takomi 2.1.34 → 2.1.35

package/.pi/extensions/takomi-runtime/context-panel.ts

@@ -206,6 +206,18 @@ function calculateActiveMs(intervals: ActivityInterval[]): number {
   return mergeIntervals(intervals).reduce((total, interval) => total + (interval.end - interval.start), 0);
 }
 
+function clampActiveMs(activeMs: number, sessionStart: number, now = Date.now()): number {
+  if (!Number.isFinite(activeMs) || activeMs <= 0) return 0;
+  const ageMs = Math.max(0, now - sessionStart);
+  return Math.min(activeMs, ageMs);
+}
+
+function boundedPendingStart(starts: number[], sessionStart: number, now = Date.now()): number | undefined {
+  const valid = starts.filter((start) => Number.isFinite(start) && start <= now);
+  if (valid.length === 0) return undefined;
+  return Math.max(sessionStart, Math.min(...valid));
+}
+
 function formatDisplayPath(filePath: string, cwd?: string): string {
   const normalized = filePath.replace(/^@/, "");
   const absolute = path.isAbsolute(normalized) ? normalized : undefined;
@@ -312,11 +324,13 @@ class ContextPanelComponent implements Component {
     lines.push("");
 
     if (ctx) {
-      const age = formatDuration(Date.now() - state.sessionStart);
+      const now = Date.now();
+      const ageMs = Math.max(0, now - state.sessionStart);
+      const age = formatDuration(ageMs);
       const pendingStarts = Object.values(state.pendingToolStarts ?? {});
-      const pendingStart = pendingStarts.length > 0 ? Math.min(...pendingStarts) : undefined;
-      const activeMs = pendingStart !== undefined ? state.activeMs + Math.max(0, Date.now() - pendingStart) : state.activeMs;
-      const active = formatDuration(activeMs);
+      const pendingStart = boundedPendingStart(pendingStarts, state.sessionStart, now);
+      const rawActiveMs = pendingStart !== undefined ? state.activeMs + Math.max(0, now - pendingStart) : state.activeMs;
+      const active = formatDuration(clampActiveMs(rawActiveMs, state.sessionStart, now));
       lines.push(`${pad}${theme.fg("dim", "Age:")}     ${theme.fg("muted", age)}`);
       lines.push(`${pad}${theme.fg("dim", "Active:")}  ${theme.fg("muted", active)}`);
 
@@ -417,15 +431,18 @@ export class TakomiContextPanel {
     this.requestRender?.();
   }
 
-  private recomputeActiveMs(): void {
-    this.state.activeMs = calculateActiveMs(this.state.activityIntervals);
+  private recomputeActiveMs(now = Date.now()): void {
+    this.state.activeMs = clampActiveMs(calculateActiveMs(this.state.activityIntervals), this.state.sessionStart, now);
   }
 
   private addActivityInterval(start: number, end: number): void {
-    if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start) return;
-    this.state.activityIntervals.push({ start, end });
-    this.recomputeActiveMs();
-    this.state.lastActivityAt = Math.max(this.state.lastActivityAt, end);
+    const now = Date.now();
+    const boundedStart = Math.max(this.state.sessionStart, start);
+    const boundedEnd = Math.min(now, end);
+    if (!Number.isFinite(boundedStart) || !Number.isFinite(boundedEnd) || boundedEnd <= boundedStart) return;
+    this.state.activityIntervals.push({ start: boundedStart, end: boundedEnd });
+    this.recomputeActiveMs(now);
+    this.state.lastActivityAt = Math.max(this.state.lastActivityAt, boundedEnd);
   }
 
   private noteActivity(timestamp = Date.now(), allowLongGap = false): void {
@@ -564,10 +581,13 @@ export class TakomiContextPanel {
       lastActivityPoint = ts;
     }
 
