ultimate-pi 0.8.0 → 0.9.1

package/.agents/skills/harness-plan/SKILL.md

@@ -14,15 +14,15 @@ description: Produce PlanPacket-aligned harness plans before execute phase. Use
 
 ## Workflow (orchestrator)
 
-1. Spawn `harness/planner` with `HarnessSpawnContext` JSON (see `.pi/harness/specs/harness-spawn-context.schema.json`).
-2. Parse planner JSON (`status`, `plan_packet`, `clarification`) from `get_subagent_result`.
-3. On `needs_clarification`, `ask_user` with planner options, then re-spawn.
-4. Present full plan; `ask_user` Approve / Request changes / Cancel.
-5. **Only after Approve** — write canonical `plan_packet_path`.
+1. Use `HarnessSpawnContext` from injected `[HarnessRunContext]` — do not read spec files from disk.
+2. Spawn `harness/planner` **once** with that JSON in the prompt (`inherit_context: false`).
+3. Parse planner JSON from `get_subagent_result` (`status`, `plan_packet`, `clarification`).
+4. Do **not** parent `ask_user` or re-spawn for clarification — planner uses `ask_user` in the subagent.
+5. **Only after** subagent approval is synced — write canonical `plan_packet_path`.
 
 ## Rules
 
-- Parent owns all `ask_user`; `harness/planner` has `disallowed_tools: ask_user`.
+- `harness/planner` owns clarification and approval `ask_user` (bridged to parent UI).
 - Never plan or mutate source inline in the slash-command session.
 - context-mode only on harness paths; never lean-ctx.
 

package/.pi/agents/harness/planner.md

@@ -1,8 +1,7 @@
 ---
 description: Harness planner that compiles strict PlanPacket contracts before execution.
-tools: read, grep, find, ls
+tools: read, grep, find, ls, ask_user
 extensions: false
-disallowed_tools: ask_user
 thinking: medium
 max_turns: 20
 inherit_context: false
@@ -12,7 +11,7 @@ You are the Harness Planner.
 
 ## Mission
 
-Compile a strict, machine-readable `PlanPacket` draft for the parent orchestrator. You do **not** write `plan-packet.json` or call `ask_user` — the slash-command session handles approval and disk writes.
+Compile a strict, machine-readable `PlanPacket` draft. Run clarification and final approval via `ask_user` in this session (parent UI). You do **not** write `plan-packet.json` — the orchestrator writes the canonical file after you return `status: ready` and the user has approved.
 
 ## Spawn context
 
@@ -20,20 +19,20 @@ Read the `HarnessSpawnContext` JSON in the spawn prompt (`schema_version`, `mode
 
 ## Process
 
-1. Read `.pi/harness/specs/plan-packet.schema.json` and graphify context (`graphify-out/GRAPH_REPORT.md` or wiki) before claiming architecture.
+1. Use graphify context (`graphify-out/GRAPH_REPORT.md` or wiki) before claiming architecture — do not read harness spec JSON files from disk.
 2. Parse task scope, constraints, and acceptance intent from spawn context.
-3. **Greenfield** (`mode: create`) vs **revise** (`mode: revise`) — when revising, read the existing packet at `plan_packet_path` and amend; do not restart unless spawn context says so.
-4. `--quick` / `quick: true` narrows breadth (fewer checks, tighter scope), never safety or rollback requirements.
+3. **Greenfield** (`mode: create`) vs **revise** (`mode: revise`) — when revising, read the existing packet at `plan_packet_path` if present and amend.
+4. `--quick` / `quick: true` narrows breadth, never safety or rollback requirements.
 5. Build a complete `PlanPacket`: `plan_id`, `task_id`, `scope`, `assumptions`, `risk_level`, `acceptance_checks`, `rollback_plan` with `revert_command`, `revert_branch`, `patch_bundle`, `revert_commit_ready: true`.
 6. Escalate `risk_level` to `high` for blast radius, uncertainty, or policy-sensitive surfaces.
-7. If scope, risk, or acceptance is ambiguous, return `needs_clarification` with `clarification.options` for the parent to run `ask_user` — do not guess.
+7. If scope is ambiguous, call `ask_user` with structured options — do not return `needs_clarification` without trying `ask_user` first when options are clear.
+8. Before returning `ready`, present the full plan in chat and call `ask_user` with **Approve** / **Request changes** / **Cancel**. On Request changes, revise and ask again in this session.
 
