statSync().isDirectory() is true for a mode-600 directory, but a
subprocess cwd needs X_OK — spawn would fail EACCES, deferring a
self-contained configuration error past the load/start boundary the
resolution owns. Probe accessSync(X_OK) alongside the type check so
"not an accessible directory" is literally what the guard verifies.
Adopt initiator-derived private loop and session plumbing while preserving post-step recovery and balanced synthetic tool-call results after cancellation.
Keep the architecture map within its existing budget while documenting ambient Agent ownership and explicit cross-boundary identities.
Combine agent initiator scoping and exact Cordis JSDoc inspection with post-step compaction and bounded request recovery.
Regenerate the Cordis and website API catalogs, and classify the recovery and compaction types required by the current catalog link-coverage gate.
Replace the process-wide adapter-failure WeakSet with a per-call scope bound to the exact AsyncIterable returned by LlmService.stream(). Give every call a unique wrapper so waterfall middleware can reuse an iterable without sharing provenance.
Move agent-loop recovery classification to the model-stream boundary. Only the final adapter behind that exact call can become an agent/request-error; nested llm/stream calls remain ordinary outer middleware failures while preserving the original Error.
Cover nested calls, reused middleware iterables, and end-to-end agent-loop recovery. Update the package and RFC contracts, bilingual pairing record, and generated API and catalog references.
path.resolve('') is the process cwd, so an empty configured cwd would
silently reintroduce the launch-directory fallback the parent-session
cwd resolution removed. Fail at plugin load with an actionable message
instead.
The ACP backend resolved an unset cwd to the harness process's launch
directory, so a delegated child ran — and announced its ACP session —
in the server's cwd instead of the delegating session's workspace.
Resolve the working directory explicitly: the config cwd override
(made absolute and validated at load), else the parent session
header's cwd (validated at start), failing loud before spawning when
neither exists.
Document every context-window path returned by mapStopReason: recognized provider error wording, successful stop usage beyond the resolved window, and zero-output length stops that fill the window.
This keeps the public return contract aligned with usage-based overflow classification without duplicating the provider-specific detection table owned by pi-ai.
Dispatch RequestErrorDecision and CompactionTrigger through explicit discriminant switches. End each closed union with assertNever so new variants fail compilation instead of silently inheriting fail or pressure behavior.
This preserves the current retry, fail, pressure, and overflow semantics while aligning the new recovery seams with the repository closed-union contract.
Contain arbitrary plugin and runtime failures even when a thrown Proxy traps instanceof checks or its string coercion throws. Fall back to a stable diagnostic instead of letting executeCli reject outside its exit-code contract.
Route abort reasons through the same total renderer so cancellation cannot escape containment through an exotic reason value.
Add a focused regression that exercises both hostile inspection paths and verifies stdout remains empty, stderr remains labelled, and the CLI resolves with exit code 1.
Yichen Jiang
Tianyi Cui