@alphacoder-v0/pi-loops 0.24.0 → 0.24.2

package/src/pi-loops.ts

@@ -16,7 +16,7 @@
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext, ToolDefinition } from "@earendil-works/pi-coding-agent";
-import { ProjectTrustStore, SessionManager, VERSION as PI_VERSION, getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
+import { ProjectTrustStore, SessionManager, VERSION as PI_VERSION, copyToClipboard, getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 import { ARCHIVE_EXT, type ActivateMode, applyImport, automationOf, defaultExportPath, exportSession, importSession, offerToEnable, parseActivateMode } from "./archive.ts";
 import { Box, Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
@@ -38,16 +38,18 @@ import { cardLines, cardOrigin, claimPrompt, dismissOutcome, dismissTail, inboxC
 import { shouldEmitSnapshot, snapshotFingerprint } from "./snapshot.ts";
 import { FRESH_RUNS_READ, burstLine, freshRuns, panelRuns, placeRunCards, runCardDelivery, runCardLines, runCardsHere, runLine } from "./run-card.ts";
 import { type ShareMessage, renderShare, shareSummary, shareableMessages } from "./share.ts";
-import { installLauncherWithConfirm, installedByPi, launcherSource, launcherState, launcherTarget, refreshLauncher, stopAndWait, stopService } from "./cli.ts";
+import { UsageError, addLauncher, installLauncherWithConfirm, installedByPi, launcherAction, launcherSource, launcherState, launcherTarget, openPage, pageLaunchHost, refreshLauncher, slashDir, stopAndWait, stopService, uninstallLauncher, webPageRequest } from "./cli.ts";
+import { copyText, isRemoteTty } from "./browser-open.ts";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { computeDue, computeNext, formatLocal, formatSchedule, localOffset, parseSchedule, stamp } from "./schedule.ts";
 import { applyJobEdit } from "./job-edit.ts";
 import { jobLines as cronJobLines } from "./job-lines.ts";
+import { plural } from "./plural.ts";
 import { openWhere, runsHere } from "./job-owner.ts";
 import { type AcquireOutcome, LeaseBinding, LeaseStore, TURN_EVENTS, type TurnMarks, closedConversation, markTurnEvent, openWindowPids, procStart, turnSinceOf } from "./lease.ts";
 import { type DrainOptions, type EngineSinks, type HandOverDeps, type HandOverOutcome, type Producer, type RowAddress, armRetry, cancelRow, coalesced, drain, dropContinuations, goalRow, handOver as engineHandOver, handOverTarget, heldTurnFor, inboxClaimRow, newTriggerRow, promotionTarget, promotionView, pushRunRow, recipeRow, releaseLocalRows, ringProduced, ruleResultRow, stopRow, waitingLine } from "./engine.ts";
-import { PANEL_RUN_LIMIT, heldJobsNotice, leftConversationLine, panelLines, pickQueued, plural, queueLines, toolsCapNotice } from "./job-lines.ts";
+import { PANEL_RUN_LIMIT, heldJobsNotice, leftConversationLine, panelLines, pickQueued, queueLines, toolsCapNotice } from "./job-lines.ts";
 import { RequestStore, type SessionRequest } from "./requests.ts";
 import { WindowExecutor, unattendedTurn } from "./window-executor.ts";
 import { type GuardAnswer, WINDOW_GUARD_CONFIRM_MS, askRefusingFirst, windowGuard } from "./window-guard.ts";
@@ -1119,7 +1121,7 @@ export default function piLoops(pi: ExtensionAPI) {
 		const parts: string[] = [];
 		const n = scheduler.inbox.newCount();
 		const decisions = scheduler.inbox.decisionCount();
-		if (n > 0) parts.push(`Inbox: ${n} new${decisions ? ` (${decisions} decision${decisions === 1 ? "" : "s"})` : ""}`);
+		if (n > 0) parts.push(`Inbox: ${n} new${decisions ? ` (${plural(decisions, "decision")})` : ""}`);
 		// Machine-wide like the inbox count and the running list above it: one process owns the
 		// machine's clock, and a loop failing in another checkout is still this machine's automation
 		// going quiet.
@@ -1133,7 +1135,7 @@ export default function piLoops(pi: ExtensionAPI) {
 		const queued = here ? requests.list(here).filter((r) => r.kind === "input" && !executor.handedOver.has(r.id)).length : 0;
 		if (queued) parts.push(`queued ${queued}`);
 		const attention = mcpSources.filter((s) => s.status.state === "disconnected" || s.status.state === "auth_failed").length;
-		if (attention) parts.push(`mcp: ${attention} source${attention === 1 ? "" : "s"} down`);
+		if (attention) parts.push(`mcp: ${plural(attention, "source")} down`);
 		const paused = hostPauseReason();
 		if (paused && hostHasWork()) parts.push(`loops paused: ${paused}`);
 		else if (hostState?.kind === "channel-broken") parts.push(HOST_STATE_BADGE["channel-broken"]);
@@ -1321,7 +1323,7 @@ export default function piLoops(pi: ExtensionAPI) {
 						for (const row of targets) requests.append(cancelRow(sessionId, { id: row.id }, "window", createdBy()));
 						const result = await drainRequests();
 						const gone = targets.filter((row) => result?.removed.includes(row.id)).length;
-						ctx.ui.notify(gone === targets.length ? `cancelled ${gone} queued item${gone === 1 ? "" : "s"}` : `cancelled ${gone} of ${targets.length}; the rest are handed to pi already (Esc stops the turn) or are for the window that has this conversation to cancel`, "info");
+						ctx.ui.notify(gone === targets.length ? `cancelled ${plural(gone, "queued item")}` : `cancelled ${gone} of ${targets.length}; the rest are handed to pi already (Esc stops the turn) or are for the window that has this conversation to cancel`, "info");
 						refreshBadge();
 						return;
 					}
@@ -1617,7 +1619,7 @@ export default function piLoops(pi: ExtensionAPI) {
 								const who = job ? "" : `${r.jobName ?? r.jobId} `;
 								const cost = r.usage?.cost ? ` $${r.usage.cost.toFixed(3)}` : "";
 								const chk = r.checker ? (r.checker.ok ? `, checker kept ${r.checker.kept}/${r.checker.kept + r.checker.dropped.length + r.checker.unreviewed}` : ", checker FAILED") : "";
-								const tail = r.ok ? `${r.findings} finding${r.findings === 1 ? "" : "s"}${chk}${r.stateUpdated ? ", state updated" : ""}` : r.stoppedBy === "person" ? `stopped by you ${r.stoppedFrom === "page" ? "from the page" : "from a terminal"}` : r.aborted ? "stopped" : `FAILED: ${previewRedacted(r.error ?? "?", 80)}`;
+								const tail = r.ok ? `${plural(r.findings, "finding")}${chk}${r.stateUpdated ? ", state updated" : ""}` : r.stoppedBy === "person" ? `stopped by you ${r.stoppedFrom === "page" ? "from the page" : "from a terminal"}` : r.aborted ? "stopped" : `FAILED: ${previewRedacted(r.error ?? "?", 80)}`;
 								return `${String(i + 1).padStart(2)}. ${formatLocal(Date.parse(r.startedAt))} ${who}${secs}s${cost} · ${tail}${r.sessionFile ? "" : " (no transcript)"}`;
 							}),
 							job ? `transcript: /cron trace ${job.name ?? job.id} <k>` : "transcript: /cron trace <job> <k>",
@@ -2038,7 +2040,7 @@ export default function piLoops(pi: ExtensionAPI) {
 						}
 						const lines = inboxLines(entries, true);
 						const elsewhere = all.length - entries.length;
-						if (elsewhere) lines.push(`+ ${elsewhere} finding${elsewhere === 1 ? "" : "s"} in other projects — /inbox --all`);
+						if (elsewhere) lines.push(`+ ${plural(elsewhere, "finding")} in other projects — /inbox --all`);
 						const decisions = entries.filter((e) => e.kind === "checkpoint").length;
 						show(ctx, `Inbox (${where}, ${entries.length} new${decisions ? `, ${decisions} need${decisions === 1 ? "s" : ""} a decision` : ""}, times ${localOffset(Date.now())}):`, lines);
 						markSeenIfShown(everywhere);
@@ -2209,7 +2211,7 @@ export default function piLoops(pi: ExtensionAPI) {
 						const here = all.filter((r) => sameProject(r.cwd, session.cwd));
 						const elsewhere = all.length - here.length;
 						const lines = here.length ? ruleLines(here, true) : ["none"];
-						if (elsewhere) lines.push(`  + ${elsewhere} rule${elsewhere === 1 ? "" : "s"} in other projects — /triggers rules --all`);
+						if (elsewhere) lines.push(`  + ${plural(elsewhere, "rule")} in other projects — /triggers rules --all`);
 						if (rest.trim() === "--all") {
 							show(ctx, `Dynamic trigger rules (this machine, ${all.length}):`, all.length ? ruleLines(all, false) : ["none"]);
 							return;
@@ -2464,7 +2466,7 @@ export default function piLoops(pi: ExtensionAPI) {
 	const ARCHIVE_WARNING = `warning: ${ARCHIVE_EXT} archives include transcript and tool history. They do not include separate auth stores, provider credentials, OAuth tokens, MCP config, or the inbox.`;
 