+    const now = Date.now();
     next.sessionStart = firstSessionTs ?? next.sessionStart;
-    next.activityIntervals = intervals;
-    next.activeMs = calculateActiveMs(intervals);
-    next.lastActivityAt = lastActivityPoint ?? next.sessionStart;
+    next.activityIntervals = intervals
+      .map((interval) => ({ start: Math.max(next.sessionStart, interval.start), end: Math.min(now, interval.end) }))
+      .filter((interval) => Number.isFinite(interval.start) && Number.isFinite(interval.end) && interval.end > interval.start);
+    next.activeMs = clampActiveMs(calculateActiveMs(next.activityIntervals), next.sessionStart, now);
+    next.lastActivityAt = Math.min(now, Math.max(next.sessionStart, lastActivityPoint ?? next.sessionStart));
 
     this.state = next;
     this.requestRender?.();
@@ -671,6 +691,10 @@ export function wireContextPanel(pi: ExtensionAPI, panel: TakomiContextPanel): v
     panel.rebuildFromSession(ctx);
   });
 
+  pi.on("session_compact", (_event, ctx) => {
+    panel.rebuildFromSession(ctx);
+  });
+
   pi.registerShortcut("alt+c", {
     description: "Toggle Takomi context panel",
     handler: async (ctx) => {

package/.pi/extensions/takomi-runtime/model-routing-defaults.ts

@@ -11,6 +11,8 @@ import {
 } from "./routing-policy";
 
 export const TAKOMI_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"] as const;
+const PROJECT_TAKOMI_POLICY_ROOT_RELATIVE = path.join(".pi", "takomi");
+const MAX_POLICY_BYTES = 128 * 1024;
 
 type Settings = {
   takomi?: { modelRoutingPolicyFile?: string };
@@ -140,6 +142,8 @@ function collectModelsFromPolicy(text: string): string[] {
 
 function readPolicyTextSync(filePath: string): string | undefined {
   try {
+    const info = fs.statSync(filePath);
+    if (!info.isFile() || info.size > MAX_POLICY_BYTES) return undefined;
     const text = fs.readFileSync(filePath, "utf8").trim();
     return text || undefined;
   } catch {
@@ -147,18 +151,44 @@ function readPolicyTextSync(filePath: string): string | undefined {
   }
 }
 
+function isPathInside(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function resolveSafeProjectPolicyPathSync(cwd: string, configured: string): string | undefined {
+  if (!configured) return undefined;
+
+  const projectPolicyRoot = path.resolve(cwd, PROJECT_TAKOMI_POLICY_ROOT_RELATIVE);
+  const resolvedPath = path.isAbsolute(configured) ? path.resolve(configured) : path.resolve(cwd, configured);
+  if (!isPathInside(projectPolicyRoot, resolvedPath)) return undefined;
+
+  try {
+    const realCwd = fs.realpathSync(cwd);
+    const realRoot = fs.realpathSync(projectPolicyRoot);
+    const realFile = fs.realpathSync(resolvedPath);
+    if (!isPathInside(realCwd, realRoot)) return undefined;
+    if (!isPathInside(realRoot, realFile)) return undefined;
+    return realFile;
+  } catch {
+    return resolvedPath;
+  }
+}
+
 function resolvePolicySync(cwd: string): { policyPath?: string; text?: string } {
   const projectSettings = readSettingsFileSync(path.join(cwd, PROJECT_PI_SETTINGS_RELATIVE));
   const projectTakomi = asRecord(projectSettings.takomi);
   const configuredProject = typeof projectTakomi.modelRoutingPolicyFile === "string"
     ? projectTakomi.modelRoutingPolicyFile
     : TAKOMI_ROUTING_POLICY_RELATIVE;
-  const configuredProjectPath = path.isAbsolute(configuredProject) ? configuredProject : path.join(cwd, configuredProject);
-  const configuredProjectText = readPolicyTextSync(configuredProjectPath);
-  if (configuredProjectText) return { policyPath: configuredProjectPath, text: configuredProjectText };
+  const configuredProjectPath = resolveSafeProjectPolicyPathSync(cwd, configuredProject);
+  if (configuredProjectPath) {
+    const configuredProjectText = readPolicyTextSync(configuredProjectPath);
+    if (configuredProjectText) return { policyPath: configuredProjectPath, text: configuredProjectText };
+  }
 
