@bismawy/pi-arnative 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [0.3.6] - 2026-10-05
+
+### Fixed
+- Fixed a startup crash: `Cannot read properties of null (reading 'fg')`. pi's `[Extension issues]` diagnostic box passed a null theme into the box renderer, which dereferenced it and killed the process with `uncaughtException`. It only surfaced on machines where an extension reported a problem (a conflicting shortcut, a failed `session_start`, …), because that is when the diagnostic is drawn. The renderer now draws an uncolored box for the first frame instead of throwing (`lib/box.ts`).
+- The active theme now lives in a single `globalThis` slot. `/reload` re-imports extension modules, so two copies can coexist, and only one of them receives `session_start`. The copy that owns the `loadedResourcesContainer` patch used to keep a permanently-null theme; it now paints with the live theme (`lib/ansi.ts`, `extensions/section-headers.ts`, `extensions/ui-render-tweaks.ts`).
+- Removed the `activeThemeProxy ?? Theme` fallback in the package-update box: `Theme` is a class, not an instance, so the fallback would itself have thrown `th.fg is not a function`. The box component now tolerates a null theme (`extensions/ui-render-tweaks.ts`).
+
+## [0.3.5] - 2026-10-04
+
+### Fixed
+- Git info in the footer now works on a fresh machine: the branch is read straight from `.git/HEAD` (the trick pi's own footer uses), so it shows without a `git` install and on a repo git refuses to touch (its dubious-ownership guard). Tag, dirty count and ahead/behind still need the `git` binary; when it cannot answer, those parts are left out instead of a fabricated `-`/`clean` (`extensions/footer.ts`).
+- `run()` no longer swallows a failed `git` call into `""`. "git said nothing" and "git could not run" used to be indistinguishable, which is what made four different states — not a repo, no `git` on PATH, a detached HEAD, and a foreign-owned repo — all show as no git info at all.
+- The header's `Context`/`Skills`/`Extensions` counts show `—` instead of a misleading `0` under `"quietStartup": true` (or `"header"`), which hides the resource listing the counts are read from. The empty-tab placeholder now says the counts are not tracked, and the state resets on `session_start` so `/new` cannot show stale counts (`extensions/section-headers.ts`).
+- The header and footer preset chosen in `/arnative` now survives a restart. The choice was only kept on `globalThis`, so every new pi process fell back to the default Arnative (Full) header and footer. It is now written to `arnative-config.json` in the agent dir and read back at startup (`lib/preset-store.ts`, `extensions/section-headers.ts`, `extensions/footer.ts`).
+- The reload-box patch no longer blanks a whole chat: it only drops a container that holds nothing but the box itself (border rows, blank spacers and the message copy). Any other container whose content merely mentioned "Reloading keybindings" — a `read`/`grep` result, this repo's own source — was rendered as zero lines (`extensions/ui-render-tweaks.ts`).
+- Row-1 git info works from a subfolder of a repo: `.git` is looked up by walking up the directory tree like git itself does, so the branch no longer vanishes when the session runs in `extensions/` or `src/` (`extensions/footer.ts`).
+- A tool result whose text merely starts with `Error` is no longer painted as a failed call (red `x`); only `ctx.isError`/`result.isError` decide. Reading a file that opens with "Error handling…" used to show an error box (`extensions/tools.ts`).
+- The stale git state is cleared when the working directory leaves a repo, so a `/reload` cannot re-show the previous directory's branch (`extensions/footer.ts`).
+- The `usage.ts` self-check builds a fixture session directory (and its own cache) instead of reading the real `~/.pi/agent/sessions`. A machine without `gemini-3.8-flash` in its history failed `npm test` (`extensions/usage.ts`, `lib/usage-store.ts`).
+- `isMain()` compares canonical file URLs, so a checkout path containing a space or another character that `import.meta.url` percent-encodes no longer makes a self-check exit 0 without running (`lib/check.ts`).
+
+### Changed
+- An active session that grows is no longer walked in full on every usage refresh. The cache keeps a per-file rollup (providers and provider+model totals) plus the byte offset of the last complete line, so a refresh reads only the appended tail and folds it in. On a 2.3MB / 11,000-message session, a refresh after one new record went from ~76ms (full re-parse **and** re-aggregation of every cached entry) to ~12ms, flat as the chat grows; the cache file went from megabytes to ~0.4KB. A half-written trailing record is retried instead of counted or dropped (`lib/usage-store.ts`).
+- The usage cache format is version 4 (per-file rollup, was raw entries in v3); an older cache is rebuilt once.
+- `npm test` also runs `lib/color.ts`; `prepublishOnly` runs the full test suite before the pre-publish preflight, so a publish cannot ship a red build (`package.json`).
+- `release-check.mjs` verifies the tag points at `HEAD`, and `post-publish` also checks the `latest` dist-tag and the tarball URL are live, not just that the version exists (`scripts/release-check.mjs`).
+- The open-PR check falls back to the public GitHub API when `gh` is unavailable, instead of failing the whole preflight (`scripts/release-check.mjs`).
+- `.gitattributes` pins every text file to LF in the repository, so a Windows checkout stops reintroducing CRLF into diffs.
+
+### Removed
+- `ASCII_LOGO_LINES` (computed at module load, never read) and the unused `Dim` export (`extensions/section-headers.ts`, `lib/box.ts`).
+
 ## [0.3.4] - 2026-10-04
 
