@andares/pi-toolkits 0.11.2 → 0.12.0

package/src/features/quit-guard/report.ts

@@ -0,0 +1,212 @@
+/**
+ * quit-guard feature — hang artifact.
+ *
+ * When the watchdog fires, extension cleanup was cut short. The artifact is
+ * the only evidence of what the process was waiting on, so it is written
+ * synchronously *before* `process.exit(0)` and never throws: a failed report
+ * must not keep the user from getting the prompt back.
+ *
+ * Contents: the arm/fire timing, the process state (`activeHandles` /
+ * `activeRequests` class names from Node's undocumented introspection helpers),
+ * and the host's own libuv handle table (`process.report.getReport().libuv`).
+ * Together they are enough to tell "waiting on a socket" from "waiting on a
+ * thin promise that nobody will ever resolve" — the latter shows up as an
+ * empty handle table with pi's extension-shutdown frames missing.
+ *
+ * Privacy: `argv` and `cwd` are process facts, not conversation data, but they
+ * are still credential-adjacent (`pi --api-key …`, a prompt passed as an
+ * argument, a path under a private tree). The file is therefore owner-only
+ * (0600 in an 0700 directory, matching the approval log) and every argument
+ * goes through the same redaction rules the approval log uses.
+ */
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { redactText } from "../../lib/approval-log.js";
+
+export interface HangReport {
+	version: 1;
+	kind: "quit-guard";
+	/** ISO timestamp of the forced exit. */
+	timestamp: string;
+	pid: number;
+	/** Watchdog deadline that was configured at arm time. */
+	timeoutMs: number;
+	/** Time actually spent inside the shutdown phase. */
+	elapsedMs: number;
+	/** The teardown sequence that armed the guard. */
+	marker: string;
+	uptimeSeconds: number;
+	cwd: string;
+	/** Process arguments, redacted (see the privacy note above). */
+	argv: string[];
+	/** Constructor names of handles keeping the event loop alive. */
+	activeHandles: string[];
+	/** Node's pending-request list (fs, dns, zlib, ... callbacks). */
+	activeRequests: string[];
+	/**
+	 * Host libuv handle table (trimmed). Empty but non-null means "nothing is
+	 * pending that the OS knows about": the process is parked on a promise.
+	 */
+	libuv: unknown[];
+}
+
+interface ProcessIntrospection {
+	_getActiveHandles?: () => unknown[];
+	_getActiveRequests?: () => unknown[];
+	report?: { getReport?: () => { libuv?: unknown[] } };
+}
+
+export interface HangReportInput {
+	timeoutMs: number;
+	elapsedMs: number;
+	marker: string;
+}
+
+export interface HangReportOptions {
+	now?: () => Date;
+	pid?: number;
+	cwd?: string;
+	argv?: string[];
+}
+
+/** Stand-in for `process.cwd()` when the working directory no longer exists. */
+const UNKNOWN_CWD = "<unknown: working directory unavailable>";
+
+/**
+ * Flags whose *next* argument is a credential. `--api-key` with a bare opaque
+ * token is the common shape and matches none of the value-prefix rules, so the
+ * pair has to be recognised positionally.
+ */
+const SECRET_ARG =
+	/^--?(?:api[-_]?key|key|token|access[-_]?token|refresh[-_]?token|auth[-_]?token|secret|client[-_]?secret|password|passwd)$/i;
+
+/** Redact one argument list: flag/value pairs first, then the value patterns. */
+export function redactArgv(argv: readonly string[]): string[] {
+	let hideNext = false;
+	return argv.map((arg) => {
+		if (hideNext) {
+			hideNext = false;
+			return "[redacted]";
+		}
+		if (SECRET_ARG.test(arg)) {
+			hideNext = true;
+			return arg;
+		}
+		const pair = /^(--?[^=]+)=(.+)$/.exec(arg);
+		if (pair && SECRET_ARG.test(pair[1] ?? "")) {
+			return `${pair[1]}=[redacted]`;
+		}
+		return redactText(arg);
+	});
+}
+
+/** Owner-only modes; the file is credential-adjacent, like the approval log. */
