pi-subagents 0.35.1 → 0.37.0

package/src/runs/shared/pi-args.ts

@@ -3,14 +3,17 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { encodeNestedPathEnv, parseNestedPathEnv, type NestedPathEntry } from "./nested-path.ts";
-import { resolveMcpDirectToolNames } from "./mcp-direct-tool-allowlist.ts";
+import { resolveMcpDirectToolSelections, type ResolvedMcpDirectToolSelection } from "./mcp-direct-tool-allowlist.ts";
+import { resolvePiPackageRoot } from "./pi-spawn.ts";
 import { STRUCTURED_OUTPUT_CAPTURE_ENV, STRUCTURED_OUTPUT_SCHEMA_ENV } from "./structured-output.ts";
 import { TEMP_ROOT_DIR, type JsonSchemaObject, type ResolvedToolBudget } from "../../shared/types.ts";
 import { THINKING_LEVELS } from "../../shared/model-info.ts";
-import { TOOL_BUDGET_ENV, encodeToolBudgetEnv } from "./tool-budget.ts";
-import { CHILD_TOOL_DIAGNOSTIC_PATH_ENV, REQUIRED_CHILD_TOOLS_ENV } from "./tool-availability.ts";
+import { TOOL_BUDGET_ENV, TOOL_BUDGET_ZERO_AUTH_ENV, encodeToolBudgetEnv } from "./tool-budget.ts";
+import { CHILD_TOOL_DIAGNOSTIC_PATH_ENV, MCP_DIRECT_CHILD_TOOLS_ENV, REQUIRED_CHILD_TOOLS_ENV } from "./tool-availability.ts";
 import { CHILD_WATCHDOG_CONFIG_ENV, encodeChildWatchdogConfig, type ChildWatchdogConfig } from "../../watchdog/child-status.ts";
 import { WAIT_TOOL_ENABLED_ENV } from "../background/wait-config.ts";
+import { PI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../shared/utils.ts";
+import { SUBAGENT_CAPABILITY_CEILING_ENV, decodeSubagentCapabilityCeiling, encodeSubagentCapabilityCeiling, intersectSubagentCapabilityCeilings, type ResolvedSubagentCapabilityCeiling, type SubagentCapabilityAudit } from "./capability-ceiling.ts";
 
 const TASK_ARG_LIMIT = 8000;
 const PROMPT_RUNTIME_EXTENSION_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), "subagent-prompt-runtime.ts");
@@ -36,7 +39,7 @@ export const SUBAGENT_STEER_INBOX_ENV = "PI_SUBAGENT_STEER_INBOX";
 export const SUBAGENT_STEER_CAPABILITY_ENV = "PI_SUBAGENT_STEER_CAPABILITY";
 export const SUBAGENT_STEER_ACK_DIR_ENV = "PI_SUBAGENT_STEER_ACK_DIR";
 
-interface BuildPiArgsInput {
+export interface BuildPiArgsInput {
 	parentSessionId?: string;
 	baseArgs: string[];
 	task: string;
@@ -78,15 +81,18 @@ interface BuildPiArgsInput {
 		outputPath: string;
 	};
 	toolBudget?: ResolvedToolBudget;
+	allowZeroToolBudget?: boolean;
 	childWatchdog?: ChildWatchdogConfig;
 	waitToolEnabled?: boolean;
+	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
 }
 
-interface BuildPiArgsResult {
+export interface BuildPiArgsResult {
 	args: string[];
 	env: Record<string, string | undefined>;
 	tempDir?: string;
 	toolDiagnosticPath?: string;
+	capabilityAudit?: SubagentCapabilityAudit;
 }
 
 function sanitizeSupervisorChannelSegment(value: string): string {
@@ -106,6 +112,106 @@ export function applyThinkingSuffix(model: string | undefined, thinking: string
 	return `${model}:${thinking}`;
 }
 
