pi-subagents 0.47.0 → 0.48.0

package/src/runs/foreground/chain-execution.ts

@@ -34,6 +34,7 @@ import {
 import { discoverAvailableSkills, normalizeSkillInput } from "../../agents/skills.ts";
 import { INTERCOM_BRIDGE_MARKER } from "../../intercom/intercom-bridge.ts";
 import { runSync } from "./execution.ts";
+import { createTaskMutationArbiter } from "../shared/llm-intent-arbiter.ts";
 import { workflowForegroundSteeringLaunchOptions } from "./workflow-foreground-steering.ts";
 import {
 	beginForegroundChild,
@@ -42,6 +43,7 @@ import {
 	settleForegroundSchedulingOwner,
 	updateForegroundChild,
 } from "./foreground-control.ts";
+import { updateLiveEffectivePrompt } from "./prompt-audit.ts";
 import { buildChainSummary } from "../../shared/formatters.ts";
 import { compactForegroundDetails, getSingleResultOutput, mapConcurrent, resolveChildCwd, sumResultsCost, sumResultsUsage } from "../../shared/utils.ts";
 import { DEFAULT_GLOBAL_CONCURRENCY_LIMIT, Semaphore } from "../shared/parallel-utils.ts";
@@ -71,6 +73,7 @@ import {
 	type ResolvedControlConfig,
 	type ResolvedTurnBudget,
 	type ResolvedToolBudget,
+	type RunFanoutBudgetDescriptor,
 	type SingleResult,
 	type ToolBudgetConfig,
 	type ChainCheckpointState,
@@ -86,6 +89,7 @@ import { ChainOutputValidationError, outputEntryFromResult, resolveOutputReferen
 import { createStructuredOutputRuntime } from "../shared/structured-output.ts";
 import { collectDynamicResults, DynamicFanoutError, materializeDynamicParallelStep, validateDynamicCollection, type DynamicCollectedResult } from "../shared/dynamic-fanout.ts";
 import { acceptanceFailureMessage, aggregateAcceptanceReport, evaluateAcceptance, resolveEffectiveAcceptance } from "../shared/acceptance.ts";
+import { claimRunFanoutBatch, RunFanoutLimitError } from "../shared/run-fanout-budget.ts";
 import { isAgentContractV1 } from "../shared/agent-contract.ts";
 import type { ChainOutputMap } from "../../shared/types.ts";
 import { validateToolBudgetConfig } from "../shared/tool-budget.ts";
@@ -167,6 +171,7 @@ interface ParallelChainRunInput {
 	configToolBudget?: ToolBudgetConfig;
 	globalSemaphore?: Semaphore;
 	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
+	runFanoutBudget?: RunFanoutBudgetDescriptor;
 	permissions?: PermissionConfig;
 	dynamic?: boolean;
 }
@@ -368,7 +373,11 @@ async function runParallelChainTasks(input: ParallelChainRunInput): Promise<Sing
 				beginForegroundChild(input.foregroundControl, {
 					index: childIndex,
 					agent: task.agent,
-					description: cleanTask.trim(),
+					authoredTask: cleanTask,
+					effectivePrompt: taskStr,
+					cwd: taskCwd,
+					...(outputPath ? { outputPath } : {}),
+					description: `${task.agent} child`,
 					...(effectiveModel ? { model: effectiveModel } : {}),
 					...(thinking ? { thinking } : {}),
 					interrupt: () => {
@@ -388,8 +397,10 @@ async function runParallelChainTasks(input: ParallelChainRunInput): Promise<Sing
 				result = await runSync(input.ctx.cwd, input.agents, task.agent, taskStr, {
 				permissions: input.permissions,
 				parentSessionId: input.ctx.sessionManager.getSessionId() ?? undefined,
+				llmIntentArbiter: createTaskMutationArbiter(input.ctx),
 				...workflowForegroundSteeringLaunchOptions(input.foregroundControl, childIndex),
 				capabilityCeiling: input.capabilityCeiling,
+				runFanoutBudget: input.runFanoutBudget ? { ...input.runFanoutBudget, parentPath: `${input.runFanoutBudget.parentPath ? `${input.runFanoutBudget.parentPath}/` : ""}chain[${input.stepIndex}]${input.dynamic ? `.expand[${taskIndex}]` : `.parallel[${taskIndex}]`}` } : undefined,
 				context: input.contextForAgent?.(task.agent),
 				cwd: taskCwd,
 				signal: input.signal,
@@ -422,6 +433,7 @@ async function runParallelChainTasks(input: ParallelChainRunInput): Promise<Sing
 				agentContract,
 				acceptance: task.acceptance,
 				acceptanceContext: { mode: "chain", dynamic: input.dynamic && task.acceptance === undefined },
+				onEffectivePrompt: input.foregroundControl ? (prompt) => updateLiveEffectivePrompt(input.foregroundControl!, childIndex, prompt) : undefined,
 				timeoutMs: input.timeoutMs,
 				deadlineAt: input.deadlineAt,
 				turnBudget: input.turnBudget,
@@ -540,6 +552,7 @@ interface ChainExecutionParams {
 	/** Global cap on simultaneously-running tasks within this chain. Defaults to DEFAULT_GLOBAL_CONCURRENCY_LIMIT. */
 	globalConcurrencyLimit?: number;
 	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
+	runFanoutBudget?: RunFanoutBudgetDescriptor;
 }
 
