@diegopetrucci/pi-extensions 0.1.76 → 0.1.78

package/extensions/dynamic-context-pruning/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-dynamic-context-pruning",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "type": "module",
   "description": "A pi extension that dynamically prunes stale context to keep sessions lean.",
   "keywords": [

package/extensions/fast/README.md

@@ -143,13 +143,13 @@ Optional global config:
 ~/<pi-config-dir>/agent/extensions/fast.json
 ```
 
-Optional project config:
+Optional project config, from the nearest ancestor of the working directory (the working directory itself counts):
 
 ```text
 <project>/<pi-config-dir>/fast.json
 ```
 
-Here `<pi-config-dir>` is Pi's runtime config directory name (`CONFIG_DIR_NAME`; `.pi` by default). Project config overrides global config after Pi reports that the project is trusted.
+Here `<pi-config-dir>` is Pi's runtime config directory name (`CONFIG_DIR_NAME`; `.pi` by default). The loader uses that nearest ancestor `fast.json`, which overrides global config after Pi reports that the project is trusted.
 
 ```json
 {

package/extensions/fast/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-fast",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "A pi extension that enables Fast mode for supported direct OpenAI API, OpenAI Codex, and Anthropic Claude models based on the currently selected model.",
   "keywords": [
     "pi-package",

package/extensions/inline-bash/index.ts

@@ -1,19 +1,3 @@
-/**
- * Inline Bash Extension - expands inline bash commands in user prompts.
- *
- * Start pi with this extension:
- *   pi -e ./extensions/inline-bash/index.ts
- *
- * Then type prompts with inline bash:
- *   What's in !{pwd}?
- *   The current branch is !{git branch --show-current} and status: !{git status --short}
- *   My node version is !{node --version}
- *
- * The !{command} patterns are executed and replaced with their trimmed output
- * before the prompt is sent to the agent. Very large expansions are truncated.
- *
- * Note: Regular !command syntax (whole-line bash) is preserved and works as before.
- */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export default function (pi: ExtensionAPI) {

package/extensions/inline-bash/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-inline-bash",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "A pi extension that expands inline bash commands in user prompts.",
   "keywords": [
     "pi-package",

package/extensions/librarian/README.md

@@ -35,7 +35,7 @@ Then reload pi:
 ## Behavior
 
 - Tool name: `librarian`
-- Uses a restricted subagent with `bash` and `read`
+- Uses a restricted subagent with `bash`, `read`, and any configured MCP tools (MCP tools run without confirmation; may have side effects; use for evidence gathering only; requires host Pi >=1.0.4; older hosts degrade to no MCP, no error); the global `mcp.json` always applies; a project `.pi/mcp.json` is never loaded (the librarian subagent runs in a separate temp workspace)
 - Uses `gh` for GitHub search/API access
 - Uses cached local checkouts only when enabled
 - Toggle cache behavior for future calls with `/librarian-cache on | off | toggle | status`