+export interface ResolvePiLaunchToolPlanInput {
+	tools?: string[];
+	extensions?: string[];
+	subagentOnlyExtensions?: string[];
+	mcpDirectTools?: string[];
+	cwd?: string;
+	requireReadTool?: boolean;
+	structuredOutput?: boolean;
+	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
+	inheritedCapabilityCeiling?: ResolvedSubagentCapabilityCeiling;
+}
+
+export interface PiLaunchToolPlan {
+	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
+	requestedBuiltinTools: string[];
+	declaredBuiltinTools: string[];
+	toolExtensionPaths: string[];
+	resolvedMcpSelections: ResolvedMcpDirectToolSelection[];
+	effectiveMcpSelections: ResolvedMcpDirectToolSelection[];
+	effectiveMcpTools: string[];
+	explicitToolAllowlist: boolean;
+	internalTools: string[];
+	effectiveToolAllowlist: string[];
+	requiredChildTools: string[];
+	fanoutAuthorized: boolean;
+	runtimeExtensions: string[];
+	configuredExtensions: string[];
+	extensionArgs: string[];
+	disableAmbientExtensions: boolean;
+	capabilityAudit?: SubagentCapabilityAudit;
+}
+
+export function resolvePiLaunchToolPlan(input: ResolvePiLaunchToolPlanInput): PiLaunchToolPlan {
+	const capabilityCeiling = intersectSubagentCapabilityCeilings(input.capabilityCeiling, input.inheritedCapabilityCeiling);
+	const allowedToolSet = capabilityCeiling?.allowedTools === undefined ? undefined : new Set(capabilityCeiling.allowedTools);
+	const requestedBuiltinTools = input.tools?.filter((tool) => !(tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js"))) ?? [];
+	if (input.requireReadTool && allowedToolSet && !allowedToolSet.has("read")) {
+		throw new Error(`Capability ceiling from ${capabilityCeiling?.sources.join(", ") || "unknown source"} excludes required tool 'read' for lazy skill loading.`);
+	}
+	const declaredBuiltinTools = input.tools === undefined
+		? (allowedToolSet ? [...allowedToolSet] : [])
+		: (input.requireReadTool && requestedBuiltinTools.length > 0 && !requestedBuiltinTools.includes("read") && !allowedToolSet
+			? ["read", ...requestedBuiltinTools]
+			: requestedBuiltinTools).filter((tool) => !allowedToolSet || allowedToolSet.has(tool));
+	const fanoutAuthorized = declaredBuiltinTools.includes("subagent");
+	const toolExtensionPaths: string[] = capabilityCeiling?.denyExtensions ? [] : (input.tools ?? []).filter((tool) => !requestedBuiltinTools.includes(tool) && (tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js")));
+	const resolvedMcpSelections = capabilityCeiling?.denyExtensions ? [] : resolveMcpDirectToolSelections(input.mcpDirectTools, input.cwd);
+	const effectiveMcpSelections = resolvedMcpSelections.filter((selection) => !allowedToolSet || allowedToolSet.has(selection.name));
+	const effectiveMcpTools = effectiveMcpSelections.map((selection) => selection.name);
+	const explicitToolAllowlist = input.tools !== undefined || (input.mcpDirectTools?.length ?? 0) > 0 || allowedToolSet !== undefined;
+	const internalTools = input.structuredOutput ? ["structured_output"] : [];
+	const effectiveToolAllowlist = [...new Set([...declaredBuiltinTools, ...effectiveMcpTools, ...internalTools])];
+	const requiredChildTools = explicitToolAllowlist ? [...new Set([
+		...(input.tools !== undefined ? declaredBuiltinTools : []),
+		...(input.mcpDirectTools?.length ? effectiveMcpTools : []),
+		...internalTools,
+	])] : [];
+	const runtimeExtensions = fanoutAuthorized
+		? [PROMPT_RUNTIME_EXTENSION_PATH, FANOUT_CHILD_EXTENSION_PATH]
+		: [PROMPT_RUNTIME_EXTENSION_PATH];
+	const disableAmbientExtensions = capabilityCeiling?.denyExtensions === true || input.extensions !== undefined;
+	const configuredExtensions = capabilityCeiling?.denyExtensions ? [] : [...toolExtensionPaths, ...(input.extensions ?? []), ...(input.subagentOnlyExtensions ?? [])];
+	const extensionArgs = disableAmbientExtensions
+		? [...new Set([...runtimeExtensions, ...configuredExtensions])]
+		: [...new Set([...runtimeExtensions, ...toolExtensionPaths, ...(input.subagentOnlyExtensions ?? [])])];
+	const requestedToolNames = input.tools !== undefined
+		? [...new Set([...requestedBuiltinTools, ...resolvedMcpSelections.map((selection) => selection.name)])]
+		: undefined;
+	const capabilityAudit = capabilityCeiling ? {
+		ceiling: capabilityCeiling,
+		...(requestedToolNames ? { requestedTools: requestedToolNames } : {}),
+		effectiveTools: effectiveToolAllowlist,
+		removedTools: requestedToolNames?.filter((tool) => !effectiveToolAllowlist.includes(tool)) ?? [],
+		internalTools,
+		extensionsDenied: capabilityCeiling.denyExtensions,
+		removedExtensionCount: capabilityCeiling.denyExtensions ? (input.extensions?.length ?? 0) + (input.subagentOnlyExtensions?.length ?? 0) + ((input.tools ?? []).filter((tool) => tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js")).length) : 0,
+		requestedMcpToolCount: input.mcpDirectTools?.length ?? 0,
+		effectiveMcpTools,
+	} satisfies SubagentCapabilityAudit : undefined;
+	return {
+		...(capabilityCeiling ? { capabilityCeiling } : {}),
+		requestedBuiltinTools,
+		declaredBuiltinTools,
+		toolExtensionPaths,
+		resolvedMcpSelections,
+		effectiveMcpSelections,
+		effectiveMcpTools,
+		explicitToolAllowlist,
+		internalTools,
+		effectiveToolAllowlist,
+		requiredChildTools,
+		fanoutAuthorized,
+		runtimeExtensions,
+		configuredExtensions,
+		extensionArgs,
+		disableAmbientExtensions,
+		...(capabilityAudit ? { capabilityAudit } : {}),
+	};
+}
+
 export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	const args = [...input.baseArgs];
 
