pi-open-agents 0.1.13 → 0.1.15

package/README.md

@@ -91,8 +91,10 @@ permission:
   "subagent": deny        # no delegation
 ```
 
-Tool names are normalized automatically: `write` → `edit`, `task` → `subagent`,
-`vscode` → `read`.
+Tool names are normalized automatically: `task` → `subagent`, `vscode` → `read`,
+`apply_patch` → `edit` (OpenCode-only tool). In pi, `write` and `edit` are
+**separate** tools — `write` creates/overwrites files, `edit` does search-and-
+replace — so they have separate permission categories.
 
 ### Auto-injected delegation guidance
 
@@ -118,6 +120,11 @@ This means:
 - Each subagent runs with exactly the model and tools it declares
 - Skills load per-agent, with wildcard support (`security-*`, `git-*`)
 
+The `--tools` whitelist is derived from both explicit `tools:` arrays and
+permission allow-lists. An agent with `permission: { read: allow, edit: allow }`
+will only get `read` and `edit` in the child process. Wildcard permissions
+(`*: allow`) cannot produce a finite whitelist — the child gets all tools.
+
 ### OpenCode compatibility
 
 Your `.opencode/agent/` files work as-is. The `tools` map format is auto-converted
@@ -133,6 +140,10 @@ tools:
   bash: false
 ```
 
+The `tools` map is converted to permission rules and **also restricts the
+subagent child process** — a subagent with `tools: { read: true, bash: false }`
+will only have access to the `read` tool when spawned.
+
 ### Mode-based visibility
 
 | `mode` | TUI selector | `subagent` tool | `set_agent` tool |
@@ -249,9 +260,12 @@ Optional cleanup:
 