 	pi.registerCommand("pi-loops", {
-		description: "About this extension; start | stop | restart | status the part that runs loops while no pi is open; install-launcher puts the `pi-loops` command on your PATH",
+		description: "About this extension; start | stop | restart | status the part that runs loops while no pi is open; web opens this conversation in the browser page; install-launcher puts the `pi-loops` command on your PATH, uninstall-launcher removes it",
 		handler: async (args, ctx) => {
 			lastCtx = ctx;
 			const sub = args.trim().split(/\s+/)[0] ?? "";
@@ -2491,6 +2493,37 @@ export default function piLoops(pi: ExtensionAPI) {
 				await drainRequests({ tick: true });
 				return;
 			}
+			if (sub === "web") {
+				// The page on this conversation with no `pi-loops` on PATH: the same page-open and opener
+				// the command line uses. Shown as a notice, not written into the conversation: the link
+				// carries a one-use key.
+				const lines: string[] = [];
+				const host = { ...pageLaunchHost(dir), packageDir: PACKAGE_DIR, piPackage: piPackageDir(), startedBy: `the pi window pid ${process.pid}`, myPiVersion: PI_VERSION };
+				const req = webPageRequest({ cwd: session.cwd, sessionId: binding.here().sessionId ?? session.sessionId, sessionFile: ctx.sessionManager.getSessionFile() });
+				// The link is shown and copied before the browser is tried: the wait for a browser to spend
+				// the key can take seconds, and the person may paste the link sooner.
+				const onLink = async (link: string) => {
+					// Said only when a clipboard command took the link. pi's copy can still get there through
+					// OSC 52, which no terminal confirms, so that try says nothing either way.
+					if (await copyText(link)) lines.push("  copied to the clipboard");
+					else await copyToClipboard(link).catch((err: any) => log.info(`/pi-loops web: copy: ${err?.message ?? err}`));
+					ctx.ui.notify(lines.join("\n"), "info");
+				};
+				const opened = await openPage(dir, req, { key: true, browser: isRemoteTty() ? "remote" : "yes", host }, (l) => lines.push(l), undefined, onLink);
+				// pi shows one notice at a time, so the last one repeats the link with the outcome.
+				ctx.ui.notify(lines.join("\n"), opened.code === 0 ? "info" : "warning");
+				refreshBadge();
+				return;
+			}
+			if (sub === "install-launcher" || sub === "uninstall-launcher") {
+				try {
+					slashDir(tokenize(splitCommand(args).rest).map((t) => t.value));
+				} catch (err: any) {
+					if (!(err instanceof UsageError)) throw err;
+					ctx.ui.notify(`${err.message}. usage: /pi-loops ${sub} [--dir <dir>]`, "warning");
+					return;
+				}
+			}
 			if (sub === "install-launcher") {
 				// The command line's own `install-launcher` cannot be reached until it has run once —
 				// `pi install` does not put the package on your PATH. You are already inside pi with
@@ -2505,12 +2538,20 @@ export default function piLoops(pi: ExtensionAPI) {
 				show(ctx, code === 0 ? "installed the pi-loops launcher" : "could not install the launcher", lines.map((l) => `  ${l.trim()}`));
 				return;
 			}
+			if (sub === "uninstall-launcher") {
+				const lines: string[] = [];
+				const code = uninstallLauncher(slashDir(tokenize(splitCommand(args).rest).map((t) => t.value)), (l) => lines.push(l));
+				show(ctx, code === 0 ? "the pi-loops launcher is gone" : "left the launcher alone", lines.map((l) => `  ${l.trim()}`));
+				return;
+			}
 			show(ctx, `pi-loops ${PI_LOOPS_VERSION}`, [
 				`  loops directory: ${homeRel(dir)}`,
 				`  package: ${homeRel(PACKAGE_DIR)}`,
 				"",
 				"  /pi-loops start | stop | restart | status",
+				"  /pi-loops web                              open this conversation in the browser page",
 				"  /pi-loops install-launcher [--dir <dir>]   put the `pi-loops` command on your PATH",
+				"  /pi-loops uninstall-launcher [--dir <dir>] remove it, so no session writes it again",
 				"  /cron · /triggers · /inbox · /goal",
 			]);
 		},
@@ -3160,7 +3201,7 @@ export default function piLoops(pi: ExtensionAPI) {
 	/* -------------------------------------------------------- lifecycle */
 