 interface ChainExecutionResult {
@@ -876,6 +889,7 @@ ${step.message}` : ""}` }],
 					configToolBudget: params.configToolBudget,
 					globalSemaphore,
 					permissions: params.permissions,
+					runFanoutBudget: params.runFanoutBudget,
 				});
 				globalTaskIndex += step.parallel.length;
 
@@ -1002,6 +1016,19 @@ ${step.message}` : ""}` }],
 				return buildChainExecutionErrorResult(message, makeDetailsInput({ currentStepIndex: stepIndex, currentFlatIndex: globalTaskIndex }));
 			}
 
+			try {
+				if (params.runFanoutBudget) claimRunFanoutBatch(params.runFanoutBudget, materialized.parallel.map((_, itemIndex) => `chain[${stepIndex}].expand[${itemIndex}]`));
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				dynamicGroupStatuses[stepIndex] = { status: "failed", error: message };
+				const result = buildChainExecutionErrorResult(message, makeDetailsInput({ currentStepIndex: stepIndex, currentFlatIndex: globalTaskIndex }));
+				if (error instanceof RunFanoutLimitError) {
+					result.details.runFanoutBudget = error.snapshot;
+					result.details.runFanoutRejection = error.rejection;
+				}
+				return result;
+			}
+
 			dynamicChildren[stepIndex] = materialized.items.map((item, itemIndex) => ({
 				agent: step.parallel.agent,
 				label: materialized.parallel[itemIndex]?.label,
@@ -1137,6 +1164,7 @@ ${step.message}` : ""}` }],
 				configToolBudget: params.configToolBudget,
 				globalSemaphore,
 				permissions: params.permissions,
+				runFanoutBudget: params.runFanoutBudget,
 				dynamic: true,
 			});
 			globalTaskIndex = dynamicStartIndex + reservedDynamicItems;
@@ -1332,7 +1360,11 @@ ${step.message}` : ""}` }],
 				beginForegroundChild(foregroundControl, {
 					index: childIndex,
 					agent: seqStep.agent,
-					description: cleanTask.trim(),
+					authoredTask: cleanTask,
+					effectivePrompt: stepTask,
+					cwd,
+					...(outputPath ? { outputPath } : {}),
+					description: `${seqStep.agent} child`,
 					...(effectiveModel ? { model: effectiveModel } : {}),
 					...(thinking ? { thinking } : {}),
 					interrupt: () => {
@@ -1369,8 +1401,10 @@ ${step.message}` : ""}` }],
 				r = await runSync(ctx.cwd, agents, seqStep.agent, stepTask, {
 				permissions: params.permissions,
 				parentSessionId: ctx.sessionManager.getSessionId() ?? undefined,
+				llmIntentArbiter: createTaskMutationArbiter(ctx),
 				...workflowForegroundSteeringLaunchOptions(params.foregroundControl, childIndex),
 				capabilityCeiling: params.capabilityCeiling,
+				runFanoutBudget: params.runFanoutBudget ? { ...params.runFanoutBudget, parentPath: `${params.runFanoutBudget.parentPath ? `${params.runFanoutBudget.parentPath}/` : ""}chain[${stepIndex}]` } : undefined,
 				context: params.contextForAgent?.(seqStep.agent),
 				cwd: resolveChildCwd(cwd ?? ctx.cwd, seqStep.cwd),
 				signal,
@@ -1403,6 +1437,7 @@ ${step.message}` : ""}` }],
 				agentContract,
 				acceptance: seqStep.acceptance,
 				acceptanceContext: { mode: "chain" },
+				onEffectivePrompt: foregroundControl ? (prompt) => updateLiveEffectivePrompt(foregroundControl, childIndex, prompt) : undefined,
 				timeoutMs: params.timeoutMs,
 				deadlineAt,
 				turnBudget: params.turnBudget,