package/extensions/librarian/index.ts

@@ -1,9 +1,11 @@
 import { randomUUID } from "node:crypto";
 import type { Dirent, Stats } from "node:fs";
+import { realpathSync } from "node:fs";
 import type { FileHandle } from "node:fs/promises";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import type {
   ExtensionAPI,
@@ -19,6 +21,7 @@ import {
   getAgentDir,
   getMarkdownTheme,
 } from "@earendil-works/pi-coding-agent";
+import * as piCodingAgent from "@earendil-works/pi-coding-agent";
 import { Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
@@ -90,6 +93,82 @@ function getModelRuntimeOption(ctx: {
 const DEFAULT_CACHE_MODE: CacheMode = "disabled";
 const DEFAULT_THINKING_LEVEL: ThinkingLevel = "low";
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
+const SUBAGENT_MCP_TOOLS = [
+  "mcp__*",
+  "tool_search",
+  "list_mcp_resources",
+  "list_mcp_resource_templates",
+  "read_mcp_resource",
+];
+
+// Derive project-trust for the isolated subagent session from the host tool context.
+// Fails closed: returns false if the host has not trusted the project, or if the subagent
+// runs in a different directory (e.g. a temp workspace), preventing an untrusted project's
+// .pi/mcp.json from being loaded by the MCP extension.
+function resolveSubagentProjectTrusted(
+  ctx: { cwd: string; isProjectTrusted(): boolean },
+  subagentCwd: string,
+): boolean {
+  // Feature-detected for older Pi hosts that may lack isProjectTrusted.
+  const hostTrusted =
+    typeof (ctx as { isProjectTrusted?: unknown }).isProjectTrusted === "function"
+      ? ctx.isProjectTrusted()
+      : false;
+  if (!hostTrusted) return false;
+  try {
+    return realpathSync(subagentCwd) === realpathSync(ctx.cwd);
+  } catch {
+    return false; // fail closed if realpath resolution fails
+  }
+}
+
+/** Returns true when v is a semver string >=1.0.4 (ignores prerelease; missing/garbage → false). */
+function isMcpCompatibleVersion(v: string | undefined): boolean {
+  if (!v) return false;
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+  if (!m) return false;
+  const major = Number(m[1]),
+    minor = Number(m[2]),
+    patch = Number(m[3]);
+  if (major !== 1) return major > 1;
+  if (minor !== 0) return minor > 0;
+  return patch >= 4;
+}
+
+// Safe runtime access to MCP/tool-search factories — feature-detected for Pi >=0.99.0 hosts.
+// Additionally gated on VERSION >=1.0.4: on older hosts mcp__* allowlist entries are exact-name
+// matches that resolve nothing, so spawning MCP servers provides no benefit.
+function createMcpSubagentFactories(): ExtensionFactory[] {
+  const ns = piCodingAgent as Record<string, unknown>;
+  if (!isMcpCompatibleVersion(ns["VERSION"] as string | undefined)) return [];
+  const factories: ExtensionFactory[] = [];
+  const mcp = ns["createMcpExtension"];
+  const toolSearch = ns["createToolSearchExtension"];
+  if (typeof mcp === "function") factories.push((mcp as () => ExtensionFactory)());
+  if (typeof toolSearch === "function") factories.push((toolSearch as () => ExtensionFactory)());
+  return factories;
+}
+
+// Emit session_shutdown before dispose so MCP closes server connections (no leaked child processes).
+async function disposeSubagentSession(
+  session: { extensionRunner?: unknown; dispose(): void } | undefined,
+): Promise<void> {
+  if (!session) return;
+  try {
+    const runner = session.extensionRunner as
+      | {
+          hasHandlers(n: string): boolean;
+          emit(e: { type: string; reason: string }): Promise<unknown>;
+        }
+      | undefined;
+    if (runner?.hasHandlers("session_shutdown")) {
+      await runner.emit({ type: "session_shutdown", reason: "quit" });
+    }
+  } catch {
+    // Shutdown errors must not prevent dispose.
+  }
+  session.dispose();
+}
 
 const PREFERRED_FAST_MODEL_PATTERNS = [
   /\bgpt[-_. ]?5\.5(?:[-_. ].*)?\b(?:mini|nano|fast|lite)\b/,
@@ -903,6 +982,82 @@ async function buildLibrarianCandidates(
   return candidates;
 }
 