 ## Guardrails
 
-- Do not mutate files (read-only tools only).
+- Do not mutate project files (read-only tools except `ask_user`).
 - Never speculate about code you have not read.
 - Do not execute or widen implementation scope.
-- Project overrides must not set `inherit_context: true` for `harness/*`.
 
 ## Output (required JSON block)
 
@@ -48,4 +47,4 @@ End with a single fenced `json` block the parent can parse:
 }
 ```
 
-Use `"status": "needs_clarification"` and omit `plan_packet` when blocked; include `clarification: { "question": "…", "options": [{ "title": "…", "description": "…" }] }`.
+Use `"status": "needs_clarification"` only when blocked after `ask_user` or user cancelled; include `clarification` when the parent must intervene without a live subagent.

package/.pi/extensions/budget-guard.ts

@@ -23,7 +23,9 @@ interface BudgetExhaustedEvent {
 	exhaustion_reason:
 		| "max_rounds_reached"
 		| "round_token_cap_exceeded"
-		| "debate_global_cap_exceeded";
+		| "debate_global_cap_exceeded"
+		| "phase_cap_exceeded"
+		| "global_cap_exceeded";
 	caps: {
 		max_rounds: number;
 		round_token_cap: number;
@@ -52,7 +54,7 @@ const DEFAULT_GLOBAL_CAP = Number(
 );
 const HARD_STOP_BUDGETS = process.env.HARNESS_BUDGET_HARD_STOP === "true";
 const DEFAULT_PHASE_CAPS: Record<HarnessPhase, number> = {
-	plan: Number(process.env.HARNESS_BUDGET_PLAN_TOKENS ?? "12000"),
+	plan: Number(process.env.HARNESS_BUDGET_PLAN_TOKENS ?? "80000"),
 	execute: Number(process.env.HARNESS_BUDGET_EXECUTE_TOKENS ?? "80000"),
 	evaluate: Number(process.env.HARNESS_BUDGET_EVALUATE_TOKENS ?? "25000"),
 	adversary: Number(process.env.HARNESS_BUDGET_ADVERSARY_TOKENS ?? "35000"),
@@ -191,6 +193,8 @@ async function emitBudgetEvent(
 	pi.appendEntry("harness-budget-exhausted", event);
 }
 
+const debouncedSoftLimit = new Map<string, boolean>();
+
 export default function budgetGuard(pi: ExtensionAPI) {
 	pi.on("tool_call", async (_event, ctx) => {
 		const policy = getPolicyContext(ctx);
@@ -202,35 +206,60 @@ export default function budgetGuard(pi: ExtensionAPI) {
 		const globalCap = DEFAULT_GLOBAL_CAP;
 		const phaseCap = DEFAULT_PHASE_CAPS[phase];
 		const caps = await readDebateCapsFromSchema();
+		const runId = getRunId(ctx);
+
+		const phaseExceeded = phaseUsed >= phaseCap;
+		const globalExceeded = usage.totalTokens >= globalCap;
+		if (!phaseExceeded && !globalExceeded) return undefined;
 
-		if (usage.totalTokens < globalCap && phaseUsed < phaseCap) return undefined;
+		const exhaustionReason = phaseExceeded
+			? "phase_cap_exceeded"
+			: "global_cap_exceeded";
+		const debateCaps =
+			phase === "adversary" || phase === "evaluate"
+				? caps
+				: {
+						max_rounds: 0,
+						round_token_cap: phaseCap,
+						debate_global_cap: globalCap,
+					};
 
 		const exhausted: BudgetExhaustedEvent = {
 			schema_version: "1.0.0",
 			contract_version: "1.0.0",
 			event_type: "budget_exhausted",
-			run_id: getRunId(ctx),
+			run_id: runId,
 			debate_id: `${phase}-budget-guard`,
 			round_count: 1,
-			budget_used: Math.max(usage.totalTokens, phaseUsed),
-			exhaustion_reason: "debate_global_cap_exceeded",
-			caps,
+			budget_used: phaseExceeded ? phaseUsed : usage.totalTokens,
+			exhaustion_reason: exhaustionReason,
+			caps: debateCaps,
 			minimum_evidence_confidence: 0.6,
 			default_policy_outcome: "block",
 			human_override_allowed: true,
 		};
 
-		await emitBudgetEvent(pi, exhausted);
+		const debounceKey = `${runId}:${phase}:${exhaustionReason}`;
+		if (!debouncedSoftLimit.has(debounceKey)) {
+			debouncedSoftLimit.set(debounceKey, true);
+			await emitBudgetEvent(pi, exhausted);
+		}
+
