@diegopetrucci/pi-extensions 0.1.76 → 0.1.79

package/extensions/minimal-footer/openai-usage.ts

@@ -15,7 +15,6 @@ export type UsageAvailability = "unsupported" | "unavailable";
 
 interface WhamUsageWindow {
   limit_window_seconds?: number;
-  reset_at?: number;
   used_percent?: number;
 }
 
@@ -29,7 +28,6 @@ interface WhamUsageResponse {
 export interface UsageWindow {
   usedPercent?: number;
   windowSeconds?: number;
-  resetAt?: number;
 }
 
 export interface UsageSnapshot {
@@ -59,19 +57,12 @@ function normalizeWindowSeconds(value?: number): number | undefined {
   return value;
 }
 
-function normalizeResetAt(value?: number): number | undefined {
-  if (typeof value !== "number" || !Number.isFinite(value)) return undefined;
-  return value * 1000;
-}
-
 function parseUsageWindow(window?: WhamUsageWindow): UsageWindow | undefined {
   if (!window) return undefined;
   const usedPercent = normalizeUsedPercent(window.used_percent);
   const windowSeconds = normalizeWindowSeconds(window.limit_window_seconds);
-  const resetAt = normalizeResetAt(window.reset_at);
-  if (usedPercent === undefined && windowSeconds === undefined && resetAt === undefined)
-    return undefined;
-  return { usedPercent, windowSeconds, resetAt };
+  if (usedPercent === undefined && windowSeconds === undefined) return undefined;
+  return { usedPercent, windowSeconds };
 }
 
 function parseUsageSnapshot(data: WhamUsageResponse): Omit<UsageSnapshot, "fetchedAt"> {

package/extensions/minimal-footer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-minimal-footer",
-  "version": "0.1.22",
+  "version": "0.1.25",
   "description": "A minimal custom footer for pi.",
   "keywords": [
     "pi-package",

package/extensions/oracle/README.md

@@ -4,11 +4,11 @@
 
 An Amp-style oracle for [pi](https://github.com/earendil-works/pi).
 
-It adds an `oracle` tool that spins up a separate read-only pi subprocess and sends it to the strongest reasoning model available on the **same provider/subscription** the user is currently using.
+It adds an `oracle` tool that spins up a separate pi subprocess with read-only built-in tools and any configured MCP tools, and sends it to the strongest reasoning model available on the **same provider/subscription** the user is currently using.
 
 ## What it does
 
-- creates an isolated read-only subprocess
+- creates an isolated subprocess with read-only built-in tools (read, grep, find, ls) and any configured MCP tools
 - auto-picks the strongest reasoning model on the current provider
 - uses provider-specific hardcoded rankings first, then a heuristic fallback
 - requests `xhigh` by default for reasoning models, then clamps to the model-supported thinking level
@@ -110,7 +110,8 @@ When the current Pi session has a non-empty model scope, Oracle limits automatic
 
 ## Notes
 
-- The oracle is intentionally **read-only by default**.
+- The oracle subprocess uses read-only built-in tools (read, grep, find, ls) by default, plus any configured MCP tools. It can optionally include bash for non-mutating inspection.
+- Configured MCP tools run without confirmation inside the subprocess and may have side effects — use them only for gathering evidence. MCP access requires host Pi >=1.0.4; older hosts degrade to no MCP, no error.
 - It is best for review, analysis, planning, debugging, and second opinions.
 - It is slower than using the main model directly, so it should be used selectively.
 - While it runs in interactive mode, it adds a footer status line and a widget below the editor.

package/extensions/oracle/index.ts

@@ -102,8 +102,15 @@ interface OraclePreferences {
   thinkingLevel?: ThinkingLevel;
 }
 