+const UNICODE_SPACES_PATTERN = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
+/**
+ * Mirrors normalizeWindowsShellPath from dist/utils/paths.js. No-op on
+ * non-win32 paths.
+ */
+function normalizeWindowsShellPathLocal(filePath: string): string {
+  if (!filePath.startsWith("/") || filePath.startsWith("//") || filePath.includes("\\"))
+    return filePath;
+  const match = filePath.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+  if (!match) return filePath;
+  const suffix = match[2]?.replaceAll("/", "\\");
+  return `${match[1].toUpperCase()}:\\${suffix ?? ""}`;
+}
+
+/**
+ * Mirrors Pi's normalizePath (dist/utils/paths.js). On win32, Git Bash / WSL
+ * drive-path normalisation always runs; only tilde expansion is gated by
+ * expandTilde.
+ */
+function normalizePath(
+  input: string,
+  opts: { normalizeUnicodeSpaces?: boolean; stripAtPrefix?: boolean; expandTilde?: boolean } = {},
+): string {
+  const { normalizeUnicodeSpaces = false, stripAtPrefix = false, expandTilde = true } = opts;
+  let p = input;
+  if (normalizeUnicodeSpaces) p = p.replace(UNICODE_SPACES_PATTERN, " ");
+  if (stripAtPrefix && p.startsWith("@")) p = p.slice(1);
+  if (process.platform === "win32") p = normalizeWindowsShellPathLocal(p);
+  if (expandTilde) {
+    const home = os.homedir();
+    if (p === "~") p = home;
+    else if (p.startsWith("~/") || (process.platform === "win32" && p.startsWith("~\\")))
+      p = path.join(home, p.slice(2));
+  }
+  if (/^file:\/\//.test(p)) p = fileURLToPath(p);
+  return p;
+}
+
+/**
+ * Mirrors Pi's resolveToCwd (dist/core/tools/path-utils.js). Exposed via
+ * __test__ for parity tests; not imported by other extensions.
+ */
+function resolveToCwd(rawPath: string, cwd: string): string {
+  const normalized = normalizePath(rawPath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });
+  const base = normalizePath(cwd);
+  return path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(base, normalized);
+}
+
+/** Mirrors tryMacOSScreenshotPath from dist/core/tools/path-utils.js */
+function tryMacOSScreenshotPathVariant(filePath: string): string {
+  return filePath.replace(/ (AM|PM)\./gi, " $1.");
+}
+/** Mirrors tryNFDVariant from dist/core/tools/path-utils.js */
+function tryNFDPathVariant(filePath: string): string {
+  return filePath.normalize("NFD");
+}
+/** Mirrors tryCurlyQuoteVariant from dist/core/tools/path-utils.js */
+function tryCurlyQuotePathVariant(filePath: string): string {
+  return filePath.replace(/'/g, "’");
+}
+/**
+ * Returns all read path candidates including Pi's resolveReadPathAsync fallback
+ * variants. Used only for the read tool guard; grep/find/ls use resolveToCwd only.
+ */
+function getReadPathCandidates(resolved: string): string[] {
+  const nfd = tryNFDPathVariant(resolved);
+  return [
+    resolved,
+    tryMacOSScreenshotPathVariant(resolved),
+    nfd,
+    tryCurlyQuotePathVariant(resolved),
+    tryCurlyQuotePathVariant(nfd),
+  ];
+}
+
 function resolveToolPath(cwd: string, rawPath: string): string {
   const normalized = rawPath.startsWith("@") ? rawPath.slice(1) : rawPath;
   return path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(cwd, normalized);
@@ -992,16 +1147,53 @@ function createLibrarianRuntimeGuardExtension(options: {
       if (event.toolName === "read") {
         const input = event.input as { path?: unknown };
         if (typeof input.path !== "string") return undefined;
+        // Canonicalize allowed roots. A path is allowed if it is inside EITHER
+        // the original root (options.workspace / options.cacheRoot) OR its
+        // realpath'd form. This handles both: a realpath'd file under a
+        // symlinked alias workspace (lexical match on original root) and an
+        // existing file canonicalized beyond the alias (match on real root).
+        const realWorkspace = await fs
+          .realpath(options.workspace)
+          .catch(() => path.resolve(options.workspace));
+        const realCacheRoot = await fs
+          .realpath(options.cacheRoot)
+          .catch(() => path.resolve(options.cacheRoot));
+        function isAllowedPath(p: string): boolean {
+          return (
+            isInside(options.workspace, p) ||
+            isInside(realWorkspace, p) ||
+            (options.cacheEnabled && (isInside(options.cacheRoot, p) || isInside(realCacheRoot, p)))
+          );
+        }
         const resolved = resolveToolPath(options.workspace, input.path);
         const realPath = await fs.realpath(resolved).catch(() => resolved);
-        const allowed =
-          isInside(options.workspace, realPath) ||
-          (options.cacheEnabled && isInside(options.cacheRoot, realPath));
-        if (!allowed)
+        if (!isAllowedPath(realPath))
           return {
             block: true,
             reason: `Librarian read is limited to its workspace/cache: ${realPath}`,
           };
+        // Pi-effective path check (monotonic: block if either resolution is
+        // outside). For the read tool, also check Pi's resolveReadPathAsync
+        // fallback variants so a missing file whose variant resolves outside is
+        // not silently allowed.
+        try {
+          const piResolved = resolveToCwd(input.path, options.workspace);
+          const candidates = getReadPathCandidates(piResolved);
+          // Deliberate policy: all candidates are checked regardless of existence (not
+          // Pi's existence-ordered selection) so the guard cannot be raced by creating
+          // a variant between the hook and the read. Trade-off: a read is blocked when
+          // an escaping variant symlink sits next to a safe primary file.
+          for (const candidate of candidates) {
+            const candidateRealPath = await fs.realpath(candidate).catch(() => candidate);
+            if (!isAllowedPath(candidateRealPath))
+              return {
+                block: true,
+                reason: `Librarian read is limited to its workspace/cache: ${candidateRealPath}`,
+              };
+          }
+        } catch {
+          return { block: true, reason: "Librarian read path could not be resolved safely." };
+        }
       }
 