-  const defaultProjectPath = path.join(cwd, TAKOMI_ROUTING_POLICY_RELATIVE);
-  if (path.resolve(defaultProjectPath) !== path.resolve(configuredProjectPath)) {
+  const defaultProjectPath = resolveSafeProjectPolicyPathSync(cwd, TAKOMI_ROUTING_POLICY_RELATIVE);
+  if (defaultProjectPath && path.resolve(defaultProjectPath) !== path.resolve(configuredProjectPath ?? "")) {
     const defaultProjectText = readPolicyTextSync(defaultProjectPath);
     if (defaultProjectText) return { policyPath: defaultProjectPath, text: defaultProjectText };
   }

package/.pi/extensions/takomi-runtime/routing-policy.ts

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -14,6 +14,8 @@ export const BUNDLED_TAKOMI_ROUTING_POLICY_PATH = path.resolve(
   "takomi",
   "model-routing.md",
 );
+const PROJECT_TAKOMI_POLICY_ROOT_RELATIVE = path.join(".pi", "takomi");
+const MAX_POLICY_BYTES = 128 * 1024;
 
 export type RoutingPolicyInstallResult = {
   policyPath: string;
@@ -56,6 +58,8 @@ async function readJsonObject(filePath: string): Promise<JsonObject> {
 
 async function readPolicyText(filePath: string): Promise<string | undefined> {
   try {
+    const info = await stat(filePath);
+    if (!info.isFile() || info.size > MAX_POLICY_BYTES) return undefined;
     const text = (await readFile(filePath, "utf8")).trim();
     return text || undefined;
   } catch {
@@ -63,6 +67,28 @@ async function readPolicyText(filePath: string): Promise<string | undefined> {
   }
 }
 
+function isPathInside(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+async function resolveSafeProjectPolicyPath(cwd: string, configured: string): Promise<string | undefined> {
+  if (!configured) return undefined;
+
+  const projectPolicyRoot = path.resolve(cwd, PROJECT_TAKOMI_POLICY_ROOT_RELATIVE);
+  const resolvedPath = path.isAbsolute(configured) ? path.resolve(configured) : path.resolve(cwd, configured);
+  if (!isPathInside(projectPolicyRoot, resolvedPath)) return undefined;
+
+  try {
+    const [realCwd, realRoot, realFile] = await Promise.all([realpath(cwd), realpath(projectPolicyRoot), realpath(resolvedPath)]);
+    if (!isPathInside(realCwd, realRoot)) return undefined;
+    if (!isPathInside(realRoot, realFile)) return undefined;
+    return realFile;
+  } catch {
+    return resolvedPath;
+  }
+}
+
 function extractQuotedPolicy(text: string): string {
   const triple = text.match(/"""([\s\S]*?)"""|```(?:\w+)?\s*([\s\S]*?)```/);
   const raw = (triple?.[1] ?? triple?.[2] ?? text).trim();
@@ -133,14 +159,16 @@ export async function resolveTakomiRoutingPolicy(cwd: string): Promise<ResolvedR
   const configuredProject = typeof projectTakomi.modelRoutingPolicyFile === "string"
     ? projectTakomi.modelRoutingPolicyFile
     : TAKOMI_ROUTING_POLICY_RELATIVE;
-  const configuredProjectPath = path.isAbsolute(configuredProject) ? configuredProject : path.join(cwd, configuredProject);
-  const configuredProjectText = await readPolicyText(configuredProjectPath);
-  if (configuredProjectText) {
-    return { source: "project", policyPath: configuredProjectPath, text: configuredProjectText };
+  const configuredProjectPath = await resolveSafeProjectPolicyPath(cwd, configuredProject);
+  if (configuredProjectPath) {
+    const configuredProjectText = await readPolicyText(configuredProjectPath);
+    if (configuredProjectText) {
+      return { source: "project", policyPath: configuredProjectPath, text: configuredProjectText };
+    }
   }
 
-  const defaultProjectPath = path.join(cwd, TAKOMI_ROUTING_POLICY_RELATIVE);
-  if (path.resolve(defaultProjectPath) !== path.resolve(configuredProjectPath)) {
+  const defaultProjectPath = await resolveSafeProjectPolicyPath(cwd, TAKOMI_ROUTING_POLICY_RELATIVE);
+  if (defaultProjectPath && path.resolve(defaultProjectPath) !== path.resolve(configuredProjectPath ?? "")) {
     const defaultProjectText = await readPolicyText(defaultProjectPath);
     if (defaultProjectText) {
       return { source: "project", policyPath: defaultProjectPath, text: defaultProjectText };

package/.pi/extensions/takomi-runtime/takomi-stats.js

@@ -1,4 +1,5 @@
-import { promises as fs } from 'node:fs';
+import { createReadStream, promises as fs } from 'node:fs';
+import readline from 'node:readline';
 import os from 'os';
 import path from 'path';
 