-const READ_ONLY_TOOLS = ["read", "grep", "find", "ls"];
-const READ_ONLY_PLUS_BASH_TOOLS = [...READ_ONLY_TOOLS, "bash"];
+const SUBAGENT_MCP_TOOLS = [
+  "mcp__*",
+  "tool_search",
+  "list_mcp_resources",
+  "list_mcp_resource_templates",
+  "read_mcp_resource",
+];
+const READ_ONLY_TOOLS = ["read", "grep", "find", "ls", ...SUBAGENT_MCP_TOOLS];
+const READ_ONLY_PLUS_BASH_TOOLS = ["read", "grep", "find", "ls", "bash", ...SUBAGENT_MCP_TOOLS];
 const DEFAULT_THINKING_LEVEL: ThinkingLevel = "xhigh";
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
 const COLLAPSED_LINE_LIMIT = 8;
@@ -111,6 +118,33 @@ const ORACLE_STATUS_ID = "oracle";
 const ORACLE_WIDGET_ID = "oracle";
 const ORACLE_CONFIG_FILE = "oracle.json";
 
+const AZURE_MODEL_PREFERENCES = [
+  "gpt-6-astra ",
+  "gpt-6-astra",
+  "gpt-6.1-sol ",
+  "gpt-6-sol ",
+  "gpt-6-sol",
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-6-luna ",
+  "gpt-6-luna",
+  "gpt-5.6-luna",
+  "gpt-5.5-pro",
+  "gpt-5.5",
+  "gpt-5.4-pro",
+  "gpt-5.4 ",
+  "gpt-5.3-codex",
+  "gpt-5-pro",
+  "gpt-5-chat-latest",
+  "gpt-5.2-pro",
+  "gpt-5.2",
+  "gpt-5.1",
+  "o3-pro",
+  "o1-pro",
+  "gpt-5.4-mini",
+  "gpt-5-mini",
+];
+
 const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "amazon-bedrock": [
     "global.anthropic.claude-opus-5-5 ",
@@ -163,32 +197,9 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "claude-sonnet-4-5",
   ],
   "ant-ling": ["Ling-2.6-1T", "Ling-2.6-flash"],
-  "azure-openai-responses": [
-    "gpt-6-astra ",
-    "gpt-6-astra",
-    "gpt-6.1-sol ",
-    "gpt-6-sol ",
-    "gpt-6-sol",
-    "gpt-5.6-sol",
-    "gpt-5.6-terra",
-    "gpt-6-luna ",
-    "gpt-6-luna",
-    "gpt-5.6-luna",
-    "gpt-5.5-pro",
-    "gpt-5.5",
-    "gpt-5.4-pro",
-    "gpt-5.4 ",
-    "gpt-5.3-codex",
-    "gpt-5-pro",
-    "gpt-5-chat-latest",
-    "gpt-5.2-pro",
-    "gpt-5.2",
-    "gpt-5.1",
-    "o3-pro",
-    "o1-pro",
-    "gpt-5.4-mini",
-    "gpt-5-mini",
-  ],
+  azure: AZURE_MODEL_PREFERENCES,
+  // Legacy alias for Pi 1.0.0–1.0.2 hosts (renamed to `azure` in Pi 1.0.3).
+  "azure-openai-responses": AZURE_MODEL_PREFERENCES,
   baseten: [
     "moonshotai/Kimi-K3",
     "moonshotai/Kimi-K2.7-Code ",
@@ -213,10 +224,6 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "cloudflare-ai-gateway": [
     "claude-fable-5",
     "claude-opus-5",
-    "claude-opus-4.8",
-    "claude-opus-4.7",
-    "claude-opus-4.6",
-    "claude-opus-4.5",
     "gpt-6-astra ",
     "gpt-6-astra",
     "gpt-5.5",
@@ -553,9 +560,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "MiniMaxAI/MiniMax-M3",
     "MiniMaxAI/MiniMax-M2.7",
     "openai/gpt-oss-120b",
-    "openai/gpt-oss-20b",
     "nvidia/nemotron-3-ultra-550b-a55b",
-    "google/gemma-4-31B-it",
   ],
   typesafe: [],
   "vercel-ai-gateway": [
@@ -631,11 +636,12 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 };
 