 	/**
-	 * The `pi-loops` command, kept on the PATH of whoever asked for it there.
+	 * The `pi-loops` command, put on the PATH and kept working there.
 	 *
 	 * `pi install` puts this package under pi's directory and nothing on the PATH, so until 0.22.1
 	 * the first thing a new user had to do was type a bare `node …/cli-entry.mjs install-launcher`
@@ -3169,40 +3210,47 @@ export default function piLoops(pi: ExtensionAPI) {
 	 * it runs and where a launcher would go, so the step belongs here.
 	 *
 	 * This is the extension's only write outside the loops directory (AGENTS.md). Its limit is one
-	 * file, `pi-loops` in a directory already on the PATH, and only where a launcher of ours already
-	 * is or after a yes. A file with no marker of ours is somebody's own wrapper and is left alone;
-	 * one naming another copy of this package that is still on disk is that copy's to keep current,
-	 * so an install and a checkout both being opened never trade the file back and forth; a no is
-	 * remembered in `ui.json`, so it is asked once rather than in every window; and a checkout is
-	 * never asked for a launcher that is not there at all — nobody ran `pi install`, so nothing is
-	 * missing from their PATH — though one written from a checkout is still kept working.
+	 * file, `pi-loops` in a directory already on the PATH. With nothing there, the first interactive
+	 * session of a copy `pi install` put in place writes it with no question and says so in one line,
+	 * as pi's own installer does for `pi` (#180); after that only a launcher of ours is rewritten. A
+	 * file that does not open with our header is somebody's own wrapper and is left alone; one naming another
+	 * copy of this package that is still on disk is that copy's to keep current, so an install and a
+	 * checkout both being opened never trade the file back and forth; `uninstall-launcher` is
+	 * remembered in `ui.json`, so no later session writes it again; a write that failed is
+	 * remembered with its directory, so it is not tried in every window; and a checkout never writes
+	 * a launcher that is not there at all — nobody ran `pi install`, so nothing is missing from their
+	 * PATH — though one written from a checkout is still kept working. The decision is
+	 * `launcherAction` in src/cli.ts.
 	 */
 	async function keepLauncher(ctx: ExtensionContext): Promise<void> {
 		const { entryDir, node, agentDir } = launcherSource();
 		const target = launcherTarget(undefined);
-		// Nothing on the PATH to write into. `/pi-loops install-launcher`, run by hand, is where that
-		// is explained; a session start saying it unprompted would be a warning about nothing.
-		if (!target) return;
-		const { state } = launcherState(entryDir, node, agentDir, target);
-		if (state === "stale") {
+		const prefs = readUiPrefs(dir);
+		const state = target ? launcherState(entryDir, node, agentDir, target).state : undefined;
+		const action = launcherAction({ target, state, hasUI: ctx.hasUI, declined: prefs.launcher === "declined", failedIn: prefs.launcher === "failed" ? prefs.launcherFailedIn : undefined, installedByPi: state === "absent" && installedByPi() });
+		if (!target || action === "none") return;
+		if (action === "refresh") {
 			const done = refreshLauncher(entryDir, node, agentDir, target);
 			if (!done) return;
 			log.info(`launcher: ${done.message}`);
-			// No question: they asked for a launcher once, and keeping that one working is what they
-			// asked for. The line is so that a file changing under them is never a silent change.
+			// They have a launcher of ours, and keeping that one working is what it is for. The line is
+			// so that a file changing under them is never a silent change.
 			if (ctx.hasUI) ctx.ui.notify(`[pi-loops] ${done.message}`, done.ok ? "info" : "warning");
 			return;
 		}
-		if (state !== "absent") return; // ours and current, another copy's, or somebody else's entirely
-		if (!ctx.hasUI || readUiPrefs(dir).launcher === "declined" || !installedByPi()) return;
-		const lines: string[] = [];
-		const code = await installLauncherWithConfirm([], (title, body) => ctx.ui.confirm(title, body), (l) => lines.push(l));
-		if (code === undefined) {
-			writeUiPref(dir, "launcher", "declined");
-			ctx.ui.notify("[pi-loops] not installed — `/pi-loops install-launcher` writes one whenever you want it", "info");
+		const added = addLauncher(entryDir, node, agentDir, target);
+		if (added.kind === "none") return;
+		if (added.kind === "added") {
+			// A failed write into another directory is not news any more.
+			clearUiPref(dir, "launcher");
+			clearUiPref(dir, "launcherFailedIn");
+			log.info(`launcher: wrote ${added.file}`);
+			ctx.ui.notify(`[pi-loops] added pi-loops to ${homeRel(target)}; /pi-loops uninstall-launcher removes it`, "info");
 			return;
 		}
-		ctx.ui.notify(`[pi-loops] ${lines.map((l) => l.trim()).join(" · ")}`, code === 0 ? "info" : "warning");
+		writeUiPref(dir, "launcher", "failed");
+		writeUiPref(dir, "launcherFailedIn", target);
+		ctx.ui.notify(`[pi-loops] ${added.message}; /pi-loops install-launcher --dir <dir> writes it elsewhere`, "warning");
 	}
 