@@ -127,43 +233,25 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 		args.push("--model", modelArg);
 	}
 
-	const declaredBuiltinToolsBase = input.tools?.filter((tool) => !(tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js"))) ?? [];
-	const declaredBuiltinTools = input.requireReadTool && input.tools?.length && !declaredBuiltinToolsBase.includes("read")
-		? ["read", ...declaredBuiltinToolsBase]
-		: declaredBuiltinToolsBase;
-	const fanoutAuthorized = declaredBuiltinTools.includes("subagent");
-	const toolExtensionPaths: string[] = [];
-	let requiredChildTools: string[] = [];
-	if (input.tools?.length) {
-		const allowedTools = [...declaredBuiltinTools];
-		for (const tool of input.tools) {
-			if (!declaredBuiltinTools.includes(tool) && (tool.includes("/") || tool.endsWith(".ts") || tool.endsWith(".js"))) {
-				toolExtensionPaths.push(tool);
-			}
-		}
-		if (allowedTools.length > 0) {
-			if (input.mcpDirectTools?.length) {
-				allowedTools.push(...resolveMcpDirectToolNames(input.mcpDirectTools, input.cwd));
-			}
-			if (input.structuredOutput) allowedTools.push("structured_output");
-			requiredChildTools = [...new Set(allowedTools)];
-			args.push("--tools", requiredChildTools.join(","));
-		}
+	const toolPlan = resolvePiLaunchToolPlan({
+		tools: input.tools,
+		extensions: input.extensions,
+		subagentOnlyExtensions: input.subagentOnlyExtensions,
+		mcpDirectTools: input.mcpDirectTools,
+		cwd: input.cwd,
+		requireReadTool: input.requireReadTool,
+		structuredOutput: input.structuredOutput,
+		capabilityCeiling: input.capabilityCeiling,
+		inheritedCapabilityCeiling: decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV]),
+	});
+	if (toolPlan.explicitToolAllowlist) {
+		args.push(toolPlan.effectiveToolAllowlist.length > 0 ? "--tools" : "--no-tools");
+		if (toolPlan.effectiveToolAllowlist.length > 0) args.push(toolPlan.effectiveToolAllowlist.join(","));
 	}
-
-	const runtimeExtensions = fanoutAuthorized
-		? [PROMPT_RUNTIME_EXTENSION_PATH, FANOUT_CHILD_EXTENSION_PATH]
-		: [PROMPT_RUNTIME_EXTENSION_PATH];
-	if (input.extensions !== undefined) {
+	if (toolPlan.disableAmbientExtensions) {
 		args.push("--no-extensions");
-		for (const extPath of [...new Set([...runtimeExtensions, ...toolExtensionPaths, ...input.extensions, ...(input.subagentOnlyExtensions ?? [])])]) {
-			args.push("--extension", extPath);
-		}
-	} else {
-		for (const extPath of [...new Set([...runtimeExtensions, ...toolExtensionPaths, ...(input.subagentOnlyExtensions ?? [])])]) {
-			args.push("--extension", extPath);
-		}
 	}
+	for (const extPath of toolPlan.extensionArgs) args.push("--extension", extPath);
 
 	if (!input.inheritSkills) {
 		args.push("--no-skills");
@@ -190,15 +278,18 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	}
 