 const ORACLE_SYSTEM_PROMPT = [
-  "You are Oracle, a read-only high-reasoning coding assistant.",
+  "You are Oracle, a high-reasoning coding assistant with access to read-only built-in tools and any configured MCP tools.",
   "Your job is analysis, debugging, planning, review, and second opinions.",
   "Use the available tools to inspect the repository and gather evidence.",
   "Never claim to have changed files or run mutating actions.",
   "If bash is available, use it only for non-mutating inspection commands.",
+  "Configured MCP tools are available and run without confirmation inside this subagent. Use them only to gather evidence or context. Avoid side-effecting MCP actions unless the task explicitly asks for them.",
   "Be concrete. Reference file paths, symbols, commands, and risks when helpful.",
   "Prefer short sections and finish with a concise 'Bottom line' summary.",
 ].join("\n");
@@ -1681,14 +1687,15 @@ function createOracleExtension(pi: ExtensionAPI, deps: OracleExtensionDeps = {})
     name: "oracle",
     label: "Oracle",
     description:
-      "Consult a separate read-only oracle subprocess for deep analysis, code review, debugging, planning, and second opinions.",
+      "Consult a separate oracle subprocess with read-only built-in tools and configured MCP tools for deep analysis, code review, debugging, planning, and second opinions.",
     promptSnippet:
-      "Consult a read-only oracle that auto-selects the strongest reasoning model on the current provider/subscription.",
+      "Consult an oracle subprocess that auto-selects the strongest reasoning model on the current provider/subscription; exposes read-only built-in tools plus any configured MCP tools.",
     promptGuidelines: [
       "Use oracle sparingly when you want a second opinion, deeper analysis, code review, debugging help, or a higher-reasoning pass.",
       "Do not use oracle for routine low-value work; oracle is slower than the main agent.",
-      "The oracle tool is read-only by default and only exposes read, grep, find, and ls unless oracle includeBash is enabled.",
+      "The oracle tool exposes read-only built-in tools (read, grep, find, and ls) plus any configured MCP tools; oracle includeBash adds the bash inspection tool.",
       "Set oracle includeBash only when the extra bash inspection tool is genuinely useful; keep oracle relying on read, grep, find, and ls otherwise.",
+      "Configured MCP tools are available to oracle and run without confirmation inside the subagent; they may have side effects — use them only for gathering evidence, not for state-changing actions unless the task explicitly asks. MCP access requires host Pi >=1.0.4; older hosts degrade to no MCP, no error.",
       "The oracle tool requests xhigh by default for reasoning models; oracle defaults and explicit thinkingLevel overrides are clamped to the effective model-supported level when the model is matched.",
     ],
     parameters: OracleParams,
@@ -1803,8 +1810,7 @@ function createOracleExtension(pi: ExtensionAPI, deps: OracleExtensionDeps = {})
           onUpdate?.(partial);
         };
 
-        let lastErrorResult: { ok: false; error: string; details: OracleDetails } | undefined;
-        for (let index = 0; index < attempts.length; index++) {
+        for (let index = 0; ; index++) {
           const previous = index > 0 ? attempts[index - 1] : undefined;
           const attempt = previous
             ? withFallbackReason(attempts[index], previous)
@@ -1828,7 +1834,6 @@ function createOracleExtension(pi: ExtensionAPI, deps: OracleExtensionDeps = {})
             });
           }
 