 	/**
@@ -3277,8 +3325,7 @@ export default function piLoops(pi: ExtensionAPI) {
 			loadMcpConfig(windowTrusted(getAgentDir(), ctx.cwd, ctx.isProjectTrusted(), APPROVED));
 			for (const d of mcpDiagnostics) if (ctx.hasUI) ctx.ui.notify(`[pi-loops] ${d}`, "warning");
 			await startMcpSources(); // tools for every process; pushes are consumed by interactive processes only
-			// Not awaited: the question below is a dialog, and the clock must not wait behind someone who
-			// has walked away from it.
+			// A launcher that cannot be written or kept is logged, and never stops the session starting.
 			void keepLauncher(ctx).catch((err: any) => log.info(`launcher: ${err?.message ?? err}`));
 			// tui and rpc processes stay alive and run the clock; `PI_LOOPS_HOST=1` starts it in a `pi -p`
 			// run too, which queues its conversation's due prompts but hands none to pi (the window

package/src/plural.ts

@@ -0,0 +1,4 @@
+/** `1 loop`, `2 loops`: a count a person reads, never `loop(s)`. */
+export function plural(n: number, one: string, many = `${one}s`): string {
+	return `${n} ${n === 1 ? one : many}`;
+}

package/src/run-card.ts

@@ -6,6 +6,7 @@
  */
 import { screenText } from "./inbox-card.ts";
 import { loopLabel } from "./job-lines.ts";
+import { plural } from "./plural.ts";
 import { previewRedacted } from "./redact.ts";
 import type { RunRecord } from "./store.ts";
 