 	const env: Record<string, string | undefined> = {};
+	const piPackageRoot = process.env[PI_CODING_AGENT_PACKAGE_ROOT_ENV] ?? resolvePiPackageRoot();
+	if (piPackageRoot) env[PI_CODING_AGENT_PACKAGE_ROOT_ENV] = piPackageRoot;
 	let toolDiagnosticPath: string | undefined;
-	if (requiredChildTools.length > 0) {
+	if (toolPlan.requiredChildTools.length > 0) {
 		if (!tempDir) tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-subagent-"));
 		toolDiagnosticPath = path.join(tempDir, "tool-diagnostic.json");
-		env[REQUIRED_CHILD_TOOLS_ENV] = JSON.stringify(requiredChildTools);
+		env[REQUIRED_CHILD_TOOLS_ENV] = JSON.stringify(toolPlan.requiredChildTools);
 		env[CHILD_TOOL_DIAGNOSTIC_PATH_ENV] = toolDiagnosticPath;
 	}
+	env[MCP_DIRECT_CHILD_TOOLS_ENV] = toolPlan.effectiveMcpTools.length > 0 ? JSON.stringify(toolPlan.effectiveMcpTools) : undefined;
 	env[SUBAGENT_CHILD_ENV] = "1";
-	env[SUBAGENT_FANOUT_CHILD_ENV] = fanoutAuthorized ? "1" : "0";
+	env[SUBAGENT_FANOUT_CHILD_ENV] = toolPlan.fanoutAuthorized ? "1" : "0";
 	if (input.waitToolEnabled !== undefined) {
 		env[WAIT_TOOL_ENABLED_ENV] = input.waitToolEnabled ? "true" : "false";
 	}
@@ -219,20 +310,20 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 			...(input.childAgentName ? { agent: input.childAgentName } : {}),
 		}] : []),
 	];
-	env[SUBAGENT_PARENT_EVENT_SINK_ENV] = fanoutAuthorized
+	env[SUBAGENT_PARENT_EVENT_SINK_ENV] = toolPlan.fanoutAuthorized
 		? input.parentEventSink ?? process.env[SUBAGENT_PARENT_EVENT_SINK_ENV] ?? ""
 		: "";
-	env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] = fanoutAuthorized
+	env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] = toolPlan.fanoutAuthorized
 		? input.parentControlInbox ?? process.env[SUBAGENT_PARENT_CONTROL_INBOX_ENV] ?? ""
 		: "";
-	env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] = fanoutAuthorized
+	env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] = toolPlan.fanoutAuthorized
 		? input.parentRootRunId ?? process.env[SUBAGENT_PARENT_ROOT_RUN_ID_ENV] ?? input.runId ?? ""
 		: "";
-	env[SUBAGENT_PARENT_RUN_ID_ENV] = fanoutAuthorized ? parentRunId : "";
-	env[SUBAGENT_PARENT_CHILD_INDEX_ENV] = fanoutAuthorized ? parentChildIndex : "";
-	env[SUBAGENT_PARENT_DEPTH_ENV] = fanoutAuthorized ? String(parentDepth) : "";
-	env[SUBAGENT_PARENT_PATH_ENV] = fanoutAuthorized ? encodeNestedPathEnv(parentPath) : "";
-	env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] = fanoutAuthorized
+	env[SUBAGENT_PARENT_RUN_ID_ENV] = toolPlan.fanoutAuthorized ? parentRunId : "";
+	env[SUBAGENT_PARENT_CHILD_INDEX_ENV] = toolPlan.fanoutAuthorized ? parentChildIndex : "";
+	env[SUBAGENT_PARENT_DEPTH_ENV] = toolPlan.fanoutAuthorized ? String(parentDepth) : "";
+	env[SUBAGENT_PARENT_PATH_ENV] = toolPlan.fanoutAuthorized ? encodeNestedPathEnv(parentPath) : "";
+	env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] = toolPlan.fanoutAuthorized
 		? input.parentCapabilityToken ?? process.env[SUBAGENT_PARENT_CAPABILITY_TOKEN_ENV] ?? ""
 		: "";
 	env.PI_SUBAGENT_INHERIT_PROJECT_CONTEXT = input.inheritProjectContext ? "1" : "0";
@@ -262,11 +353,11 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	if (input.childIndex !== undefined) {
 		env[SUBAGENT_CHILD_INDEX_ENV] = String(input.childIndex);
 	}
-	if (input.mcpDirectTools?.length) {
-		env.MCP_DIRECT_TOOLS = input.mcpDirectTools.join(",");
-	} else {
-		env.MCP_DIRECT_TOOLS = "__none__";
-	}
+	if (!toolPlan.capabilityCeiling && input.mcpDirectTools?.length) env.MCP_DIRECT_TOOLS = input.mcpDirectTools.join(",");
+	else if (toolPlan.capabilityCeiling && toolPlan.effectiveMcpSelections.length && !toolPlan.capabilityCeiling.denyExtensions) env.MCP_DIRECT_TOOLS = toolPlan.effectiveMcpSelections.map((selection) => selection.selector).join(",");
+	else env.MCP_DIRECT_TOOLS = "__none__";
+	const encodedCapabilityCeiling = encodeSubagentCapabilityCeiling(toolPlan.capabilityCeiling);
+	if (encodedCapabilityCeiling) env[SUBAGENT_CAPABILITY_CEILING_ENV] = encodedCapabilityCeiling;
 	if (input.structuredOutput) {
 		env[STRUCTURED_OUTPUT_CAPTURE_ENV] = input.structuredOutput.outputPath;
 		env[STRUCTURED_OUTPUT_SCHEMA_ENV] = input.structuredOutput.schemaPath;
@@ -278,12 +369,13 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	if (input.steerAckDir) env[SUBAGENT_STEER_ACK_DIR_ENV] = input.steerAckDir;
 	const encodedToolBudget = encodeToolBudgetEnv(input.toolBudget);
 	if (encodedToolBudget) env[TOOL_BUDGET_ENV] = encodedToolBudget;
+	env[TOOL_BUDGET_ZERO_AUTH_ENV] = input.allowZeroToolBudget ? "1" : undefined;
 	const encodedChildWatchdog = encodeChildWatchdogConfig(input.childWatchdog);
 	if (encodedChildWatchdog) env[CHILD_WATCHDOG_CONFIG_ENV] = encodedChildWatchdog;
 