-          lastErrorResult = result;
           const canFallBack = index < attempts.length - 1 && isModelAvailabilityError(result.error);
           if (!canFallBack) {
             return finalizeResult({
@@ -1837,30 +1842,6 @@ function createOracleExtension(pi: ExtensionAPI, deps: OracleExtensionDeps = {})
             });
           }
         }
-
-        return finalizeResult({
-          content: [
-            {
-              type: "text",
-              text: lastErrorResult?.error ?? "Oracle could not select an available model.",
-            },
-          ],
-          details: lastErrorResult?.details ?? {
-            modelRef: "",
-            provider: ctx.model?.provider ?? "unknown",
-            modelId: "",
-            modelName: undefined,
-            thinkingLevel: configuredThinkingLevel ?? DEFAULT_THINKING_LEVEL,
-            autoSelected: true,
-            selectionReason: "No authenticated models were available to run the oracle.",
-            includeBash: params.includeBash ?? false,
-            usage: createEmptyUsage(),
-            stderr: "",
-            exitCode: 1,
-            durationMs: 0,
-            cwd: params.cwd ?? ctx.cwd,
-          },
-        });
       } finally {
         activeRuns.delete(toolCallId);
         updateOracleUi(ctx, activeRuns);

package/extensions/oracle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-oracle",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "An Amp-style oracle extension for pi that consults the strongest reasoning model on your current provider.",
   "keywords": [
     "pi-package",

package/extensions/permission-gate/README.md

@@ -17,6 +17,8 @@ This started from the original `permission-gate.ts` example in [`earendil-works/
 
 Safe `.env` templates/examples such as `.env.example` and `.env.production.template` are allowed.
 
+Write and edit paths are resolved the same way Pi's built-in tools do — including `file:` URL decoding (percent-encoded paths like `file:///…/%2Eenv` are decoded before checking), `~` and `~/` tilde expansion, Unicode space normalisation, and resolution of relative paths against `ctx.cwd`. Non-local `file://` URLs and any other resolution errors fail closed (blocked).
+
 If pi is running without an interactive UI, it blocks matching commands and protected path writes by default.
 
 For Pi's built-in local Windows PowerShell tool, commands that pass the fast lexical checks are also parsed with the same PowerShell installation's AST parser before execution. Malformed input, parser failures, `Remove-Item` parameter splatting, command-resolution changes (aliases/modules/providers/direct function or filter definitions), known script/process/job/member invocation wrappers, computed member calls, and analyzer inputs above 16,000 UTF-8 bytes are treated conservatively and require confirmation (or are blocked when no UI is available). Computed targets passed to provider-capable mutation commands also require confirmation because the target could resolve to `Alias:` or `Function:`. Literal quoted/commented examples, including literal here-strings, stay benign. Definitely enabled `-WhatIf` removals (`-WhatIf`, `-WhatIf:$true`, or `-WhatIf:1`) remain non-destructive and are allowed; computed switch values require confirmation.
@@ -63,4 +65,5 @@ Then reload pi:
 - Inspects `bash`, `powershell`, `write`, and `edit` tool calls.
 - Validates shell timeouts as well as command strings and fails closed on malformed calls.
 - Normalizes relative/absolute paths before matching so traversal tricks do not bypass the guard.
+- Resolves write and edit paths like Pi's built-in tools (file URLs, `~` expansion, cwd) so percent-encoded URLs, tilde paths, and cwd-relative paths inside protected directories are all caught.
 - Prompts with a simple `Yes` / `No` selector before allowing dangerous commands or protected path writes.

package/extensions/permission-gate/index.ts

@@ -7,7 +7,9 @@
  * secret-bearing .env files (excluding example/template variants).
  */
 
+import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
@@ -18,6 +20,12 @@ import {
   parsePowerShellAstOutput,
 } from "./powershell-safety.ts";
 
+/**
+ * Unicode space characters that Pi's path normalizer replaces with an ASCII space.
+ * Mirrors the UNICODE_SPACES constant in dist/utils/paths.js.
+ */
+const UNICODE_SPACES_PATTERN = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
 const dangerousPatterns = [/\bsudo\b/i, /\b(chmod|chown)\b.*777/i];
 const protectedPathSegments = new Set([".git", "node_modules"]);
 const shellCommandSeparators = new Set([";", "&", "&&", "||", "|", "\n", "(", ")", "{", "}"]);
@@ -48,14 +56,88 @@ type ShellToken = {
   quote?: '"' | "'";
 };
 