@@ -48,12 +49,12 @@ export function runLine(r: RunRecord, name?: string): string {
 	if (r.aborted) return `${label} stopped · ${secs}s`;
 	if (!r.ok) return `${label} FAILED · ${secs}s · ${previewRedacted(r.error ?? "unknown error", ERROR_CHARS)}`;
 	const cost = r.usage?.cost ? ` · $${r.usage.cost.toFixed(3)}` : "";
-	return `${label} · ${secs}s${cost} · ${r.findings} finding${r.findings === 1 ? "" : "s"}`;
+	return `${label} · ${secs}s${cost} · ${plural(r.findings, "finding")}`;
 }
 
 /** The one line a burst's carded rest is folded into. */
 export function burstLine(placed: { more: number; failed: number }): string {
-	return `+${placed.more} more run${placed.more === 1 ? "" : "s"} finished${placed.failed ? ` (${placed.failed} failed)` : ""} — /cron runs`;
+	return `+${plural(placed.more, "more run")} finished${placed.failed ? ` (${placed.failed} failed)` : ""} — /cron runs`;
 }
 
 /** The carded runs of `fresh`, oldest first, at most `max`; `more` counts the carded rest and `failed` the failures among them. */

package/src/schedule.ts

@@ -127,6 +127,26 @@ export function formatSchedule(schedule: Schedule): string {
 	}
 }
 
+const DAY_NAMES = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
+
+/**
+ * A schedule as the page's Loops pane says it: the common cron shapes in words (`every hour`,
+ * `daily 09:00`, `weekdays 09:00`, `weekly Mon 09:00`), anything else as `formatSchedule` says it.
+ * A person who typed "daily" reads that back, not `0 9 * * *`.
+ */
+export function scheduleWords(schedule: Schedule): string {
+	if (schedule.kind !== "cron") return formatSchedule(schedule);
+	const [m, h, dom, mon, dow, ...rest] = schedule.expr.trim().split(/\s+/);
+	if (rest.length || dom !== "*" || mon !== "*") return schedule.expr;
+	if (m === "0" && h === "*" && dow === "*") return "every hour";
+	if (!/^\d{1,2}$/.test(m) || !/^\d{1,2}$/.test(h)) return schedule.expr;
+	const at = `${h.padStart(2, "0")}:${m.padStart(2, "0")}`;
+	if (dow === "*") return `daily ${at}`;
+	if (dow === "1-5") return `weekdays ${at}`;
+	if (/^[0-7]$/.test(dow)) return `weekly ${DAY_NAMES[Number(dow)]} ${at}`;
+	return schedule.expr;
+}
+
 /**
  * The machine's offset from UTC at that instant, as `+08:00`.
  *

package/src/seen.ts

@@ -5,6 +5,7 @@ import { Inbox, type InboxEntry } from "./inbox.ts";
 import { stamp } from "./schedule.ts";
 import { JobStore, type RunRecord } from "./store.ts";
 import { realpathish, sameProject } from "./paths.ts";
+import { plural } from "./plural.ts";
 
 /**
  * When `/inbox` was last looked at, per project: the terminal's `/inbox`, and the page's Mark all
@@ -232,7 +233,6 @@ export function sinceWords(sinceMs: number, nowMs: number): string {
 	return a.getFullYear() === b.getFullYear() ? `${date} ${time}` : `${date} ${a.getFullYear()} ${time}`;
 }
 
-const plural = (n: number, one: string, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
 /** How many findings came from this conversation, worth saying only when that is not all of them. */
 const fromHere = (s: AwaySummary): number => (s.fromThisConversation !== s.findings ? s.fromThisConversation : 0);

package/src/share.ts

@@ -9,7 +9,7 @@
  * taken back, so the summary comes first and the confirmation after it.
  */
 import { redact } from "./redact.ts";
-import { plural } from "./job-lines.ts";
+import { plural } from "./plural.ts";
 import { stamp } from "./schedule.ts";
 
 export interface ShareMessage {

package/src/store.ts

@@ -196,8 +196,17 @@ export function homeLoopsDir(agentDir: string): string {
 
 export function defaultLoopsDir(agentDir?: string): string {
 	if (process.env.PI_LOOPS_DIR) return process.env.PI_LOOPS_DIR;
-	const base = agentDir ?? process.env.PI_CODING_AGENT_DIR ?? path.join(os.homedir(), ".pi", "agent");
-	return path.join(base, "loops");
+	return path.join(agentDir ?? piAgentDir(), "loops");
+}
+
+/**
+ * pi's agent directory, by pi's rule (its `getAgentDir`): `PI_CODING_AGENT_DIR` with a leading `~`
+ * expanded, else `~/.pi/agent`. Here so that `pi-loops` does not load pi's SDK, about a second, for
+ * a path; test/store.test.ts holds it to the SDK's answer.
+ */
+export function piAgentDir(): string {
+	const env = process.env.PI_CODING_AGENT_DIR;
+	return env ? env.replace(/^~(?=$|\/)/, os.homedir()) : path.join(os.homedir(), ".pi", "agent");
 }
 
