pi-subagents 0.53.0 → 0.54.0

package/src/runs/shared/model-scope.ts

@@ -15,7 +15,7 @@
 
 import { splitKnownThinkingSuffix } from "../../shared/model-info.ts";
 
-export interface ModelScopeConfig {
+export interface ModelScopeRule {
 	enforce?: boolean;
 	/** Reject inherited and fallback models outside the allowlist instead of warning. */
 	strict?: boolean;
@@ -23,6 +23,19 @@ export interface ModelScopeConfig {
 	allow?: string[];
 }
 
+export interface ModelScopeConfig extends ModelScopeRule {
+	/** Additional restrictions keyed by canonical agent name. */
+	agents?: Record<string, ModelScopeRule>;
+}
+
+export interface ModelScopeCheckRule extends ModelScopeRule {
+	origin?: string;
+}
+
+export interface ResolvedModelScope extends ModelScopeCheckRule {
+	origin: string;
+}
+
 /** Where a resolved model originated, deciding enforcement severity. */
 export type ModelSource = "explicit" | "inherited";
 
@@ -32,6 +45,7 @@ export interface ModelScopeViolation {
 	severity: "warn" | "error";
 	message: string;
 	allowedPatterns: string[];
+	origin: string;
 }
 
 function stripThinkingSuffix(model: string): string {
@@ -61,7 +75,7 @@ export function matchesScopePattern(model: string, pattern: string): boolean {
  */
 export function checkModelScope(
 	model: string | undefined,
-	scope: ModelScopeConfig | undefined,
+	scope: ModelScopeCheckRule | undefined,
 	source: ModelSource,
 ): ModelScopeViolation | undefined {
 	if (!model || !scope?.enforce) return undefined;
@@ -71,16 +85,89 @@ export function checkModelScope(
 
 	const baseModel = stripThinkingSuffix(model);
 	const severity: ModelScopeViolation["severity"] = source === "explicit" || scope.strict === true ? "error" : "warn";
+	const origin = scope.origin ?? "modelScope";
 	return {
 		model: baseModel,
 		severity,
 		allowedPatterns: allow,
+		origin,
 		message:
-			`Model '${baseModel}' is outside the configured subagent model scope. ` +
+			`Model '${baseModel}' is outside the configured subagent model scope (${origin}). ` +
 			`Allowed patterns: ${allow.join(", ")}.`,
 	};
 }
 