-type WriteInput = { path: string; content: string };
-type EditInput = { path: string; edits: Array<{ oldText: string; newText: string }> };
 type ShellInput = { command: string; timeout?: number };
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
+/**
+ * Converts Git Bash / MSYS / Cygwin / WSL drive paths to a form native Windows
+ * APIs accept. Mirrors normalizeWindowsShellPath from
+ * dist/utils/paths.js. No-op on non-win32 paths.
+ */
+function normalizeWindowsShellPathLocal(filePath: string): string {
+  if (!filePath.startsWith("/") || filePath.startsWith("//") || filePath.includes("\\"))
+    return filePath;
+  const match = filePath.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+  if (!match) return filePath;
+  const suffix = match[2]?.replaceAll("/", "\\");
+  return `${match[1].toUpperCase()}:\\${suffix ?? ""}`;
+}
+
+/**
+ * Mirrors Pi's normalizePath (dist/utils/paths.js). On win32, Git Bash / WSL
+ * drive-path normalisation always runs; only tilde expansion is gated by
+ * expandTilde.
+ */
+function normalizePath(
+  input: string,
+  opts: { normalizeUnicodeSpaces?: boolean; stripAtPrefix?: boolean; expandTilde?: boolean } = {},
+): string {
+  const { normalizeUnicodeSpaces = false, stripAtPrefix = false, expandTilde = true } = opts;
+  let p = input;
+  if (normalizeUnicodeSpaces) p = p.replace(UNICODE_SPACES_PATTERN, " ");
+  if (stripAtPrefix && p.startsWith("@")) p = p.slice(1);
+  if (process.platform === "win32") p = normalizeWindowsShellPathLocal(p);
+  if (expandTilde) {
+    const home = os.homedir();
+    if (p === "~") p = home;
+    else if (p.startsWith("~/") || (process.platform === "win32" && p.startsWith("~\\")))
+      p = path.join(home, p.slice(2));
+  }
+  if (/^file:\/\//.test(p)) p = fileURLToPath(p);
+  return p;
+}
+
+/**
+ * Mirrors Pi's resolveToCwd (dist/core/tools/path-utils.js): normalises the
+ * raw path with { normalizeUnicodeSpaces: true, stripAtPrefix: true }, normalises
+ * cwd with default options (expandTilde: true, so win32 shell-path handling
+ * also applies to cwd as Pi does), then resolves absolute paths via
+ * path.resolve and relative paths against cwd.
+ *
+ * Exported for tests that check parity with Pi's resolveToCwd. Note: other
+ * extensions will not import this file; each extension keeps its own local copy.
+ */
+export function resolveToCwd(rawPath: string, cwd: string): string {
+  const normalized = normalizePath(rawPath, { normalizeUnicodeSpaces: true, stripAtPrefix: true });
+  const base = normalizePath(cwd);
+  return path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(base, normalized);
+}
+
+type PiCheckResult =
+  | { status: "protected"; resolvedPath: string }
+  | { status: "error" }
+  | { status: "allowed" };
+
+/**
+ * Resolves rawPath via the Pi-mirroring resolveToCwd, then checks whether the
+ * resulting absolute path is a protected path.
+ */
+function checkPiResolvedPath(rawPath: string, cwd: string): PiCheckResult {
+  try {
+    const resolved = resolveToCwd(rawPath, cwd);
+    const normalized = normalizeToolPath(resolved);
+    if (normalized !== undefined && isProtectedPath(normalized)) {
+      return { status: "protected", resolvedPath: resolved };
+    }
+    return { status: "allowed" };
+  } catch {
+    return { status: "error" };
+  }
+}
+
 function normalizeToolPath(rawPath: string): NormalizedPath | undefined {
   const trimmed = rawPath.trim();
   if (!trimmed) return undefined;
@@ -636,21 +718,20 @@ async function hasDangerousPowerShellCommand(
   }
 }
 