+const REPORT_DIR_MODE = 0o700;
+const REPORT_FILE_MODE = 0o600;
+
+/** Read a process fact without letting it abort the report. */
+function attempt<T>(read: () => T, fallback: T): T {
+	try {
+		return read();
+	} catch {
+		// Every field here is diagnostics; a missing one is better than no report.
+		return fallback;
+	}
+}
+
+function constructorNames(list: unknown[] | undefined): string[] {
+	if (!Array.isArray(list)) return [];
+	const names = new Set<string>();
+	for (const item of list) {
+		const name =
+			item && typeof item === "object" && "constructor" in item
+				? (item.constructor as { name?: string })?.name
+				: undefined;
+		names.add(
+			typeof name === "string" && name.length > 0
+				? name
+				: typeof item === "undefined"
+					? "undefined"
+					: String(typeof item),
+		);
+	}
+	return [...names].sort((a, b) => a.localeCompare(b));
+}
+
+/** Show this to whoever has to debug the hang: one line, no prefixes. */
+export function formatHangReportSummary(report: HangReport): string {
+	const handles =
+		report.activeHandles.length > 0
+			? report.activeHandles.join(", ")
+			: "none";
+	const cwd = report.cwd === UNKNOWN_CWD ? " (cwd unavailable)" : "";
+	return `shutdown exceeded ${report.timeoutMs}ms (spent ${report.elapsedMs}ms); handles: ${handles}${cwd}`;
+}
+
+export function collectHangReport(
+	input: HangReportInput,
+	options: HangReportOptions = {},
+): HangReport {
+	// SAFETY: `_getActiveHandles`, `_getActiveRequests`, and `report.getReport`
+	// exist on Node's process object but are missing from (or narrower in)
+	// @types/node. `ProcessIntrospection` declares them as optional, so every
+	// use below is guarded and nothing is called unconditionally.
+	const proc = process as unknown as ProcessIntrospection & NodeJS.Process;
+	const now = options.now ?? (() => new Date());
+	const libuv = attempt(() => {
+		const raw = proc.report?.getReport?.();
+		return raw && Array.isArray(raw.libuv) ? raw.libuv.slice(0, 200) : [];
+	}, [] as unknown[]);
+	return {
+		version: 1,
+		kind: "quit-guard",
+		timestamp: now().toISOString(),
+		pid: options.pid ?? proc.pid,
+		timeoutMs: input.timeoutMs,
+		elapsedMs: Math.round(input.elapsedMs),
+		marker: input.marker,
+		uptimeSeconds: attempt(() => Math.round(proc.uptime()), 0),
+		// `process.cwd()` throws ENOENT when the directory was removed during
+		// the session (a startup crash pi itself guards against in 1.5.0). The
+		// report is written on the exit path, so it must survive that.
+		cwd: options.cwd ?? attempt(() => proc.cwd(), UNKNOWN_CWD),
+		argv: attempt(
+			() => redactArgv(options.argv ?? [...proc.argv]),
+			[],
+		),
+		activeHandles: constructorNames(
+			attempt(() => proc._getActiveHandles?.(), [] as unknown[]),
+		),
+		activeRequests: constructorNames(
+			attempt(() => proc._getActiveRequests?.(), [] as unknown[]),
+		),
+		libuv,
+	};
+}
+
+/**
+ * Write the report under `dir`. Returns the path, or `undefined` when the
+ * filesystem rejected it (read-only home, missing permissions, ...).
+ */
+export function writeHangReport(
+	dir: string,
+	report: HangReport,
+): string | undefined {
+	try {
+		mkdirSync(dir, { recursive: true, mode: REPORT_DIR_MODE });
+		const stamp = report.timestamp.replace(/[:.]/g, "-");
+		const file = join(dir, `quit-hang-${stamp}-${report.pid}.json`);
+		writeFileSync(file, `${JSON.stringify(report, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: REPORT_FILE_MODE,
+		});
+		return file;
+	} catch (error) {
+		// pi-lens-ignore: no-console-except-error,console-statement, — deliberate degradation log
+		console.warn(
+			"[pi-toolkits/quit-guard] Failed to write hang report:",
+			error instanceof Error ? error.message : String(error),
+		);
+		return undefined;
+	}
+}