+function expandInheritPattern(pattern: string, parentModel: { provider: string; id: string } | undefined): string {
+	return pattern === "inherit" && parentModel ? `${parentModel.provider}/${parentModel.id}` : pattern;
+}
+
+function assertRecord(value: unknown, field: string, meta: { filePath: string }, expected = "an object"): Record<string, unknown> {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected ${expected}.`);
+	}
+	return value as Record<string, unknown>;
+}
+
+function parseAllowList(value: unknown, field: string, meta: { filePath: string }): string[] {
+	if (!Array.isArray(value)) {
+		throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected an array of strings.`);
+	}
+	const allow: string[] = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") {
+			throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected an array of strings.`);
+		}
+		const trimmed = entry.trim();
+		if (trimmed) allow.push(trimmed);
+	}
+	if (allow.length === 0) {
+		throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected a non-empty array of patterns.`);
+	}
+	return allow;
+}
+
+function parseScopeRule(input: Record<string, unknown>, field: string, meta: { filePath: string }): ModelScopeRule {
+	const rule: ModelScopeRule = {};
+	if ("enforce" in input) {
+		if (typeof input.enforce !== "boolean") throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}.enforce'; expected a boolean.`);
+		rule.enforce = input.enforce;
+	}
+	if ("strict" in input) {
+		if (typeof input.strict !== "boolean") throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}.strict'; expected a boolean.`);
+		rule.strict = input.strict;
+	}
+	if ("allow" in input) rule.allow = parseAllowList(input.allow, `${field}.allow`, meta);
+	return rule;
+}
+
+/** Resolve the global and matching agent policies into independent launch-time checks. */
+export function resolveModelScopesForAgent(
+	config: ModelScopeConfig | undefined,
+	agentName: string,
+	parentModel: { provider: string; id: string } | undefined,
+): ResolvedModelScope[] {
+	if (!config) return [];
+	const scopes: ResolvedModelScope[] = [];
+	if (config.allow) {
+		scopes.push({
+			...(config.enforce !== undefined ? { enforce: config.enforce } : {}),
+			...(config.strict !== undefined ? { strict: config.strict } : {}),
+			allow: config.allow.map((pattern) => expandInheritPattern(pattern, parentModel)),
+			origin: "modelScope",
+		});
+	}
+	const agentScope = config.agents?.[agentName];
+	if (agentScope?.allow) {
+		scopes.push({
+			enforce: agentScope.enforce ?? config.enforce,
+			strict: agentScope.strict ?? config.strict,
+			allow: agentScope.allow.map((pattern) => expandInheritPattern(pattern, parentModel)),
+			origin: `modelScope.agents.${agentName}`,
+		});
+	}
+	return scopes;
+}
+
 /**
  * Validate and normalize a raw `subagents.modelScope` value from settings.
  * Throws a descriptive error for malformed configs (matching the surrounding
@@ -91,46 +178,26 @@ export function parseModelScopeConfig(
 	meta: { filePath: string },
 ): ModelScopeConfig | undefined {
 	if (value === undefined) return undefined;
-	if (!value || typeof value !== "object" || Array.isArray(value)) {
-		throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope'; expected an object.`);
-	}
-
-	const input = value as Record<string, unknown>;
-	const config: ModelScopeConfig = {};
-
-	if ("enforce" in input) {
-		if (typeof input.enforce !== "boolean") {
-			throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.enforce'; expected a boolean.`);
-		}
-		config.enforce = input.enforce;
-	}
-
-	if ("strict" in input) {
-		if (typeof input.strict !== "boolean") {
-			throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.strict'; expected a boolean.`);
-		}
-		config.strict = input.strict;
-	}
-
-	if ("allow" in input) {
-		if (!Array.isArray(input.allow)) {
-			throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected an array of strings.`);
-		}
-		const allow: string[] = [];
-		for (const entry of input.allow) {
-			if (typeof entry !== "string") {
-				throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected an array of strings.`);
+	const input = assertRecord(value, "modelScope", meta);
+	const config: ModelScopeConfig = parseScopeRule(input, "modelScope", meta);
+
+	if ("agents" in input) {
+		const agents: Record<string, ModelScopeRule> = {};
+		for (const [rawName, rawScope] of Object.entries(assertRecord(input.agents, "modelScope.agents", meta, "an object keyed by agent name"))) {
+			const name = rawName.trim();
+			const field = `modelScope.agents.${name}`;
+			if (!name) throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.agents' key; expected a non-empty agent name.`);
+			const agentInput = assertRecord(rawScope, field, meta);
+			if ("agents" in agentInput) {
+				throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}.agents'; nested agent scopes are not supported.`);
 			}
-			const trimmed = entry.trim();
-			if (trimmed) allow.push(trimmed);
-		}
-		if (allow.length === 0) {
-			throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected a non-empty array of patterns.`);
+			agents[name] = parseScopeRule(agentInput, field, meta);
 		}
-		config.allow = allow;
+		config.agents = agents;
 	}
 