@@ -120,8 +121,14 @@ async function scanPiSessions(root, source, events, sessionRows = [], taskRows =
   for (const file of await files(root)) {
     let provider = 'unknown', model = 'unknown', session = path.basename(file, '.jsonl'), cwd = '', currentTask = null;
     const row = { key: session, session, source, file, project: projectKey(file), cwd, start: '', end: '', turns: 0, messages: 0, toolCalls: 0, subagentCalls: 0, roles: new Map(), stages: new Map(), workflows: new Map(), activeMs: 0, activityTimestamps: [] };
-    const text = await fs.readFile(file, 'utf8').catch(() => '');
-    for (const line of text.split(/\r?\n/)) {
+    let lines;
+    try {
+      lines = readline.createInterface({ input: createReadStream(file, { encoding: 'utf8' }), crlfDelay: Infinity });
+    } catch {
+      continue;
+    }
+    try {
+      for await (const line of lines) {
       const obj = safeJson(line); if (!obj) continue;
       if (obj.timestamp) { row.start ||= obj.timestamp; row.end = obj.timestamp; addTimestamp(row.activityTimestamps, obj.timestamp); }
       if (obj.type === 'session') { session = obj.id || session; cwd = obj.cwd || cwd; row.key = session; row.session = session; row.cwd = cwd; }
@@ -164,6 +171,9 @@ async function scanPiSessions(root, source, events, sessionRows = [], taskRows =
       }
       const u = msg && msg.usage;
       if (u) events.push({ source, file, timestamp: obj.timestamp, day: dayOf(obj.timestamp), session, provider, model, project: projectKey(file), kind: 'usage', input: +u.input||0, cache: +u.cacheRead||0, output: +u.output||0, total: +u.totalTokens||0, cost: cost(model, +u.input||0, +u.cacheRead||0, +u.output||0, true) });
+      }
+    } catch {
+      continue;
     }
     pushTask(taskRows, currentTask);
     row.activeMs = activeDuration(row.activityTimestamps);

package/.pi/extensions/takomi-subagents/index.ts

@@ -47,8 +47,8 @@ const SubagentParameters = Type.Object({
   clarify: Type.Optional(Type.Boolean({ description: "Show the native pi-subagents TUI to preview/edit before execution. Especially useful for chains; requires an interactive Pi TUI." })),
   chain: Type.Optional(Type.Array(TaskSchema, { description: "Sequential chain of subagent tasks" })),
   agentScope: Type.Optional(Type.Union([Type.Literal("user"), Type.Literal("project"), Type.Literal("both")])),
-  confirmProjectAgents: Type.Optional(Type.Boolean({ description: "Prompt before running project-local agents. Default: true." })),
-  overrideUserBlock: Type.Optional(Type.Boolean({ description: "Only set true when the user explicitly approves retrying after a blocked/cancelled/review-gated launch." })),
+  // Project-agent confirmation and hard-stop overrides are enforced server-side;
+  // they are intentionally not model-callable parameters.
 });
 
 function registerSubagentTool(pi: ExtensionAPI): void {
@@ -63,7 +63,7 @@ function registerSubagentTool(pi: ExtensionAPI): void {
       "Set clarify=true when the user asks to preview/edit a subagent run in the native Pi TUI before launch.",
       "Use model, fallbackModels, and thinking only when deliberate; otherwise let the agent/profile defaults apply.",
       "If review sends work back to the same agent, reuse the same conversationId for continuity.",
-      "If a launch is blocked, cancelled, paused, or review-gated, do not retry automatically; wait for the user's next prompt. Use overrideUserBlock only after explicit user approval.",
+      "If a launch is blocked, cancelled, paused, or review-gated, do not retry automatically; wait for the user's next prompt."
     ],
     parameters: SubagentParameters,
     async execute(_toolCallId, params, signal, onUpdate, ctx) {

