.cwd }),
+			);
+		},
+	};
+}

package/src/runs/args.ts

@@ -97,6 +97,12 @@ export interface BuildArgsInput {
 	 * the child Pi process so the session records it as the first user turn.
 	 */
 	includeTask?: boolean;
+	/**
+	 * When true, append `--approve` so headless pi trusts the project cwd for
+	 * settings / resources / extension discovery (#193). Default false: omit
+	 * the flag (v1 never emits `--no-approve`).
+	 */
+	approve?: boolean;
 }
 
 export interface BuildArgsResult {
@@ -123,6 +129,8 @@ export function buildPiArgs(input: BuildArgsInput): BuildArgsResult {
 	pushSkillArgs(args, input.agent);
 	pushSystemPromptArgs(args, tempFiles, input);
 	if (input.includeTask !== false) pushTaskArg(args, tempFiles, input);
+	// Opt-in project trust for headless rpc (#193). Never emit --no-approve in v1.
+	if (input.approve === true) args.push("--approve");
 
 	return { args, tempFiles };
 }

package/src/runs/orchestrator.ts

@@ -12,13 +12,13 @@ import * as path from "node:path";
 import { modelCandidates } from "../agents/model-resolution.ts";
 import { DEFAULT_TEAM, TEAM_ENV, type ActiveTeam } from "../agents/teams.ts";
 import type { LegionSettings } from "../shared/types.ts";
-import { LEGION_DB_ENV, LEGION_IDENTITY_ENV_KEYS, LEGION_NODE_ID_ENV, legionIdentityEnv } from "./args.ts";
+import { LEGION_IDENTITY_ENV_KEYS, legionIdentityEnv } from "./args.ts";
 import type { DatabaseSync } from "../legion/db.ts";
 import type { RunStore } from "./store.ts";
 import type { LegionEventBus, LegionProcessEventType } from "../extension/event-bus.ts";
 import { appendEvent } from "../legion/events.ts";
 import { withLaunchBudget, type LegionBudgetLimits } from "../legion/budget.ts";
-import { getChildByName, getNode, insertNode, nodeIdForChild, sanitizeNodeSlug, type LegionNode, updateNode, LIVE_CHILD_STATUSES } from "../legion/nodes.ts";
+import { getChildByName, getNode, insertNode, nodeIdForChild, sanitizeNodeSlug, type LegionNode, updateNode } from "../legion/nodes.ts";
 import { upsertUsage } from "../legion/usage.ts";
 import { evaluatePhaseTransition, isLegionPhase, isTerminalPhase } from "../legion/state-machine.ts";
 import { CHILD_ACCEPTANCE_ROLE_ENV, CHILD_ROLE_ENV } from "../extension/child-guard.ts";
@@ -54,11 +54,13 @@ import {
 	type NestedPathEntry,
 	type RetireOptions,
 	type RunRecord,
+	type SpawnMode,
 	SubagentError,
 	type Usage,
 } from "../shared/types.ts";
 import { RpcSupervisor } from "../supervisor/rpc-supervisor.ts";
 import type { LegionSupervisor, SettleResult, SpawnInput } from "../supervisor/types.ts";
+import { isInProcessSpawn, resolveSpawnMode } from "../supervisor/spawn-mode.ts";
 import type { PendingUIRequest, UIProxy } from "../supervisor/ui-proxy.ts";
 import { nativeModelFor } from "./kind.ts";
 import { applyVerification, type VerifyRunner } from "./acceptance.ts";
@@ -107,6 +109,11 @@ export interface OrchestratorDeps {
 	worktreeBootstrapTimeoutMs?: number;
 	team?: ActiveTeam;
 	childContext?: string;
+	/**
+	 * When true, RPC child argv includes `--approve` (`subagents.rpc.approve`).
+	 * Default false / omitted.
+	 */
+	rpcApprove?: boolean;
 	onBudgetRefused?: (event: BudgetRefusedEvent) => void;
 }
 
@@ -132,9 +139,20 @@ const CHILD_ENV = "PI_SUBAGENT_CHILD";
 const POLL_INTERVAL_MS = 500;
 
 function parseDepthCeiling(raw: string | undefined): number | undefined {
-	if (raw === undefined || !/^\d+$/.test(raw.trim())) return undefined;
-	const value = Number(raw.trim());
-	return Number.isInteger(value) && value >= 0 ? value : undefined;
+	// Genuinely unset / blank → no env ceiling (settings + hard cap still apply).
+	if (raw === undefined) return undefined;
+	const t = raw.trim();
+	if (t === "") return undefined;
+	// #173: illegal values fail closed to leaf-only (0), matching contract :361 —
+	// never widen to the hard cap via `undefined` → +Infinity.
+	if (!/^\d+$/.test(t)) {
+		console.error(
+			`[pi-legion] ${MAX_DEPTH_ENV}=${JSON.stringify(t)} is not a non-negative integer; treating as 0 (leaf only).`,
+		);
+		return 0;
+	}
+	const value = Number(t);
+	return Number.isInteger(value) && value >= 0 ? value : 0;
 }
 