 /**

package/src/tools.ts

@@ -3,6 +3,7 @@
  * SetCronJobState and NewTrigger / ListTriggers / RemoveTrigger / SetTriggerState — as pi tool
  * definitions. One factory serves the interactive session (hop 0, registered with pi), every
  * in-process sub-session (hop 1, passed as customTools) and the headless host (hop 1, no UI).
+ * Hop 1 does not get `new_trigger`, `remove_trigger` or `cron_remove`: nobody can approve any of them there.
  */
 import { QUIET_MARK_AFTER, SIGNAL_WINDOW_MS, loopSignal } from "./job-signal.ts";
 import { formatWait, queuedPrompt, type QueuedPrompt } from "./engine.ts";
@@ -16,7 +17,7 @@ import type { LoopScheduler, SessionSnapshot } from "./scheduler.ts";
 import { MAX_PROMPT_BYTES, type LoopJob, newId, owningSessionId, resolveJobRef } from "./store.ts";
 import { asleepNote, ownerSession, runsSomewhere, whereRuns, type OwnerView } from "./job-owner.ts";
 import { inProject } from "./inbox.ts";
-import { plural } from "./job-lines.ts";
+import { plural } from "./plural.ts";
 import type { TriggerRuntime } from "./trigger-runtime.ts";
 import { sameProject, withinProject } from "./paths.ts";
 import { type TriggerStore, cleanCondition, looksLikeFixedScheduleRequest, parseTriggerRule, resolveRuleRef, type DynamicTriggerRule } from "./triggers.ts";
@@ -323,11 +324,16 @@ export interface ToolScope {
 	parentSessionId?: string;
 	parentCwd?: string;
 }
+// Every call of these is a prompt-class operation, denied at hop > 0 (controlPlanePreflight): a
+// tool that can only fail is one an agent tries first.
+const HOP0_ONLY = new Set(["new_trigger", "remove_trigger", "cron_remove"]);
+
 /**
  * The cron/trigger tools are registered in sub-agents too (Prompt-class ones are denied there)
  * and bounds cycles with a hop count. The same definitions serve the interactive session
  * (hop 0, registered with pi) and every in-process sub-session (hop 1, passed as customTools).
  */
+
 export function automationTools(scope: ToolScope, host: ToolHost): ToolDefinition<any, any>[] {
 	const defs: ToolDefinition<any, any>[] = [];
 	// Only where a person's message can arrive: a sub-agent is told nothing about it.
@@ -341,9 +347,9 @@ export function automationTools(scope: ToolScope, host: ToolHost): ToolDefinitio
 			"Create an event/condition-based dynamic trigger rule. Use this for future events such as a browser tab, file, MCP notification, webhook, or other condition becoming true. Do not use this for fixed time, recurring, scheduled, hourly, daily, weekly, cron, crontab, 定时任务, 每小时, or similar time-based jobs; use cron_create instead.",
 		parameters: Type.Object(
 			{
-				condition: Type.String({ description: "The natural-language condition that should be evaluated against future trigger events." }),
+				condition: Type.String({ description: "The natural-language condition that should be evaluated against future trigger events. For 'when <path> exists', keep the person's words: '<path> exists', with nothing added (no aside in parentheses) — a condition like that is checked with a local stat, no model call, while the path is absent." }),
 				action: Type.String({ description: "The action to perform when the condition matches. This may be a shell command or a natural-language instruction." }),
-				spec: Type.Optional(Type.String({ description: "Fallback complete trigger rule text when condition and action cannot be supplied separately." })),
+				spec: Type.Optional(Type.String({ description: "The whole rule as one sentence, only when condition and action cannot be given apart." })),
 				fire_once: Type.Optional(Type.Boolean({ description: "Whether to disable the rule after the first successful match. Defaults to true unless the user explicitly asks for a repeating trigger." })),
 				promote_to_chat: Type.Optional(Type.Boolean({ description: "Whether a match's result goes into this conversation (true) or the inbox (false). With a person present the question starts at this conversation whatever this says; with nobody to ask, the default is false." })),
 			},
@@ -456,14 +462,14 @@ export function automationTools(scope: ToolScope, host: ToolHost): ToolDefinitio
 			"Create a scheduled job. Use when the user asks for a fixed time, recurring, scheduled, hourly, daily, weekly, crontab, 定时任务, 每小时, 每天, or similar time-based job. Jobs persist across pi restarts. A plain job runs its prompt in this chat when due. Set stateful=true for loop mode: a fresh sub-agent runs it, keeps persistent notes across runs (injected each time), and routes findings to the user's /inbox instead of the chat — use that for recurring watch/triage jobs like \"check for new issues and report only what changed\"." + watchSentence,
 		parameters: Type.Object({
 			schedule: Type.String({
-				description: 'Local-time schedule: 5-field cron ("0 9 * * *", "*/30 * * * 1-5"), "@daily", "every 30m", "in 10m", or "at 2026-09-08T18:00".',
+				description: 'Local-time schedule: 5-field cron ("0 9 * * *", "*/30 * * * 1-5"), "hourly", "daily" (09:00), "weekly" (Monday 09:00), "@daily" (midnight), "every 30m", "in 10m", or "at 2026-09-08T18:00".',
 			}),
 			action: Type.String({ description: "Natural-language instruction to run when the schedule is due. For stateful jobs, write it for a fresh agent whose only memory is its own notes." }),
 			stateful: Type.Optional(Type.Boolean({ description: "Loop mode: sub-agent + notes between runs + findings to the inbox. With a person present the question starts at the inbox unless this is false; with nobody to ask, the default is false." })),
 			verify: Type.Optional(Type.Boolean({ description: "Maker/checker: a second adversarial sub-agent verifies each finding before it enters the inbox (stateful jobs only, default false). Use when the user asks for verified, double-checked, or high-precision findings." })),