 		if (!HARD_STOP_BUDGETS) {
-			pi.appendEntry("harness-budget-soft-limit", {
-				run_id: exhausted.run_id,
-				phase,
-				phaseUsed,
-				phaseCap,
-				totalUsed: usage.totalTokens,
-				totalCap: globalCap,
-				timestamp: nowIso(),
-			});
+			const softKey = `${debounceKey}:soft`;
+			if (!debouncedSoftLimit.has(softKey)) {
+				debouncedSoftLimit.set(softKey, true);
+				pi.appendEntry("harness-budget-soft-limit", {
+					run_id: exhausted.run_id,
+					phase,
+					phaseUsed,
+					phaseCap,
+					totalUsed: usage.totalTokens,
+					totalCap: globalCap,
+					exhaustion_reason: exhaustionReason,
+					timestamp: nowIso(),
+				});
+			}
 			return undefined;
 		}
 		return {

package/.pi/extensions/harness-run-context.ts

@@ -5,6 +5,7 @@
  * in before_agent_start so trace-recorder reuses it on agent_start.
  */
 
+import { readFile, writeFile } from "node:fs/promises";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import {
 	canonicalPlanPath,
@@ -13,15 +14,17 @@ import {
 	extractCompletionStatuses,
 	formatActivePlanBlock,
 	formatPlanContextBlock,
+	getLatestHarnessTurn,
 	getLatestPolicyPhase,
 	getLatestRunContext,
 	getPolicyTransitionBlock,
 	type HarnessRunContext,
+	type HarnessTurnEntry,
 	hasHarnessAbortSignal,
 	hasPlanUserApproval,
+	inferHarnessPhase,
 	isAmendPlanAllowed,
 	isHarnessBootstrapPrompt,
-	isHarnessSlashCommand,
 	isNewTaskPlanBlocked,
 	isStaleActiveRunPointer,
 	loadProjectActiveRun,
@@ -30,7 +33,7 @@ import {
 	nowIso,
 	type PlanPacketSummary,
 	parseAskUserApprovalFromMessage,
-	parseHarnessSlashCommand,
+	parseHarnessSlashInput,
 	planPacketSummary,
 	readPlanPacketFromPath,
 	resolveArgsForCommand,
@@ -60,14 +63,26 @@ function persistContext(pi: ExtensionAPI, ctx: HarnessRunContext): void {
 	void saveProjectActiveRun(ctx);
 }
 
-function extractTaskSummary(prompt: string): string | null {
-	const quoted = prompt.match(/"([^"]+)"/);
-	if (quoted?.[1]) return quoted[1];
-	const cmd = parseHarnessSlashCommand(prompt);
-	if (cmd?.args) return cmd.args.slice(0, 200);
+function extractTaskSummary(args: string, prompt?: string): string | null {
+	const fromArgs = args.match(/"([^"]+)"/);
+	if (fromArgs?.[1]) return fromArgs[1];
+	if (args.trim()) return args.trim().slice(0, 200);
+	if (prompt) {
+		const quoted = prompt.match(/"([^"]+)"/);
+		if (quoted?.[1]) return quoted[1];
+	}
 	return null;
 }
 
+function appendHarnessTurn(pi: ExtensionAPI, turn: HarnessTurnEntry): void {
+	pi.appendEntry("harness-turn", turn);
+	pi.appendEntry("harness-plan-attempt", {
+		run_id: null,
+		command: turn.command,
+		started_at: turn.invoked_at,
+	});
+}
+
 function syncPolicyFromPlan(
 	pi: ExtensionAPI,
 	entries: unknown[],
@@ -148,15 +163,35 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 		activeCtx = await hydrateFromDisk(sessionId, projectRoot, entries);
 	});
 
+	pi.on("input", async (event) => {
+		if (event.source === "extension") {
+			return { action: "continue" as const };
+		}
+		const parsed = parseHarnessSlashInput(event.text);
+		if (!parsed) {
+			return { action: "continue" as const };
+		}
+		appendHarnessTurn(pi, {
+			schema_version: "1.0.0",
+			command: parsed.command,
+			args: parsed.args,
+			source: "slash",
+			invoked_at: nowIso(),
+		});
+		return { action: "continue" as const };
+	});
+
 	pi.on("before_agent_start", async (event, ctx) => {
 		const sessionId = ctx.sessionManager.getSessionId();
 		const projectRoot = process.cwd();
 		const entries = getEntries(ctx);
 		const userPrompt = userVisiblePromptSlice(event.prompt);
-		const parsed = parseHarnessSlashCommand(userPrompt);
+		const turn = getLatestHarnessTurn(entries);