 ### Added

package/README.md

@@ -14,8 +14,10 @@ pi-arnative replaces pi’s default terminal chrome with a unified, cohesive vis
 
 - Warm Themes: Cohesive, contrast-checked color palettes generated without drift.
 - Tabbed Header: Greeting, version line, and a compact box menu over Directory, Model, Context, Skills, Extensions, and Shortcut.
+  > The Context/Skills/Extensions counts read pi's startup listing, which `"quietStartup": true` (and `"header"`) hides. Under those settings the counts show `—` rather than a misleading `0`; set `"quietStartup": false` to see the real numbers.
 - Rounded Tool Boxes: Clear status, spinner, and duration for every tool call. Built-in `codemode` is boxed and collapsed to two rows (title + first script line) like `bash`/`grep`/`read`; nested calls and output sit behind `[ctrl+o to expand]` (shown whenever the collapsed summary hides more, including `edit` diffs); a failed run always shows its full output. The `chrome_devtools_*` tools box too, replacing their bare "Chrome DevTools: …" lines.
 - Enhanced Footer: fixed 3-row grid — directory/git line, then extension status paired with token metrics.
+  > The branch is read straight from `.git/HEAD`, so it shows up without a git install. Tag, dirty count, and ahead/behind need the `git` binary — when it is missing (or the repo is owned by another user, which git refuses to touch) that half is left out rather than shown wrong. Run `git config --global --add safe.directory <repo>` (a local, non-synced setting) to make `git` cooperate with such a repo.
 - Transcript Clock: Timestamps for messages with clean bubble backgrounds.
 - Usage Dashboard: /usage command to track tokens and session costs.
 
@@ -101,10 +103,10 @@ npm run themes  # Rebuild all theme variants
 | Stage | Run before | Checks |
 | :--- | :--- | :--- |
 | `pre-tag` | `git tag` | clean tree on `main`, in sync, no open PRs, `CHANGELOG.md` entry, tag free, version unpublished |
-| `pre-publish` | `npm publish` | the above, plus the tag exists **and is pushed** |
-| `post-publish` | done | the above, plus the version is live on the registry |
+| `pre-publish` | `npm publish` | the above, plus the tag exists **and is pushed**, and points at `HEAD` |
+| `post-publish` | done | the above, plus the version is live on the registry, `latest` points at it and its tarball URL answers |
 
-`pre-publish` runs automatically through npm's `prepublishOnly`, so a missing or unpushed tag aborts the publish (`npm error code 1`) instead of shipping a version whose tag was forgotten. `npm run release:check` is the `pre-tag` shorthand. Exit codes: `0` pass, `1` a check failed, `2` bad usage.
+`pre-publish` runs automatically through npm's `prepublishOnly` (after `npm test`), so a red build or a missing/unpushed tag aborts the publish (`npm error code 1`) instead of shipping a version whose tag was forgotten. The open-PR check uses `gh` when present and falls back to the public GitHub API otherwise. `npm run release:check` is the `pre-tag` shorthand. Exit codes: `0` pass, `1` a check failed, `2` bad usage.
 </details>
 
 ## License

package/extensions/footer.ts

@@ -13,14 +13,15 @@ import type { AssistantMessage } from "@earendil-works/pi-ai";
 import { CustomEditor, FooterComponent, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { execFile } from "node:child_process";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { stripAnsi } from "../lib/ansi.ts";
 import { assert, isMain } from "../lib/check.ts";
 import { capitalize, markedLabels, modelDisplayParts } from "../lib/format.ts";
 import { IS_WINDOWS_LIKE, SHORTCUT_RELOAD } from "../lib/shortcuts.ts";
 import { formatTokens } from "../lib/usage-store.ts";
+import { FOOTER_PRESET_KEY as FOOTER_PRESET_CONFIG_KEY, loadChoice, resetPresetCache, saveChoice } from "../lib/preset-store.ts";
 
 // ctrl+alt+r (alt+r on Windows/WSL — see lib/shortcuts.ts).
 // The TUI drops key-release events before handleInput, so press+release cannot
@@ -38,7 +39,7 @@ const FOOTER_PRESET_KEY = Symbol.for("pi-arnative.footerPreset");
 const FOOTER_REGISTRAR_KEY = Symbol.for("pi-arnative.footerRegistrar");
 
 export function activeFooterPreset(): FooterPreset {
-	const stored = (globalThis as Record<symbol, unknown>)[FOOTER_PRESET_KEY];
+	const stored = (globalThis as Record<symbol, unknown>)[FOOTER_PRESET_KEY] ?? loadChoice(FOOTER_PRESET_CONFIG_KEY, FOOTER_PRESETS);
 	return FOOTER_PRESETS.includes(stored as FooterPreset) ? (stored as FooterPreset) : DEFAULT_FOOTER_PRESET;
 }
 