package/.pi/extensions/takomi-subagents/native-render.ts

@@ -48,18 +48,63 @@ function summarizeCollapsedResult(text: string, status: string, theme: Theme): s
   const label = policies.length > 0
     ? `policy context loaded: ${policies.join(", ")}`
     : `${lineCount} result line${lineCount === 1 ? "" : "s"} hidden`;
-  const icon = status === "failed" ? "⚠" : "✓";
-  const color = status === "failed" ? "warning" : "success";
+  const icon = status === "failed" ? "⚠" : status === "running" ? "…" : "✓";
+  const color = status === "failed" ? "warning" : status === "running" ? "accent" : "success";
   return `${theme.fg(color, `${icon} takomi_subagent ${status}`)}${theme.fg("dim", ` · ${label} (ctrl+o to expand)`)}`;
 }
 
+function recentOutputLines(value: unknown): string[] {
+  if (Array.isArray(value)) return value.map(String).filter(Boolean).slice(-3);
+  if (typeof value === "string") return value.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-3);
+  return [];
+}
+
+function livePartialText(result: ToolResult, theme: Theme): string {
+  const details = (result as any)?.details ?? {};
+  const results = Array.isArray(details.results) ? details.results : [];
+  const progress = Array.isArray(details.progress) ? details.progress : [];
+  const lines = [
+    theme.fg("toolTitle", theme.bold("takomi_subagent running")),
+    theme.fg("dim", "Live detail is bounded while streaming so manual scroll/ctrl+o does not jump on every token."),
+  ];
+
+  const rows = results.length ? results : progress;
+  if (!rows.length) {
+    const text = resultText(result).split(/\r?\n/).find((line) => line.trim())?.trim();
+    lines.push(theme.fg("dim", text || "Waiting for subagent progress…"));
+    return lines.join("\n");
+  }
+
+  rows.slice(0, 6).forEach((row: any, index: number) => {
+    const status = row.status ?? (row.exitCode === 0 ? "completed" : row.exitCode === -1 ? "running" : row.exitCode === undefined ? "running" : "failed");
+    const agent = row.agent ?? `task ${index + 1}`;
+    const task = String(row.task ?? "").replace(/\s+/g, " ").trim();
+    const currentTool = row.currentTool ?? row.progress?.currentTool;
+    const tokens = row.tokens ?? row.progress?.tokens ?? row.usage?.output;
+    const tail = recentOutputLines(row.recentOutput ?? row.progress?.recentOutput ?? row.finalOutput ?? row.output);
+    lines.push(theme.fg("accent", `${index + 1}. ${agent} ${theme.fg("dim", `[${status}]`)}`));
+    if (task) lines.push(theme.fg("dim", `   ${task.slice(0, 140)}${task.length > 140 ? "…" : ""}`));
+    if (currentTool || tokens) lines.push(theme.fg("muted", `   ${[currentTool ? `tool:${currentTool}` : "", tokens ? `tokens:${tokens}` : ""].filter(Boolean).join(" | ")}`));
+    for (const line of tail) lines.push(theme.fg("dim", `   › ${line.slice(0, 160)}${line.length > 160 ? "…" : ""}`));
+  });
+  if (rows.length > 6) lines.push(theme.fg("muted", `… ${rows.length - 6} more running item${rows.length - 6 === 1 ? "" : "s"}`));
+  lines.push(theme.fg("muted", "Final output will use the normal expandable native subagent renderer."));
+  return lines.join("\n");
+}
+
 export function renderTakomiSubagentResult(result: ToolResult, options: { expanded?: boolean; isPartial?: boolean }, theme: Theme, context: any): any {
+  const status = (result as any)?.isError ? "failed" : options.isPartial ? "running" : "completed";
+  const text = resultText(result);
+
+  if (options.isPartial) {
+    if (options.expanded) return new Text(livePartialText(result, theme), 0, 0);
+    return new Text(summarizeCollapsedResult(text, status, theme), 0, 0);
+  }
+
   const native = renderNativeSubagentResult(result, options, theme, context);
   if (native) return native;
 