 	env[SUBAGENT_PARENT_SESSION_ENV] = input.parentSessionId ?? process.env[SUBAGENT_PARENT_SESSION_ENV] ?? "";
 
-	return { args, env, tempDir, toolDiagnosticPath };
+	return { args, env, tempDir, toolDiagnosticPath, capabilityAudit: toolPlan.capabilityAudit };
 }
 
 export const parseParentPathEnv = parseNestedPathEnv;

package/src/runs/shared/run-history.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getAgentDir } from "../../shared/utils.ts";
@@ -5,6 +6,7 @@ import { getAgentDir } from "../../shared/utils.ts";
 export interface RunEntry {
 	agent: string;
 	task: string;
+	taskHash?: string;
 	ts: number;
 	status: "ok" | "error";
 	duration: number;
@@ -13,24 +15,103 @@ export interface RunEntry {
 
 const ROTATE_READ_THRESHOLD = 1200;
 const ROTATE_KEEP = 1000;
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+const REDACTED_TASK = "[redacted]";
 
 function getHistoryPath(): string {
 	return path.join(getAgentDir(), "run-history.jsonl");
 }
 
+function hashTask(task: string): string {
+	return createHash("sha256").update(task).digest("hex");
+}
+
+function hardenHistoryStorage(historyPath: string): void {
+	const historyDir = path.dirname(historyPath);
+	fs.mkdirSync(historyDir, { recursive: true, mode: PRIVATE_DIR_MODE });
+	try { fs.chmodSync(historyDir, PRIVATE_DIR_MODE); } catch {}
+	try { if (fs.existsSync(historyPath)) fs.chmodSync(historyPath, PRIVATE_FILE_MODE); } catch {}
+}
+
+function sanitizeHistoryLine(line: string): string | undefined {
+	let value: unknown;
+	try {
+		value = JSON.parse(line);
+	} catch {
+		return undefined;
+	}
+	if (!value || typeof value !== "object") return undefined;
+
+	const record = value as Record<string, unknown>;
+	const task = typeof record.task === "string" ? record.task : "";
+	const taskHash = typeof record.taskHash === "string" && record.taskHash
+		? record.taskHash
+		: task && task !== REDACTED_TASK
+			? hashTask(task)
+			: undefined;
+
+	return JSON.stringify({
+		...record,
+		task: REDACTED_TASK,
+		...(taskHash ? { taskHash } : {}),
+	});
+}
+
+function sanitizeHistoryLines(raw: string): { lines: string[]; changed: boolean } {
+	const lines: string[] = [];
+	let changed = false;
+	for (const line of raw.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed) continue;
+		const sanitized = sanitizeHistoryLine(trimmed);
+		if (!sanitized) {
+			changed = true;
+			continue;
+		}
+		if (sanitized !== trimmed) changed = true;
+		lines.push(sanitized);
+	}
+	return { lines, changed };
+}
+
+function writePrivateHistory(historyPath: string, lines: string[]): void {
+	fs.writeFileSync(historyPath, lines.length ? `${lines.join("\n")}\n` : "", { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
+	try { fs.chmodSync(historyPath, PRIVATE_FILE_MODE); } catch {}
+}
+
+function sanitizeHistoryFile(historyPath: string): void {
+	if (!fs.existsSync(historyPath)) return;
+	const raw = fs.readFileSync(historyPath, "utf-8");
+	const { lines, changed } = sanitizeHistoryLines(raw);
+	if (changed) writePrivateHistory(historyPath, lines);
+}
+
+function appendPrivateHistoryLine(historyPath: string, line: string): void {
+	const fd = fs.openSync(historyPath, fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_WRONLY, PRIVATE_FILE_MODE);
+	try {
+		fs.writeSync(fd, `${line}\n`);
+	} finally {
+		fs.closeSync(fd);
+	}
+	try { fs.chmodSync(historyPath, PRIVATE_FILE_MODE); } catch {}
+}
+
 export function recordRun(agent: string, task: string, exitCode: number, durationMs: number): void {
 	try {
 		const entry: RunEntry = {
 			agent,
-			task: task.slice(0, 200),
+			task: REDACTED_TASK,
+			taskHash: hashTask(task),
 			ts: Math.floor(Date.now() / 1000),
 			status: exitCode === 0 ? "ok" : "error",
 			duration: durationMs,
 			...(exitCode !== 0 ? { exit: exitCode } : {}),
 		};
 		const historyPath = getHistoryPath();
-		fs.mkdirSync(path.dirname(historyPath), { recursive: true });
-		fs.appendFileSync(historyPath, `${JSON.stringify(entry)}\n`);
+		hardenHistoryStorage(historyPath);
+		try { sanitizeHistoryFile(historyPath); } catch {}
+		appendPrivateHistoryLine(historyPath, JSON.stringify(entry));
 	} catch {
 		// Best-effort — never crash the execution flow for history recording
 	}
@@ -38,6 +119,7 @@ export function recordRun(agent: string, task: string, exitCode: number, duratio
 