@@ -59,6 +60,7 @@ export function applyFooterPreset(ctx: ExtensionContext): void {
 /** Select a preset and apply it immediately (the footer swaps on the spot). */
 export function setFooterPreset(name: FooterPreset, ctx: ExtensionContext): void {
 	(globalThis as Record<symbol, unknown>)[FOOTER_PRESET_KEY] = name;
+	saveChoice(FOOTER_PRESET_CONFIG_KEY, name);
 	applyFooterPreset(ctx);
 }
 
@@ -77,7 +79,14 @@ if (FooterComponent?.prototype?.render && !(globalThis as Record<symbol, boolean
 
 let activeThemeProxy: { fg(color: string, text: string): string; bg?(color: string, text: string): string } | null = null;
 
-type GitInfo = { branch: string; tag: string; uncommitted: number; ahead: number; behind: number } | null;
+type GitInfo = {
+	branch: string;
+	/** Absent (null) when git could not answer — never a false "-"/"clean". */
+	tag: string | null;
+	uncommitted: number | null;
+	ahead: number;
+	behind: number;
+} | null;
 let gitRefreshInFlight = false;
 
 let git: GitInfo = null;
@@ -118,18 +127,64 @@ export function currentToolVerb(active: ReadonlyMap<string, string>): string {
 	return verb;
 }
 
-function run(cmd: string, args: string[], cwd: string): Promise<string> {
-	return new Promise((resolve) => {
+type RunResult = { ok: boolean; out: string };
+/** Distinguishes "git said nothing" from "git could not run" — the caller must not
+ *  invent a clean tree when git is absent or the repo is not ours. */
+function run(cmd: string, args: string[], cwd: string): Promise<RunResult> {
+	return new Promise((resolvePromise) => {
 		execFile(cmd, args, { cwd, timeout: 2000 }, (err, stdout) => {
-			resolve(err ? "" : String(stdout).trim());
+			resolvePromise({ ok: !err, out: String(stdout).trim() });
 		});
 	});
 }
 