       if (event.toolName === "bash") {
@@ -1045,7 +1237,7 @@ function buildSystemPrompt(options: {
     ? `\nLocal checkout cache is ENABLED for this call.\n- Cache root: ${options.cacheRoot}\n- Use checkout path pattern: ${options.cacheRoot}/github.com/<owner>/<repo>\n- Reuse an existing checkout when it has a .git directory. Fetch/prune before relying on it: git -C "$DIR" fetch --all --prune --tags --quiet\n- If missing, clone with gh repo clone "$REPO" "$DIR" (or git clone https://github.com/$REPO.git "$DIR").\n- If a ref/branch/SHA is requested, fetch it and check it out locally before citing files from that ref.\n- After using a checkout, update its cache marker: touch "$DIR/${CACHE_MARKER_FILE}"\n- Prefer local rg/read inside cached checkouts once a repo is cloned, and cite absolute cached paths with line ranges.\n- Clone only repositories that are relevant to the query; do not bulk-clone broad owner/org scopes unless necessary.`
     : `\nLocal checkout cache is DISABLED for this call.\n- Do not clone repositories.\n- Use gh search/API/tree/contents calls and cache only necessary proof files under ${options.workspace}/repos/<owner>/<repo>/<path>.`;
 
-  return `You are Librarian, an evidence-first GitHub code scout running inside pi.\n\nUse only the available bash/read tools. Use gh, jq, rg, find/fd, ls, stat, mkdir, base64, and nl -ba for GitHub reconnaissance and numbered evidence. Use read for focused local file inspection.\n\nWorkspace: ${options.workspace}\nDefault gh search limit: ${options.maxSearchResults}\nTurn budget: ${MAX_TURNS} turns total, including your final answer. Stop searching once you have enough evidence.\n${cacheSection}\n\nPerformance guidance:\n- Prefer fast, parallel exploration. When probes are independent, issue multiple separate tool calls in the same assistant turn instead of waiting for each result one-by-one.\n- Aim for 4-8 independent bash/read calls in an exploration turn when useful: parallel gh searches, tree probes, contents fetches, and targeted file reads.\n- Keep dependent work sequential, and avoid concurrent writes to the same file, checkout, or cache directory.\n\nNon-negotiable constraints:\n- Never treat gh search snippets as proof by themselves. Use fetched files or local checkouts for code-content claims.\n- Keep temporary workspace writes under ${options.workspace}/repos unless local checkout cache is enabled, in which case writes under the cache root are also allowed.
+  return `You are Librarian, an evidence-first GitHub code scout running inside pi.\n\nUse the available bash and read tools for local inspection, and any configured MCP tools for additional context (MCP tools run without confirmation inside this subagent; use them only to gather evidence, not for state-changing actions unless the task explicitly asks; MCP access requires host Pi >=1.0.4, older hosts degrade to no MCP). Use gh, jq, rg, find/fd, ls, stat, mkdir, base64, and nl -ba for GitHub reconnaissance and numbered evidence. Use read for focused local file inspection.\n\nWorkspace: ${options.workspace}\nDefault gh search limit: ${options.maxSearchResults}\nTurn budget: ${MAX_TURNS} turns total, including your final answer. Stop searching once you have enough evidence.\n${cacheSection}\n\nPerformance guidance:\n- Prefer fast, parallel exploration. When probes are independent, issue multiple separate tool calls in the same assistant turn instead of waiting for each result one-by-one.\n- Aim for 4-8 independent bash/read calls in an exploration turn when useful: parallel gh searches, tree probes, contents fetches, and targeted file reads.\n- Keep dependent work sequential, and avoid concurrent writes to the same file, checkout, or cache directory.\n\nNon-negotiable constraints:\n- Never treat gh search snippets as proof by themselves. Use fetched files or local checkouts for code-content claims.\n- Keep temporary workspace writes under ${options.workspace}/repos unless local checkout cache is enabled, in which case writes under the cache root are also allowed.