 /** Root/process ceiling: inherited env, settings, and the saturated path cap. */
@@ -234,6 +252,7 @@ export class Orchestrator {
 	private readonly worktreeBootstrapTimeoutMs?: number;
 	private readonly team?: ActiveTeam;
 	private readonly childContext?: string;
+	private readonly rpcApprove: boolean;
 	private readonly onBudgetRefused?: (event: BudgetRefusedEvent) => void;
 	private readonly legion?: OrchestratorLegionContext;
 	private readonly requestedDepthCap?: number;
@@ -267,6 +286,7 @@ export class Orchestrator {
 		this.worktreeBootstrapTimeoutMs = deps.worktreeBootstrapTimeoutMs;
 		this.team = deps.team;
 		this.childContext = deps.childContext?.trim() || undefined;
+		this.rpcApprove = deps.rpcApprove === true;
 		this.onBudgetRefused = deps.onBudgetRefused;
 		this.legion = deps.legion;
 	}
@@ -341,11 +361,24 @@ export class Orchestrator {
 		const depthCeiling = input.utility
 			? parent.depth + 1
 			: Math.min(legion.settings?.maxDepth ?? this.maxDepthValue, MAX_NESTED_PATH_ENTRIES);
-		const liveStatuses = LIVE_CHILD_STATUSES.map(() => "?").join(", ");
-		const childCount = Number(legion.db.prepare(`SELECT COUNT(*) AS count FROM nodes WHERE parent_id = ? AND status IN (${liveStatuses})`).get(legion.nodeId, ...LIVE_CHILD_STATUSES)?.count ?? 0);
-		const maxChildren = previous ? Math.max(legion.settings?.maxChildrenPerNode ?? 8, childCount + 1) : legion.settings?.maxChildrenPerNode;
+		// Resume must NOT inflate maxChildrenPerNode (#180). Retired nodes free
+		// slots (#142); turning one live again re-charges the fanout cap — same
+		// gate as a fresh launch. activeReservation below still covers the node's
+		// own maxActiveNodes slot when it is already starting/running.
+		const maxChildren = legion.settings?.maxChildrenPerNode ?? 8;
 		const activeReservation = previous && (previous.status === "starting" || previous.status === "running") ? 1 : 0;
-		const limits: LegionBudgetLimits = { maxDepth: depthCeiling, maxChildrenPerNode: maxChildren, maxActiveNodes: (legion.settings?.maxActiveNodes ?? 30) + activeReservation };
+		// In-process children use subagents.inprocess.* only — do not spend RPC legion.* slots (#197).
+		const limits: LegionBudgetLimits = isInProcessSpawn(input.agent)
+			? {
+					maxDepth: MAX_NESTED_PATH_ENTRIES,
+					maxChildrenPerNode: Number.MAX_SAFE_INTEGER,
+					maxActiveNodes: Number.MAX_SAFE_INTEGER,
+			  }
+			: {
+					maxDepth: depthCeiling,
+					maxChildrenPerNode: maxChildren,
+					maxActiveNodes: (legion.settings?.maxActiveNodes ?? 30) + activeReservation,
+			  };
 		const gate = withLaunchBudget(legion.db, { parentId: legion.nodeId, depth: parent.depth + 1, nodeId: input.nodeId }, () => {
 			if (previous) {
 				updateNode(legion.db, input.nodeId, { status: "starting", sessionFile: input.sessionFile, worktreePath: input.worktreePath ?? previous.worktreePath, model: input.model ?? previous.model, team: team && team !== DEFAULT_TEAM ? team : previous.team }, this.now);
@@ -520,10 +553,6 @@ export class Orchestrator {
 		const ledgerPrevious = nodeId ? getNode(this.legion!.db, nodeId) : null;
 		const previous = this.children.get(name) ?? (ledgerPrevious ? this.childFromNode(name, ledgerPrevious) : undefined);
 		if (previous && !this.children.has(name)) this.children.set(name, previous);
-		// A utility dispatch is a hard leaf, not a nested command-chain launch.
-		// The frozen contract therefore skips assertWithinBudgets entirely.
-		if (!input.utilityDispatch) this.assertWithinBudgets(Boolean(previous));
-		if (this.supervisor.isAlive(name)) throw new SubagentError(`child is already alive: ${name}`, ErrorCodes.NAME_TAKEN);
 		const models = this.planModelCandidates({
 			agent: input.agent,
 			...(input.model !== undefined ? { model: input.model } : {}),
@@ -542,6 +571,53 @@ export class Orchestrator {
 					launch: input.worktree,
 					parentInWorktree: isInsideChildWorktree(this.cwd),
 				});
+		// Spawn-mode arbitration (contract D2). `resolveSpawnMode` only reports the
+		// configured intent; the launch context decides whether an OMITTED mode can
+		// actually run in-process. An omitted mode falls back to rpc when this
+		// launch needs worktree isolation (a hard requirement of the in-process
+		// backend). An explicit value is never downgraded (invariant I6) — a bad
+		// explicit combination still throws below.
+		// `kind !== "pi"` is NOT re-tested here: the early guard above (before this
+		// arbitration) already refuses it, so such a clause would be dead code.
+		const explicitMode = input.agent.spawnMode !== undefined;
+		const mode: SpawnMode =
+			!explicitMode && worktree === true
+				? "rpc"
+				: resolveSpawnMode(input.agent);
+		const inProcess = mode === "inprocess";
+		// Downstream must see the arbitrated result, otherwise RoutingSupervisor
+		// re-resolves the omitted field to `inprocess` on its own and throws
+		// "cannot combine with worktree: true" — the arbitration would be moot.
+		// `worktree` is normalized too: a role card that pins `worktree: true`
+		// (e.g. `agents/worker.md`) keeps that raw value even when THIS launch
+		// resolved to no isolation (`parentRole === "centurion"`, an explicit
+		// `launch({ worktree: false })`, or the nested-worktree suppression), and
+		// leaking it makes `{spawnMode:"inprocess", worktree:true}` reach
+		// routing-supervisor.ts:79 / inprocess-supervisor.ts:342, which reject it
+		// with INVALID_PARAMS. That shape is exactly the "centurion dispatches