package/src/runs/foreground/execution.ts

@@ -54,18 +54,19 @@ import {
 import { buildSkillInjection, resolveSkillsWithFallback } from "../../agents/skills.ts";
 import { buildAgentMemoryInjection } from "../../agents/agent-memory.ts";
 import { evaluateCompletionMutationGuard } from "../shared/completion-guard.ts";
+import { arbitrateCompletionGuardRescue } from "../shared/llm-intent-arbiter.ts";
 import { getPiSpawnCommand } from "../shared/pi-spawn.ts";
 import { createJsonlWriter } from "../../shared/jsonl-writer.ts";
 import { attachPostExitStdioGuard, trySignalChild } from "../../shared/post-exit-stdio-guard.ts";
 import { resolvePermissionRules } from "../shared/permissions.ts";
-import { applyThinkingSuffix, buildPiArgs, cleanupTempDir, projectLaunchResolvedChildExtensions, resolvePiLaunchToolPlan } from "../shared/pi-args.ts";
+import { applyThinkingSuffix, buildPiArgs, cleanupTempDir, projectLaunchResolvedChildExtensions, resolvePiLaunchToolPlan, type SubagentTaskDelivery } from "../shared/pi-args.ts";
 import { readRuntimeAcknowledgedExtensions } from "../shared/runtime-acknowledged-extensions.ts";
 import { assertAgentAllowedByCapabilityCeiling, decodeSubagentCapabilityCeiling, intersectSubagentCapabilityCeilings, resolveCurrentSubagentCapabilityCeiling, SUBAGENT_CAPABILITY_CEILING_ENV } from "../shared/capability-ceiling.ts";
 import { resolveEffectiveThinking } from "../../shared/model-info.ts";
 import { MISSING_STRUCTURED_OUTPUT_CALL_ERROR, readStructuredOutput } from "../shared/structured-output.ts";
 import { formatProcessSignalError, isUnexplainedProcessSignal } from "../shared/process-signal.ts";
 import { readChildToolDiagnosticError } from "../shared/tool-availability.ts";
-import { captureSingleOutputSnapshot, extractChildWrittenOutput, formatSavedOutputReference, injectOutputPathSystemPrompt, resolveSingleOutput, validateFileOnlyOutputMode, type SingleOutputSnapshot } from "../shared/single-output.ts";
+import { captureSingleOutputSnapshot, extractChildWrittenOutput, finalizeSingleOutput, formatSavedOutputReference, injectOutputPathSystemPrompt, resolveSingleOutput, validateFileOnlyOutputMode, type SingleOutputSnapshot } from "../shared/single-output.ts";
 import {
 	buildModelCandidates,
 	formatModelAttemptNote,
@@ -90,6 +91,7 @@ import {
 	summarizeRecentMutatingFailures,
 } from "../shared/long-running-guard.ts";
 import { acceptanceFailureMessage, buildSkippedAcceptanceLedger, evaluateAcceptance, formatAcceptancePrompt, resolveEffectiveAcceptance, stripAcceptanceReport, validateAcceptanceInput } from "../shared/acceptance.ts";
+import { PROMPT_REDACTED } from "../../shared/utils.ts";
 import { attachContractProjections, isAgentContractV1 } from "../shared/agent-contract.ts";
 import { appendTurnBudgetSystemPrompt, formatTurnBudgetOutput, initialTurnBudgetState, turnBudgetDecision, turnBudgetDeferredNote, turnBudgetDeferredState, turnBudgetExceededMessage, turnBudgetSoftNote, turnBudgetState } from "../shared/turn-budget.ts";
 import { initialToolBudgetState, toolBudgetState } from "../shared/tool-budget.ts";
@@ -117,6 +119,12 @@ function withRunContext<T extends SingleResult>(result: T, context: RunSyncOptio
 	return result;
 }
 