 			name: Type.Optional(Type.String({ description: "Short unique label (letters, digits, . _ -)." })),
 			cwd: Type.Optional(Type.String({ description: "Directory a stateful job's sub-agent runs in. Default: current project." })),
-			catch_up: Type.Optional(Type.Boolean({ description: "Run once for a tick that was missed while nothing could run the job: a loop when pi-loops next starts, a plain job when its conversation is next opened or pi-loops next starts (default: true for stateful jobs, false for plain jobs)." })),
+			catch_up: Type.Optional(Type.Boolean({ description: "Run once for a missed tick (default: true for stateful jobs, false for plain jobs)." })),
 		}),
 		async execute(_id, params, signal, _onUpdate, ctx) {
 			let schedule: LoopJob["schedule"];
@@ -521,29 +527,22 @@ export function automationTools(scope: ToolScope, host: ToolHost): ToolDefinitio
 		name: "cron_remove",
 		label: "Remove cron job",
 		description:
-			"Preview or confirm removal of a scheduled job by id or name. Use confirm=false first when the user asks to delete, remove, or clear a scheduled job, cron job, crontab entry, or 定时任务. Call confirm=true only after the user explicitly confirms removal. Removal deletes the job itself; a loop's saved notes and run transcripts are kept on disk, and `/cron gc --purge` is what clears them.",
+			"Remove a scheduled job by id or name. Use when the user asks to delete, remove, or clear a scheduled job, cron job, crontab entry, or 定时任务; the user is asked to confirm in the same call. Removal deletes the job itself; a loop's saved notes and run transcripts are kept on disk, and `/cron gc --purge` is what clears them.",
 		parameters: Type.Object({
 			ref: Type.String({ description: "Job id (for example cron-abc123), unique id prefix, or name." }),
-			confirm: Type.Optional(Type.Boolean({ description: "false to preview the removal; true only after explicit user confirmation." })),
 		}),
 		async execute(_id, params, _signal, _onUpdate, ctx) {
 			const job = resolveJobRefScoped(host.scheduler.store.load(), params.ref, host.session().cwd);
-			if (!job) return { content: [{ type: "text", text: `no cron job matching '${params.ref}' in this project; cron_list shows the ids and names` }], isError: true, details: { id: undefined as string | undefined, removed_count: 0, confirmation_required: false, audit_entry_id: undefined as string | undefined } };
+			if (!job) return { content: [{ type: "text", text: `no cron job matching '${params.ref}' in this project; cron_list shows the ids and names` }], isError: true, details: { id: undefined as string | undefined, removed_count: 0, audit_entry_id: undefined as string | undefined } };
 			const label = `${job.id}${job.name ? ` "${job.name}"` : ""}`;
-			if (!params.confirm) {
-				return {
-					content: [{ type: "text", text: `remove cron job ${label} requires confirmation\nschedule: ${formatSchedule(job.schedule)}\naction: ${previewRedacted(job.prompt, 120)}\ncall cron_remove again with confirm=true only after the user confirms` }],
-					details: { id: job.id as string | undefined, removed_count: 0, confirmation_required: true, audit_entry_id: undefined as string | undefined },
-				};
-			}
 			// The only control-plane tool that used to skip this gate, so a sub-agent (hop > 0) could
 			// delete any project's job unapproved — and what that costs is the automation itself: the
 			// loop stops running and its id is gone from jobs.json. Its notes and transcripts stay
 			// behind (under an id nothing schedules any more; `/cron gc --purge` clears those), which
-			// is why the gate is about what stops, not about data destroyed. The preview above stays
-			// free: it is what the user is shown before deciding.
+			// is why the gate is about what stops, not about data destroyed. The dialog shows the
+			// schedule and the action: one question, where a preview call used to make it two.
 			const denied = await host.confirmTool(ctx, { label: `remove cron job ${label}`, tool: "cron_remove", reason: "remove a scheduled job", preview: `${formatSchedule(job.schedule)} · ${previewRedacted(job.prompt, 120)}`, args: params }, scope.hop);
-			if (denied) return { content: [{ type: "text", text: denied }], isError: true, details: { id: undefined as string | undefined, removed_count: 0, confirmation_required: false, audit_entry_id: undefined as string | undefined } };
+			if (denied) return { content: [{ type: "text", text: denied }], isError: true, details: { id: undefined as string | undefined, removed_count: 0, audit_entry_id: undefined as string | undefined } };
 			const { aborted } = await host.scheduler.removeJob(job.id);
 			const auditEntryId = host.cronControlAudit("remove", scope.actor, job, undefined);
 			// The slash command says where a loop's notes went; a tool-driven removal has to say it too,
@@ -553,7 +552,7 @@ export function automationTools(scope: ToolScope, host: ToolHost): ToolDefinitio
 			const kept = job.stateful ? "\nits loop state and run transcripts are kept; /cron gc --purge clears them" : "";
 			const abortedNote = aborted > 0 ? "\naborted its running run" : "";
 			const statePath = job.stateful ? host.scheduler.store.statePath(job.id) : undefined;
-			return { content: [{ type: "text", text: `removed cron job ${label}\nschedule: ${formatSchedule(job.schedule)}\naction: ${previewRedacted(job.prompt, 120)}${kept}${abortedNote}` }], details: { id: job.id as string | undefined, removed_count: 1, confirmation_required: false, audit_entry_id: auditEntryId, state_path: statePath } };
+			return { content: [{ type: "text", text: `removed cron job ${label}\nschedule: ${formatSchedule(job.schedule)}\naction: ${previewRedacted(job.prompt, 120)}${kept}${abortedNote}` }], details: { id: job.id as string | undefined, removed_count: 1, audit_entry_id: auditEntryId, state_path: statePath } };
 		},
 	});
 