package/src/features/quit-guard/store.ts

@@ -0,0 +1,144 @@
+/**
+ * quit-guard feature — persisted settings store.
+ *
+ * State lives in `<agent-dir>/pi-toolkits-quit-guard.json` (agent-dir from
+ * getAgentDir(), same convention as the favorites/compact/review stores).
+ *
+ * File shape:
+ *   {
+ *     "enabled": true,
+ *     "timeoutMs": 10000,
+ *     "report": true
+ *   }
+ *
+ * `enabled` (default true) gates the whole watchdog; `timeoutMs` is clamped
+ * to [MIN_TIMEOUT_MS, MAX_TIMEOUT_MS]; `report` (default true) writes a JSON
+ * artifact under `<agent-dir>/quit-guard/` every time the guard fires.
+ *
+ * Robustness: a missing file means defaults (and is created on first save),
+ * corrupted/unreadable files fall back to defaults with a console.warn, and
+ * writes are atomic (tmp + rename) and never throw.
+ */
+import {
+	existsSync,
+	mkdirSync,
+	readFileSync,
+	renameSync,
+	writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import {
+	DEFAULT_TIMEOUT_MS,
+	MAX_TIMEOUT_MS,
+	MIN_TIMEOUT_MS,
+	QUIT_GUARD_FILE,
+} from "./constants.js";
+
+export interface QuitGuardConfig {
+	/** Master switch. When false the guard never arms. */
+	enabled: boolean;
+	/** Milliseconds allowed between the terminal teardown write and exit. */
+	timeoutMs: number;
+	/** Write a JSON hang report before forcing exit. */
+	report: boolean;
+}
+
+export const DEFAULT_CONFIG: QuitGuardConfig = {
+	enabled: true,
+	timeoutMs: DEFAULT_TIMEOUT_MS,
+	report: true,
+};
+
+/** Clamp/round a timeout into the supported range; non-numbers fall back. */
+export function normalizeTimeoutMs(value: unknown): number {
+	if (typeof value !== "number" || !Number.isFinite(value)) {
+		return DEFAULT_TIMEOUT_MS;
+	}
+	const rounded = Math.round(value);
+	if (rounded <= MIN_TIMEOUT_MS) return MIN_TIMEOUT_MS;
+	if (rounded >= MAX_TIMEOUT_MS) return MAX_TIMEOUT_MS;
+	return rounded;
+}
+
+/** Coerce an unknown JSON blob into a complete config (defaults for gaps). */
+export function normalizeConfig(input: unknown): QuitGuardConfig {
+	const config: QuitGuardConfig = { ...DEFAULT_CONFIG };
+	if (!input || typeof input !== "object") return config;
+	const raw = input as Partial<QuitGuardConfig>;
+	if (typeof raw.enabled === "boolean") config.enabled = raw.enabled;
+	if (typeof raw.report === "boolean") config.report = raw.report;
+	if (raw.timeoutMs !== undefined) {
+		config.timeoutMs = normalizeTimeoutMs(raw.timeoutMs);
+	}
+	return config;
+}
+
+export class QuitGuardStore {
+	private config: QuitGuardConfig = { ...DEFAULT_CONFIG };
+	private readonly file: string;
+	private loaded = false;
+
+	constructor(file: string = join(getAgentDir(), QUIT_GUARD_FILE)) {
+		this.file = file;
+	}
+
+	/** Path of the JSON file (also used to derive the report directory). */
+	get path(): string {
+		return this.file;
+	}
+
+	private ensureLoaded(): void {
+		if (this.loaded) return;
+		this.loaded = true;
+		try {
+			if (!existsSync(this.file)) return;
+			const parsed: unknown = JSON.parse(readFileSync(this.file, "utf8"));
+			this.config = normalizeConfig(parsed);
+		} catch (error) {
+			// pi-lens-ignore: no-console-except-error,console-statement, — deliberate degradation log
+			console.warn(
+				"[pi-toolkits/quit-guard] Failed to load settings, using defaults:",
+				error instanceof Error ? error.message : String(error),
+			);
+			this.config = { ...DEFAULT_CONFIG };
+		}
+	}
+
+	/** Current settings (a copy). */
+	get(): QuitGuardConfig {
+		this.ensureLoaded();
+		return { ...this.config };
+	}
+
+	/** Merge a patch, normalize it, persist, and return the new settings. */
+	update(patch: Partial<QuitGuardConfig>): QuitGuardConfig {
+		this.ensureLoaded();
+		this.config = normalizeConfig({ ...this.config, ...patch });
+		this.save();
+		return { ...this.config };
+	}
+
+	/** Atomically persist (tmp + rename). Never throws. */
+	save(): void {
+		try {
+			const dir = dirname(this.file);
+			if (!existsSync(dir)) {
+				mkdirSync(dir, { recursive: true });
+			}
+			const tmp = `${this.file}.tmp`;
+			writeFileSync(
+				tmp,
+				`${JSON.stringify(this.config, null, 2)}\n`,
+				"utf8",
+			);
+			renameSync(tmp, this.file);
+		} catch (error) {
+			// pi-lens-ignore: no-console-except-error,console-statement, — deliberate degradation log
+			console.warn(
+				"[pi-toolkits/quit-guard] Failed to save settings:",
+				error instanceof Error ? error.message : String(error),
+			);
+		}
+	}
+}