+		const parsed = turn
+			? { command: turn.command, args: turn.args }
+			: parseHarnessSlashInput(userPrompt);
 		const harnessTurn =
-			isHarnessSlashCommand(userPrompt) ||
-			needsClarificationFollowUp(activeCtx);
+			Boolean(turn) || Boolean(parsed) || needsClarificationFollowUp(activeCtx);
 
 		if (
 			userPrompt.toLowerCase().includes("/harness-abort") ||
@@ -186,7 +221,10 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 		}
 
 		const policyPhase =
-			getLatestPolicyPhase(entries) ?? activeCtx?.phase ?? "plan";
+			inferHarnessPhase(entries, userPrompt) ??
+			getLatestPolicyPhase(entries) ??
+			activeCtx?.phase ??
+			"plan";
 		const driftActive = driftGateActive(entries);
 
 		// Plain-language follow-up after needs_clarification
@@ -196,13 +234,11 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 			const packet = activeCtx.plan_packet_path
 				? await readPlanPacketFromPath(activeCtx.plan_packet_path)
 				: null;
-			const summary = packet
-				? planPacketSummary(
-						packet,
-						activeCtx.plan_packet_path!,
-						"needs_clarification",
-					)
-				: null;
+			const planPath = activeCtx.plan_packet_path;
+			const summary =
+				packet && planPath
+					? planPacketSummary(packet, planPath, "needs_clarification")
+					: null;
 			syncPolicyFromPlan(
 				pi,
 				entries,
@@ -244,7 +280,7 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 				activeCtx.last_outcome = "abandoned";
 				persistContext(pi, activeCtx);
 			}
-			const task = extractTaskSummary(userPrompt);
+			const task = extractTaskSummary(args, userPrompt);
 			activeCtx = createFreshRunContext(sessionId, projectRoot, task);
 			persistContext(pi, activeCtx);
 			return {
@@ -323,21 +359,29 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 				!activeCtx ||
 				!shouldReuseHarnessRunId(userPrompt, activeCtx, command)
 			) {
-				const task = extractTaskSummary(userPrompt);
+				const task = extractTaskSummary(args, userPrompt);
 				activeCtx = createFreshRunContext(sessionId, projectRoot, task);
 			}
 			activeCtx.plan_ready = false;
 			activeCtx.phase = "plan";
 			activeCtx.status = "active";
 			if (command === "harness-plan") {
-				const task = extractTaskSummary(userPrompt);
+				const task = extractTaskSummary(args, userPrompt);
 				if (task) activeCtx.task_summary = task;
 			}
-			pi.appendEntry("harness-plan-attempt", {
-				run_id: activeCtx.run_id,
-				command,
-				started_at: nowIso(),
-			});
+			if (turn) {
+				pi.appendEntry("harness-plan-attempt", {
+					run_id: activeCtx.run_id,
+					command,
+					started_at: turn.invoked_at,
+				});
+			} else {
+				pi.appendEntry("harness-plan-attempt", {
+					run_id: activeCtx.run_id,
+					command,
+					started_at: nowIso(),
+				});
+			}
 		} else if (
 			activeCtx &&
 			shouldReuseHarnessRunId(userPrompt, activeCtx, command)
@@ -473,7 +517,6 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 
 	pi.on("agent_end", async (_event, ctx) => {
 		const entries = getEntries(ctx);
-		const sessionId = ctx.sessionManager.getSessionId();
 		if (!activeCtx) {
 			activeCtx = getLatestRunContext(entries);
 		}
@@ -493,7 +536,10 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 					? lastUser.message.content
 					: "";
 		}
-		const parsed = parseHarnessSlashCommand(userVisiblePromptSlice(lastPrompt));
+		const lastTurn = getLatestHarnessTurn(entries);
+		const parsed = lastTurn
+			? { command: lastTurn.command, args: lastTurn.args }
+			: parseHarnessSlashInput(userVisiblePromptSlice(lastPrompt));
 		if (!parsed && !needsClarificationFollowUp(activeCtx)) return;
 
 		const policyPhase = getLatestPolicyPhase(entries) ?? activeCtx.phase;