+/**
+ * The branch, straight from `.git/HEAD` — the same trick pi's own footer uses.
+ * `git branch --show-current` fails identically for a repo the user does not own
+ * (git's dubious-ownership guard), a PATH without git, and a detached HEAD; all
+ * three collapsed into a silent null before. Reading the ref needs no binary and
+ * no ownership check, so a fresh user sees the branch without installing git.
+ */
+function branchFromDisk(cwd: string): string | null {
+	// Walk up like git does: a subfolder of a repo is still inside it.
+	for (let dir = resolve(cwd); ; ) {
+		try {
+			const dotGit = join(dir, ".git");
+			// A worktree/submodule has a `.git` file pointing at the real git dir.
+			const gitDir = statSync(dotGit).isDirectory()
+				? dotGit
+				: resolve(dir, readFileSync(dotGit, "utf8").trim().replace(/^gitdir:\s*/, ""));
+			const head = readFileSync(join(gitDir, "HEAD"), "utf8").trim();
+			const ref = /^ref:\s+refs\/heads\/(.+)$/.exec(head);
+			return ref ? ref[1] : "detached";
+		} catch (e) {
+			if ((e as NodeJS.ErrnoException).code !== "ENOENT") return null; // unreadable metadata
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return null; // reached the filesystem root: not a repo
+		dir = parent;
+	}
+}
+
 // A refresh arriving while one is in flight is queued (last requested cwd wins) and
 // re-run afterwards — it used to be dropped, leaving the footer's git state stale
 // until the next trigger.
 let gitRefreshQueuedCwd: string | null = null;
+
+/**
+ * Row-1 git segment: branch(+sync), tag, worktree state. Halves git cannot answer
+ * (no binary, or a repo the user does not own) are omitted, so a fresh user still sees
+ * the branch but never a fabricated "-" or "clean".
+ */
+export function gitParts(info: GitInfo, acc: (t: string) => string, soft: (t: string) => string): string[] {
+	if (!info) return [];
+	const branch = `${acc("\uf126")} ${soft(info.branch)}${info.ahead > 0 ? ` ${soft(`↑${info.ahead}`)}` : ""}${info.behind > 0 ? ` ${soft(`↓${info.behind}`)}` : ""}`;
+	const parts = [branch];
+	if (info.tag !== null) parts.push(`${acc("\uf02b")} ${soft(info.tag)}`);
+	if (info.uncommitted !== null) parts.push(`${acc("\uf172")}  ${info.uncommitted > 0 ? soft(`~${info.uncommitted}`) : soft("clean")}`);
+	return parts;
+}
+
 async function refreshGit(cwd: string): Promise<void> {
 	if (gitRefreshInFlight) {
 		gitRefreshQueuedCwd = cwd;
@@ -137,9 +192,11 @@ async function refreshGit(cwd: string): Promise<void> {
 	}
 	gitRefreshInFlight = true;
 	try {
-		const branch = await run("git", ["branch", "--show-current"], cwd);
+		const branch = branchFromDisk(cwd);
 		if (!branch) {
+			// Clear the shared slot too, or the previous cwd's branch survives a reload.
 			git = null;
+			(globalThis as Record<symbol, any>)[GIT_KEY] = null;
 			return;
 		}
 		const [tag, status, sync] = await Promise.all([
@@ -147,13 +204,13 @@ async function refreshGit(cwd: string): Promise<void> {
 			run("git", ["status", "--porcelain"], cwd),
 			run("git", ["rev-list", "--left-right", "--count", "@{u}...HEAD"], cwd),
 		]);
-		const uncommitted = status ? status.split("\n").filter((l) => l.trim().length > 0).length : 0;
-		const parts = sync.trim() === "" ? [] : sync.trim().split(/\s+/).map(Number);
+		const uncommitted = status.ok ? status.out.split("\n").filter((l) => l.trim().length > 0).length : null;
+		const parts = sync.ok && sync.out !== "" ? sync.out.split(/\s+/).map(Number) : [];
 		const behind = parts.length > 0 && parts[0] > 0 ? parts[0] : 0;
 		const ahead = parts.length > 1 && parts[1] > 0 ? parts[1] : 0;
 		git = {
 			branch,
-			tag: tag || "-",
+			tag: tag.ok && tag.out ? tag.out : null,
 			uncommitted,
 			ahead,
 			behind,
@@ -528,12 +585,7 @@ export default function (pi: ExtensionAPI) {
 							const cwdShort = shortenCwd(cwd);
 							let left1 = `${acc("\uf07b")} ${dim(cwdShort)}${sep}${pDuration}`;
 							if (git) {
-								const gitIcon = acc("\uf172");
-								const gitText = git.uncommitted > 0 ? soft(`~${git.uncommitted}`) : soft("clean");
-								const pBranch = `${acc("\uf126")} ${soft(git.branch)}${git.ahead > 0 ? ` ${soft(`↑${git.ahead}`)}` : ""}${git.behind > 0 ? ` ${soft(`↓${git.behind}`)}` : ""}`;
-								const pTag = `${acc("\uf02b")} ${soft(git.tag)}`;
-								const pState = `${gitIcon}  ${gitText}`;
-								left1 = `${acc("\uf07b")} ${dim(cwdShort)}${sep}${pDuration}${sep}${pBranch}${sep}${pTag}${sep}${pState}`;
+								left1 = `${acc("\uf07b")} ${dim(cwdShort)}${sep}${pDuration}${gitParts(git, acc, soft).map((p) => `${sep}${p}`).join("")}`;
 							}
 							const right1 = formatModelName(currentModel, currentThinkingLevel, acc, soft, dim);
 
@@ -885,14 +937,43 @@ if (isMain(import.meta.url)) {
 	assert(s3.includes("↑1.1k") && s3.includes("↓2.6k"), "branch length changed: full rescan");
 
 	// regression: a refresh arriving while one is in flight is re-run with the newest
-	// cwd, not dropped (the footer's git state no longer stays stale until the next trigger)
+	// cwd, not dropped (the footer's git state no longer stays stale until the next trigger).
+	// "newest cwd" needs a real repo: the branch now comes from .git/HEAD, not from git.
+	const repo = mkdtempSync(join(tmpdir(), "pi-arnative-repo-"));
+	mkdirSync(join(repo, ".git"), { recursive: true });
+	writeFileSync(join(repo, ".git", "HEAD"), "ref: refs/heads/arnative-tests\n");
 	git = null;
 	const noGit = mkdtempSync(join(tmpdir(), "pi-arnative-nogit-"));
 	void refreshGit(noGit); // in flight (deterministic: sync up to the first await), resolves git = null
-	await refreshGit(process.cwd()); // queued behind it with the newest cwd
+	await refreshGit(repo); // queued behind it with the newest cwd
 	for (let i = 0; i < 100 && git === null; i++) await new Promise((r) => setTimeout(r, 20));
-	assert(git !== null && git.branch.length > 0, "queued git refresh re-ran on the newest cwd (not dropped)");
+	assert(git !== null && git.branch === "arnative-tests", "queued git refresh re-ran on the newest cwd (not dropped)");
 	rmSync(noGit, { recursive: true, force: true });
+	rmSync(repo, { recursive: true, force: true });
+
+	// A repo whose branch is readable without git on PATH: the branch comes from .git/HEAD
+	// (pi's own footer does this too), so a fresh user needs no git install for row 1.
+	const bare = mkdtempSync(join(tmpdir(), "pi-arnative-disk-"));
+	mkdirSync(join(bare, ".git"), { recursive: true });
+	writeFileSync(join(bare, ".git", "HEAD"), "ref: refs/heads/arnative-smoke\n");
+	assert(branchFromDisk(bare) === "arnative-smoke", "branch is read from .git/HEAD without running git");
+	writeFileSync(join(bare, ".git", "HEAD"), "1234567890abcdef1234567890abcdef12345678\n");
+	assert(branchFromDisk(bare) === "detached", "a raw HEAD hash reports detached, not null");
+	// A subfolder of the repo resolves to the repo's branch (walks up like git).
+	writeFileSync(join(bare, ".git", "HEAD"), "ref: refs/heads/arnative-smoke\n");
+	mkdirSync(join(bare, "src", "deep"), { recursive: true });
+	assert(branchFromDisk(join(bare, "src", "deep")) === "arnative-smoke", "branch resolves from a subfolder of the repo");
+	rmSync(bare, { recursive: true, force: true });
+
+	// Honesty: with the branch known but git unable to answer, tag/status must be absent
+	// rather than the old false "-"/"clean".
+	const A = (t: string) => t;
+	const S = (t: string) => t;
+	const unknownGit = gitParts({ branch: "main", tag: null, uncommitted: null, ahead: 0, behind: 0 }, A, S);
+	assert(unknownGit.length === 1 && unknownGit[0]!.endsWith("main"), "unreadable git: branch only, no fake '-'/'clean'");
+	const fullGit = gitParts({ branch: "main", tag: "v1.2.3", uncommitted: 2, ahead: 1, behind: 0 }, A, S);
+	assert(fullGit.length === 3 && fullGit[1]!.endsWith("v1.2.3") && fullGit[2]!.includes("~2"), "readable git: tag + dirty count present");
+	assert(gitParts(null, A, S).length === 0, "not a repo: no git segment at all");
 