package/src/features/review/index.ts

@@ -57,7 +57,7 @@ export async function pickReviewModel(
 	// headless contexts have no dialogs, so fall back to a manual-config hint.
 	if (!ctx.hasUI) {
 		ctx.ui.notify(
-			"third-review: 当前环境不支持模型选择对话框，请编辑 <agent-dir>/pi-toolkits-review.json 手动配置。",
+			"third-review: this environment has no model picker dialog — edit <agent-dir>/pi-toolkits-review.json to configure it manually.",
 			"error",
 		);
 		return undefined;
@@ -66,15 +66,16 @@ export async function pickReviewModel(
 	const configuredModel = resolveConfiguredModel(ctx, configured);
 	if (!configuredModel && configured) {
 		ctx.ui.notify(
-			`third-review: 配置的评审模型 ${configured} 不存在或不可用，请重新选择。`,
+			`third-review: the configured review model ${configured} does not exist or is unavailable — pick another one.`,
 			"warning",
 		);
 	}
 	const model = await openModelPicker(ctx, configuredModel, {
-		selectTitle: "选择评审模型（首项为当前默认，回车使用）",
+		selectTitle:
+			"Select the review model (first entry is the current default; press Enter to use it)",
 	});
 	if (!model) {
-		ctx.ui.notify("third-review: 已取消，评审模型配置未变更。", "info");
+		ctx.ui.notify("third-review: cancelled — the review model is unchanged.", "info");
 		return undefined;
 	}
 	const key = modelKey(model);
@@ -82,7 +83,7 @@ export async function pickReviewModel(
 		// Persist immediately (disk + in-memory + footer) — next run defaults here.
 		store.setModel(key);
 		ctx.ui.notify(
-			`third-review: 评审模型已保存为「${model.name}」，下次默认使用。`,
+			`third-review: review model saved as "${model.name}" — it will be the default next time.`,
 			"info",
 		);
 	}
@@ -103,12 +104,12 @@ export function createReviewRunner(
 
 	return async (ctx) => {
 		if (running) {
-			ctx.ui.notify("third-review: 评审已在执行中，请稍候。", "warning");
+			ctx.ui.notify("third-review: a review is already running — please wait.", "warning");
 			return;
 		}
 		if (!ctx.isIdle()) {
 			ctx.ui.notify(
-				"third-review: 当前任务仍在进行中，请等待完成后再触发。",
+				"third-review: the current task is still running — wait for it to finish before starting a review.",
 				"warning",
 			);
 			return;
@@ -129,7 +130,7 @@ export function createReviewRunner(
 				model = resolveConfiguredModel(ctx, store.getModel());
 				if (!model) {
 					ctx.ui.notify(
-						"third-review: 当前环境不支持模型选择对话框，请编辑 <agent-dir>/pi-toolkits-review.json 手动配置。",
+						"third-review: this environment has no model picker dialog — edit <agent-dir>/pi-toolkits-review.json to configure it manually.",
 						"error",
 					);
 					return;
@@ -138,13 +139,13 @@ export function createReviewRunner(
 			const switched = await pi.setModel(model);
 			if (!switched) {
 				ctx.ui.notify(
-					`third-review: 无法切换到评审模型「${model.name}」（缺少 API key 或鉴权未配置）。`,
+					`third-review: cannot switch to the review model "${model.name}" (missing API key or auth not configured).`,
 					"error",
 				);
 				return;
 			}
 			ctx.ui.notify(
-				`third-review: 已切换到评审模型「${model.name}」执行评审（查+修）；评审完成后会话保持该模型。`,
+				`third-review: switched to the review model "${model.name}" for this review (check + fix); the session stays on it afterwards.`,
 				"info",
 			);
 			pi.sendUserMessage(REVIEW_PROMPT);

