pi-roundtable-coding 0.8.0 → 0.9.1

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-10-10
+
+- Release in lockstep with pi-roundtable 0.9.1; no package-specific behavior changes.
+
+## [0.9.0] - 2026-10-09
+
+- The extra `skill_list` is offered by whom a conversation serves, not by its kind: only a private conversation whose person holds the owner role (`IDENTITY.tierOf`) gets it. A member's private conversation and any shared conversation, an owner's included, get none, and a failed or absent role lookup offers none. A host that ran its owner's conversation with kind `owner` but without `conversation: { visibility: "private", principalId }`, or without recording it private, loses the list until it does. Needs pi-roundtable 0.9, which gives `SessionContext.conversation`.
+- `repo_task` refuses the host's own turns, whose speaker is `SYSTEM_PRINCIPAL`, such as an ops error report's or a Discord webhook report's: their text is untrusted input, and a coding task started there would run later as the owner's. Ask the owner to start it. Needs pi-roundtable 0.9, which exports `SYSTEM_PRINCIPAL`.
+
 ## [0.8.0] - 2026-10-07
 
 - Release in lockstep with pi-roundtable 0.8.0; no package-specific behavior changes.

package/README.md

@@ -64,13 +64,20 @@ const workerPackages = [packageDir("your-provider-package", import.meta.url)];
 Install the provider package on the host first and pass `workerPackages` to `coding`.
 Workers activate only `SHELL_TOOLS` (`bash`, `read`, `edit`, `write`); extension packages are trusted executable code, not a way to grant extra model tools.
 
+## Principal migration in 0.9
+
+Use the same lockstep core and package release; [Migrating to 0.9](../../docs/migration-0.9.md) covers the host changes.
+Owner skills depend on a private conversation's principal holding a lasting owner role, not `kind: "owner"` or an assumed tier.
+Pass the router-resolved speaker to any custom turn or report integration, and direct personal reports only to that principal's own channel.
+System report turns cannot call `repo_task`; do the work in the turn or hand it to a person.
+
 ## Tools and flow
 
 | Tool | Parameters | Behavior |
 | --- | --- | --- |
 | `repo_add` | `repo` | Clone `owner/repo` into `shelfDir/owner/repo`; refuse invalid names and existing clones. |
 | `repo_list` | `fetch?` | List paths, branches, upstream ahead/behind counts, dirty files, last commits, prose summaries, CI hints and linked skills. |
-| `repo_task` | `repo`, `task`, `skills?` | Start a background worker, returning its job number immediately. |
+| `repo_task` | `repo`, `task`, `skills?` | Start a background worker, returning its job number immediately. The host's own turns, such as a report's, may not. |
 | `repo_change_report` | `repo` | Fetch and post the commits and diffstat ahead of the default branch; return its full SHA. |
 | `repo_push` | `repo`, `sha` | Push the exact reported SHA to the reported default branch, without force, after the hold gate permits it. |
 
@@ -81,7 +88,11 @@ The host's skills addon resolves explicit skills, or the calling agent's carried
 Missing or unknown skills refuse the task by default; requesting skills while the addon is off also refuses it.
 `skipUnavailableCarriedSkills: true` opts into skipping unavailable implicit skills and disclosing them in the task-start text or through `presentation.taskStarted`.
 Explicit skill requests still refuse missing or unknown skills.
-Sessions with kind `owner` get the public `skillListExtension`; agent sessions keep the core's existing `skill_list` instead of registering it twice.
+A private conversation whose person holds the owner role, as `IDENTITY.tierOf` tells, gets the public `skillListExtension`, whatever its kind.
+A member's private conversation and any shared conversation, an owner's included, get none; so does every conversation when the identity service is absent or its lookup fails.
+Agent sessions keep the core's existing `skill_list` instead of registering it twice.
+The role is checked when the session is built and again before every extra `skill_list` execution; a removed role or failed lookup immediately refuses the call, even in a reused session.
+A newly granted role makes the extra tool available once the session is rebuilt.
 