 - A runtime guard blocks destructive shell commands, credential/environment inspection, and reads outside the workspace/cache.\n- Never paste whole files. Use short snippets only when they clarify the evidence.\n- If evidence is partial or access fails (404/403), state the limitation clearly.\n- Do not present anything as fact unless it appeared in tool output or in a file you read.\n\nRecommended search flow:\n1. If symbols/text are known, start with gh search code and the provided repo/owner filters.\n2. If a repo is known but paths are unclear, resolve the default branch and inspect the git tree or contents API.\n3. Fetch or clone only the files/repos required to prove the answer.\n4. Use rg/read/nl -ba locally to produce stable path and line evidence.\n\nUseful gh patterns:\n- gh repo view "$REPO" --json defaultBranchRef --jq '.defaultBranchRef.name'\n- gh search code '<terms>' --json path,repository,sha,url,textMatches --limit ${options.maxSearchResults}\n- gh api "repos/$REPO/git/trees/$REF?recursive=1" > tree.json\n- gh api "repos/$REPO/contents/$FILE?ref=$REF" --jq .content | tr -d '\\n' | base64 --decode > "repos/$REPO/$FILE"\n- rg -n '<pattern>' '<local path>'\n- nl -ba '<local file>' | sed -n '10,30p'\n\nOutput format, exact order:\n## Summary\n1-3 concise sentences.\n## Locations\n- \`path\` or \`path:lineStart-lineEnd\` — what is here and why it matters; include GitHub URL when useful. If nothing relevant is found, write \`- (none)\`.\n## Evidence\n- \`path\` or \`path:lineStart-lineEnd\` — what this proves. Include concise snippets only if useful.\n## Searched\nOnly include when incomplete/not found or when the search path matters. List queries, filters, and probes used.\n## Next steps\nOptional: 1-3 narrow follow-up checks for remaining ambiguity.`;
 }
 
@@ -1277,6 +1469,13 @@ function renderAnswer(details: LibrarianDetails): string {
 }
 
 export const __test__ = {
+  SUBAGENT_MCP_TOOLS,
+  isMcpCompatibleVersion,
+  resolveSubagentProjectTrusted,
+  createMcpSubagentFactories,
+  disposeSubagentSession,
+  createLibrarianRuntimeGuardExtension,
+  resolveToCwd,
   buildLibrarianCandidates,
   findAvailableModel,
   isModelAvailabilityError,
@@ -1652,7 +1851,10 @@ export default function librarianExtension(pi: ExtensionAPI) {
         // Keep the research session from inheriting user/project tool, shell,
         // retry, or provider-request settings. The host model runtime is still
         // passed explicitly below so the selected provider/auth policy is kept.
-        const isolatedSettingsManager = SettingsManager.inMemory({});
+        // workspace is a temp clone dir — always a different dir from ctx.cwd,
+        // so projectTrusted is always false here (project .pi/mcp.json is never loaded).
+        const projectTrusted = resolveSubagentProjectTrusted(ctx, workspace);
+        const isolatedSettingsManager = SettingsManager.inMemory({}, { projectTrusted });
         const resourceLoader = new DefaultResourceLoader({
           cwd: workspace,
           agentDir: getAgentDir(),
@@ -1669,6 +1871,7 @@ export default function librarianExtension(pi: ExtensionAPI) {
               cacheRoot,
               cacheEnabled: cacheDecision.enabled,
             }),
+            ...createMcpSubagentFactories(),
           ],
           systemPromptOverride: () => systemPrompt,
           skillsOverride: () => ({ skills: [], diagnostics: [] }),
@@ -1693,43 +1896,48 @@ export default function librarianExtension(pi: ExtensionAPI) {
             sessionManager: SessionManager.inMemory(workspace),
             model: candidate.model,
             thinkingLevel: candidate.details.thinkingLevel,
-            tools: ["read", "bash"],
+            tools: ["read", "bash", ...SUBAGENT_MCP_TOOLS],
           });
 
