The title summarizer ran with `tools: "readonly"` but host extensions
(`@runfusion/fusion`) were still injected, exposing `fn_task_create` and
the rest of the `fn_*` mutation surface. A summarizer model called
`fn_task_create` mid-summary, spawning an unintended sibling task and
leaving its chat-style reply ("Created **FN-xxxx** with the full spec…")
sliced as the original task's title.
- pi.ts: in `tools: "readonly"` mode, skip host extension paths and drop
caller-supplied customTools so the session truly only has read/grep/
find/ls.
- ai-summarize.ts: harden all four system prompts (title, merge summary,
commit body, commit subject) with explicit no-tool / treat-input-as-
content framing; wrap the title prompt's user content in a
`<description>` delimiter; route the AI response through new
`sanitizeTitle` that strips chatty preambles, markdown emphasis,
surrounding quotes, and trailing punctuation before truncation.
- Tests: add a regression covering the exact incident shape plus
unit coverage for `sanitizeTitle` edge cases.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
12e336b32e