-	if (config.enforce === true && (!config.allow || config.allow.length === 0)) {
+	const hasAnyAllow = Boolean(config.allow?.length) || Object.values(config.agents ?? {}).some((scope) => Boolean(scope.allow?.length));
+	if (config.enforce === true && !hasAnyAllow) {
 		throw new Error(`Subagent settings in '${meta.filePath}' set modelScope.enforce without a non-empty 'allow' list; supply allowed model patterns or disable enforcement.`);
 	}
 

package/src/runs/shared/pi-args.ts

@@ -191,6 +191,7 @@ export interface BuildPiArgsInput {
 export interface BuildPiArgsResult {
 	args: string[];
 	env: Record<string, string | undefined>;
+	warnings: string[];
 	tempDir?: string;
 	toolDiagnosticPath?: string;
 	runtimeAcknowledgedExtensionsPath?: string;
@@ -251,6 +252,7 @@ export interface ResolvePiLaunchToolPlanInput {
 	capabilityCeiling?: ResolvedSubagentCapabilityCeiling;
 	inheritedCapabilityCeiling?: ResolvedSubagentCapabilityCeiling;
 	agentName?: string;
+	permissionRules?: PermissionRules;
 }
 
 export interface PiLaunchToolPlan {
@@ -271,6 +273,13 @@ export interface PiLaunchToolPlan {
 	extensionArgs: string[];
 	disableAmbientExtensions: boolean;
 	capabilityAudit?: SubagentCapabilityAudit;
+	/**
+	 * Non-fatal footguns surfaced during plan resolution (currently: an agent
+	 * `extensions: []` override, which disables ALL ambient extensions for the
+	 * child rather than "adding nothing" — see the empty-extensions-override
+	 * warning below). Callers may log these; they never change behavior.
+	 */
+	warnings: string[];
 }
 
 function extensionIdentifier(value: string): string {
@@ -288,6 +297,10 @@ function boundedExtensionIdentifiers(values: string[]): {
 	};
 }
 
+function hasPermissionRules(rules: PermissionRules | undefined): boolean {
+	return rules !== undefined && Object.keys(rules).length > 0;
+}
+
 export function projectLaunchResolvedChildExtensions(
 	toolPlan: Pick<
 		PiLaunchToolPlan,
@@ -451,7 +464,9 @@ export function resolvePiLaunchToolPlan(
 		: [];
 	const permSystemExt = capabilityCeiling?.denyExtensions
 		? undefined
-		: resolvePermissionSystemExtension();
+		: hasPermissionRules(input.permissionRules)
+			? resolvePermissionSystemExtension()
+			: undefined;
 	const runtimeExtensions = [
 		PROMPT_RUNTIME_EXTENSION_PATH,
 		...(fanoutAuthorized ? [FANOUT_CHILD_EXTENSION_PATH] : []),
@@ -460,6 +475,21 @@ export function resolvePiLaunchToolPlan(
 	const disableAmbientExtensions =
 		capabilityCeiling?.denyExtensions === true ||
 		input.extensions !== undefined;
+	const warnings: string[] = [];
+	// An agent override that sets `extensions: []` reads like "add nothing", but
+	// any *defined* extensions list (including an empty one) disables every
+	// ambient extension for this child — not just skips adding extras. That
+	// silently strips load-bearing ambient extensions (e.g. a model provider
+	// extension), so a provider-qualified model pin becomes unresolvable in the
+	// child with no error pointing back at the override that caused it.
+	if (capabilityCeiling?.denyExtensions !== true && Array.isArray(input.extensions) && input.extensions.length === 0) {
+		const agentLabel = input.agentName ? ` for agent '${input.agentName}'` : "";
+		warnings.push(
+			`extensions: [] override${agentLabel} disables ALL ambient extensions for this child (not just "adds nothing"), `
+				+ "including any model-provider extension needed to resolve a provider-qualified model. "
+				+ "List the extensions this child actually needs instead of an empty array.",
+		);
+	}
 	const configuredExtensions = capabilityCeiling?.denyExtensions
 		? []
 		: [
@@ -540,6 +570,7 @@ export function resolvePiLaunchToolPlan(
 		configuredExtensions,
 		extensionArgs,
 		disableAmbientExtensions,
+		warnings,
 		...(capabilityAudit ? { capabilityAudit } : {}),
 	};
 }
@@ -587,6 +618,7 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 			process.env[SUBAGENT_CAPABILITY_CEILING_ENV],
 		),
 		agentName: input.childAgentName,
+		permissionRules: input.permissionRules,
 	});
 	if (toolPlan.explicitToolAllowlist) {
 		args.push(
@@ -829,6 +861,7 @@ export function buildPiArgs(input: BuildPiArgsInput): BuildPiArgsResult {
 	return {
 		args,
 		env,
+		warnings: toolPlan.warnings,
 		tempDir,
 		toolDiagnosticPath,
 		runtimeAcknowledgedExtensionsPath,