-function validateWriteInput(input: unknown): WriteInput | undefined {
+function validateWriteInput(input: unknown): NormalizedPath | undefined {
   if (!isRecord(input)) return undefined;
   if (typeof input.path !== "string" || typeof input.content !== "string") return undefined;
-  if (!normalizeToolPath(input.path)) return undefined;
-  return { path: input.path, content: input.content };
+  return normalizeToolPath(input.path);
 }
 
-function validateEditInput(input: unknown): EditInput | undefined {
+function validateEditInput(input: unknown): NormalizedPath | undefined {
   if (!isRecord(input)) return undefined;
   if (typeof input.path !== "string" || !Array.isArray(input.edits)) return undefined;
-  if (!normalizeToolPath(input.path)) return undefined;
+  const normalizedPath = normalizeToolPath(input.path);
+  if (!normalizedPath) return undefined;
 
-  const edits = input.edits;
   if (
-    edits.some(
+    input.edits.some(
       (edit) =>
         !isRecord(edit) || typeof edit.oldText !== "string" || typeof edit.newText !== "string",
     )
@@ -658,10 +739,7 @@ function validateEditInput(input: unknown): EditInput | undefined {
     return undefined;
   }
 
-  return {
-    path: input.path,
-    edits: edits as Array<{ oldText: string; newText: string }>,
-  };
+  return normalizedPath;
 }
 
 async function requestConfirmation(
@@ -691,21 +769,48 @@ async function confirmProtectedPathAction(
   toolName: "write" | "edit",
   normalizedPath: NormalizedPath,
   ctx: ConfirmationContext,
+  alsoProtected = false,
+  displaySuffix?: string,
 ): Promise<GuardDecision> {
-  if (!isProtectedPath(normalizedPath)) return undefined;
+  if (!alsoProtected && !isProtectedPath(normalizedPath)) return undefined;
+  const displayLabel = displaySuffix
+    ? `${normalizedPath.displayPath}${displaySuffix}`
+    : normalizedPath.displayPath;
   if (!ctx.hasUI || !ctx.ui) {
     return {
       block: true,
-      reason: `Protected path blocked (${toolName} without UI confirmation): ${normalizedPath.displayPath}`,
+      reason: `Protected path blocked (${toolName} without UI confirmation): ${displayLabel}`,
     };
   }
 
   return requestConfirmation(
-    `⚠️ Protected path ${toolName} request:\n\n  ${normalizedPath.displayPath}\n\nAllow?`,
+    `⚠️ Protected path ${toolName} request:\n\n  ${displayLabel}\n\nAllow?`,
     ctx,
   );
 }
 
+async function confirmLexicalOrResolvedPath(
+  toolName: "write" | "edit",
+  normalizedPath: NormalizedPath,
+  ctx: ConfirmationContext & { cwd?: string },
+): Promise<GuardDecision> {
+  // Monotonic hardening: also check via Pi-style path resolution against ctx.cwd.
+  // OR logic: protected if EITHER the lexical check OR the Pi-resolved check matches.
+  // When only the Pi-resolved check catches a path, show the resolved absolute path in
+  // the reason so the user understands why the plain-looking path is protected.
+  const lexicalProtected = isProtectedPath(normalizedPath);
+  const piResult = checkPiResolvedPath(normalizedPath.original, ctx.cwd ?? process.cwd());
+  const piAlsoProtected = piResult.status === "protected" || piResult.status === "error";
+  const displaySuffix = lexicalProtected
+    ? undefined
+    : piResult.status === "protected"
+      ? ` (resolves to ${piResult.resolvedPath})`
+      : piResult.status === "error"
+        ? " (path could not be resolved)"
+        : undefined;
+  return confirmProtectedPathAction(toolName, normalizedPath, ctx, piAlsoProtected, displaySuffix);
+}
+
 export default function (pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
     if (event.toolName === "bash" || event.toolName === "powershell") {
@@ -733,28 +838,14 @@ export default function (pi: ExtensionAPI) {
       return undefined;
     }
 