package/src/features/review/prompt.ts

@@ -7,25 +7,30 @@
  * it makes — stays in the current session transcript right next to the work
  * under review.
  *
- * The three focus points the user asked for (本轮需求实现 / 是否有遗漏 /
- * 是否有错误) are spelled out verbatim in the prompt, together with a hard
+ * The three focus points the user asked for (requirement coverage / anything
+ * missing / anything wrong — originally stated as 本轮需求实现 / 是否有遗漏 /
+ * 是否有错误) are spelled out one by one in the prompt, together with a hard
  * scope constraint: the review must stay within this round's changes.
+ *
+ * The prompt is English because everything the model and the operator see at
+ * runtime is English (TUI notices, tool text, prompts); keep it that way when
+ * editing, and keep the three focus points and the scope rule intact.
  */
 
-export const REVIEW_PROMPT = `请以第三方代码评审的身份，对本次会话中刚完成的开发任务进行 Review。
+export const REVIEW_PROMPT = `Act as a third-party code reviewer and review the development task that was just completed in this session.
 
-本轮需求、开发过程和代码改动都在当前会话上下文中，请结合上下文，并用 read/grep 等工具实际检查仓库代码，不要凭空猜测。
+The requirement for this round, the development process and the code changes are all in the current session context. Use that context, and actually inspect the repository with tools such as read/grep — do not guess.
 
-请重点检查以下三点（逐项给出结论）：
-1. 本轮需求实现：本轮需求是否已完整、正确地实现？实现与需求描述是否一致？
-2. 是否有遗漏：需求中是否有遗漏的功能点、边界情况、异常处理、兼容性、测试等？
-3. 是否有错误：代码中是否存在逻辑错误、潜在 bug、类型/编译错误、安全与性能隐患等？
+Focus on the following three points and give a conclusion for each:
+1. Requirement coverage: was this round's requirement implemented completely and correctly? Does the implementation match the requirement as described?
+2. Anything missing: are there requirement points, edge cases, error handling, compatibility concerns, or tests that were left out?
+3. Anything wrong: are there logic errors, potential bugs, type/compile errors, or security and performance risks in the code?
 
-范围强约束：
-- 本次 Review 仅限当前本轮修改内容（本轮需求对应的代码改动），避免扩大范围；
-- 本轮改动范围内确认的问题才直接修复；范围外的问题（历史遗留、无关代码）只记录提示，不要动手修改。
+Hard scope constraint:
+- Review only this round's changes (the code changes that correspond to this round's requirement); do not widen the scope;
+- Only fix problems confirmed inside this round's changes directly; for problems outside that scope (pre-existing issues, unrelated code) record them as notes — do not touch them.
 
-要求：
-- 对确认的问题直接修复（write/edit），并简要说明改了什么、为什么改；
-- 无法确认或不宜直接改的问题，列出：位置（文件/行）、问题描述、建议方案；
-- 最后输出评审报告：发现问题清单（已修复 / 未修复）、修复说明、总体结论（通过 / 需修改）与剩余风险。`;
+Requirements:
+- Fix confirmed problems directly (write/edit) and briefly state what you changed and why;
+- For problems you cannot confirm or should not fix directly, list: location (file/line), description of the problem, and a suggested approach;
+- Finish with a review report: the list of findings (fixed / not fixed), the fix notes, an overall verdict (pass / needs changes) and the remaining risks.`;