@@ -715,6 +761,82 @@ export default function harnessRunContext(pi: ExtensionAPI) {
 		},
 	});
 
+	pi.registerCommand("harness-plan-commit", {
+		description:
+			"Write approved plan-packet.json to the active run (requires harness-plan-approval)",
+		handler: async (args, ctx) => {
+			const projectRoot = process.cwd();
+			const entries = getEntries(ctx);
+			let runCtx = getLatestRunContext(entries) ?? activeCtx;
+			if (!runCtx) {
+				runCtx = await hydrateFromDisk(
+					ctx.sessionManager.getSessionId(),
+					projectRoot,
+					entries,
+				);
+			}
+			if (!runCtx?.plan_packet_path) {
+				const msg = "No active harness run. Run /harness-plan first.";
+				if (ctx.hasUI) ctx.ui.notify(msg, "warning");
+				return;
+			}
+			if (
+				!hasPlanUserApproval(entries, {
+					sincePlanCommand: true,
+					planId: runCtx.plan_id,
+				})
+			) {
+				const msg =
+					"Plan commit blocked: no user approval recorded. Approve via ask_user in the planner subagent first.";
+				if (ctx.hasUI) ctx.ui.notify(msg, "warning");
+				return;
+			}
+			const pathArg = args.trim();
+			let packetPath = runCtx.plan_packet_path;
+			if (pathArg) {
+				packetPath = pathArg;
+			}
+			const packet = await readPlanPacketFromPath(packetPath);
+			const validation = validatePlanPacket(packet);
+			if (!validation.valid || !packet) {
+				const msg = !packet
+					? "Plan packet file missing or unreadable."
+					: `Invalid plan packet: ${validation.errors.join("; ")}`;
+				if (ctx.hasUI) ctx.ui.notify(msg, "error");
+				return;
+			}
+			const target = runCtx.plan_packet_path;
+			if (!target) {
+				if (ctx.hasUI) ctx.ui.notify("No plan_packet_path on active run.", "error");
+				return;
+			}
+			if (pathArg && pathArg !== target) {
+				const raw = await readFile(pathArg, "utf-8");
+				await writeFile(target, raw, "utf-8");
+			}
+			runCtx.plan_id = packet.plan_id ?? runCtx.plan_id;
+			runCtx.plan_ready = true;
+			runCtx.phase = "plan";
+			runCtx.last_completed_step = "plan";
+			runCtx.last_outcome = "ready";
+			runCtx.next_recommended_command = "/harness-run";
+			runCtx.updated_at = nowIso();
+			activeCtx = runCtx;
+			persistContext(pi, runCtx);
+			syncPolicyFromPlan(
+				pi,
+				entries,
+				runCtx.plan_id ?? packet.plan_id ?? "plan-pending",
+				"plan",
+				true,
+			);
+			const summary = planPacketSummary(packet, target, "ready");
+			pi.appendEntry("harness-plan-packet", summary);
+			const msg = `Plan committed: ${target}`;
+			if (ctx.hasUI) ctx.ui.notify(msg, "info");
+		},
+	});
+
 	pi.registerCommand("harness-use-run", {
 		description: "Point this session at an existing run directory (recovery)",
 		handler: async (args, ctx) => {

package/.pi/extensions/lib/harness-subagents/harness-subagent-policy.ts

@@ -82,7 +82,7 @@ export function evaluateHarnessSubagentToolCall(
 	input: Record<string, unknown> | undefined,
 	agentType: string,
 ): ToolCallDecision {
-	const base = evaluateSubagentToolCall(toolName);
+	const base = evaluateSubagentToolCall(toolName, agentType);
 	if (base.action === "block") {
 		return base;
 	}

package/.pi/extensions/lib/harness-subagents/parent-ask-user-bridge.ts

@@ -0,0 +1,89 @@
+/**
+ * Registers ask_user in subagent sessions, delegating UI to the parent harness session.
+ */
+
+import type {
+	ExtensionAPI,
+	ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import { runAskDialog } from "../ask-user/dialog.js";
+import { runAskFallback } from "../ask-user/fallback.js";
+import { renderAskCall, renderAskResult } from "../ask-user/render.js";
+import {
+	AskUserParamsSchema,
+	PROMPT_GUIDELINES,
+	PROMPT_SNIPPET,