package/src/runs/shared/subagent-prompt-runtime.ts

@@ -21,7 +21,7 @@ import type { JsonSchemaObject, ResolvedToolBudget, SubagentState } from "../../
 import { resolveCurrentSessionId } from "../../shared/session-identity.ts";
 import { resolveWatchPath } from "../../shared/utils.ts";
 import { registerChildWatchdog } from "../../watchdog/register-child.ts";
-import { CHILD_WATCHDOG_CONFIG_ENV } from "../../watchdog/child-status.ts";
+import { CHILD_WATCHDOG_CONFIG_ENV, decodeChildWatchdogConfig } from "../../watchdog/child-status.ts";
 import { requestWatchdogPermission, type WatchdogPermissionRequest, type WatchdogPermissionResult } from "../../watchdog/permission-arbiter.ts";
 import { SUBAGENT_WATCHDOG_WARNING_TYPE } from "../../watchdog/types.ts";
 import { resolveWaitToolConfig } from "../background/wait-config.ts";
@@ -296,14 +296,41 @@ export function registerPermissionGate(
 		const decision = permissionDecision(rules, toolName);
 		if (decision === "allow") return undefined;
 		if (decision === "deny") return { block: true, reason: `Blocked by pi-subagents permission rule: '${toolName}' is denied.` };
-		const result = await requestPermission({
-			ctx,
-			toolName,
-			args: event.input ?? {},
-			rawWatchdogConfig: process.env[CHILD_WATCHDOG_CONFIG_ENV],
-			auditPath: process.env[PERMISSION_AUDIT_PATH_ENV],
-			...(ctx.signal ? { signal: ctx.signal } : {}),
-		});
+		const rawWatchdogConfig = process.env[CHILD_WATCHDOG_CONFIG_ENV];
+		let timeoutMs = 30_000;
+		try {
+			timeoutMs = decodeChildWatchdogConfig(rawWatchdogConfig)?.agentEndTimeoutMs ?? timeoutMs;
+		} catch {
+			// The arbiter reports invalid configuration with the concrete decode error.
+		}
+		if (ctx.signal?.aborted) return { block: true, reason: "Blocked by pi-subagents permission rule: Watchdog permission decision was cancelled." };
+		let timeout: ReturnType<typeof setTimeout> | undefined;
+		let abort: (() => void) | undefined;
+		let result: WatchdogPermissionResult;
+		try {
+			result = await Promise.race([
+				requestPermission({
+					ctx,
+					toolName,
+					args: event.input ?? {},
+					rawWatchdogConfig,
+					auditPath: process.env[PERMISSION_AUDIT_PATH_ENV],
+					...(ctx.signal ? { signal: ctx.signal } : {}),
+				}),
+				new Promise<WatchdogPermissionResult>((resolve) => {
+					if (!ctx.signal) return;
+					abort = () => resolve({ approved: false, reason: "Watchdog permission decision was cancelled.", source: "watchdog" });
+					ctx.signal.addEventListener("abort", abort, { once: true });
+				}),
+				new Promise<never>((_, reject) => { timeout = setTimeout(() => reject(new Error(`Watchdog permission decision timed out after ${timeoutMs}ms.`)), timeoutMs); }),
+			]);
+		} catch (error) {
+			const reason = error instanceof Error ? error.message : String(error);
+			return { block: true, reason: `Blocked by pi-subagents permission rule: Watchdog permission arbiter failed closed: ${reason}` };
+		} finally {
+			if (timeout) clearTimeout(timeout);
+			if (abort) ctx.signal?.removeEventListener("abort", abort);
+		}
 		if (result.approved) return undefined;
 		return { block: true, reason: `Blocked by pi-subagents permission rule: ${result.reason}` };
 	});