+          // Assign session BEFORE bindExtensions so the finally block can dispose it
+          // even if binding fails partway through (e.g. a server starts then an
+          // extension's session_start throws).
           session = created.session as typeof session;
-          if (abortController.callerAborted) abortController.abortForCleanup();
-          unsubscribe = (created.session as any).subscribe((event: any) => {
-            addSessionEventUsage(usage, event);
-            switch (event.type) {
-              case "turn_end":
-                details.turns += 1;
-                emit();
-                break;
-              case "tool_execution_start":
-                details.toolCalls.push({
-                  id: event.toolCallId,
-                  name: event.toolName,
-                  args: event.args,
-                  startedAt: Date.now(),
-                });
-                if (details.toolCalls.length > MAX_TOOL_CALLS_TO_KEEP) {
-                  details.toolCalls.splice(0, details.toolCalls.length - MAX_TOOL_CALLS_TO_KEEP);
-                }
-                emit();
-                break;
-              case "tool_execution_end": {
-                const call = details.toolCalls.find((item) => item.id === event.toolCallId);
-                if (call) {
-                  call.endedAt = Date.now();
-                  call.isError = event.isError;
+          try {
+            // Connect extensions (MCP servers) before prompting. Feature-detected: Pi >=0.99.0.
+            await (created.session as any).bindExtensions?.({ mode: "json" });
+            if (abortController.callerAborted) abortController.abortForCleanup();
+            unsubscribe = (created.session as any).subscribe((event: any) => {
+              addSessionEventUsage(usage, event);
+              switch (event.type) {
+                case "turn_end":
+                  details.turns += 1;
+                  emit();
+                  break;
+                case "tool_execution_start":
+                  details.toolCalls.push({
+                    id: event.toolCallId,
+                    name: event.toolName,
+                    args: event.args,
+                    startedAt: Date.now(),
+                  });
+                  if (details.toolCalls.length > MAX_TOOL_CALLS_TO_KEEP) {
+                    details.toolCalls.splice(0, details.toolCalls.length - MAX_TOOL_CALLS_TO_KEEP);
+                  }
+                  emit();
+                  break;
+                case "tool_execution_end": {
+                  const call = details.toolCalls.find((item) => item.id === event.toolCallId);
+                  if (call) {
+                    call.endedAt = Date.now();
+                    call.isError = event.isError;
+                  }
+                  emit();
+                  break;
                 }
-                emit();
-                break;
               }
-            }
-          });
+            });
 
-          try {
             if (!abortController.callerAborted) {
               const promptPromise = created.session.prompt(
                 buildUserPrompt(query, repos, owners, maxSearchResults, details.cache),
@@ -1758,7 +1966,7 @@ export default function librarianExtension(pi: ExtensionAPI) {
             }
             unsubscribe?.();
             unsubscribe = undefined;
-            session?.dispose();
+            await disposeSubagentSession(session);
             session = undefined;
           }
         };
@@ -1841,7 +2049,7 @@ export default function librarianExtension(pi: ExtensionAPI) {
         if (runTimeout) clearTimeout(runTimeout);
         if (signal && abortListenerAdded) signal.removeEventListener("abort", abortFromCaller);
         unsubscribe?.();
-        session?.dispose();
+        await disposeSubagentSession(session);
       }
     },
 

