ultimate-pi 0.18.1 → 0.19.1

package/.pi/extensions/harness-subagent-governance.ts

@@ -0,0 +1,8 @@
+/**
+ * @deprecated Use subagent-governance.ts — re-export for subprocess -e path stability.
+ */
+export {
+	default,
+	harnessSubagentGovernanceExtensionPath,
+	subagentGovernanceExtensionPath,
+} from "./subagent-governance.js";

package/.pi/extensions/harness-subagent-submit.ts

@@ -1,85 +1,42 @@
 /**
  * Subprocess-only harness submit tools — validate + write artifacts under run_dir.
- * Loaded via `pi --no-extensions -e harness-subagent-submit.ts` for harness agents.
+ * Prefer harness-subagent-governance.ts bundle (AGT + submit) for harness spawns.
  */
 
 import { join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { Type } from "@sinclair/typebox";
-import { resolveGuardedRunDir } from "../lib/harness-subagent-submit-path.js";
-import { claimHarnessGovernanceLoad } from "./lib/extension-load-guard.js";
-import { getHarnessPackageRoot } from "./lib/harness-paths.js";
-import { evaluateHarnessSubagentToolCall } from "./lib/harness-subagent-policy.js";
+import { claimHarnessGovernanceLoad } from "../lib/extension-load-guard.js";
+import { evaluateAgtHarnessToolCall } from "../lib/harness-agt-tool-guard.js";
+import { getHarnessPackageRoot } from "../lib/harness-paths.js";
 import {
-	executeSubmitPipeline,
-	loadSubmitDocument,
-} from "./lib/harness-subagent-submit-pipeline.js";
-import { SUBMIT_TOOL_SPECS } from "./lib/harness-subagent-submit-registry.js";
+	isSubprocessHarnessSubmit,
+	registerHarnessSubagentSubmitTools,
+	resolveHarnessSubmitRunContext,
+} from "../lib/harness-subagent-submit-register.js";
 
 // @ts-expect-error pi extensions run as ESM
 const MODULE_URL = import.meta.url;
 
-const DocumentSchema = Type.Object(
-	{
-		document: Type.Optional(
-			Type.Record(Type.String(), Type.Unknown(), {
-				description:
-					"Artifact fields (deprecated when source_path is set; ADR 0043)",
-			}),
-		),
-		source_path: Type.Optional(
-			Type.String({
-				description:
-					"Relative path under run dir, e.g. artifacts/.draft/decomposition.yaml",
-			}),
-		),
-	},
-	{ additionalProperties: false },
-);
-
-function resolveRunContext(): {
-	projectRoot: string;
-	specsDir: string;
-	runId: string;
-	runDirEnv?: string;
-	agentId: string;
-} {
-	const projectRoot = process.env.HARNESS_PKG_ROOT ?? process.cwd();
-	const specsDir = join(projectRoot, ".pi", "harness", "specs");
-	const runId = process.env.HARNESS_RUN_ID?.trim() ?? "";
-	const runDirEnv = process.env.HARNESS_RUN_DIR?.trim();
-	const agentId = process.env.HARNESS_AGENT_ID?.trim() ?? "";
-	return { projectRoot, specsDir, runId, runDirEnv, agentId };
-}
-
-function isSubprocessHarness(): boolean {
-	return (
-		process.env.PI_HARNESS_SUBPROCESS === "1" &&
-		Boolean(process.env.HARNESS_RUN_ID?.trim())
-	);
-}
-
 export default function harnessSubagentSubmit(pi: ExtensionAPI) {
 	if (!claimHarnessGovernanceLoad("harness-subagent-submit", MODULE_URL))
 		return;
-	// Option A: only load submit tools in subprocess (`-e` bundle), not parent discovery.
 	if (process.env.PI_HARNESS_SUBPROCESS !== "1") {
 		return;
 	}
 
-	const _packageRoot = getHarnessPackageRoot(MODULE_URL);
+	const packageRoot = getHarnessPackageRoot(MODULE_URL);
+	registerHarnessSubagentSubmitTools(pi, packageRoot);
 
-	pi.on("tool_call", async (event) => {
+	pi.on("tool_call", async (event, ctx) => {
 		if (!event.toolName.startsWith("submit_")) return undefined;
-		const subprocessOk = isSubprocessHarness();
-		if (!subprocessOk) {
+		if (!isSubprocessHarnessSubmit()) {
 			return {
 				block: true,
 				reason:
 					"harness-subagent-submit: submit_* tools are only available in harness subagent subprocesses.",
 			};
 		}
-		const { agentId } = resolveRunContext();
+		const { agentId } = resolveHarnessSubmitRunContext(packageRoot);
 		if (!agentId) {
 			return {
 				block: true,
@@ -87,118 +44,32 @@ export default function harnessSubagentSubmit(pi: ExtensionAPI) {
 					"harness-subagent-submit: HARNESS_AGENT_ID is required for submit tools.",
 			};
 		}
-		const decision = evaluateHarnessSubagentToolCall(
-			event.toolName,
-			event.input as Record<string, unknown>,
-			agentId,
-		);
-		if (decision.action === "block") {
-			return { block: true, reason: decision.reason };
-		}
-		return undefined;
-	});
 