package/src/shared/types.ts

@@ -8,7 +8,7 @@ import type { Message } from "@earendil-works/pi-ai";
 import type { AgentConfig } from "../agents/agents.ts";
 import type { FSWatcher } from "node:fs";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ModelScopeConfig } from "../runs/shared/model-scope.ts";
+import type { ModelScopeRule } from "../runs/shared/model-scope.ts";
 import type { ResolvedSubagentCapabilityCeiling, SubagentCapabilityAudit } from "../runs/shared/capability-ceiling.ts";
 import type { AuthorityPolicyConfig } from "../policy/authority.ts";
 import type { GlobalMissionIndexRecord, MissionRecord, MissionStoreConfig } from "../missions/types.ts";
@@ -957,6 +957,13 @@ export interface SingleResult {
 	modelAttempts?: ModelAttempt[];
 	controlEvents?: ControlEvent[];
 	error?: string;
+	/**
+	 * True when the dispatch failed because the input exceeded the model's
+	 * context window. The model fallback loop stops immediately (retrying the
+	 * same input on another model cannot succeed). Callers should treat this as
+	 * a signal to reduce input size or re-decompose the task.
+	 */
+	contextOverflow?: boolean;
 	protocolError?: ProtocolOutputLimit;
 	sessionFile?: string;
 	skills?: string[];
@@ -1022,6 +1029,7 @@ export interface WaitCompletionChild {
 	outputState?: SubagentOutputState;
 	error?: string;
 	model?: string;
+	contextOverflow?: boolean;
 	artifactPaths?: Partial<ArtifactPaths>;
 }
 
@@ -1496,6 +1504,8 @@ export interface AsyncStatus {
 		thinking?: string;
 		attemptedModels?: string[];
 		modelAttempts?: ModelAttempt[];
+		/** True when the child input exceeded the model context window. */
+		contextOverflow?: boolean;
 		totalCost?: CostSummary;
 		steering?: SteeringStatus;
 		error?: string;
@@ -1890,7 +1900,7 @@ export interface RunSyncOptions {
 	/** Current parent-session provider to prefer for ambiguous bare model ids */
 	preferredModelProvider?: string;
 	/** Optional subagent model-scope enforcement for fallback candidates */
-	modelScope?: ModelScopeConfig;
+	modelScope?: ModelScopeRule | ModelScopeRule[];
 	/** Skills to make available (overrides agent default if provided) */
 	skills?: string[];
 	structuredOutput?: {
@@ -2054,7 +2064,7 @@ export interface ExtensionConfig {
 	/** Artifact cleanup retention. Set cleanupDays to 0 to disable cleanup. */
 	artifactConfig?: Pick<ArtifactConfig, "cleanupDays">;
 	intercomBridge?: IntercomBridgeConfig;
-	/** Control how slow result-index scans are logged. Defaults to \"all\".
+	/** Control how slow result-index scans are logged. Defaults to \"activity\".
 	 *  - \"all\": log every slow scan, including scans that find nothing.
 	 *  - \"activity\": log only slow scans that found or scheduled work. Silences
 	 *    the periodic healthy rescan that inspects zero files while no async runs