-  const status = (result as any)?.isError ? "failed" : "completed";
-  const text = resultText(result);
-  if (!options.expanded && !options.isPartial) {
+  if (!options.expanded) {
     return new Text(summarizeCollapsedResult(text, status, theme), 0, 0);
   }
   return new Text(`${theme.fg("toolTitle", theme.bold(`takomi_subagent ${status}`))}\n${text || "No result content."}`, 0, 0);

package/.pi/extensions/takomi-subagents/pi-subagents-engine.ts

@@ -75,7 +75,7 @@ function resolveTasks(params: TakomiSubagentToolParams): TakomiSubagentToolTask[
       fallbackModels: params.fallbackModels,
       thinking: params.thinking,
       conversationId: params.conversationId,
-      cwd: params.cwd,
+      cwd: undefined,
       checklist: params.checklist,
     }];
   }
@@ -109,6 +109,26 @@ function modelWithThinking(model: string | undefined, thinking: string | undefin
   return `${model}:${level}`;
 }
 
+function isPathInside(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function resolveRelativeCwd(root: string, value: string | undefined, label: string): string {
+  const lexicalRoot = path.resolve(root);
+  const lexicalCandidate = value
+    ? path.isAbsolute(value) ? path.resolve(value) : path.resolve(lexicalRoot, value)
+    : lexicalRoot;
+  if (!isPathInside(lexicalRoot, lexicalCandidate)) throw new Error(`${label} escapes the current workspace.`);
+
+  const realRoot = fs.realpathSync(lexicalRoot);
+  const realCandidate = fs.realpathSync(lexicalCandidate);
+  const stat = fs.statSync(realCandidate);
+  if (!stat.isDirectory()) throw new Error(`${label} must be a directory inside the current workspace.`);
+  if (!isPathInside(realRoot, realCandidate)) throw new Error(`${label} escapes the current workspace.`);
+  return realCandidate;
+}
+
 function safeConversationSlug(value: string): string {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 96) || "conversation";
 }
@@ -164,13 +184,14 @@ function agentNameSet(discoverPiAgents: any, cwd: string): Set<string> {
   return new Set(discoverUnifiedAgents(discoverPiAgents, cwd, "both").agents.map((agent) => agent.name));
 }
 
-function mapSingleTask(task: TakomiSubagentToolTask, names: Set<string>) {
+function mapSingleTask(task: TakomiSubagentToolTask, names: Set<string>, rootCwd: string) {
   const resolvedAgent = resolveAgentName(task.agent, new Map([...names].map((name) => [name, { name } as any])));
   return {
     agent: resolvedAgent,
     task: buildTakomiTaskPrompt({ ...task, agent: resolvedAgent }),
-    cwd: task.cwd,
+    cwd: resolveRelativeCwd(rootCwd, task.cwd, "task.cwd"),
     model: modelWithThinking(task.model, task.thinking),
+    fallbackModels: task.fallbackModels,
     skill: task.skills?.length ? task.skills : undefined,
   };
 }
@@ -193,13 +214,14 @@ function toSubagentParams(params: TakomiSubagentToolParams, rootCwd: string, dis
 
   if (mode === "single") {
     const task = tasks[0]!;
-    const mapped = mapSingleTask(task, names);
+    const mapped = mapSingleTask(task, names, rootCwd);
     return {
       ...base,
       agent: mapped.agent,
       task: mapped.task,
-      cwd: task.cwd ? path.resolve(rootCwd, task.cwd) : rootCwd,
+      cwd: mapped.cwd,
       model: mapped.model,
+      fallbackModels: mapped.fallbackModels,
       skill: mapped.skill,
     };
   }
@@ -207,19 +229,20 @@ function toSubagentParams(params: TakomiSubagentToolParams, rootCwd: string, dis
   if (mode === "parallel") {
     return {
       ...base,
-      tasks: tasks.map((task) => mapSingleTask(task, names)),
+      tasks: tasks.map((task) => mapSingleTask(task, names, rootCwd)),
     };
   }
 