package/src/features/review/review.test.ts

@@ -256,7 +256,7 @@ describe("pickReviewModel", () => {
 		expect(await pickReviewModel(ctx, store)).toBeUndefined();
 		expect(custom).not.toHaveBeenCalled();
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("没有可用模型"),
+			expect.stringContaining("No models are available"),
 			"error",
 		);
 	});
@@ -267,7 +267,7 @@ describe("pickReviewModel", () => {
 		expect(await pickReviewModel(ctx, store)).toBeUndefined();
 		expect(custom).not.toHaveBeenCalled();
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("不支持模型选择对话框"),
+			expect.stringContaining("has no model picker dialog"),
 			"error",
 		);
 	});
@@ -302,7 +302,7 @@ describe("pickReviewModel", () => {
 		const { ctx, notify } = fakeCtx({ customResult: undefined });
 		await pickReviewModel(ctx, store);
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("不存在或不可用"),
+			expect.stringContaining("does not exist or is unavailable"),
 			"warning",
 		);
 	});
@@ -325,7 +325,7 @@ describe("pickReviewModel", () => {
 		expect(picked).toBe(MODELS[2]);
 		expect(store.getModel()).toBe("openrouter/openai/gpt-5");
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("已保存为"),
+			expect.stringContaining("review model saved as"),
 			"info",
 		);
 	});
@@ -339,7 +339,7 @@ describe("createReviewRunner", () => {
 		const { ctx, notify } = fakeCtx({ idle: false });
 		await createReviewRunner(pi)(ctx);
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("等待完成"),
+			expect.stringContaining("wait for it to finish"),
 			"warning",
 		);
 		expect(pi.setModel).not.toHaveBeenCalled();
@@ -356,7 +356,7 @@ describe("createReviewRunner", () => {
 		expect(setModel).toHaveBeenCalledWith(MODELS[0]);
 		expect(sendUserMessage).toHaveBeenCalledWith(REVIEW_PROMPT);
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("已切换到评审模型"),
+			expect.stringContaining("switched to the review model"),
 			"info",
 		);
 	});
@@ -387,7 +387,7 @@ describe("createReviewRunner", () => {
 		const { ctx, notify, custom } = fakeCtx({ customResult: MODELS[0] });
 		await createReviewRunner(pi)(ctx);
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("不存在或不可用"),
+			expect.stringContaining("does not exist or is unavailable"),
 			"warning",
 		);
 		expect(getReviewStore().getModel()).toBe("anthropic/claude-sonnet-4");
@@ -414,7 +414,7 @@ describe("createReviewRunner", () => {
 		expect(setModel).toHaveBeenCalledWith(MODELS[0]);
 		expect(sendUserMessage).not.toHaveBeenCalled();
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("无法切换到评审模型"),
+			expect.stringContaining("cannot switch to the review model"),
 			"error",
 		);
 	});
@@ -449,7 +449,7 @@ describe("createReviewRunner", () => {
 		} as unknown as ExtensionContext;
 		await runner(ctx2);
 		expect(notify2).toHaveBeenCalledWith(
-			expect.stringContaining("评审已在执行中"),
+			expect.stringContaining("a review is already running"),
 			"warning",
 		);
 		release?.(MODELS[0]);

package/src/index.ts

@@ -13,6 +13,7 @@
  *  - autostart — replay project-declared slash commands at session start (/add-dir persistence)
  *  - permission — session-scoped boundary permission checks (/ask-perm)
  *  - init — agent memory framework install / adoption (/ask-init)
+ *  - quit-guard — quit watchdog: force-exit when pi's shutdown hangs (/quit-guard)
  *
  * `ask` and `permission` are independent gates on one bus: each answers its own
  * question and the strictest answer wins, so they compose rather than replace
@@ -27,6 +28,7 @@ import { registerCompact } from "./features/compact/index.js";
 import { registerFavorites } from "./features/favorites/index.js";
 import { registerInit } from "./features/init/index.js";
 import { registerPermission } from "./features/permission/index.js";
+import { registerQuitGuard } from "./features/quit-guard/index.js";
 import { registerReview } from "./features/review/index.js";
 import { registerStash } from "./features/stash/index.js";
 