package/extensions/librarian/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-librarian",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "A pi GitHub research scout with a toggleable local repo checkout cache under the user's OS cache directory.",
   "keywords": [
     "pi-package",

package/extensions/minimal-footer/README.md

@@ -10,7 +10,7 @@ It replaces pi's built-in footer with a cleaner two-line layout that focuses on
 - TLH-style git dirty counts, ahead/behind counts, and optional PR number
 - current repo name
 - current context percentage
-- red `DUMB ZONE` indicator when context usage is above 200k tokens
+- red `DUMB ZONE` indicator when context usage is above 300k tokens
 - current model and thinking level
 - OpenAI Codex usage windows, labeled from the durations reported by OpenAI
 - `xp` marker when Pi experimental features are enabled
@@ -39,7 +39,7 @@ main · +1 ~2 ?3 ↑1 • PR #42
 
 The markers are `!` conflicts, `+` staged, `~` unstaged, `?` untracked, `↑` ahead, and `↓` behind. PR numbers are fetched best-effort with `gh pr view`. Git polling is skipped until Pi reports that the project is trusted, and `git status` is run with fsmonitor disabled.
 
-When context usage is above 200k tokens, the bottom-left line includes a red warning:
+When context usage is above 300k tokens, the bottom-left line includes a red warning:
 
 ```text
 44.1% · DUMB ZONE
@@ -115,7 +115,7 @@ Example:
     "showPercent": true,
     "dumbZone": {
       "enabled": true,
-      "thresholdTokens": 200000,
+      "thresholdTokens": 300000,
       "label": "DUMB ZONE",
       "color": "error"
     }
@@ -231,7 +231,7 @@ Disable git dirty/ahead/PR status:
 
 - **Top left:** current git branch plus dirty/ahead/PR status when available
 - **Top right:** current repo directory name
-- **Bottom left:** current context usage percentage, plus red `DUMB ZONE` above 200k context tokens
+- **Bottom left:** current context usage percentage, plus red `DUMB ZONE` above 300k context tokens
 - **Bottom left on `openai-codex`:** current context usage percentage plus the Codex usage windows reported for the account
 - **Bottom left on `openai` ChatGPT OAuth:** current context usage percentage plus `usage unsupported`; no legacy WHAM request is attempted
 - **Bottom left with `PI_EXPERIMENTAL=1`:** current context usage percentage plus `xp`
@@ -246,7 +246,7 @@ This extension also lives inside the broader [`pi-extensions`](../../README.md)
 - Replaces pi's built-in footer entirely.
 - Uses pi footer data for git branch updates, plus background cached git/gh checks for dirty counts and PR number after project trust is granted.
 - Shows only context percentage, not context window size.
-- Shows `DUMB ZONE` only while context usage is above 200k tokens.
+- Shows `DUMB ZONE` only while context usage is above 300k tokens.
 - Shows the model id rather than a provider-specific display label.
 - Shows `xp` when `PI_EXPERIMENTAL=1`.
 - For `openai-codex`, reads pi's stored OAuth login and fetches usage from ChatGPT's backend usage endpoint. Window labels are inferred from each window's reported duration; missing or unrecognized durations use neutral `usage` labels rather than guessing from window position.

package/extensions/minimal-footer/index.ts

@@ -24,7 +24,7 @@ const DEFAULT_CONFIG: MinimalFooterConfig = {
     showPercent: true,
     dumbZone: {
       enabled: true,
-      thresholdTokens: 200_000,
+      thresholdTokens: 300_000,
       label: "DUMB ZONE",
       color: "error",
     },
@@ -121,7 +121,6 @@ type UsageSessionState = {
   snapshot?: UsageSnapshot;
   lastFetchedAt?: number;
   loading: boolean;
-  error?: string;
   availability?: UsageAvailability;
   usageIdentity?: UsageIdentity;
   requestVersion: number;
@@ -834,7 +833,6 @@ function clearUsageState(state: UsageSessionState): void {
   state.snapshot = undefined;
   state.lastFetchedAt = undefined;
   state.loading = false;
-  state.error = undefined;
   state.availability = undefined;
 }
 
@@ -909,7 +907,6 @@ function invalidateUsageState(state: UsageSessionState, usageIdentity?: UsageIde