+function redactResultPrompt<T extends SingleResult>(result: T): T {
+	result.task = PROMPT_REDACTED;
+	if (result.progress) result.progress.task = PROMPT_REDACTED;
+	return result;
+}
+
 function sumUsage(target: Usage, source: Usage): void {
 	target.input += source.input;
 	target.output += source.output;
@@ -139,7 +147,7 @@ function persistSingleResultMetadata(input: {
 	writeMetadata(input.metadataPath, {
 		runId: input.runId,
 		agent: input.agent,
-		task: input.task,
+		task: PROMPT_REDACTED,
 		exitCode: target.exitCode,
 		processSignal: target.processSignal,
 		usage: target.usage,
@@ -231,6 +239,7 @@ function stripAcceptanceReportsFromMessages(messages: Message[] | undefined): vo
 function snapshotProgress(progress: AgentProgress): AgentProgress {
 	return {
 		...progress,
+		task: PROMPT_REDACTED,
 		skills: progress.skills ? [...progress.skills] : undefined,
 		recentTools: boundStreamedRecentTools(progress.recentTools),
 		recentOutput: boundStreamedRecentOutput(progress.recentOutput),
@@ -240,6 +249,7 @@ function snapshotProgress(progress: AgentProgress): AgentProgress {
 function snapshotResult(result: SingleResult, progress: AgentProgress): SingleResult {
 	return {
 		...result,
+		task: PROMPT_REDACTED,
 		messages: result.outputMode === "file-only" && result.savedOutputPath ? undefined : result.messages ? [...result.messages] : undefined,
 		usage: { ...result.usage },
 		skills: result.skills ? [...result.skills] : undefined,
@@ -291,6 +301,7 @@ async function runSingleAttempt(
 		attemptNotes: string[];
 		outputSnapshot?: SingleOutputSnapshot;
 		originalTask?: string;
+		taskDelivery?: SubagentTaskDelivery;
 	},
 ): Promise<SingleResult> {
 	const effectiveThinking = options.thinkingOverride ?? agent.thinking;
@@ -312,6 +323,7 @@ async function runSingleAttempt(
 	const { args, env: sharedEnv, tempDir, toolDiagnosticPath, runtimeAcknowledgedExtensionsPath, capabilityAudit } = buildPiArgs({
 		baseArgs: ["--mode", "json", "-p"],
 		task,
+		taskDelivery: shared.taskDelivery,
 		sessionEnabled: shared.sessionEnabled,
 		sessionDir: options.sessionDir,
 		sessionFile: options.sessionFile,
@@ -337,6 +349,7 @@ async function runSingleAttempt(
 		parentControlInbox: options.nestedRoute?.controlInbox,
 		parentRootRunId: options.nestedRoute?.rootRunId,
 		parentCapabilityToken: options.nestedRoute?.capabilityToken,
+		runFanoutBudget: options.runFanoutBudget,
 		parentSessionId: options.parentSessionId,
 		steerInboxDir: options.steerInboxDir,
 		steerCapabilityPath: options.steerCapabilityPath,
@@ -1277,15 +1290,38 @@ async function runSingleAttempt(
 			mcpDirectTools: agent.mcpDirectTools,
 		})
 		: undefined;
-	const completionGuardTriggered = completionGuard?.triggered === true && !observedMutationAttempt;
+	let completionGuardTriggered = completionGuard?.triggered === true && !observedMutationAttempt;
+	// The classifier is deliberately narrow, so a read-only review task can
+	// still be misread as implementation. Arbitrate BEFORE any failure side
+	// effect is published (effects, exit code, progress, notifications,
+	// acceptance, output persistence): only a confident read-only verdict
+	// rescues, and the task text alone is evidence — never the child's own
+	// final message.
+	let arbiterRescued = false;
+	if (completionGuardTriggered) {
+		const arbitration = await arbitrateCompletionGuardRescue({
+			guardTriggered: true,
+			task: shared.originalTask ?? task,
+			arbiter: options.llmIntentArbiter,
+		});
+		completionGuardTriggered = arbitration.triggered;
+		arbiterRescued = arbitration.rescued;
+	}
 	if (completionGuard) {
 		result.effects = {
 			...(result.effects ?? {}),
 			fileMutation: {
-				status: completionGuard.expectedMutation ? completionGuardTriggered ? "missing" : "observed" : "not-applicable",
+				status: completionGuard.expectedMutation
+					? completionGuardTriggered
+						? "missing"
+						: arbiterRescued
+							? "not-applicable"
+							: "observed"
+					: "not-applicable",
 				expected: completionGuard.expectedMutation,
 				attempted: completionGuard.attemptedMutation || observedMutationAttempt,
 				...(completionGuardTriggered ? { message: "Subagent completed without making edits for an implementation task." } : {}),
+				...(arbiterRescued ? { resolvedBy: "llm-intent-arbiter" } : {}),
 			},
 		};
 	}
@@ -1355,7 +1391,7 @@ async function runSyncCompletion(
 	};
 	const agent = agents.find((a) => a.name === agentName);
 	if (!agent) {
-		return withRunContext({
+		return redactResultPrompt(withRunContext({
 			index: options.index ?? 0,
 			agent: agentName,
 			task,
@@ -1363,12 +1399,12 @@ async function runSyncCompletion(
 			messages: [],
 			usage: emptyUsage(),
 			error: `Unknown agent: ${agentName}`,
-		}, options.context);
+		}, options.context));
 	}
 	try {
 		assertAgentAllowedByCapabilityCeiling(agent.name, options.capabilityCeiling);
 	} catch (error) {
-		return withRunContext({
+		return redactResultPrompt(withRunContext({
 			index: options.index ?? 0,
 			agent: agent.name,
 			task,
@@ -1377,11 +1413,11 @@ async function runSyncCompletion(
 			usage: emptyUsage(),
 			error: error instanceof Error ? error.message : String(error),
 			...(options.capabilityCeiling ? { capabilityCeiling: options.capabilityCeiling } : {}),
-		}, options.context);
+		}, options.context));
 	}
 	const acceptanceErrors = validateAcceptanceInput(options.acceptance);
 	if (acceptanceErrors.length > 0) {
-		return withRunContext({
+		return redactResultPrompt(withRunContext({
 			index: options.index ?? 0,
 			agent: agentName,
 			task,
@@ -1389,11 +1425,11 @@ async function runSyncCompletion(
 			messages: [],
 			usage: emptyUsage(),
 			error: acceptanceErrors.join(" "),
-		}, options.context);
+		}, options.context));
 	}
 	const outputModeValidationError = validateFileOnlyOutputMode(options.outputMode, options.outputPath, `Single run (${agentName})`);
 	if (outputModeValidationError) {
-		return withRunContext({
+		return redactResultPrompt(withRunContext({
 			index: options.index ?? 0,
 			agent: agentName,
 			task,
@@ -1402,7 +1438,7 @@ async function runSyncCompletion(
 			usage: emptyUsage(),
 			outputMode: options.outputMode,
 			error: outputModeValidationError,
-		}, options.context);
+		}, options.context));
 	}
 