 	// Footer presets: Arnative (Full) is the default; Pi (system) hands the footer slot back to pi (the editor stays arnative).
 	assert(DEFAULT_FOOTER_PRESET === "Arnative (Full)" && FOOTER_PRESETS.length === 2, "Arnative (Full) is the default footer preset");
@@ -906,6 +987,11 @@ if (isMain(import.meta.url)) {
 			setEditorComponent: () => { editorTouched++; },
 		},
 	};
+	// Persisting a preset writes a config file: point it at a fixture so the real agent dir stays clean.
+	const presetFixture = mkdtempSync(join(tmpdir(), "arnative-ftr-"));
+	const prevAgentDir = process.env.PI_CODING_AGENT_DIR;
+	process.env.PI_CODING_AGENT_DIR = presetFixture;
+	resetPresetCache();
 	setFooterPreset("Pi (system)", presetCtx);
 	assert(footerCleared === 1 && editorTouched === 0 && activeFooterPreset() === "Pi (system)", "Pi (system) clears the footer only (an editor swap would close the picker)");
 	let registered = 0;
@@ -913,6 +999,16 @@ if (isMain(import.meta.url)) {
 	setFooterPreset("Arnative (Full)", presetCtx);
 	assert(registered === 1 && activeFooterPreset() === "Arnative (Full)", "Arnative (Full) re-runs the arnative registrar");
 	delete (globalThis as Record<symbol, unknown>)[FOOTER_REGISTRAR_KEY];
+	// Persist a NON-default value: asserting the default survives proves nothing.
+	setFooterPreset("Pi (system)", presetCtx);
+	assert(loadChoice(FOOTER_PRESET_CONFIG_KEY, FOOTER_PRESETS) === "Pi (system)", "the footer preset is persisted to disk");
+	delete (globalThis as Record<symbol, unknown>)[FOOTER_PRESET_KEY];
+	resetPresetCache();
+	assert(activeFooterPreset() === "Pi (system)", "a restart reads the non-default footer preset back from disk");
+	rmSync(presetFixture, { recursive: true, force: true });
+	if (prevAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+	else process.env.PI_CODING_AGENT_DIR = prevAgentDir;
+	resetPresetCache();
 
 	console.log("footer.ts self-check OK");
 }

package/extensions/section-headers.ts

@@ -31,10 +31,11 @@ import {
 	type TuiMouseEventResult,
 } from "@earendil-works/pi-tui";
 import { renderBoxLines } from "../lib/box.ts";
-import { stripAnsi, themeOf } from "../lib/ansi.ts";
+import { getActiveTheme, setActiveTheme, stripAnsi, themeOf } from "../lib/ansi.ts";
 import { assert, isMain } from "../lib/check.ts";
 import { capitalize, markedLabels, modelDisplayParts } from "../lib/format.ts";
 import { SHORTCUT_NEW_SESSION, SHORTCUT_NEXT_TAB, SHORTCUT_RELOAD } from "../lib/shortcuts.ts";
+import { HEADER_PRESET_KEY as HEADER_PRESET_CONFIG_KEY, loadChoice, resetPresetCache, saveChoice } from "../lib/preset-store.ts";
 import { formatTokens, getModelAllTimeUsage } from "../lib/usage-store.ts";
 
 export type TabKey = "Model" | "Directory" | "Context" | "Skills" | "Extensions" | "Shortcut";
@@ -53,8 +54,6 @@ export const SECTION_ICONS: Record<TabKey, string> = {
 
 export type Themeish = { fg?(color: string, text: string): string; bg?(color: string, text: string): string } | null;
 