@@ -587,5 +586,5 @@ export function automationTools(scope: ToolScope, host: ToolHost): ToolDefinitio
 			};
 		},
 	});
-	return defs;
+	return scope.hop === 0 ? defs : defs.filter((d) => !HOP0_ONLY.has(d.name));
 }

package/src/triggers.ts

@@ -463,9 +463,8 @@ export function auditArgs(rest: string): { limit: number; all: boolean } | { usa
 /**
  * The control-plane prompt gate, pre-flight part. Prompt-class tool calls (create or remove
  * a trigger, re-enable a trigger or a cron job) need a human. Sub-agents have no prompt channel
- * and are denied fail-closed ("control-plane prompt required but no
- * on_control_plane_prompt hook configured"); a UI-less interactive process is refused; an
- * interactive UI gets to ask. Returns the denial text, or undefined when the caller should ask.
+ * and are denied fail-closed; a UI-less interactive process is refused; an interactive UI gets
+ * to ask. Returns the denial text, or undefined when the caller should ask.
  */
 export function controlPlanePreflight(proc: { hop: number; hasUI: boolean; held?: boolean }, reason: string): string | undefined {
 	// A plain job's turn in a closed conversation: the person's own turn, run where they were not.

package/src/trust.ts

@@ -10,17 +10,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { ProjectTrustStore, hasTrustRequiringProjectResources } from "@earendil-works/pi-coding-agent";
-import { withinProject } from "./paths.ts";
-
-/** pi's own normalisation: resolved, then through symlinks where the path exists. */
-export function canonicalDir(dir: string): string {
-	const resolved = path.resolve(dir);
-	try {
-		return fs.realpathSync(resolved);
-	} catch {
-		return resolved;
-	}
-}
+import { canonicalDir, withinProject } from "./paths.ts";
 
 /**
  * pi's own saved decision for `cwd`: the nearest entry, this directory's or a parent's, so a

package/src/ui-prefs.ts

@@ -25,10 +25,13 @@ export interface UiPrefs {
 	model?: string;
 	thinking?: string;
 	/**
-	 * `"declined"` once someone has said no to the launcher a session start offers, so the offer is
-	 * made once and not in every window. `/pi-loops install-launcher` clears it when it writes one.
+	 * `"declined"` once someone has removed the launcher with `uninstall-launcher`, so no session
+	 * start writes it again; `"failed"` once a session start could not write it. `/pi-loops
+	 * install-launcher` clears it when it writes one.
 	 */
 	launcher?: string;
+	/** The directory a session start could not write the launcher into: tried again only elsewhere. */
+	launcherFailedIn?: string;
 	/** `"stopped"` once a person stopped pi-loops by hand: no window starts it again until `pi-loops start`. */
 	host?: string;
 	/** `"shown"` once a session start has said that closed conversations' plain jobs now run in the host. */
@@ -65,6 +68,7 @@ export function readUiPrefs(dir: string): UiPrefs {
 	if (typeof doc.model === "string") prefs.model = doc.model;
 	if (typeof doc.thinking === "string") prefs.thinking = doc.thinking;
 	if (typeof doc.launcher === "string") prefs.launcher = doc.launcher;
+	if (typeof doc.launcherFailedIn === "string") prefs.launcherFailedIn = doc.launcherFailedIn;
 	if (typeof doc.host === "string") prefs.host = doc.host;
 	if (typeof doc.heldJobsNotice === "string") prefs.heldJobsNotice = doc.heldJobsNotice;
 	if (typeof doc.toolsCapNotice === "string") prefs.toolsCapNotice = doc.toolsCapNotice;