 	const shareEnabled = options.share === true;
@@ -1419,6 +1455,7 @@ async function runSyncCompletion(
 	});
 	const acceptancePrompt = formatAcceptancePrompt(effectiveAcceptance, { reportOptional: isAgentContractV1(options.agentContract) });
 	const taskWithAcceptance = acceptancePrompt ? `${task}\n${acceptancePrompt}` : task;
+	options.onEffectivePrompt?.(taskWithAcceptance);
 	const sessionEnabled = Boolean(options.sessionFile || options.sessionDir) || shareEnabled;
 	if (options.context === "fork" && options.sessionFile && existsSync(options.sessionFile)) {
 		alignForkedSessionCwd(options.sessionFile, options.cwd ?? runtimeCwd);
@@ -1433,7 +1470,7 @@ async function runSyncCompletion(
 		agent.filePath ? path.dirname(agent.filePath) : skillCwd,
 	);
 	if (skillNames.some((skill) => skill.trim() === "pi-subagents") && missingSkills.includes("pi-subagents")) {
-		return withRunContext({
+		return redactResultPrompt(withRunContext({
 			index: options.index ?? 0,
 			agent: agentName,
 			task,
@@ -1441,7 +1478,7 @@ async function runSyncCompletion(
 			messages: [],
 			usage: emptyUsage(),
 			error: "Skills not found: pi-subagents",
-		}, options.context);
+		}, options.context));
 	}
 	let systemPrompt = agent.systemPrompt?.trim() || "";
 	if (resolvedSkills.length > 0) {
@@ -1476,7 +1513,7 @@ async function runSyncCompletion(
 		artifactPathsResult = getArtifactPaths(options.artifactsDir, options.runId, agentName, options.index);
 		ensureArtifactsDir(options.artifactsDir);
 		if (options.artifactConfig?.includeInput !== false) {
-				writeArtifact(artifactPathsResult.inputPath, `# Task for ${agentName}\n\n${taskWithAcceptance}`);
+			writeArtifact(artifactPathsResult.inputPath, `# Task for ${agentName}\n\n${PROMPT_REDACTED}; live Prompt Audit only.\n`);
 		}
 		if (options.artifactConfig?.includeJsonl !== false) {
 			jsonlPath = artifactPathsResult.jsonlPath;
@@ -1490,7 +1527,7 @@ async function runSyncCompletion(
 				childIndex: options.index,
 				cwd: options.cwd ?? runtimeCwd,
 			});
-			transcriptWriter.writeInitialUserMessage(taskWithAcceptance);
+			transcriptWriter.writeInitialUserMessage(`${PROMPT_REDACTED}; live Prompt Audit only.`);
 		}
 	}
 