-    if (event.toolName === "write") {
-      const input = validateWriteInput(event.input);
-      if (!input) {
-        return { block: true, reason: "Malformed write input blocked" };
-      }
-      const normalizedPath = normalizeToolPath(input.path);
-      if (!normalizedPath) {
-        return { block: true, reason: "Malformed write input blocked" };
-      }
-      return confirmProtectedPathAction("write", normalizedPath, ctx);
-    }
-
-    if (event.toolName === "edit") {
-      const input = validateEditInput(event.input);
-      if (!input) {
-        return { block: true, reason: "Malformed edit input blocked" };
-      }
-      const normalizedPath = normalizeToolPath(input.path);
+    if (event.toolName === "write" || event.toolName === "edit") {
+      const toolName = event.toolName;
+      const normalizedPath =
+        toolName === "write" ? validateWriteInput(event.input) : validateEditInput(event.input);
       if (!normalizedPath) {
-        return { block: true, reason: "Malformed edit input blocked" };
+        return { block: true, reason: `Malformed ${toolName} input blocked` };
       }
-      return confirmProtectedPathAction("edit", normalizedPath, ctx);
+      return confirmLexicalOrResolvedPath(toolName, normalizedPath, ctx);
     }
 
     return undefined;

package/extensions/permission-gate/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-permission-gate",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "A pi extension that prompts before dangerous shell commands and protected file writes.",
   "keywords": [
     "pi-package",

package/extensions/project-mcp-json/README.md

@@ -89,10 +89,10 @@ if a parent directory is trusted.
 Other approaches and their limitations:
 
 - **Delete the entry (or set it to `null`)** in `trust.json`: this resumes
-  nearest-ancestor lookup (step 3b), *not* a direct fallback to
+  nearest-ancestor lookup (step 3), *not* a direct fallback to
   `defaultProjectTrust`.  If any ancestor directory has a saved `true`, that
   decision is found first and loading is re-enabled.  `defaultProjectTrust`
-  (step 3c) only applies when the nearest-ancestor walk finds no decision at
+  (step 4) only applies when the nearest-ancestor walk finds no decision at
   all.  Deleting/nulling an entry is therefore *not* a reliable denial when
   any ancestor path is trusted.
 - **Set `defaultProjectTrust` to `"never"`** in `~/.pi/agent/settings.json`:

package/extensions/project-mcp-json/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-project-mcp-json",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "A pi extension that reads Claude Code-style .mcp.json files and registers the configured servers with pi.registerMcpServer.",
   "keywords": [
     "pi-package",

package/extensions/quiet-tools/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.4
+1.1.0

package/extensions/quiet-tools/README.md

@@ -1,33 +1,45 @@
 # quiet-tools
 
-A pi extension that makes collapsed built-in tool rows much quieter in the TUI.
+A pi extension that makes collapsed built-in tool rows and MCP tool rows quieter in the TUI.
 
-When enabled, each collapsed tool row renders as one invocation line plus a separate `(Ctrl+O to expand)` hint line. Tool output is hidden until expanded. Expanding with `Ctrl+O` still shows pi's full rendered output.
+When loaded on a supported pi host, quiet rendering is always on: each collapsed tool row shows one invocation line plus a separate `(Ctrl+O to expand)` hint line. Tool output is hidden until expanded. The global `Ctrl+O` binding, per-row expansion, and native expanded result rendering remain available.
 
