pi-squire 0.18.1 → 0.18.2

package/CHANGELOG.md

@@ -6,6 +6,31 @@ follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.18.2] - 2026-11-01
+
+### Fixed
+
+- Agents without a `tools:` field inherit available deferred and codemode tools
+  from root sessions, just as they already did from nested delegates. Inactive
+  direct tools and hidden tools remain excluded. Pi initially declares the
+  selected tools in the child; extensions that enable optional tools on demand
+  must deselect them during child startup. This can increase initial declarations
+  for root-launched delegates whose extensions do not deselect those tools.
+- Creating a companion session no longer saves the first delegate's environment,
+  including `PI_UNATTENDED` and API keys, into the session for later windows to
+  inherit. Each delegate still receives its own launch environment. Existing
+  polluted sessions are not changed. The fresh-companion argument test now pins
+  window-local environment delivery instead of session-level `-e` options.
+  Launches still pass only Squire's environment and `session:launch` additions,
+  never a copy of the parent's full process environment.
+- tmux failures report a bounded subcommand error instead of raw process errors
+  or stderr that could expose launch arguments or environment values. The two
+  failed ownership-recheck tests now expect the bounded error wording.
+- The discovery-count regression uses a controlled clock so additional parallel
+  test load does not turn its structural count assertion into a timing failure.
+  The separate real-time discovery deadline test and 200 ms product bound are
+  unchanged.
+
 ## [0.18.1] - 2026-11-01
 
 ### Changed
@@ -1024,7 +1049,8 @@ author's dotfiles; the changes below are against that copy.
 
 - The published file list includes `child.ts`, which `index.ts` imports.
 
-[Unreleased]: https://github.com/gvanderclay/pi-squire/compare/v0.18.1...HEAD
+[Unreleased]: https://github.com/gvanderclay/pi-squire/compare/v0.18.2...HEAD
+[0.18.2]: https://github.com/gvanderclay/pi-squire/compare/v0.18.1...v0.18.2
 [0.18.1]: https://github.com/gvanderclay/pi-squire/compare/v0.18.0...v0.18.1
 [0.18.0]: https://github.com/gvanderclay/pi-squire/compare/v0.17.0...v0.18.0
 [0.17.0]: https://github.com/gvanderclay/pi-squire/compare/v0.16.0...v0.17.0

package/README.md

@@ -992,11 +992,14 @@ are not checked against the parent's tools, at top level or nested: normal Pi
 extension discovery or `session:launch` customization can provide tools in the
 child.
 
-- No `tools` field: the delegate gets the parent session's tools as they are
-  when the launch (or resume) starts: active tools for a top-level launch, or
-  available tools including codemode/deferred operations for a nested one, passed as
-  `--tools`, plus the `delegateTools` entries. A parent limited to `read`
-  gives such a delegate only `read`.
+- No `tools` field: the delegate gets the parent session's available tools
+  when the launch (or resume) starts, at any depth: active tools plus registered
+  codemode/deferred operations, excluding hidden tools and inactive direct tools,
+  passed as `--tools`, plus the `delegateTools` entries. Pi initially declares
+  these selected tools in the child, even when their exposure is codemode or
+  deferred. An extension can deselect optional tools during child startup and
+  enable them later. A parent with only `read` available gives such a delegate
+  only `read`.
 - An empty `tools` field, `tools:` or `tools: []`: the delegate gets no tools
   except the `delegateTools` entries. With none of those either, it starts
   with `--no-tools`.
@@ -1692,6 +1695,11 @@ An empty final set also receives `--no-tools` and an empty allowlist so earlier
 selection flags cannot restore tools. Do all work synchronously: the emitter
 reads the payload the moment `emit` returns.
 