-let activeThemeProxy: Themeish = null;
-
 const MODEL_SNAPSHOT_KEY = Symbol.for("pi-arnative.currentModel");
 const THINKING_SNAPSHOT_KEY = Symbol.for("pi-arnative.currentThinking");
 
@@ -282,7 +281,6 @@ export function buildLogoLines(th: Themeish): string[] {
 	];
 }
 
-export const ASCII_LOGO_LINES = buildLogoLines(null);
 
 // Singleton store for loaded resources
 const STORE_KEY = Symbol.for("pi-arnative.resourceStore");
@@ -307,7 +305,7 @@ export const DEFAULT_HEADER_PRESET: HeaderPreset = "Arnative (Full)";
 const HEADER_PRESET_KEY = Symbol.for("pi-arnative.headerPreset");
 
 export function activeHeaderPreset(): HeaderPreset {
-	const stored = (globalThis as Record<symbol, unknown>)[HEADER_PRESET_KEY];
+	const stored = (globalThis as Record<symbol, unknown>)[HEADER_PRESET_KEY] ?? loadChoice(HEADER_PRESET_CONFIG_KEY, HEADER_PRESETS);
 	return HEADER_PRESETS.includes(stored as HeaderPreset) ? (stored as HeaderPreset) : DEFAULT_HEADER_PRESET;
 }
 
@@ -323,9 +321,20 @@ export function applyHeaderPreset(ctx: ExtensionContext): void {
 /** Select a preset and apply it immediately (real-time: the header swaps on the spot). */
 export function setHeaderPreset(name: HeaderPreset, ctx: ExtensionContext): void {
 	(globalThis as Record<symbol, unknown>)[HEADER_PRESET_KEY] = name;
+	saveChoice(HEADER_PRESET_CONFIG_KEY, name);
 	applyHeaderPreset(ctx);
 }
 
+// Counts are captured from pi's loaded-resource listing, which pi skips entirely under
+// `quietStartup: true | "header"` (docs/settings.md). Without the listing, [Context]/
+// [Skills]/[Extensions] are never built, so the store can only answer "unknown" — not 0.
+// That state is tracked globally because the header renders long after `session_start`.
+let countsKnown = true;
+export function resourcesListingShown(current?: boolean): boolean {
+	if (current !== undefined) countsKnown = current;
+	return countsKnown;
+}
+
 // The installed header instance. globalThis-backed because `/reload` re-imports the
 // extension modules and arnative.ts imports this file, so two copies can coexist.
 const HEADER_INSTANCE_KEY = Symbol.for("pi-arnative.headerInstance");
@@ -402,21 +411,21 @@ export class ArnativeHeader implements Component {
 				name: "Context",
 				icon: SECTION_ICONS.Context,
 				count: tabStore.get("Context")?.length ?? 0,
-				label: `Context [${tabStore.get("Context")?.length ?? 0}]`,
+				label: countsKnown ? `Context [${tabStore.get("Context")?.length ?? 0}]` : "Context [—]",
 			},
 			{
 				key: "Skills",
 				name: "Skills",
 				icon: SECTION_ICONS.Skills,
 				count: tabStore.get("Skills")?.length ?? 0,
-				label: `Skills [${tabStore.get("Skills")?.length ?? 0}]`,
+				label: countsKnown ? `Skills [${tabStore.get("Skills")?.length ?? 0}]` : "Skills [—]",
 			},
 			{
 				key: "Extensions",
 				name: "Extensions",
 				icon: SECTION_ICONS.Extensions,
 				count: tabStore.get("Extensions")?.length ?? 0,
-				label: `Extensions [${tabStore.get("Extensions")?.length ?? 0}]`,
+				label: countsKnown ? `Extensions [${tabStore.get("Extensions")?.length ?? 0}]` : "Extensions [—]",
 			},
 			{
 				key: "Shortcut",
@@ -463,7 +472,7 @@ export class ArnativeHeader implements Component {
 		if (width < 36) {
 			return [centerLine(`pi v${VERSION}`, width)];
 		}
-		const th = this.themeProxy || (activeThemeProxy as Themeish);
+		const th = this.themeProxy || getActiveTheme<Themeish>();
 		const side = fgFirst(th, ["dim"], "│");
 
 		const infoLines: string[] = [];
@@ -608,7 +617,9 @@ export class ArnativeHeader implements Component {
 				infoLines.push(fgFirst(th, ["accentSoft", "text"], line));
 			}
 		} else if (activeItems.length === 0) {
-			infoLines.push(fgFirst(th, ["accentSoft"], "(empty)"));
+			infoLines.push(
+				fgFirst(th, ["dim"], countsKnown ? "(empty)" : "(not tracked — quietStartup hides the listing)"),
+			);
 		} else if (this.activeTab === "Model") {
 			// The Model tab already carries soft styling + a dim separator
 			infoLines.push(...activeItems);
@@ -658,6 +669,7 @@ if (UserMessageComponent?.prototype && !(globalThis as Record<symbol, boolean>)[
 					// Mark this container as the loadedResourcesContainer
 					(this as Record<string, unknown>)._isLoadedResourcesContainer = true;
 