 export function loadRunsForAgent(agent: string): RunEntry[] {
 	const historyPath = getHistoryPath();
+	try { hardenHistoryStorage(historyPath); } catch {}
 	if (!fs.existsSync(historyPath)) return [];
 	let raw: string;
 	try {
@@ -46,11 +128,14 @@ export function loadRunsForAgent(agent: string): RunEntry[] {
 		return [];
 	}
 
-	let lines = raw.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+	let { lines, changed } = sanitizeHistoryLines(raw);
 
 	if (lines.length > ROTATE_READ_THRESHOLD) {
 		lines = lines.slice(-ROTATE_KEEP);
-		try { fs.writeFileSync(historyPath, `${lines.join("\n")}\n`, "utf-8"); } catch {}
+		changed = true;
+	}
+	if (changed) {
+		try { writePrivateHistory(historyPath, lines); } catch {}
 	}
 
 	return lines

package/src/runs/shared/session-lease.ts

@@ -37,9 +37,14 @@ export interface SessionLeaseHandle {
 	leaseDir: string;
 	owner: SessionLeaseOwner;
 	updateWriter(writer: { state: "none" | "spawning" } | { state: "running"; pid: number }): void;
-	release(): void;
+	release(): boolean;
 }
 
+export type SessionLeaseState =
+	| { state: "free"; canonicalSessionFile: string; canonicalSessionId: string }
+	| { state: "owned"; canonicalSessionFile: string; canonicalSessionId: string; owner: SessionLeaseOwner }
+	| { state: "unreadable"; canonicalSessionFile: string; canonicalSessionId: string };
+
 interface SessionLeaseOptions {
 	rootDir?: string;
 	now?: () => number;
@@ -98,11 +103,25 @@ export function canonicalSessionFilePath(sessionFile: string): string {
 	return fs.realpathSync.native(path.resolve(sessionFile));
 }
 
-export function sessionLeaseDir(sessionFile: string, rootDir = SESSION_LEASES_DIR): string {
+export function canonicalSessionId(sessionFile: string): string {
 	const canonical = canonicalSessionFilePath(sessionFile);
 	const key = process.platform === "win32" ? canonical.toLowerCase() : canonical;
-	const digest = createHash("sha256").update(key).digest("hex");
-	return path.join(rootDir, digest);
+	return createHash("sha256").update(key).digest("hex");
+}
+
+export function sessionLeaseDir(sessionFile: string, rootDir = SESSION_LEASES_DIR): string {
+	return path.join(rootDir, canonicalSessionId(sessionFile));
+}
+
+export function inspectSessionLease(sessionFile: string, rootDir = SESSION_LEASES_DIR): SessionLeaseState {
+	const canonicalSessionFile = canonicalSessionFilePath(sessionFile);
+	const canonicalSessionIdValue = canonicalSessionId(canonicalSessionFile);
+	const leaseDir = path.join(rootDir, canonicalSessionIdValue);
+	if (!fs.existsSync(leaseDir)) return { state: "free", canonicalSessionFile, canonicalSessionId: canonicalSessionIdValue };
+	const owner = readLeaseOwner(leaseDir);
+	return owner
+		? { state: "owned", canonicalSessionFile, canonicalSessionId: canonicalSessionIdValue, owner }
+		: { state: "unreadable", canonicalSessionFile, canonicalSessionId: canonicalSessionIdValue };
 }
 
 function parseOwner(value: unknown): SessionLeaseOwner | undefined {
@@ -251,8 +270,9 @@ export function acquireSessionLease(request: SessionLeaseRequest, options: Sessi
 				},
 				release() {
 					const currentOwner = readLeaseOwner(leaseDir);
-					if (!currentOwner || currentOwner.token !== owner.token) return;
+					if (!currentOwner || currentOwner.token !== owner.token) return false;
 					fs.rmSync(leaseDir, { recursive: true, force: true });
+					return !fs.existsSync(leaseDir);
 				},
 			};
 		}