+} from "../ask-user/schema.js";
+import type { AskUserParams, DialogResult } from "../ask-user/types.js";
+import {
+	formatResultText,
+	toToolDetails,
+	validateAskParams,
+} from "../ask-user/validate.js";
+
+const ASK_USER_AGENT_TYPES = new Set([
+	"harness/planner",
+	"harness/evaluator",
+	"harness/adversary",
+	"harness/tie-breaker",
+]);
+
+export function agentTypeAllowsParentAskUser(agentType: string): boolean {
+	return ASK_USER_AGENT_TYPES.has(agentType);
+}
+
+export function createParentAskUserBridgeFactory(
+	parentCtx: ExtensionContext,
+	agentType: string,
+): ((pi: ExtensionAPI) => void) | null {
+	if (!agentTypeAllowsParentAskUser(agentType)) {
+		return null;
+	}
+	return (pi: ExtensionAPI) => {
+		pi.registerTool({
+			name: "ask_user",
+			label: "Ask User",
+			description:
+				"Ask the user a structured question (parent session UI). Use for clarification and plan approval.",
+			promptSnippet: PROMPT_SNIPPET,
+			promptGuidelines: PROMPT_GUIDELINES,
+			parameters: AskUserParamsSchema,
+			async execute(_toolCallId, params, _signal, _onUpdate) {
+				const validated = validateAskParams(params as AskUserParams);
+				if (typeof validated === "string") {
+					return {
+						content: [{ type: "text", text: validated }],
+						details: {
+							question: params.question ?? "",
+							options: [],
+							response: null,
+							cancelled: true,
+						},
+					};
+				}
+				let outcome: DialogResult;
+				if (parentCtx.hasUI) {
+					outcome = await runAskDialog(parentCtx.ui, validated);
+				} else {
+					outcome = await runAskFallback(parentCtx.ui, validated);
+				}
+				const details = toToolDetails(
+					validated,
+					outcome.response,
+					outcome.cancelled,
+				);
+				const text = formatResultText(outcome.response, outcome.cancelled);
+				return {
+					content: [{ type: "text", text }],
+					details,
+				};
+			},
+			renderCall(args, theme) {
+				return renderAskCall(args, theme);
+			},
+			renderResult(result, options, theme) {
+				return renderAskResult(result, options, theme);
+			},
+		});
+	};
+}

package/.pi/extensions/lib/harness-subagents/spawn-policy.ts

@@ -7,7 +7,13 @@ export const SUBAGENT_BLOCKED_TOOLS = new Set([
 	"get_subagent_result",
 	"steer_subagent",
 	"blackboard",
-	"ask_user",
+]);
+
+const ASK_USER_ALLOWED_AGENT_TYPES = new Set([
+	"harness/planner",
+	"harness/evaluator",
+	"harness/adversary",
+	"harness/tie-breaker",
 ]);
 
 export interface ToolCallDecision {
@@ -16,12 +22,24 @@ export interface ToolCallDecision {
 	newArgs?: Record<string, unknown>;
 }
 
-export function evaluateSubagentToolCall(toolName: string): ToolCallDecision {
+export function evaluateSubagentToolCall(
+	toolName: string,
+	agentType?: string,
+): ToolCallDecision {
 	if (SUBAGENT_BLOCKED_TOOLS.has(toolName)) {
 		return {
 			action: "block",
 			reason: `Tool "${toolName}" is not available in subagent sessions (single spawn depth).`,
 		};
 	}
+	if (toolName === "ask_user") {
+		if (agentType && ASK_USER_ALLOWED_AGENT_TYPES.has(agentType)) {
+			return { action: "allow" };
+		}
+		return {
+			action: "block",
+			reason: `Tool "ask_user" is not available for ${agentType ?? "this agent"} (orchestrator-only).`,
+		};
+	}
 	return { action: "allow" };
 }

package/.pi/extensions/lib/harness-subagents/vendored/agent-manager.ts

@@ -252,6 +252,7 @@ export class AgentManager {
 				options.onSessionCreated?.(session);
 			},
 			systemPromptAppendix: options.systemPromptAppendix,
+			parentExtensionContext: ctx,
 		})
 			.then(({ responseText, session, aborted, steered }) => {
 				// Don't overwrite status if externally stopped via abort()