@@ -1526,6 +1563,9 @@ async function runSyncCompletion(
 	};
 	let lastResult: SingleResult | undefined;
 	const modelsToTry = candidates.length > 0 ? candidates : [undefined];
+	// Escalated to "file" after an unexplained zero-activity startup failure so
+	// retries keep the task text out of argv (endpoint pre-exec scans may deny it).
+	let taskDeliveryOverride: SubagentTaskDelivery | undefined;
 	modelAttemptsLoop: for (let modelIndex = 0; modelIndex < modelsToTry.length; modelIndex++) {
 		const candidate = modelsToTry[modelIndex];
 		for (let startupAttemptIndex = 0; ; startupAttemptIndex++) {
@@ -1544,6 +1584,7 @@ async function runSyncCompletion(
 					.filter((modelCandidate): modelCandidate is string => Boolean(modelCandidate)),
 				outputSnapshot,
 				originalTask: task,
+				taskDelivery: taskDeliveryOverride,
 			});
 			lastResult = result;
 			if (startupAttemptIndex === 0) {
@@ -1612,6 +1653,10 @@ async function runSyncCompletion(
 					}
 					break modelAttemptsLoop;
 				}
+				if (!taskDeliveryOverride && result.processSignal === "SIGKILL") {
+					taskDeliveryOverride = "file";
+					attemptNotes.push("[startup-retry] retrying with file task delivery to keep the task text out of the child process argv.");
+				}
 				attempt.error = retryNote;
 				attemptNotes.push(retryNote);
 				continue;
@@ -1726,13 +1771,39 @@ async function runSyncCompletion(
 	stripAcceptanceReportsFromMessages(result.messages);
 	if (acceptanceFailure && result.acceptance.explicit && result.exitCode === 0 && !result.interrupted && !result.timedOut && !isAgentContractV1(options.agentContract)) {
 		result.exitCode = 1;
+		if (result.savedOutputPath) {
+			result.finalOutput = finalizeSingleOutput({
+				fullOutput: result.finalOutput ?? "",
+				outputPath: options.outputPath,
+				outputMode: result.outputMode,
+				exitCode: result.exitCode,
+				preserveSavedOutput: true,
+				savedPath: result.savedOutputPath,
+				outputReference: result.outputReference,
+			}).displayOutput;
+			artifactOutputByResult.set(result, result.finalOutput);
+		}
 		result.error = result.error ? `${result.error}\n${acceptanceFailure}` : acceptanceFailure;
+		if (artifactPathsResult && options.artifactConfig?.enabled !== false && options.artifactConfig?.includeOutput !== false) {
+			try {
+				writeArtifact(artifactPathsResult.outputPath, formatOutputArtifactContent({
+					output: artifactOutputByResult.get(result) ?? result.finalOutput ?? "",
+					error: result.error,
+					transcriptPath: result.transcriptPath,
+					metadataPath: options.artifactConfig?.includeMetadata === false ? undefined : artifactPathsResult.metadataPath,
+				}));
+			} catch (error) {
+				const message = `Artifact output post-processing failed: ${error instanceof Error ? error.message : String(error)}`;
+				result.outputSaveError = result.outputSaveError ? `${result.outputSaveError}\n${message}` : message;
+			}
+		}
 		if (result.progress) {
 			result.progress.status = "failed";
 			result.progress.error = result.error;
 		}
 	}
 	if (isAgentContractV1(options.agentContract)) attachContractProjections(result);
+	redactResultPrompt(result);
 	try {
 		persistResultMetadata(result);
 	} catch (error) {
@@ -1817,7 +1888,7 @@ export async function runSync(
 				durationMs: publishedReceipt.progressSummary?.durationMs ?? 0,
 				error: failureMessage,
 			};
-		const failedResult: SingleResult = {
+		const failedResult: SingleResult = redactResultPrompt({
 			...publishedReceipt,
 			detached: undefined,
 			detachedReason,
@@ -1833,7 +1904,7 @@ export async function runSync(
 			acceptance: publishedReceipt.acceptance
 				? buildSkippedAcceptanceLedger(publishedReceipt.acceptance.effectiveAcceptance, { id: "completion-pipeline", message: failureMessage })
 				: undefined,
-		};
+		});
 		if (strictContract) attachContractProjections(failedResult);
 		try {
 			// Replace the provisional detach receipt metadata with the authoritative

package/src/runs/foreground/foreground-control.ts

@@ -1,9 +1,15 @@
 import type { AgentProgress, ForegroundChildControl, ForegroundRunControl } from "../../shared/types.ts";
+import { registerLivePromptAudit, removeLivePromptAudit, type PromptAuditRerunContract } from "./prompt-audit.ts";
 