-	for (const spec of SUBMIT_TOOL_SPECS) {
-		pi.registerTool({
-			name: spec.toolName,
-			label: spec.toolName.replace(/^submit_/, "Submit "),
-			description: `Terminal harness artifact submit for ${spec.agents.join(", ")}. Call once with the full schema document before ending the turn.`,
-			parameters: DocumentSchema,
-			async execute(_id, params, _signal, _onUpdate, _ctx) {
-				if (!isSubprocessHarness()) {
-					return {
-						content: [
-							{
-								type: "text",
-								text: "submit tools require PI_HARNESS_SUBPROCESS and HARNESS_RUN_ID",
-							},
-						],
-						details: {},
-						isError: true,
-					};
-				}
-				const { projectRoot, specsDir, runId, runDirEnv, agentId } =
-					resolveRunContext();
-				if (!spec.agents.includes(agentId)) {
-					return {
-						content: [
-							{
-								type: "text",
-								text: `${spec.toolName} is not allowed for agent ${agentId}`,
-							},
-						],
-						details: { agentId, tool: spec.toolName },
-						isError: true,
-					};
-				}
-				const runResolved = await resolveGuardedRunDir({
-					projectRoot,
-					runId,
-					runDirEnv,
-				});
-				if (!runResolved.ok) {
-					return {
-						content: [{ type: "text", text: runResolved.error }],
-						details: {},
-						isError: true,
-					};
-				}
-				const loaded = await loadSubmitDocument({
-					projectRoot,
-					runDir: runResolved.runDir,
-					document: (params as { document?: Record<string, unknown> }).document,
-					source_path: (params as { source_path?: string }).source_path,
-				});
-				if (!loaded.ok) {
-					return {
-						content: [
-							{
-								type: "text",
-								text: `Validation failed:\n${loaded.validation_errors.join("\n")}`,
-							},
-						],
-						isError: true,
-						details: loaded,
-					};
-				}
-				const result = await executeSubmitPipeline({
-					projectRoot,
-					specsDir,
-					spec,
-					agentId,
-					document: loaded.document,
-					runId,
-					runDirEnv,
-				});
-				if (!result.ok) {
-					return {
-						content: [
-							{
-								type: "text",
-								text: `Validation failed:\n${(result.validation_errors ?? []).join("\n")}`,
-							},
-						],
-						isError: true,
-						details: result,
-					};
-				}
-				const lines = [`ok: wrote ${result.artifact_path}`];
-				if (result.lane_result?.messenger_posted) {
-					lines.push("messenger updated");
-				}
-				if (result.human_required) {
-					lines.push("human_required: parent must call ask_user");
-				}
-				return {
-					content: [{ type: "text", text: lines.join("\n") }],
-					details: result as unknown,
-				};
+		return evaluateAgtHarnessToolCall({
+			moduleUrl: MODULE_URL,
+			toolName: event.toolName,
+			toolInput: event.input as Record<string, unknown>,
+			policyState: {
+				phase:
+					(process.env.HARNESS_SUBAGENT_PHASE_HINT as
+						| "plan"
+						| "execute"
+						| "evaluate"
+						| "adversary"
+						| "merge") ?? "plan",
+				approvedPlan: true,
+				planId: null,
+				aborted: false,
+				budgetBypass: false,
 			},
+			entries: ctx.sessionManager.getEntries(),
+			sessionId: ctx.sessionManager.getSessionId(),
+			projectRoot: ctx.cwd,
 		});
-	}
+	});
 }
 
-/** Absolute path to the subprocess submit extension (Option A). */
+/** Absolute path to the subprocess submit extension (legacy standalone). */
 export function harnessSubagentSubmitExtensionPath(
 	packageRoot: string,
 ): string {

package/.pi/extensions/harness-subagents.ts

@@ -6,7 +6,7 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { claimHarnessGovernanceLoad } from "./lib/extension-load-guard.js";
+import { claimHarnessGovernanceLoad } from "../lib/extension-load-guard.js";
 
 // @ts-expect-error pi extensions run as ESM
 const MODULE_URL = import.meta.url;
@@ -15,9 +15,9 @@ async function loadHarnessSubagents(): Promise<(pi: ExtensionAPI) => void> {
 	if (!claimHarnessGovernanceLoad("harness-subagents", MODULE_URL)) {
 		return () => {};
 	}
-	const { getHarnessPackageRoot } = await import("./lib/harness-paths.js");
+	const { getHarnessPackageRoot } = await import("../lib/harness-paths.js");
 	const { createHarnessSubagentsExtension } = await import(
-		"./lib/harness-subagents-bridge.js"
+		"../lib/harness-subagents-bridge.js"
 	);
 	return createHarnessSubagentsExtension(getHarnessPackageRoot(MODULE_URL));
 }

package/.pi/extensions/harness-telemetry.ts

@@ -9,12 +9,12 @@
 
 import { createHash } from "node:crypto";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { isHarnessProjectEnabled } from "../lib/harness-project-config.js";
 import {
 	captureHarnessEvent,
 	type HarnessPostHogEventName,
 	shutdownHarnessPostHog,
-} from "./lib/harness-posthog.js";
+} from "../lib/harness-posthog.js";
+import { isHarnessProjectEnabled } from "../lib/harness-project-config.js";
 
 type HarnessPhase = "plan" | "execute" | "evaluate" | "adversary" | "merge";
 

package/.pi/extensions/harness-web-guard.ts

@@ -5,7 +5,8 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 const BLOCK_REASON =
-	"harness-web-guard: use web_search (SERP) or web_fetch (page content) instead of raw curl/wget/firecrawl/scrapling fetch. " +
+	"harness-web-guard: use web_search (tier=deep for research), web_fetch, web_find_similar, or web_contents — " +
+	"not raw curl/wget/firecrawl/scrapling fetch. See web-retrieval skill. " +
 	"Setup may use harness-web.py status directly.";
 
 const ALLOW_PATTERNS = [