pi-open-agents 0.1.28 → 0.1.30

package/README.md

@@ -167,6 +167,15 @@ active agent's rules *before it runs* — not just used to filter the toolset:
 > blocks matching *individual calls* (patterns included), not just statically
 > hiding whole tools. (#20)
 
+> **⚠️ Behavior change (v0.1.30):** primary-agent static filtering now covers
+> **all tool sources**, not just builtins (#18). If an agent declares
+> `permission` or `tools:`, extension tools (web, LSP, MCP, …) not matched
+> are hidden from the model — previously they were always kept. Only blanket
+> `deny` rules hide a tool; argument-pattern denies and `ask` stay enforced
+> by the runtime gate. If your allowlist drops `subagent`, the agent cannot
+> delegate anymore — apply warns you explicitly. No restrictions = everything
+> stays active, exactly as before.
+
 **Inheritance down the delegation chain (#8).** A subagent can never exceed
 the authority of the agent that delegated to it — in both directions of the
 rule language:
@@ -387,6 +396,7 @@ six sessions, zero chaos: that's the exact workstation setup documented in
 - ~~**Parent permission inheritance** for subagents~~ — ✅ shipped in [0.1.27](https://github.com/andrea-tomassi/pi-open-agents/releases/tag/v0.1.27) (#8)
 - ~~**Agent hot-reload**~~ — ✅ works via pi's built-in `/reload`, shipped in [0.1.27](https://github.com/andrea-tomassi/pi-open-agents/releases/tag/v0.1.27) (#9)
 - ~~**Per-call model override** in `subagent()`~~ — ✅ shipped in [0.1.19](https://github.com/andrea-tomassi/pi-open-agents/releases/tag/v0.1.19) (#10)
+- ~~**Primary tool filters incl. extension tools**~~ — ✅ shipped in [0.1.30](https://github.com/andrea-tomassi/pi-open-agents/releases/tag/v0.1.30) (#18)
 - **Parallel subagent limit** — #11
 