@@ -44,6 +46,7 @@ export default function piToolkits(pi: ExtensionAPI): void {
 	registerCompact(pi);
 	registerFavorites(pi);
 	registerInit(pi);
+	registerQuitGuard(pi);
 	registerReview(pi);
 	registerStash(pi);
 

package/src/lib/approval-log.ts

@@ -261,7 +261,14 @@ const REDACTIONS: ReadonlyArray<readonly [RegExp, Replacer]> = [
 	],
 ];
 
-function redactText(value: string): string {
+/**
+ * Apply the credential patterns below to one string.
+ *
+ * Exported for the quit-guard hang report, which writes process arguments and
+ * must not store `pi --api-key …` verbatim; the approval log ships one copy of
+ * these rules so the two artifacts cannot drift apart.
+ */
+export function redactText(value: string): string {
 	let out = value;
 	for (const [pattern, replacement] of REDACTIONS) {
 		out =

package/src/lib/model-picker.test.ts

@@ -115,7 +115,7 @@ describe("openModelPicker", () => {
 		const { ctx, notify } = fakeCtx([]);
 		expect(await openModelPicker(ctx)).toBeUndefined();
 		expect(notify).toHaveBeenCalledWith(
-			expect.stringContaining("没有可用模型"),
+			expect.stringContaining("No models are available"),
 			"error",
 		);
 	});
@@ -170,7 +170,7 @@ describe("openModelPicker", () => {
 		const picked = await openModelPicker(ctx, MODELS[1]);
 		expect(custom).not.toHaveBeenCalled();
 		expect(select).toHaveBeenCalledWith(
-			"选择模型（首项为当前默认，回车使用）",
+			"Select a model (first entry is the current default; press Enter to use it)",
 			[
 				"Claude Sonnet 4 (anthropic/claude-sonnet-4)",
 				"Gemini 2.5 Flash (google/gemini-2.5-flash)",
@@ -184,8 +184,10 @@ describe("openModelPicker", () => {
 		(ctx as { mode: string }).mode = "rpc";
 		select.mockResolvedValue(undefined);
 		expect(
-			await openModelPicker(ctx, MODELS[0], { selectTitle: "选择评审模型" }),
+			await openModelPicker(ctx, MODELS[0], {
+				selectTitle: "Select the review model",
+			}),
 		).toBeUndefined();
-		expect(select).toHaveBeenCalledWith("选择评审模型", expect.any(Array));
+		expect(select).toHaveBeenCalledWith("Select the review model", expect.any(Array));
 	});
 });

package/src/lib/model-picker.ts

@@ -43,9 +43,10 @@ function modelRuntimeFacade(ctx: ExtensionContext): ModelRuntime {
 		refresh: (options?: { signal?: AbortSignal }) =>
 			ctx.modelRegistry.refresh(options),
 	};
-	// SAFETY: the selector only touches the four members above (pi 1.0–1.3
-	// model-selector.js); everything else on ModelRuntime is never reached
-	// from this component.
+	// SAFETY: the selector only touches the four members above (pi 1.0–1.5
+	// model-selector.js; the 1.5.0 rendering/page-key changes add no runtime
+	// call); everything else on ModelRuntime is never reached from this
+	// component.
 	return facade as unknown as ModelRuntime;
 }
 
@@ -64,7 +65,7 @@ export async function openModelPicker(
 	if (!ctx.hasUI) return undefined;
 	const available = ctx.modelRegistry.getAvailable();
 	if (available.length === 0) {
-		ctx.ui.notify("当前没有可用模型，请先在 pi 中配置模型。", "error");
+		ctx.ui.notify("No models are available — configure a model in pi first.", "error");
 		return undefined;
 	}
 	if (ctx.mode === "tui") {
@@ -95,7 +96,8 @@ export async function openModelPicker(
 		(m: AvailableModel) => `${m.name} (${m.provider}/${m.id})`,
 	);
 	const choice = await ctx.ui.select(
-		options?.selectTitle ?? "选择模型（首项为当前默认，回车使用）",
+		options?.selectTitle ??
+			"Select a model (first entry is the current default; press Enter to use it)",
 		labels,
 	);
 	if (choice === undefined) return undefined;