   state.snapshot = undefined;
   state.lastFetchedAt = undefined;
   state.loading = false;
-  state.error = undefined;
   state.availability = undefined;
   state.usageIdentity = usageIdentity;
   // The previous promise may still be resolving. Clearing the reference lets
@@ -961,7 +958,7 @@ async function refreshUsageIfNeeded(
 
   const mode = getUsageMode(ctx, config, resolvedUsageIdentity);
   if (!mode) {
-    if (state.snapshot || state.availability || state.loading || state.error) {
+    if (state.snapshot || state.availability || state.loading) {
       clearUsageState(state);
       state.requestRender?.();
     }
@@ -1006,19 +1003,16 @@ async function refreshUsageIfNeeded(
       if (snapshot) {
         state.snapshot = snapshot;
         state.lastFetchedAt = snapshot.fetchedAt;
-        state.error = undefined;
       } else {
         state.snapshot = undefined;
         state.lastFetchedAt = Date.now();
-        state.error = undefined;
         state.availability = "unavailable";
       }
-    } catch (error) {
+    } catch {
       if (!usageRequestStillCurrent(ctx, state, requestVersion, requestUsageKey)) return;
       state.snapshot = undefined;
       state.lastFetchedAt = Date.now();
       state.availability = "unavailable";
-      state.error = error instanceof Error ? error.message : String(error);
     } finally {
       if (
         state.disposed ||
@@ -1085,7 +1079,6 @@ export default function (pi: ExtensionAPI) {
     state.snapshot = undefined;
     state.lastFetchedAt = undefined;
     state.loading = false;
-    state.error = undefined;
     state.availability = undefined;
     state.usageIdentity = undefined;
     state.inflight = undefined;

package/extensions/minimal-footer/minimal-footer.example.json

@@ -3,7 +3,7 @@
     "showPercent": true,
     "dumbZone": {
       "enabled": true,
-      "thresholdTokens": 200000,
+      "thresholdTokens": 300000,
       "label": "DUMB ZONE",
       "color": "error"
     }

package/extensions/minimal-footer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-minimal-footer",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "A minimal custom footer for pi.",
   "keywords": [
     "pi-package",

package/extensions/oracle/README.md

@@ -4,11 +4,11 @@
 
 An Amp-style oracle for [pi](https://github.com/earendil-works/pi).
 
-It adds an `oracle` tool that spins up a separate read-only pi subprocess and sends it to the strongest reasoning model available on the **same provider/subscription** the user is currently using.
+It adds an `oracle` tool that spins up a separate pi subprocess with read-only built-in tools and any configured MCP tools, and sends it to the strongest reasoning model available on the **same provider/subscription** the user is currently using.
 
 ## What it does
 
-- creates an isolated read-only subprocess
+- creates an isolated subprocess with read-only built-in tools (read, grep, find, ls) and any configured MCP tools
 - auto-picks the strongest reasoning model on the current provider
 - uses provider-specific hardcoded rankings first, then a heuristic fallback
 - requests `xhigh` by default for reasoning models, then clamps to the model-supported thinking level
@@ -110,7 +110,8 @@ When the current Pi session has a non-empty model scope, Oracle limits automatic
 
 ## Notes
 
-- The oracle is intentionally **read-only by default**.
+- The oracle subprocess uses read-only built-in tools (read, grep, find, ls) by default, plus any configured MCP tools. It can optionally include bash for non-mutating inspection.
+- Configured MCP tools run without confirmation inside the subprocess and may have side effects — use them only for gathering evidence. MCP access requires host Pi >=1.0.4; older hosts degrade to no MCP, no error.
 - It is best for review, analysis, planning, debugging, and second opinions.
 - It is slower than using the main model directly, so it should be used selectively.
 - While it runs in interactive mode, it adds a footer status line and a widget below the editor.