perf: skip parent-only workflow extensions in child sessions

[Sun-GLiang]

Summary

• derive parent-only OpenPI extensions from the existing tool surface, owner source paths, and child exclusion contract
• filter only verified package-local parent-only extensions before child lifecycle binding
• preserve child-safe OpenPI tools, third-party extensions, dynamic structured output tools, and existing parent Workflow behavior
• add deterministic regression coverage and a workflow child-startup benchmark

Validation

• bun run check
• bun run test (875 Node tests and 30 Vitest tests)
• bun run benchmark:workflow-child-startup (all 9 scenarios: 0 workflow reads, 0 bytes, 0 parses)
• Pi 0.84.1 runtime smoke for Direct and Workflow children
• parent Dashboard smoke confirms foreign Workflow history is not restored into a new request

Closes #183

[agnitum2009]

Verified locally on the PR head (0f0f8db) — this is a clean, well-scoped fix for #183. Approving.

Design

• Deriving the parent-only extension set from the existing single source of truth (OPENPI_TOOL_SURFACE + CHILD_EXCLUDED_TOOL_NAMES) is the right move: a future owner whose entire surface is child-excluded is filtered automatically, and a mixed owner (any child-safe tool) is never filtered, so the existing denylist drift guard stays the fail-closed backstop.
• Path matching degrades safely: if an owner source path can't be canonicalized, the extension still loads and its tools are still stripped by childToolPolicy — fail-open on the perf win, fail-closed on correctness.
• realpathSync on both sides handles symlinked installs; extensionsOverride is a real LoadExtensionOptions hook in the pinned SDK, and filtering before child lifecycle binding is the correct seam.

Verified by running it

• bun run typecheck (only the two pre-existing file-search Effect warnings, unrelated) and bun run lint pass.
• Full suite: 875/875 Node tests + 30/30 Vitest, matching the PR's claim.
• bun run benchmark:workflow-child-startup: all 9 scenarios report 0 reads / 0 bytes / 0 parses; 8-child startup is flat across 0/100/1000 foreign runs (~545ms vs ~515ms), confirming the perf goal.
• New tests cover the important edges: third-party extensions survive tool-name collisions, child-safe extensions (fd, git_show) stay loaded, and dynamically registered structured_output tools survive binding.

Notes (non-blocking)

• The regression test monkeypatches global fs.readFileSync/JSON.parse with syncBuiltinESMExports; it restores state in finally correctly, but any future parallel test runner would need care. Acceptable for a targeted regression test.
• The benchmark script is opt-in via a separate npm script and does not run in CI; the deterministic fs/JSON instrumentation in the unit test is what guards the invariant over time. Good split.

[Sun-GLiang]

Hi maintainers — this PR is ready for another review.

It addresses #183 by skipping verified parent-only workflow extensions during child-session binding while preserving child-safe OpenPI tools, third-party extensions, and dynamically registered tools. The full validation suite and runtime smoke tests pass, and the benchmark confirms that child startup no longer reads or parses unrelated workflow history.

When you have time, I’d appreciate a maintainer review, particularly of the extension classification and child-session authority boundary. Thank you!

[tt-a1i]

Re-reviewed exact head 053265a after updating onto main ba26d32. The optimization derives parent-only extension owners from the existing tool-surface classification, preserves child-safe and third-party extensions, and fails closed when package/path identity is unverifiable. Local validation passed: focused 25/25, bun run check, 1060 Node tests passed with 1 platform skip, and 30/30 Vitest tests. The startup benchmark reported zero Workflow artifact reads, bytes, and JSON parses for all 1/4/8-child scenarios at 0/100/1000 foreign retained runs, so the performance win does not depend on weakening child tool policy. Fresh required CI passed on Node 22.19.0, Node 24, and Windows. No blocking findings.