+		// worker" production path, so it must be normalized to `worktree: false`.
+		// The `&& worktree` short-circuit keeps the rpc path returning the
+		// original object (invariant I3: zero diff on the RPC backend).
+		// reserveNode() and SpawnInput.agent below both receive this clone.
+		const agent: AgentConfig = mode === input.agent.spawnMode && worktree
+			? input.agent
+			: { ...input.agent, spawnMode: mode, ...(worktree ? {} : { worktree: false }) };
+		// A utility dispatch is a hard leaf, not a nested command-chain launch.
+		// In-process children use subagents.inprocess.* budgets (never RPC keys).
+		if (!input.utilityDispatch && !inProcess) this.assertWithinBudgets(Boolean(previous));
+		if (this.supervisor.isAlive(name)) throw new SubagentError(`child is already alive: ${name}`, ErrorCodes.NAME_TAKEN);
+		// Only an EXPLICIT inprocess can reach this: the arbitration above already
+		// routed every omitted-mode launch that needs a worktree to rpc, so I1
+		// (explicit inprocess + worktree stays a loud throw) holds. This replaces
+		// the old gate, which inspected the raw `worktree` fields and therefore
+		// rejected callers that explicitly overrode a worktree role with
+		// `launch({ worktree: false })` — that override now wins as it should.
+		if (inProcess && worktree) {
+			throw new SubagentError(
+				`spawnMode "inprocess" cannot use worktree isolation for '${name}'`,
+				ErrorCodes.INVALID_PARAMS,
+			);
+		}
 		let worktreePath = previous?.worktreePath;
 		let worktreeBranch = previous?.worktreeBranch;
 		let createdWorktree = false;
@@ -588,7 +664,7 @@ export class Orchestrator {
 			preCreateSessionFile(sessionFile);
 			if (this.legion && nodeId) {
 				const reservationRunId = createdRunId ?? (previous ? ledgerPrevious?.runId : undefined) ?? this.legion.runId;
-				reservedNode = this.reserveNode({ nodeId, name, agent: input.agent, task: input.task, sessionFile, runId: reservationRunId, team: input.team, worktreePath, model: models.candidates[0], utility: Boolean(input.utilityDispatch && input.agent.utility) });
+				reservedNode = this.reserveNode({ nodeId, name, agent, task: input.task, sessionFile, runId: reservationRunId, team: input.team, worktreePath, model: models.candidates[0], utility: Boolean(input.utilityDispatch && input.agent.utility) });
 				reserved = true;
 				parentReservationCreated = await this.persistParentReservation({ nodeId, name, agent: input.agent, sessionFile, ...(models.candidates[0] ? { model: models.candidates[0] } : {}), ...(worktreePath ? { worktreePath } : {}) });
 			}
@@ -604,7 +680,7 @@ export class Orchestrator {
 				const spawnInput: SpawnInput = {
 					name,
 					task: input.task,
-					agent: input.agent,
+					agent,
 					sessionFile,
 					tempDir,
 					cwd: worktreePath ?? this.cwd,
@@ -616,6 +692,34 @@ export class Orchestrator {
 					...(input.agent.allowNestedSubagents !== undefined && !input.agent.utility ? { allowNestedSubagents: input.agent.allowNestedSubagents } : {}),
 					...(worktreeBranch ? { worktreeBranch } : {}),
 					...(this.childContext ? { childContext: this.childContext } : {}),
+					...(this.rpcApprove ? { approve: true } : {}),
+					// D5: in-process children cannot inherit lineage through env (they share
+					// the parent's process.env and would read the PARENT's identity, or none
+					// at the root). Hand the arbitrator a real identity scope instead. Only
+					// the in-process backend consumes it; RPC lineage stays on env (I3).
+					//
+					// `stripLegionIdentity` (vexillatio) must mask lineage on BOTH
+					// channels: the env keys are deleted above, so the context must not
+					// hand back the same identity through ALS. Keep the scope (so the
+					// child still knows it is not the root) but omit node/db lineage.
+					...(inProcess && this.legion
+						? {
+								childLaunchContext: {
+									...(!input.stripLegionIdentity && nodeId ? { nodeId } : {}),
+									...(input.stripLegionIdentity
+										? {}
+										: { parentNodeId: this.legion.nodeId, dbPath: this.legion.dbPath }),
+									// The nested path is lineage too: LEGION_IDENTITY_ENV_KEYS
+									// strips PI_SUBAGENT_PARENT_PATH on the rpc side, so the
+									// in-process channel must not hand it back.
+									...(input.stripLegionIdentity ? {} : { parentPath: this.childPath(name) }),
+									...(agent.acceptance?.role ? { acceptanceRole: agent.acceptance.role } : {}),
+									allowNested: input.agent.allowNestedSubagents === true && !input.agent.utility,
+									utility: Boolean(input.utilityDispatch && input.agent.utility),
+									spawnMode: "inprocess" as const,
+								},
+							}
+						: {}),
 				};
 				try {
 					result = await this.supervisor.spawnChild(spawnInput);
@@ -1128,7 +1232,12 @@ export class Orchestrator {
 		if (opts?.cause === "session-shutdown" && this.supervisor.isAlive(name)) {
 			child.execution = attributeParentSessionShutdown(child.execution ?? deriveOutcome(parsed), parsed);
 		}
-		if (this.supervisor.isAlive(name)) await this.supervisor.retire(name);
+		if (this.supervisor.isAlive(name)) {
+			await this.supervisor.retire(
+				name,
+				opts?.graceful === false ? { graceful: false } : {},
+			);
+		}
 		if (child.nodeId && this.legion) {
 			if (child.execution && child.execution.status !== "unknown" && child.execution.status !== "running") {
 				this.recordSettled(child, child.execution);