   return {
     ...base,
     chain: tasks.map((task) => {
-      const mapped = mapSingleTask(task, names);
+      const mapped = mapSingleTask(task, names, rootCwd);
       return {
         agent: mapped.agent,
         task: mapped.task,
-        cwd: task.cwd,
+        cwd: mapped.cwd,
         model: mapped.model,
+        fallbackModels: mapped.fallbackModels,
         skill: mapped.skill,
       };
     }),
@@ -264,7 +287,7 @@ export function createTakomiPiSubagentsEngine(pi: ExtensionAPI) {
       onUpdate: ToolUpdate | undefined,
       ctx: ExtensionContext,
     ): Promise<AgentToolResult<Details>> {
-      const rootCwd = params.cwd ? path.resolve(ctx.cwd, params.cwd) : ctx.cwd;
+      const rootCwd = resolveRelativeCwd(ctx.cwd, params.cwd, "cwd");
       const { executor, discoverPiAgents } = await getExecutor();
       const subagentParams = toSubagentParams(params, rootCwd, discoverPiAgents);
       return executor.execute(id, subagentParams, signal ?? NEVER_ABORT, onUpdate, ctx);

package/.pi/extensions/takomi-subagents/tool-runner.ts

@@ -1,3 +1,4 @@
+import fs from "node:fs/promises";
 import path from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { TakomiThinkingLevel } from "../../../src/pi-takomi-core";
@@ -30,8 +31,6 @@ export type TakomiSubagentToolParams = Partial<TakomiSubagentToolTask> & {
   previewOnly?: boolean;
   clarify?: boolean;
   agentScope?: TakomiAgentScope;
-  confirmProjectAgents?: boolean;
-  overrideUserBlock?: boolean;
 };
 
 type ToolUpdate = (partial: {
@@ -66,6 +65,10 @@ function hasProjectAgents(tasks: Array<{ agent: string }>, agents: Map<string, T
   return tasks.some((task) => agents.get(task.agent)?.source === "project");
 }
 
+function hostTrustsProjectAgents(): boolean {
+  return /^(1|true|yes)$/i.test(process.env.TAKOMI_TRUST_PROJECT_AGENTS || "");
+}
+
 function hardStopStore(pi: ExtensionAPI): Map<string, HardStopRecord> {
   const existing = RECENT_HARD_STOPS.get(pi);
   if (existing) return existing;
@@ -115,6 +118,31 @@ function consumeExpiredHardStop(pi: ExtensionAPI, fingerprint: string): HardStop
   return record;
 }
 
+function isPathInside(root: string, candidate: string): boolean {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+async function resolveRelativeCwd(root: string, value: string | undefined, label: string): Promise<string> {
+  const lexicalRoot = path.resolve(root);
+  const lexicalCandidate = value
+    ? path.isAbsolute(value) ? path.resolve(value) : path.resolve(lexicalRoot, value)
+    : lexicalRoot;
+  if (!isPathInside(lexicalRoot, lexicalCandidate)) throw new Error(`${label} escapes the current workspace.`);
+
+  const [realRoot, realCandidate] = await Promise.all([fs.realpath(lexicalRoot), fs.realpath(lexicalCandidate)]);
+  const stat = await fs.stat(realCandidate);
+  if (!stat.isDirectory()) throw new Error(`${label} must be a directory inside the current workspace.`);
+  if (!isPathInside(realRoot, realCandidate)) throw new Error(`${label} escapes the current workspace.`);
+  return realCandidate;
+}
+
+async function validateTaskCwds(root: string, tasks: TakomiSubagentToolTask[]): Promise<void> {
+  for (const [index, task] of tasks.entries()) {
+    await resolveRelativeCwd(root, task.cwd, `tasks[${index}].cwd`);
+  }
+}
+
 function getTextContent(result: any): string {
   return (result?.content ?? [])
     .map((item: any) => item?.type === "text" && typeof item.text === "string" ? item.text : "")
@@ -184,7 +212,7 @@ function resolveTasks(params: TakomiSubagentToolParams): TakomiSubagentToolTask[
       fallbackModels: params.fallbackModels,
       thinking: params.thinking,
       conversationId: params.conversationId,
-      cwd: params.cwd,
+      cwd: undefined,
       checklist: params.checklist,
     }];
   }
@@ -198,17 +226,31 @@ export async function executeTakomiSubagentTool(
   ctx: ExtensionContext,
 ) {
   const engine = getEngine(pi);
-  const rootCwd = params.cwd ? path.resolve(ctx.cwd, params.cwd) : ctx.cwd;
+  let rootCwd: string;
+  try {
+    rootCwd = await resolveRelativeCwd(ctx.cwd, params.cwd, "cwd");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return textResult(message, { results: [], agentScope: params.agentScope ?? "both" }, true);
+  }
   const profile = await loadTakomiProfile(rootCwd);
   const agentScope = params.agentScope ?? "both";
   const agents = discoverTakomiAgents(rootCwd, agentScope);
   const byName = new Map<string, TakomiAgentConfig>(agents.map((agent) => [agent.name, agent]));
   const mode = resolveMode(params);
   const routingSnapshot = await loadTakomiModelRoutingSnapshot(rootCwd);
-  const tasks = resolveTasks(params).map((task) => applyTakomiRoutingDefaults({
-    ...task,
-    agent: resolveAgentName(task.agent, byName),
-  }, routingSnapshot));
+  let tasks: TakomiSubagentToolTask[];
+  try {
+    const rawTasks = resolveTasks(params);
+    await validateTaskCwds(rootCwd, rawTasks);
+    tasks = rawTasks.map((task) => applyTakomiRoutingDefaults({
+      ...task,
+      agent: resolveAgentName(task.agent, byName),
+    }, routingSnapshot));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return textResult(message, { results: [], availableAgents: agents.map((agent) => agent.name), agentScope }, true);
+  }
 