 ## Development
 
+**Contributing?** Please read the [Contributing Guide](./CONTRIBUTING.md) before
+opening an issue or pull request.
+
 ```bash
 npm install
-npm test          # 84 tests
+npm test          # 117 tests
 npm run typecheck # tsc --noEmit
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-open-agents",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Unified agent and subagent management for pi coding agent, with OpenCode-compatible agent definitions.",
   "keywords": [
     "pi-package",
@@ -64,6 +64,7 @@
   "devDependencies": {
     "@types/node": "^24.0.0",
     "tsx": "^4.19.0",
+    "typebox": "^1.3.10",
     "typescript": "^5.6.0"
   }
 }

package/src/config/schema.ts

@@ -183,6 +183,10 @@ function parseToolsAndPermission(
  * Convert OpenCode-style tools map to PermissionConfig.
  *
  * { "read": true, "write": false } → { "read": "allow", "write": "deny" }
+ *
+ * `write` and `edit` are kept as separate keys — in pi they are separate
+ * tools (create/overwrite vs search-and-replace). Only `apply_patch`
+ * (OpenCode-only) is mapped to `edit`.
  */
 function toolsMapToPermission(toolsMap: Record<string, unknown>): PermissionConfig {
   const config: PermissionConfig = {};
@@ -191,8 +195,8 @@ function toolsMapToPermission(toolsMap: Record<string, unknown>): PermissionConf
     // Skip non-boolean values
     if (typeof enabled !== "boolean") continue;
 
-    // Map edit-like tools to "edit" permission (OpenCode convention)
-    const permKey = toolName === "write" || toolName === "edit" || toolName === "apply_patch"
+    // Map OpenCode-only tools to their pi equivalent
+    const permKey = toolName === "apply_patch"
       ? "edit"
       : toolName;
 

package/src/permission/evaluator.ts

@@ -20,15 +20,19 @@ import { matchPattern } from "./matcher.ts";
 /**
  * Map a tool name to its permission category.
  *
- * Multiple tools can share a permission category:
- *   write, edit, apply_patch  → "edit"
+ * Some tools share a permission category with another tool:
+ *   apply_patch → "edit"  (OpenCode-only tool, functionally equivalent to edit)
  *   list_mcp_resources, read_mcp_resource → "read"
  *
+ * In pi, `write` and `edit` are SEPARATE tools (create/overwrite vs
+ * search-and-replace). They must stay as separate permission categories so
+ * that `{edit: true, write: false}` works as expected.
+ *
  * Everything else maps by tool name directly.
  */
 export function toolToPermission(toolName: string): string {
-  // File-editing tools all map to "edit"
-  if (toolName === "write" || toolName === "edit" || toolName === "apply_patch") {
+  // OpenCode's apply_patch maps to pi's edit (no apply_patch tool in pi)
+  if (toolName === "apply_patch") {
     return "edit";
   }
 

package/src/subagent/env.ts

@@ -19,7 +19,6 @@ export type RecursionEnv = Partial<
     | "PI_OPEN_AGENTS_SYSTEM_PROMPT_MODE"
     | "PI_OPEN_AGENTS_ALLOWED"
     | "PI_OPEN_AGENTS_SESSION"
-    | "PI_OPEN_AGENTS_PERMISSION"
     | "PI_OPEN_AGENTS_DEBUG",
     string
   >

package/src/subagent/executor.ts

@@ -143,6 +143,41 @@ const defaultExecutorFs: ExecutorFs = {
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
+/**
+ * Derive a tools whitelist from the agent definition for the child process.
+ *
+ * The `--tools` CLI flag is a whitelist (include only these). It works with:
+ * - Explicit `agent.tools` array (pi-style CSV)
+ * - Simple permission allow-lists (keys with "allow", no wildcard)
+ *
+ * Does NOT work with:
+ * - Wildcard permissions (`*: allow` + specific denies) — can't derive a
+ *   finite whitelist. The child gets all tools. This is a known limitation
+ *   of the `--tools` flag (it's a whitelist, not a deny-list).
+ * - Pattern-based permissions (`edit: { "*.env": deny }`) — patterns can't
+ *   be expressed as a flat tool whitelist.
+ */
+function deriveToolsWhitelist(agent: AgentDefinition): string[] | undefined {
+  // Explicit tools array — use directly
+  if (agent.tools && agent.tools.length > 0) {
+    return agent.tools;
+  }
+
+  // Derive from permission config
+  if (agent.permission) {
+    // Can't derive a finite whitelist when wildcard is present
+    if ("*" in agent.permission) return undefined;
+
+    const allowed = Object.entries(agent.permission)
+      .filter(([, value]) => value === "allow")
+      .map(([key]) => key);
+
+    return allowed.length > 0 ? allowed : undefined;
+  }
+
+  return undefined;
+}
+
 function emptyUsage(): AgentUsage {
   return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cost: 0, contextTokens: 0 };
 }
@@ -478,8 +513,9 @@ export async function runSubagent(options: RunSubagentOptions): Promise<AgentRes
     args.push("--thinking", options.agent.thinking);
 
     // Tools whitelist
-    if (options.agent.tools && options.agent.tools.length > 0) {
-      args.push("--tools", options.agent.tools.join(","));
+    const toolsWhitelist = deriveToolsWhitelist(options.agent);
+    if (toolsWhitelist && toolsWhitelist.length > 0) {
+      args.push("--tools", toolsWhitelist.join(","));
     }
 
     // System prompt file (append or replace)

package/src/tui/tools.ts

@@ -14,6 +14,7 @@ import { Type } from "typebox";
 import type { AgentDefinition } from "../types.ts";
 import { selectableAgents } from "../discovery/loader.ts";
 import type { AgentManager } from "../primary/manager.ts";
+import { isSubagentProcess } from "../subagent/env.ts";
 import { updateBanner } from "./banner.ts";
 
 /**
@@ -32,6 +33,10 @@ export function registerAgentTools(manager: AgentManager, pi: ExtensionAPI): voi
       reason: Type.Optional(Type.String({ description: "Reason for switching agents" })),
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, ctx: ExtensionContext) {
+      if (isSubagentProcess(process.env)) {
+        throw new Error("set_agent is only available to the primary agent, not subagents.");
+      }
+
       const { agent: name, reason } = params;
 
       const agent = manager.getAgent(name);
@@ -40,6 +45,10 @@ export function registerAgentTools(manager: AgentManager, pi: ExtensionAPI): voi
         throw new Error(`Unknown agent "${name}". Available: ${available}`);
       }
 
+      if (agent.mode === "subagent") {
+        throw new Error(`Agent "${name}" is a subagent and cannot be set as the primary agent.`);
+      }
+
       const success = await manager.apply(name, pi, ctx);
       if (!success) {
         throw new Error(`Failed to apply agent "${name}"`);