 ---
@@ -398,7 +408,7 @@ opening an issue or pull request.
 
 ```bash
 npm install
-npm test          # 191 tests
+npm test          # 207 tests
 npm run typecheck # tsc --noEmit
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-open-agents",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "Unified agent and subagent management for pi coding agent, with OpenCode-compatible agent definitions.",
   "keywords": [
     "pi-package",

package/src/primary/executor.ts

@@ -75,47 +75,72 @@ function applyThinking(agent: AgentDefinition, pi: ExtensionAPI): void {
  *
  * Logic:
  * 1. If agent has permission rules → filter via permission engine
- * 2. Else if agent has tools whitelist → filter to only those (builtin only)
+ * 2. Else if agent has tools whitelist → filter to only those
  * 3. Otherwise → all tools active
  *
- * Extension-provided tools (MCP, SDK) always remain active.
+ * Filtering covers ALL registered tool sources (builtin, extension, MCP,
+ * SDK): a restricted profile can hide extension tools (web, LSP, …) from
+ * the model, not just block their calls. Only blanket `deny` rules hide a
+ * tool statically — argument-pattern denies and `ask` stay enforced by the
+ * runtime gate (#20), which also remains the backstop for tools registered
+ * after the agent started (issue #18).
+ *
+ * @returns The applied active tool names (for the subagent-hidden warning).
  */
-function applyTools(agent: AgentDefinition, pi: ExtensionAPI): void {
-  const allTools = pi.getAllTools();
-
-  // Case 1: Permission-based filtering
+export function computeActiveTools(
+  agent: AgentDefinition,
+  allTools: Array<{ name: string }>,
+): string[] {
+  // Case 1: Permission-based filtering (all sources)
   if (agent.permission) {
     const rules = parsePermissionRules(agent.permission);
     const disabled = getDisabledTools(
       allTools.map((t) => t.name),
       rules,
     );
-    const filtered = allTools
-      .filter((t) => {
-        // Always keep non-builtin tools (extensions, MCP)
-        if (t.sourceInfo?.source !== "builtin") return true;
-        return !disabled.has(t.name);
-      })
-      .map((t) => t.name);
-    pi.setActiveTools(filtered);
-    return;
+    return allTools.filter((t) => !disabled.has(t.name)).map((t) => t.name);
   }
 
-  // Case 2: Simple tools whitelist (builtin only)
+  // Case 2: Simple tools whitelist (all sources)
   if (agent.tools && agent.tools.length > 0) {
     const whitelist = new Set(agent.tools.map((t) => t.toLowerCase()));
-    const filtered = allTools
-      .filter((t) => {
-        if (t.sourceInfo?.source !== "builtin") return true;
-        return whitelist.has(t.name.toLowerCase());
-      })
+    return allTools
+      .filter((t) => whitelist.has(t.name.toLowerCase()))
       .map((t) => t.name);
-    pi.setActiveTools(filtered);
-    return;
   }
 
   // Case 3: No restrictions — keep all tools
-  pi.setActiveTools(allTools.map((t) => t.name));
+  return allTools.map((t) => t.name);
+}
+
+function applyTools(agent: AgentDefinition, pi: ExtensionAPI): string[] {
+  const active = computeActiveTools(agent, pi.getAllTools());
+  pi.setActiveTools(active);
+  return active;
+}
+
+/**
+ * Warn when an agent's static restrictions hide the `subagent` tool (#18).
+ *
+ * Without it the model cannot delegate at all — that may be exactly what a
+ * locked-down profile wants, but it must be a deliberate choice, never a
+ * surprise from an allowlist that simply forgot to name it.
+ */
+export function warnIfHidingSubagent(
+  agent: AgentDefinition,
+  allNames: string[],
+  activeNames: string[],
+  ui: ExtensionContext["ui"],
+): void {
+  const restricted = agent.permission !== undefined || (agent.tools?.length ?? 0) > 0;
+  if (!restricted) return;
+  if (!allNames.includes("subagent")) return;
+  if (activeNames.includes("subagent")) return;
+  ui.notify(
+    `Agent "${agent.name}": tool restrictions hide the "subagent" tool — this agent cannot delegate. ` +
+      `Add "subagent" to the allowlist if delegation is intended.`,
+    "warning",
+  );
 }
 
 // ─── Main Entry Point ────────────────────────────────────────────────────────
@@ -131,7 +156,9 @@ export async function applyAgentConfig(
 ): Promise<void> {
   await applyModel(agent, pi, ctx);
   applyThinking(agent, pi);
-  applyTools(agent, pi);
+  const before = pi.getAllTools().map((t) => t.name);
+  const active = applyTools(agent, pi);
+  warnIfHidingSubagent(agent, before, active, ctx.ui);
 }
 
 /**

package/src/subagent/executor.ts

@@ -440,10 +440,28 @@ function usageFromMessage(
   };
 }
 
+/**
+ * Extract the display model string from an assistant message (issue #27).
+ *
+ * `AssistantMessage` always carries both `provider` and `model`, so prefix the
+ * bare id (`provider/model`) to match the `model:` frontmatter format and the
+ * per-call override (`parseModelRef` splits on the first slash, so a
+ * namespaced id such as `anthropic/claude-opus-5.5` under `openrouter`
+ * round-trips exactly). No `provider` → bare id, as before.
+ *
+ * The `startsWith` guard prevents `provider/provider/...` when a host echoes
+ * an already-qualified id. Deliberately NOT `responseModel`: that is the
+ * provider-native answering snapshot (alias → dated version), a different
+ * granularity from "which provider ran the agent".
+ */
 function modelFromMessage(message: unknown): string | undefined {
   if (!message || typeof message !== "object") return undefined;
-  const model = (message as { model?: unknown }).model;
-  return typeof model === "string" ? model : undefined;
+  const data = message as { provider?: unknown; model?: unknown };
+  if (typeof data.model !== "string") return undefined;
+  if (typeof data.provider === "string" && !data.model.startsWith(`${data.provider}/`)) {
+    return `${data.provider}/${data.model}`;
+  }
+  return data.model;
 }
 
 function updateUsage(target: AgentUsage, update: Partial<AgentUsage> | undefined) {