   if (!mode) {
     return textResult(
@@ -223,19 +265,23 @@ export async function executeTakomiSubagentTool(
 
   const fingerprint = createRunFingerprint(rootCwd, mode, tasks);
   const recentHardStop = consumeExpiredHardStop(pi, fingerprint);
-  if (recentHardStop && !params.overrideUserBlock) {
+  if (recentHardStop) {
     return hardStopResult(
       `Subagent launch blocked: the same request was already stopped (${recentHardStop.reason}).\n${recentHardStop.message}`,
       { results: [], availableAgents: agents.map((agent) => agent.name), agentScope, mode, blockedAt: recentHardStop.at, reason: recentHardStop.reason },
     );
   }
-  if (params.overrideUserBlock) {
-    hardStopStore(pi).delete(fingerprint);
-  }
 
-  if (params.confirmProjectAgents !== false && ctx.hasUI && hasProjectAgents(tasks, byName)) {
+  const projectAgentsTrusted = hostTrustsProjectAgents();
+  if (!projectAgentsTrusted && hasProjectAgents(tasks, byName)) {
     const names = tasks.map((task) => byName.get(task.agent)).filter((agent): agent is TakomiAgentConfig => agent?.source === "project").map((agent) => agent.name);
-    const ok = await ctx.ui.confirm("Run project-local Takomi agents?", `Agents: ${[...new Set(names)].join(", ")}\n\nProject agents are repo-controlled. Continue only for trusted repositories.`);
+    const uniqueNames = [...new Set(names)].join(", ");
+    if (!ctx.hasUI) {
+      const message = `Blocked: project-local Takomi agents require interactive approval. Agents: ${uniqueNames}`;
+      rememberHardStop(pi, fingerprint, "project-agent-approval-required", message);
+      return hardStopResult(message, { results: [], agentScope, mode });
+    }
+    const ok = await ctx.ui.confirm("Run project-local Takomi agents?", `Agents: ${uniqueNames}\n\nProject agents are repo-controlled. Continue only for trusted repositories.`);
     if (!ok) {
       const message = "Canceled: project-local agents not approved.";
       rememberHardStop(pi, fingerprint, "project-agent-denied", message);
@@ -270,7 +316,7 @@ export async function executeTakomiSubagentTool(
   }
   try {
     const nativeParams: TakomiSubagentToolParams = mode === "single"
-      ? { ...params, agent: tasks[0]!.agent, task: tasks[0]!.task, agentScope }
+      ? { ...params, ...tasks[0]!, agentScope }
       : mode === "parallel"
         ? { ...params, tasks, agentScope }
         : { ...params, chain: tasks, agentScope };