-`quiet-tools` only changes the visual renderer. It does not truncate, summarize, or rewrite the actual tool results sent to the model. On Pi 0.99, its replacement definitions retain the upstream schemas, labels, descriptions, exposure/namespace metadata, `outputSchema`, execution function, abort signal, update callback, execution context, details, structured content, error status, and bounded output behavior. Expanded rendering delegates back to Pi's renderer.
+`quiet-tools` only changes the visual renderer. It does not truncate, summarize, or rewrite the actual tool results sent to the model. Expanded rendering delegates back to pi's renderer, preserving pi's default output for every tool.
+
+## How it works
+
+On pi >=1.0.1, `quiet-tools` registers a single `pi.registerToolRenderer` resolver. The resolver intercepts collapsed rows for the 7 built-in tools and any `mcp__*` tool and renders them quietly. All other tools are passed through to pi's default rendering. There is no opt-out setting, environment variable, or persistence mechanism.
+
+On pi <1.0.1 (where `registerToolRenderer` is not available), the extension registers no renderers and shows a one-time warning notification on session start. The read-only `/quiet-tools status` command remains available, but rendering is inactive.
 
 ## Covered tools
 
-- `bash`
-- `read`
-- `grep`
-- `find`
-- `ls`
-- `edit`
-- `write`
+**Built-in tools:** `bash`, `edit`, `find`, `grep`, `ls`, `read`, `write`
+
+Each built-in has a compact one-line summary (for example, `$ echo hello`, `read ~/project/notes.txt:1-20`, or `grep /TODO/ in src/`). Collapsed error and aborted rows retain a terse `[failed]` marker; the full native result remains available when expanded.
+
+**MCP tools:** any tool whose name starts with `mcp__`
 
-For every covered tool, the collapsed invocation is truncated to a single visual line so long paths, commands, diffs, or file contents do not fill the TUI. Expanding restores pi's normal renderer.
+MCP collapsed call lines show the tool name followed by compact JSON arguments (sanitized to a single line and truncated to the available TUI width). MCP collapsed results render empty, like built-in collapsed results.
 
-## Commands
+For every covered tool, the collapsed invocation is truncated to a single visual line. Expanding restores pi's normal renderer.
+
+## Command
 
 ```text
+/quiet-tools
 /quiet-tools status
-/quiet-tools off
-/quiet-tools on
-/quiet-tools toggle
 ```
 
-The extension starts enabled by default. Disabling is temporary for the current extension runtime/session; after `/reload`, `/new`, `/resume`, or `/fork`, it starts enabled again.
+Both forms report the always-on status. `status` is the only completion and valid action; other arguments show `Usage: /quiet-tools status` and cannot change rendering.
+
+## Export-style contexts
+
+Quiet call headers are also used in export-style renderer contexts. As a result, an export may omit a native write-call preview; this is an accepted tradeoff. Native expanded result rendering remains available in the TUI, including native error text, timing, and image handling.
+
+## Requirements
+
+Pi >=1.0.1 is required for quiet rendering. On older pi hosts, the extension loads without error and the status command remains available, but rendering is inactive.
 
 ## Install
 
@@ -57,8 +69,7 @@ Then reload pi:
 
 ## Notes
 
-- This extension overrides pi's built-in tool definitions so it can customize only their TUI renderers.
-- It reuses pi's built-in implementations and preserves `shellPath`, `shellCommandPrefix`, and image autoresize settings when they are available from settings files.
-- If another extension also overrides built-in tool execution, pi's extension load order determines which override wins.
+- `quiet-tools` uses pi's `registerToolRenderer` API to wrap only visual renderers, without touching tool execution, metadata, active-tool selection, or model-visible results.
 - It affects assistant-invoked tool rows. User `!`/`!!` bash commands are rendered by a separate pi component and keep pi's default preview behavior.
 - Pi renders image attachments outside tool result renderers, so inline image display for image reads is still controlled by pi's image settings.
+- MCP tool argument lines are sanitized (ANSI and control characters) and truncated to fit the TUI width. Expand to see full output.