package/src/runs/shared/structured-output.ts

@@ -1,11 +1,14 @@
 import * as fs from "node:fs";
+import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path from "node:path";
-import { Compile } from "typebox/compile";
+import { pathToFileURL } from "node:url";
+import { PI_CODING_AGENT_PACKAGE_ROOT_ENV } from "../../shared/utils.ts";
 import type { JsonSchemaObject } from "../../shared/types.ts";
 
 export const STRUCTURED_OUTPUT_SCHEMA_ENV = "PI_SUBAGENT_STRUCTURED_OUTPUT_SCHEMA";
 export const STRUCTURED_OUTPUT_CAPTURE_ENV = "PI_SUBAGENT_STRUCTURED_OUTPUT_CAPTURE";
+export const MISSING_STRUCTURED_OUTPUT_CALL_ERROR = "Missing structured_output call; this step has outputSchema and must finish by calling structured_output.";
 
 export interface StructuredOutputRuntime {
 	schema: JsonSchemaObject;
@@ -13,11 +16,108 @@ export interface StructuredOutputRuntime {
 	outputPath: string;
 }
 
+const SCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "$defs", "definitions", "dependentSchemas"] as const;
+const SCHEMA_SINGLE_KEYWORDS = ["additionalItems", "additionalProperties", "contains", "not", "propertyNames", "if", "then", "else", "unevaluatedItems", "unevaluatedProperties", "contentSchema"] as const;
+const SCHEMA_ARRAY_KEYWORDS = ["allOf", "anyOf", "oneOf", "prefixItems"] as const;
+
+function rewriteLocalJsonPointerRefs(schema: unknown, pointerPrefix: string, inheritsWrapperResource = true): unknown {
+	if (typeof schema === "boolean" || !schema || typeof schema !== "object" || Array.isArray(schema)) return schema;
+	const source = schema as Record<string, unknown>;
+	const rewritten: Record<string, unknown> = { ...source };
+	const sharesWrapperResource = inheritsWrapperResource && typeof source.$id !== "string";
+	if (sharesWrapperResource) {
+		for (const keyword of ["$ref", "$dynamicRef", "$recursiveRef"] as const) {
+			const ref = source[keyword];
+			if (ref === "#") rewritten[keyword] = pointerPrefix;
+			else if (typeof ref === "string" && ref.startsWith("#/")) rewritten[keyword] = `${pointerPrefix}${ref.slice(1)}`;
+		}
+	}
+	for (const keyword of SCHEMA_MAP_KEYWORDS) {
+		const entries = source[keyword];
+		if (!entries || typeof entries !== "object" || Array.isArray(entries)) continue;
+		rewritten[keyword] = Object.fromEntries(Object.entries(entries).map(([name, nested]) => [
+			name,
+			rewriteLocalJsonPointerRefs(nested, pointerPrefix, sharesWrapperResource),
+		]));
+	}
+	const items = source.items;
+	if (Array.isArray(items)) rewritten.items = items.map((nested) => rewriteLocalJsonPointerRefs(nested, pointerPrefix, sharesWrapperResource));
+	else if (items !== undefined) rewritten.items = rewriteLocalJsonPointerRefs(items, pointerPrefix, sharesWrapperResource);
+	for (const keyword of SCHEMA_SINGLE_KEYWORDS) {
+		if (source[keyword] !== undefined) rewritten[keyword] = rewriteLocalJsonPointerRefs(source[keyword], pointerPrefix, sharesWrapperResource);
+	}
+	for (const keyword of SCHEMA_ARRAY_KEYWORDS) {
+		if (Array.isArray(source[keyword])) rewritten[keyword] = source[keyword].map((nested) => rewriteLocalJsonPointerRefs(nested, pointerPrefix, sharesWrapperResource));
+	}
+	const dependencies = source.dependencies;
+	if (dependencies && typeof dependencies === "object" && !Array.isArray(dependencies)) {
+		rewritten.dependencies = Object.fromEntries(Object.entries(dependencies).map(([name, nested]) => [
+			name,
+			Array.isArray(nested) ? nested : rewriteLocalJsonPointerRefs(nested, pointerPrefix, sharesWrapperResource),
+		]));
+	}
+	return rewritten;
+}
+
+export function createStructuredOutputToolParameters(schema: JsonSchemaObject): JsonSchemaObject {
+	return {
+		type: "object",
+		properties: { value: rewriteLocalJsonPointerRefs(schema, "#/properties/value") },
+		required: ["value"],
+		additionalProperties: false,
+	};
+}
+
 interface CompiledJsonSchema {
 	Check(value: unknown): boolean;
 	Errors(value: unknown): Iterable<{ instancePath?: string; message?: string }>;
 }
 