 interface BeginForegroundChildInput {
 	index: number;
 	agent: string;
 	description?: string;
+	authoredTask: string;
+	effectivePrompt: string;
+	cwd?: string;
+	outputPath?: string;
+	rerun?: PromptAuditRerunContract;
 	model?: string;
 	thinking?: string;
 	interrupt: () => boolean;
@@ -109,6 +115,11 @@ export function beginForegroundChild(control: ForegroundRunControl, input: Begin
 	}
 	control.activeChildren ??= new Map();
 	control.activeChildren.set(input.index, child);
+	registerLivePromptAudit(control, input.index, input.authoredTask, input.effectivePrompt, {
+		...(input.cwd ? { cwd: input.cwd } : {}),
+		...(input.outputPath ? { outputPath: input.outputPath } : {}),
+		...(input.rerun ? { rerun: input.rerun } : {}),
+	});
 	syncCurrentChild(control, child);
 }
 
@@ -121,6 +132,7 @@ export function updateForegroundChild(control: ForegroundRunControl, index: numb
 }
 
 export function finishForegroundChild(control: ForegroundRunControl, index: number): void {
+	removeLivePromptAudit(control, index);
 	control.activeChildren?.delete(index);
 	if (control.currentIndex === index) {
 		const next = [...(control.activeChildren?.values() ?? [])]