+Environment additions are not a secret transport. They can be visible in tmux
+command arguments and a fresh companion's first pane start command to anyone
+with access to its socket. pi-squire never copies the parent's full process
+environment into these arguments.
+
 `cwd`, the trust flag (`--approve` or `--no-approve`), `--session-dir` and the
 session choice (`--session-id` for a new delegate, `--session` for a [resumed](#resuming-a-delegation)
 one) are launch invariants that `pi-squire` chooses. The window opens in its own `cwd`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-squire",
-	"version": "0.18.1",
+	"version": "0.18.2",
 	"description": "Starts a delegate Pi session in a background tmux window, sends it the task over message:*, and shows the parent its result",
 	"keywords": [
 		"pi-package",

package/src/index.ts

@@ -807,13 +807,13 @@ export default function delegate(
 	/**
 	 * The delegate's tools for a launch or resume starting now: the agent's
 	 * named tools, or the parent's current tools (including indirect callable
-	 * tools when nested, less any `-name` entries), then `delegateTools`.
+	 * tools, less any `-name` entries), then `delegateTools`.
 	 * Throws, naming the file, on an invalid setting.
 	 */
 	function childTools(agent: Agent): string[] {
 		const selected = toolSelection(
 			agent,
-			agent.tools === undefined ? (identity.current() ? availableTools(pi) : pi.getActiveTools()) : [],
+			agent.tools === undefined ? availableTools(pi) : [],
 			delegateTools(getAgentDir()),
 		);
 		if (grantsNesting(agent, (identity.current()?.depth ?? 0) + 1)) selected.push(...DELEGATION_TOOLS);

package/src/tmux.ts

@@ -18,7 +18,6 @@ export type TmuxWindow = { id: string; session: string; name: string; exited: bo
 /** A window just opened: its id and the name of the session it is in, when known. */
 export type OpenedWindow = { id: string; session: string | undefined };
 
-/** The oldest tmux delegate windows need: `new-session -e` arrived in 3.2. */
 export const MIN_TMUX = { major: 3, minor: 2 } as const;
 
 export type TmuxVersion = { text: string; major: number; minor: number };
@@ -124,8 +123,8 @@ function runTmux(args: string[], timeout: number): Promise<string> {
 					reject(new Error(`tmux ${args[0]} timed out after ${timeout / 1000} s`));
 					return;
 				}
-				const detail = typeof stderr === "string" && stderr.trim() !== "" ? stderr.trim() : error.message;
-				reject(new Error(detail));
+				const reason = ["duplicate session", "can't find session"].find((text) => stderr.includes(text));
+				reject(new Error(`tmux ${args[0]} failed${reason === undefined ? "" : `: ${reason}`}`));
 				return;
 			}
 			resolve(stdout);
@@ -215,8 +214,17 @@ async function openCompanion(run: Run, spec: WindowSpec, base: string): Promise<
 				continue;
 			}
 		}
-		const args = ["new-session", "-d", "-s", session, "-n", spec.name, "-c", spec.cwd, ...envArgs(spec)];
-		args.push("-P", "-F", "#{window_id}", "--", ...spec.argv);
+		const args = ["new-session", "-d", "-s", session, "-n", spec.name, "-c", spec.cwd];
+		// new-session -e persists in the session; env confines these values to its first window.
+		args.push(
+			"-P",
+			"-F",
+			"#{window_id}",
+			"--",
+			"env",
+			...Object.entries(spec.env).map(([key, value]) => `${key}=${value}`),
+			...spec.argv,
+		);
 		args.push(";", "set-option", "-t", `=${session}:`, COMPANION_OPTION, "1");
 		args.push(";", "set-option", "-t", `=${session}:`, "detach-on-destroy", "off");
 		certainty = "unknown";

package/src/tool-names.ts

@@ -12,7 +12,7 @@ export function toolMatches(pattern: string, name: string): boolean {
 
 /**
  * The operations this session can reach: active tools plus codemode and
- * deferred ones, never hidden ones. A nested delegate with no `tools` field
+ * deferred ones, never hidden ones. A delegate with no `tools` field
  * inherits these. Includes active model-only operations, though
  * ctx.executeTool cannot call those.
  */