+type CompileJsonSchema = (schema: unknown) => CompiledJsonSchema;
+
+let cachedCompile: Promise<CompileJsonSchema> | undefined;
+
+export async function resolveCompileFromPackageRoot(packageRoot: string): Promise<CompileJsonSchema | undefined> {
+	const requireFromRoot = createRequire(path.join(packageRoot, "package.json"));
+	const resolved = requireFromRoot.resolve("typebox/compile");
+	const mod = (await import(pathToFileURL(resolved).href)) as { Compile?: unknown };
+	return typeof mod.Compile === "function" ? (mod.Compile as CompileJsonSchema) : undefined;
+}
+
+async function importCompile(): Promise<CompileJsonSchema> {
+	const failures: string[] = [];
+	try {
+		const mod = (await import("typebox/compile")) as { Compile?: unknown };
+		if (typeof mod.Compile === "function") return mod.Compile as CompileJsonSchema;
+		failures.push("typebox/compile did not export a Compile function");
+	} catch (error) {
+		failures.push(`direct import failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const packageRoot = process.env[PI_CODING_AGENT_PACKAGE_ROOT_ENV];
+	if (packageRoot) {
+		try {
+			const compile = await resolveCompileFromPackageRoot(packageRoot);
+			if (compile) return compile;
+			failures.push("Pi package root typebox/compile did not export a Compile function");
+		} catch (error) {
+			failures.push(`Pi package root import failed: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	} else {
+		failures.push(`${PI_CODING_AGENT_PACKAGE_ROOT_ENV} is not set`);
+	}
+	throw new Error(`Cannot load typebox/compile for structured output validation (${failures.join("; ")})`);
+}
+
+function loadCompile(): Promise<CompileJsonSchema> {
+	if (!cachedCompile) {
+		cachedCompile = importCompile().catch((error) => {
+			cachedCompile = undefined;
+			throw error;
+		});
+	}
+	return cachedCompile;
+}
+
 export function assertJsonSchemaObject(schema: unknown, label = "outputSchema"): asserts schema is JsonSchemaObject {
 	if (!schema || typeof schema !== "object" || Array.isArray(schema)) {
 		throw new Error(`${label} must be a JSON Schema object.`);
@@ -35,10 +135,11 @@ export function createStructuredOutputRuntime(schema: JsonSchemaObject, baseDir?
 	return { schema, schemaPath, outputPath };
 }
 
-export function validateStructuredOutputValue(schema: JsonSchemaObject, value: unknown): { status: "valid" } | { status: "invalid"; message: string } {
+export async function validateStructuredOutputValue(schema: JsonSchemaObject, value: unknown): Promise<{ status: "valid" } | { status: "invalid"; message: string }> {
+	const compile = await loadCompile();
 	let validator: CompiledJsonSchema;
 	try {
-		validator = (Compile as (schema: unknown) => CompiledJsonSchema)(schema);
+		validator = compile(schema);
 	} catch (error) {
 		return { status: "invalid", message: `invalid outputSchema: ${error instanceof Error ? error.message : String(error)}` };
 	}
@@ -52,9 +153,9 @@ export function validateStructuredOutputValue(schema: JsonSchemaObject, value: u
 	return { status: "invalid", message: errors.join("; ") || "schema validation failed" };
 }
 
-export function readStructuredOutput(runtime: StructuredOutputRuntime): { value?: unknown; error?: string } {
+export async function readStructuredOutput(runtime: StructuredOutputRuntime): Promise<{ value?: unknown; error?: string }> {
 	if (!fs.existsSync(runtime.outputPath)) {
-		return { error: "Missing structured_output call; this step has outputSchema and must finish by calling structured_output." };
+		return { error: MISSING_STRUCTURED_OUTPUT_CALL_ERROR };
 	}
 	let value: unknown;
 	try {
@@ -62,8 +163,12 @@ export function readStructuredOutput(runtime: StructuredOutputRuntime): { value?
 	} catch (error) {
 		return { error: `Failed to read structured output: ${error instanceof Error ? error.message : String(error)}` };
 	}
-	const validation = validateStructuredOutputValue(runtime.schema, value);
-	if (validation.status === "invalid") return { error: `Structured output validation failed: ${validation.message}` };
+	try {
+		const validation = await validateStructuredOutputValue(runtime.schema, value);
+		if (validation.status === "invalid") return { error: `Structured output validation failed: ${validation.message}` };
+	} catch (error) {
+		return { error: `Failed to validate structured output: ${error instanceof Error ? error.message : String(error)}` };
+	}
 	return { value };
 }