package/src/watchdog/permission-arbiter.ts

@@ -45,7 +45,11 @@ export function createWatchdogPermissionArbiter(options: WatchdogPermissionArbit
 		const createdAt = Date.now();
 		const auditBase = { type: "permission.request", createdAt, toolName: request.toolName, preview, matchedRule: "ask", decisionSource: "watchdog" };
 		appendPermissionAudit(request.auditPath, auditBase);
+		let completed = false;
 		const finish = (approved: boolean, reason: string, decision: string): WatchdogPermissionResult => {
+			const concise = conciseReason(reason);
+			if (completed) return { approved, reason: concise, source: "watchdog" };
+			completed = true;
 			appendPermissionAudit(request.auditPath, {
 				type: "permission.decision",
 				createdAt: Date.now(),
@@ -54,9 +58,9 @@ export function createWatchdogPermissionArbiter(options: WatchdogPermissionArbit
 				decision,
 				approved,
 				decisionSource: "watchdog",
-				reason: conciseReason(reason),
+				reason: concise,
 			});
-			return { approved, reason: conciseReason(reason), source: "watchdog" };
+			return { approved, reason: concise, source: "watchdog" };
 		};
 
 		let childConfig;
@@ -84,61 +88,65 @@ export function createWatchdogPermissionArbiter(options: WatchdogPermissionArbit
 