package/src/runs/foreground/prompt-audit.ts

@@ -0,0 +1,171 @@
+import { Agent, type StreamFn, type ThinkingLevel } from "@earendil-works/pi-agent-core";
+import { convertToLlm, type ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { streamSimple } from "@earendil-works/pi-ai/compat";
+import type { Model } from "@earendil-works/pi-ai";
+import type { ForegroundRunControl } from "../../shared/types.ts";
+export type PromptAuditView = "authored" | "runtime" | "effective";
+
+export interface PromptAuditRerunContract {
+	params: Record<string, unknown>;
+}
+
+export interface LivePromptAudit {
+	authoredTask: string;
+	runtimeAdditions: string;
+	finalEffectivePrompt: string;
+	cwd?: string;
+	outputPath?: string;
+	rerun?: PromptAuditRerunContract;
+}
+
+const livePrompts = new WeakMap<ForegroundRunControl, Map<number, LivePromptAudit>>();
+
+type RegistryModel = Model<any>;
+
+function fullModelId(model: Pick<RegistryModel, "provider" | "id">): string {
+	return `${model.provider}/${model.id}`;
+}
+
+function textContent(value: unknown): string {
+	if (typeof value === "string") return value;
+	if (!Array.isArray(value)) return "";
+	return value.map((item) => item && typeof item === "object" && (item as { type?: unknown }).type === "text" ? String((item as { text?: unknown }).text ?? "") : "").join("");
+}
+
+function finalAssistantText(agent: Agent): string {
+	for (let index = agent.state.messages.length - 1; index >= 0; index--) {
+		const message = agent.state.messages[index];
+		if (message && typeof message === "object" && (message as { role?: unknown }).role === "assistant") {
+			return textContent((message as { content?: unknown }).content).trim();
+		}
+	}
+	return "";
+}
+
+async function resolveRewriteAuth(ctx: ExtensionContext, model: RegistryModel): Promise<{ apiKey?: string; headers?: Record<string, string>; env?: Record<string, string> }> {
+	const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+	if (auth.ok === false) throw new Error(`Prompt redo model auth failed for ${fullModelId(model)}: ${auth.error}`);
+	return {
+		...(auth.apiKey ? { apiKey: auth.apiKey } : {}),
+		...(auth.headers ? { headers: auth.headers } : {}),
+		...(auth.env ? { env: auth.env } : {}),
+	};
+}
+
+export async function rewritePromptWithGuidance(input: {
+	ctx: ExtensionContext;
+	authoredTask: string;
+	runtimeAdditions: string;
+	finalEffectivePrompt: string;
+	guidance: string;
+	signal?: AbortSignal;
+	streamFn?: StreamFn;
+}): Promise<string> {
+	const model = input.ctx.model;
+	if (!model) throw new Error("Prompt redo needs the current session model to rewrite the authored task.");
+	const auth = await resolveRewriteAuth(input.ctx, model);
+	const registeredProvider = (input.ctx.modelRegistry as {
+		getRegisteredProviderConfig?: (provider: string) => { api?: string; streamSimple?: StreamFn } | undefined;
+	}).getRegisteredProviderConfig?.(model.provider);
+	const baseStreamFn = input.streamFn ?? (registeredProvider?.streamSimple && registeredProvider.api === model.api
+		? registeredProvider.streamSimple
+		: streamSimple);
+	const streamFn: StreamFn = (nextModel, context, streamOptions) => baseStreamFn(nextModel, context, {
+		...streamOptions,
+		...(auth.apiKey ? { apiKey: auth.apiKey } : {}),
+		env: auth.env || streamOptions?.env ? { ...(auth.env ?? {}), ...(streamOptions?.env ?? {}) } : undefined,
+		headers: { ...(streamOptions?.headers ?? {}), ...(auth.headers ?? {}) },
+	});
+	const ctxThinking = (input.ctx as { getThinkingLevel?: () => ThinkingLevel }).getThinkingLevel?.();
+	const agent = new Agent({
+		initialState: {
+			systemPrompt: [
+				"Rewrite one subagent authored task from Prompt Audit context.",
+				"Return only the revised authored task text.",
+				"Do not add Markdown fences, explanations, labels, or commentary.",
+				"Preserve the original intent unless the guidance explicitly changes it.",
+				"Do not include runtime additions unless they are needed as ordinary task context.",
+			].join("\n"),
+			model,
+			thinkingLevel: ctxThinking ?? "off",
+			tools: [],
+		},
+		convertToLlm,
+		streamFunction: streamFn,
+		getApiKey: (providerName) => providerName === model.provider ? auth.apiKey : undefined,
+		toolExecution: "sequential",
+	});
+	const abort = () => agent.abort();
+	input.ctx.signal?.addEventListener("abort", abort, { once: true });
+	input.signal?.addEventListener("abort", abort, { once: true });
+	try {
+		await agent.prompt([
+			"Guidance from the human:",
+			input.guidance.trim(),
+			"",
+			"Authored task:",
+			input.authoredTask,
+			"",
+			"Runtime additions for context only:",
+			input.runtimeAdditions,
+			"",
+			"Final effective prompt for context only:",
+			input.finalEffectivePrompt,
+		].join("\n"));
+	} finally {
+		input.ctx.signal?.removeEventListener("abort", abort);
+		input.signal?.removeEventListener("abort", abort);
+	}
+	const rewritten = finalAssistantText(agent);
+	if (!rewritten) throw new Error("Prompt redo rewrite returned an empty prompt.");
+	return rewritten;
+}
+
+function runtimeAdditions(authoredTask: string, effectivePrompt: string): string {
+	if (!authoredTask) return effectivePrompt;
+	const authoredIndex = effectivePrompt.indexOf(authoredTask);
+	if (authoredIndex < 0) return "(runtime additions unavailable)";
+	const before = effectivePrompt.slice(0, authoredIndex).trim();
+	const after = effectivePrompt.slice(authoredIndex + authoredTask.length).trim();
+	return [before, after].filter(Boolean).join("\n\n") || "(none)";
+}
+
+export function registerLivePromptAudit(
+	control: ForegroundRunControl,
+	index: number,
+	authoredTask: string,
+	effectivePrompt: string,
+	metadata: { cwd?: string; outputPath?: string; rerun?: PromptAuditRerunContract } = {},
+): void {
+	let prompts = livePrompts.get(control);
+	if (!prompts) {
+		prompts = new Map();
+		livePrompts.set(control, prompts);
+	}
+	prompts.set(index, {
+		authoredTask,
+		runtimeAdditions: runtimeAdditions(authoredTask, effectivePrompt),
+		finalEffectivePrompt: effectivePrompt,
+		...(metadata.cwd ? { cwd: metadata.cwd } : {}),
+		...(metadata.outputPath ? { outputPath: metadata.outputPath } : {}),
+		...(metadata.rerun ? { rerun: metadata.rerun } : {}),
+	});
+}
+
+export function updateLiveEffectivePrompt(control: ForegroundRunControl, index: number, effectivePrompt: string): void {
+	const prompt = livePrompts.get(control)?.get(index);
+	if (!prompt) return;
+	prompt.finalEffectivePrompt = effectivePrompt;
+	prompt.runtimeAdditions = runtimeAdditions(prompt.authoredTask, effectivePrompt);
+}
+
+export function getLivePromptAudit(control: ForegroundRunControl, index: number): LivePromptAudit | undefined {
+	return livePrompts.get(control)?.get(index);
+}
+
+export function removeLivePromptAudit(control: ForegroundRunControl, index: number): void {
+	const prompts = livePrompts.get(control);
+	if (!prompts) return;
+	prompts.delete(index);
+	if (prompts.size === 0) livePrompts.delete(control);
+}