 A worker reads the repository's instructions, edits and checks the work, and commits using repository conventions.
 One worker may use a repository at a time, with up to three per channel.
@@ -187,6 +198,8 @@ The `CODING` service exposes `shelf: RepoShelf` and `desk: CodingDesk` for trust
 `RepoShelf`, `CodingDesk`, `PiCodingWorker`, `CodingWorkerFailure`, `REPO_TOOLS`, `codingReport`, `reportPost` and their option/result types are exported for testing and host integrations.
 `resolveRun(turn)` receives the public `ToolTurn`, including the calling agent scope and channel.
 It returns `{ model, thinking, channel, origin? }`; skill selection still follows the caller, not the resolved report destination.
+A `resolveRun` or `postChangeReport` that sends a person's report away from the calling channel sends it to that person's own direct channel, `context.directChannels.reach(turn.speaker.principalId)`, and throws `ToolRefusal` when none reaches them.
+It never falls back to the primary owner's channel: on a host serving more than one person, that channel would carry someone else's repository work.
 `onResult` receives those fields plus loaded `skillNames` and the optional progress `thread` in `result.job`, so a host can enqueue its own localized conversation turn.
 `adoptClones` and `RepoShelf.adopt` keep existing clone contents and path layout without database migrations.
 No database or Discord-specific types are required.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-coding",
-	"version": "0.8.0",
+	"version": "0.9.1",
 	"description": "Repository shelves and owner-approved Pi coding workers for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -38,13 +38,13 @@
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.8.0 <0.9.0"
+		"pi-roundtable": ">=0.9.0 <0.10.0"
 	},
 	"devDependencies": {
 		"@earendil-works/pi-ai": ">=1.0.0 <2",
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.8.0",
+		"pi-roundtable": "0.9.1",
 		"typescript": "7.0.2"
 	}
 }

package/src/coding-plugin.ts

@@ -3,8 +3,10 @@ import {
 	definePlugin,
 	defineTool,
 	type HoldCheck,
+	IDENTITY,
 	PluginError,
 	SKILLS,
+	SYSTEM_PRINCIPAL,
 	serviceKey,
 	type ThinkingLevel,
 	ToolRefusal,
@@ -213,6 +215,23 @@ export function coding(options: CodingOptions) {
 				}
 			}
 			context.services.provide(CODING, { shelf, desk });
+			// Whether the principal holds the owner role; no identity service, or a failed lookup,
+			// tells of no one holding it.
+			const holdsOwnerRole = async (
+				principalId: string,
+				session: { homeChannel: ChannelKey },
+			): Promise<boolean> => {
+				try {
+					const identity = context.services.find(IDENTITY);
+					return (await identity?.tierOf(principalId)) === "owner";
+				} catch (error) {
+					context.logger.warn(
+						{ channel: session.homeChannel, err: error },
+						"could not tell whether the conversation's person holds the owner role; no extra skill list",
+					);
+					return false;
+				}
+			};
 			const textOf = (tool: RepoToolName) => options.toolText?.[tool];
 			const describe = (tool: RepoToolName, fallback: string) =>
 				textOf(tool)?.description ?? fallback;
@@ -239,8 +258,45 @@ export function coding(options: CodingOptions) {
 								snapshot: () => ({
 									revision: 0,
 									factory: (session) => {
-										if (session.kind !== "owner") return null;
-										return skillListExtension(skills);
+										// Whom the conversation serves decides, not its persona's kind: an owner's own
+										// conversation. An agent's keeps the core's skill_list, and a shared one
+										// serves whoever speaks.
+										const { conversation } = session;
+										if (session.agent || conversation.visibility !== "private")
+											return null;
+										const list = skillListExtension(skills);
+										return async (pi) => {
+											if (
+												!(await holdsOwnerRole(
+													conversation.principalId,
+													session,
+												))
+											)
+												return;
+											await list({
+												...pi,
+												registerTool: (tool) =>
+													pi.registerTool({
+														...tool,
+														execute: async (...args) => {
+															// A cached session must not retain a removed owner role.
+															const current = session.conversation;
+															if (
+																session.agent ||
+																current.visibility !== "private" ||
+																!(await holdsOwnerRole(
+																	current.principalId,
+																	session,
+																))
+															)
+																throw new ToolRefusal(
+																	"The extra skill list requires a private conversation whose principal currently holds the owner role.",
+																);
+															return tool.execute(...args);
+														},
+													}),
+											});
+										};
 									},
 								}),
 							},
@@ -368,6 +424,11 @@ export function coding(options: CodingOptions) {
 						}),
 						run: ({ repo, task, skills: names }, turn) =>
 							refusal(async () => {
+								// A report's turn reads text no one vouches for; it hands no worker a task.
+								if (turn.speaker?.principalId === SYSTEM_PRINCIPAL)
+									throw new AgentError(
+										"the host's own turns, such as a report's, start no coding tasks; ask the owner to start it",
+									);
 								if (shipping.has(repo))
 									throw new AgentError(
 										"A report or push is in progress for this repository.",