+					countsKnown = true;
 					const rawBody = body.split("\n").slice(1).join("\n");
 					const items = extractItemsFromBody(rawBody, sectionName === "Extensions");
 					tabStore.set(sectionName, items);
@@ -675,7 +687,7 @@ if (UserMessageComponent?.prototype && !(globalThis as Record<symbol, boolean>)[
 					const text = themedTextOf(child);
 					if (text.includes("[Extension issues]") && typeof child.render === "function") {
 						const origRender = child.render.bind(child);
-						child.render = (w: number) => renderBoxLines(activeThemeProxy, w, origRender(w), undefined, "warning");
+						child.render = (w: number) => renderBoxLines(getActiveTheme<Themeish>(), w, origRender(w), undefined, "warning");
 						return origAddChild.call(this, child);
 					}
 					// Any other element inside loadedResourcesContainer (e.g. Spacer) is hidden too
@@ -704,8 +716,20 @@ export default function (pi: ExtensionAPI) {
 		pi.registerShortcut(key, { description: "Next header tab", handler: nextTab });
 	}
 
+	// pi renders the resource listing after this event, so a session that starts
+	// with it disabled leaves the store empty. That is "not tracked", not "none".
 	pi.on("session_start", async (_event, ctx) => {
-		activeThemeProxy = themeOf<Themeish>(ctx) ?? activeThemeProxy;
+		let quiet: boolean | "header" = false;
+		try {
+			quiet = pi.getSettings().quietStartup ?? false;
+		} catch {
+			/* older pi without getSettings: keep pi's default (listing shown) */
+		}
+		resourcesListingShown(quiet === false);
+		for (const key of ["Context", "Skills", "Extensions"] as const) tabStore.set(key, []);
+		// A context without a theme (project-trust prompt) must not drop the one we have.
+		const th = themeOf<Themeish>(ctx);
+		if (th) setActiveTheme(th);
 		// Register the header for the active preset
 		applyHeaderPreset(ctx);
 	});
@@ -735,12 +759,27 @@ if (isMain(import.meta.url)) {
 	assert(DEFAULT_HEADER_PRESET === "Arnative (Full)" && HEADER_PRESETS.length === 2, "Arnative (Full) is the default header preset");
 	assert(HEADER_PRESETS.join(" | ") === "Pi (system) | Arnative (Full)", "built-in preset is listed first");
 	assert(markedLabels(HEADER_PRESETS, "Arnative (Full)").join(" | ") === "  Pi (system) | ● Arnative (Full)", "preset labels mark the active one");
+	// Persisting a preset writes a config file: point it at a fixture so the real agent dir stays clean.
+	const presetFixture = mkdtempSync(join(tmpdir(), "arnative-hdr-"));
+	const prevAgentDir = process.env.PI_CODING_AGENT_DIR;
+	process.env.PI_CODING_AGENT_DIR = presetFixture;
+	resetPresetCache();
 	let installed: unknown = "untouched";
 	const presetCtx: any = { ui: { setHeader: (factory: unknown) => { installed = factory; } } };
 	setHeaderPreset("Pi (system)", presetCtx);
 	assert(installed === undefined && activeHeaderPreset() === "Pi (system)", "Pi (system) clears the custom header");
 	setHeaderPreset("Arnative (Full)", presetCtx);
 	assert(typeof installed === "function" && activeHeaderPreset() === "Arnative (Full)", "Arnative (Full) installs the header factory");
+	// Persist a NON-default value: asserting the default survives proves nothing.
+	setHeaderPreset("Pi (system)", presetCtx);
+	assert(loadChoice(HEADER_PRESET_CONFIG_KEY, HEADER_PRESETS) === "Pi (system)", "the header preset is persisted to disk");
+	delete (globalThis as Record<symbol, unknown>)[HEADER_PRESET_KEY];
+	resetPresetCache();
+	assert(activeHeaderPreset() === "Pi (system)", "a restart reads the non-default preset back from disk");
+	rmSync(presetFixture, { recursive: true, force: true });
+	if (prevAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+	else process.env.PI_CODING_AGENT_DIR = prevAgentDir;
+	resetPresetCache();
 
 	// Parsing & wrapping
 	assert(extractItemsFromBody("  a, b, c").length === 3, "extractItemsFromBody splits 3 comma items");
@@ -802,6 +841,25 @@ if (isMain(import.meta.url)) {
 