package/src/shared/output-cap.ts

@@ -11,12 +11,12 @@
 export const DEFAULT_MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
 export const MAX_OUTPUT_BYTES_ENV = "PI_LEGION_MAX_OUTPUT_BYTES";
 
-/** Resolve the per-stream cap from env; garbage / <=0 → default. */
+/** Resolve the per-stream cap from env; garbage / floored < 1 → default (#174). */
 export function resolveMaxOutputBytes(env: NodeJS.ProcessEnv = process.env): number {
 	const raw = env[MAX_OUTPUT_BYTES_ENV]?.trim();
 	if (!raw) return DEFAULT_MAX_OUTPUT_BYTES;
 	const n = Number(raw);
-	return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_MAX_OUTPUT_BYTES;
+	return Number.isFinite(n) && n >= 1 ? Math.floor(n) : DEFAULT_MAX_OUTPUT_BYTES;
 }
 
 export interface CappedOutput {

package/src/shared/session.ts

@@ -327,7 +327,8 @@ const SESSION_CACHE_MAX_ENTRIES = 64;
 export function resolveSessionMaxLineBytes(env: NodeJS.ProcessEnv = process.env): number {
 	const raw = env[SESSION_MAX_LINE_BYTES_ENV]?.trim();
 	const n = raw ? Number(raw) : NaN;
-	return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_SESSION_MAX_LINE_BYTES;
+	// #174: require floored value >= 1 — (0,1) must not become cap=0.
+	return Number.isFinite(n) && n >= 1 ? Math.floor(n) : DEFAULT_SESSION_MAX_LINE_BYTES;
 }
 
 interface SessionParseState {