 		let timeout: ReturnType<typeof setTimeout> | undefined;
 		let agent: Agent | undefined;
+		let abort: (() => void) | undefined;
 		try {
-			const config = childResolvedConfig(childConfig);
-			const selection = await resolveWatchdogReviewModel(request.ctx, config);
-			const auth = selection.auth;
-			const registeredProvider = (request.ctx.modelRegistry as {
-				getRegisteredProviderConfig?: (provider: string) => { api?: string; streamSimple?: StreamFn } | undefined;
-			}).getRegisteredProviderConfig?.(selection.model.provider);
-			const baseStreamFn = options.streamFn ?? (registeredProvider?.streamSimple && registeredProvider.api === selection.model.api
-				? registeredProvider.streamSimple
-				: streamSimple);
-			const streamFn: StreamFn = (model, context, streamOptions) => baseStreamFn(model, context, {
-				...streamOptions,
-				...(auth.apiKey ? { apiKey: auth.apiKey } : {}),
-				env: auth.env || streamOptions?.env ? { ...(auth.env ?? {}), ...(streamOptions?.env ?? {}) } : undefined,
-				headers: { ...(streamOptions?.headers ?? {}), ...(auth.headers ?? {}) },
-			});
-			agent = new Agent({
-				initialState: {
-					systemPrompt: [
-						"You are the pi-subagents watchdog permission arbiter.",
-						"Decide only whether this exact non-bash child tool call should proceed.",
-						"Call watchdog_permission_decision exactly once with approve or deny and a concise reason.",
-						"Deny when uncertain. Do not produce freeform advice or ask the parent orchestrator.",
-					].join("\n"),
-					model: selection.model,
-					thinkingLevel: selection.thinkingLevel,
-					tools: [tool],
-				},
-				convertToLlm,
-				...agentStreamOptions(streamFn),
-				getApiKey: (providerName) => providerName === selection.model.provider ? auth.apiKey : undefined,
-				beforeToolCall: async ({ toolCall }) => toolCall.name === tool.name ? undefined : { block: true, reason: `Permission arbiter tool '${toolCall.name}' is not allowed.` },
-				toolExecution: "sequential",
-			});
-			const abort = () => agent?.abort();
-			request.signal?.addEventListener("abort", abort, { once: true });
-			request.ctx.signal?.addEventListener("abort", abort, { once: true });
-			try {
-				const prompt = `Tool: ${request.toolName}\nRedacted arguments: ${preview}`;
-				await Promise.race([
-					agent.prompt(prompt),
-					new Promise<never>((_, reject) => { timeout = setTimeout(() => { agent?.abort(); reject(new Error("Watchdog permission decision timed out.")); }, childConfig.agentEndTimeoutMs); }),
-				]);
-			} finally {
-				request.signal?.removeEventListener("abort", abort);
-				request.ctx.signal?.removeEventListener("abort", abort);
-			}
-			if (!decision) return finish(false, "Watchdog permission arbiter returned no decision.", "malformed");
-			const approved = decision.decision === "approve";
-			return finish(approved, decision.reason, decision.decision);
+			const run = async (): Promise<WatchdogPermissionResult> => {
+				const config = childResolvedConfig(childConfig);
+				const selection = await resolveWatchdogReviewModel(request.ctx, config);
+				const auth = selection.auth;
+				const registeredProvider = (request.ctx.modelRegistry as {
+					getRegisteredProviderConfig?: (provider: string) => { api?: string; streamSimple?: StreamFn } | undefined;
+				}).getRegisteredProviderConfig?.(selection.model.provider);
+				const baseStreamFn = options.streamFn ?? (registeredProvider?.streamSimple && registeredProvider.api === selection.model.api
+					? registeredProvider.streamSimple
+					: streamSimple);
+				const streamFn: StreamFn = (model, context, streamOptions) => baseStreamFn(model, context, {
+					...streamOptions,
+					...(auth.apiKey ? { apiKey: auth.apiKey } : {}),
+					env: auth.env || streamOptions?.env ? { ...(auth.env ?? {}), ...(streamOptions?.env ?? {}) } : undefined,
+					headers: { ...(streamOptions?.headers ?? {}), ...(auth.headers ?? {}) },
+				});
+				agent = new Agent({
+					initialState: {
+						systemPrompt: [
+							"You are the pi-subagents watchdog permission arbiter.",
+							"Decide only whether this exact non-bash child tool call should proceed.",
+							"Call watchdog_permission_decision exactly once with approve or deny and a concise reason.",
+							"Deny when uncertain. Do not produce freeform advice or ask the parent orchestrator.",
+						].join("\n"),
+						model: selection.model,
+						thinkingLevel: selection.thinkingLevel,
+						tools: [tool],
+					},
+					convertToLlm,
+					...agentStreamOptions(streamFn),
+					getApiKey: (providerName) => providerName === selection.model.provider ? auth.apiKey : undefined,
+					beforeToolCall: async ({ toolCall }) => toolCall.name === tool.name ? undefined : { block: true, reason: `Permission arbiter tool '${toolCall.name}' is not allowed.` },
+					toolExecution: "sequential",
+				});
+				await agent.prompt(`Tool: ${request.toolName}\nRedacted arguments: ${preview}`);
+				if (!decision) return finish(false, "Watchdog permission arbiter returned no decision.", "malformed");
+				const approved = decision.decision === "approve";
+				return finish(approved, decision.reason, decision.decision);
+			};
+			return await Promise.race([
+				run(),
+				new Promise<WatchdogPermissionResult>((resolve) => { timeout = setTimeout(() => { agent?.abort(); resolve(finish(false, "Watchdog permission decision timed out.", "timeout")); }, childConfig.agentEndTimeoutMs); }),
+				new Promise<WatchdogPermissionResult>((resolve) => {
+					abort = () => { agent?.abort(); resolve(finish(false, "Watchdog permission decision was cancelled.", "cancelled")); };
+					request.signal?.addEventListener("abort", abort, { once: true });
+					request.ctx.signal?.addEventListener("abort", abort, { once: true });
+				}),
+			]);
 		} catch (error) {
 			const reason = error instanceof Error ? error.message : String(error);
 			return finish(false, `Watchdog permission arbiter failed closed: ${reason}`, reason.includes("timed out") ? "timeout" : "error");
 		} finally {
 			if (timeout) clearTimeout(timeout);
+			if (abort) {
+				request.signal?.removeEventListener("abort", abort);
+				request.ctx.signal?.removeEventListener("abort", abort);
+			}
 		}
 	};
 }