 	// Only "dim" is colored, so the box line colors can be asserted.
 	const ansiTheme = { fg: (c: string, t: string) => (c === "dim" ? `\x1b[2m${t}\x1b[22m` : t) };
+
+	// Counts come from pi's loaded-resource listing. With `quietStartup: true | "header"`
+	// pi skips that listing, so the counts are unknown — shown as "—", never a misleading 0.
+	resourcesListingShown(false);
+	tabStore.set("Context", []);
+	tabStore.set("Skills", []);
+	tabStore.set("Extensions", []);
+	const hdrQuiet = new ArnativeHeader(fakeTui, ansiTheme, fakeCtx);
+	assert(hdrQuiet.getTabsData(120).map((t) => t.label).join("|").includes("Skills [—]"), "hidden listing: counts render as —, not 0");
+	hdrQuiet.activeTab = "Skills";
+	assert(
+		hdrQuiet.render(120).some((l) => stripAnsi(l).includes("(not tracked")),
+		"hidden listing: empty tab explains itself instead of a bare (empty)",
+	);
+	resourcesListingShown(true);
+	assert(new ArnativeHeader(fakeTui, ansiTheme, fakeCtx).getTabsData(120).some((t) => t.label === "Skills [0]"), "shown listing: 0 is a real count again");
+	tabStore.set("Context", ["AGENTS.md"]);
+	tabStore.set("Skills", ["agents-sdk", "cloudflare"]);
+	tabStore.set("Extensions", ["@bismawy/pi-agentrouter@1.6.1", "footer.ts"]);
 	const hdr = new ArnativeHeader(fakeTui, ansiTheme, fakeCtx);
 	assert(hdr.activeTab === "Directory", "default tab is Directory");
 
@@ -1009,5 +1067,27 @@ if (isMain(import.meta.url)) {
 	assert(sectionBodyOf(helpBlock) === "\u2580\u2580\u2588  v0.99.1\n\u2588\u2580 \u2588 escape interrupt", "sectionBodyOf reads the build shape");
 	assert(sectionNameOf(sectionBodyOf(helpBlock)!) === null, "startup help block is not a resource section");
 
+	// pi's "[Extension issues]" diagnostic renders while the installing module's theme is
+	// still null (a `/reload` copy never saw session_start). The box must draw uncolored,
+	// not deref null — that crash was reported in the wild.
+	setActiveTheme(null);
+	const issuesChild = {
+		build: () => "[Extension issues]\n  extension \"x\" failed",
+		render: (_w: number) => ["[Extension issues]", '  extension "x" failed'],
+	};
+	container.addChild(issuesChild);
+	const issuesLines = issuesChild.render(80);
+	assert(issuesLines[0]!.startsWith("\u256d") && issuesLines.at(-1)!.startsWith("\u2570"), "extension-issues box renders without a theme");
+
+	// The theme proxy is globalThis-backed, so the copy that owns the addChild patch still
+	// paints once the other copy's session_start has stored the theme.
+	setActiveTheme({ fg: (c: string, t: string) => `<${c}>${t}</${c}>` });
+	const coloredChild = {
+		build: () => "[Extension issues]\n  extension \"x\" failed",
+		render: (_w: number) => ["[Extension issues]", '  extension "x" failed'],
+	};
+	container.addChild(coloredChild);
+	assert(coloredChild.render(80)[0]!.includes("<warning>"), "shared theme proxy colors the box even in the patched copy");
+
 	console.log("section-headers.ts self-check OK");
 }

package/extensions/tools.ts

@@ -601,7 +601,9 @@ function minimal(
 			if (isPartial) return EMPTY;
 			((context.state ??= {}) as Record<string, unknown>).hasResult = true;
 			const text = textOf(result);
-			const isErr = Boolean(context.isError || result.isError || text.startsWith("Error"));
+			// `ctx.isError`/`result.isError` are the only honest sources: output text starting with
+			// "Error" is normal content (a file whose first line says "Error handling...").
+			const isErr = Boolean(context.isError || result.isError);
 			const dur = fmtMs(context.toolCallId ? TIMINGS.get(context.toolCallId) : undefined);
 			const icon = isErr ? theme.fg("error", "x") : theme.fg("success", "✓");
 			return new Lines((width) => {
@@ -1207,6 +1209,11 @@ if (isMain(import.meta.url)) {
 			minRender("bash", { command: "true" }, { content: [{ type: "text", text: "done" }], details: {} }).every((l) => !l.includes("to expand")),
 			"minimal(): a single-line output has nothing hidden, so no hint",
 		);
+		// Output that merely STARTS with "Error" is content, not a failure: the box keeps its ✓.
+		assert(
+			minRender("bash", { command: "true" }, { content: [{ type: "text", text: "Error handling notes" }], details: {} }).some((l) => l.includes("✓")),
+			"minimal(): text starting with 'Error' is not treated as a failed call",
+		);
 		assert(
 			minRender("edit", { path: "README.md" }, diffRes).every((l) => visibleWidth(l) === 74),
 			"minimal(): hint row still fills the box width",