@diegopetrucci/pi-extensions 0.1.81 → 0.1.82

package/extensions/diff-summarizer/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@diegopetrucci/pi-diff-summarizer",
+  "version": "0.1.0",
+  "description": "A standalone pi extension that adds a read-only diff_summarizer subagent tool that summarizes a diff and highlights review risk in an isolated child agent.",
+  "keywords": [
+    "pi-package",
+    "pi",
+    "diff",
+    "summary",
+    "subagent"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/diegopetrucci/pi-extensions.git",
+    "directory": "extensions/diff-summarizer"
+  },
+  "files": [
+    "index.ts",
+    "README.md",
+    ".pi-fleet-tested-version"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "pi": {
+    "extensions": [
+      "index.ts"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "typebox": "*"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.19.0"
+  }
+}

package/extensions/librarian/index.ts

@@ -1057,6 +1057,9 @@ function getBlockedBashReason(
   command: string,
   options: { workspace: string; cacheRoot: string; cacheEnabled: boolean },
 ): string | undefined {
+  if (/`/.test(command) || /\$\(/.test(command))
+    return "Librarian bash blocks command substitution.";
+
   if (!options.cacheEnabled && command.includes(options.cacheRoot)) {
     return "Local repo checkout cache is disabled for this Librarian call.";
   }
@@ -1070,6 +1073,13 @@ function getBlockedBashReason(
   if (destructiveLocal.test(scan))
     return "Librarian bash blocks destructive/local side-effect commands.";
 
+  if (
+    /(^|[\n;&|()])\s*find(?=\s)[^\n;&|]*\s-(?:delete|exec|execdir|ok|okdir)(?=$|[\s;&|()])/.test(
+      scan,
+    )
+  )
+    return "Librarian bash blocks find actions that delete files or execute commands.";
+
   const extraNetworkOrShell =
     /(^|[\n;&|()])\s*(?:curl|wget|nc|netcat|ssh|scp|sftp|rsync|bash|sh|zsh|fish|python|python3|perl|ruby|node|deno)(?=$|[\s;&|()])/;
   if (extraNetworkOrShell.test(scan))

package/extensions/librarian/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-librarian",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "A pi GitHub research scout with a toggleable local repo checkout cache under the user's OS cache directory.",
   "keywords": [
     "pi-package",

package/extensions/minimal-footer/index.ts

@@ -202,7 +202,11 @@ function readConfigFile(path: string): RecursivePartial<MinimalFooterConfig> {
   if (!existsSync(path)) return {};
 
   try {
-    return JSON.parse(readFileSync(path, "utf-8")) as RecursivePartial<MinimalFooterConfig>;
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf-8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Expected a non-null, non-array object");
+    }
+    return parsed as RecursivePartial<MinimalFooterConfig>;
   } catch (error) {
     console.error(`Warning: Could not parse ${path}: ${error}`);
     return {};

package/extensions/minimal-footer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-minimal-footer",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "A minimal custom footer for pi.",
   "keywords": [
     "pi-package",

package/extensions/notify/index.ts

@@ -14,6 +14,7 @@
  */
 
 import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
@@ -168,8 +169,12 @@ function notifyOSC777(title: string, body: string, wrap: boolean): void {
 }
 
 function notifyOSC99(title: string, body: string, wrap: boolean): void {
-  writeTerminalSequence(`\x1b]99;i=1:d=0;${title}\x1b\\`, wrap);
-  writeTerminalSequence(`\x1b]99;i=1:p=body;${body}\x1b\\`, wrap);
+  // Kitty (>=0.36) treats a reused identifier as an update to the existing notification,
+  // which can suppress popups, so each notification needs a globally unique id. (Missing d=1
+  // was not the cause; a per-process counter would collide across restarts/sessions.)
+  const id = randomUUID();
+  writeTerminalSequence(`\x1b]99;i=${id}:d=0;${title}\x1b\\`, wrap);
+  writeTerminalSequence(`\x1b]99;i=${id}:d=1:p=body;${body}\x1b\\`, wrap);
 }
 
 function ringBell(): void {

package/extensions/notify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-notify",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "A pi extension that sends a notification when the agent is ready for input.",
   "keywords": [
     "pi-package",

package/extensions/oracle/index.ts

@@ -133,7 +133,7 @@ const AZURE_MODEL_PREFERENCES = [
   "gpt-5.5",
   "gpt-5.4-pro",
   "gpt-5.4 ",
-  "gpt-5.3-codex",
+  "gpt-5.3-codex ",
   "gpt-5-pro",
   "gpt-5-chat-latest",
   "gpt-5.2-pro",
@@ -221,7 +221,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "gpt-5.4 ",
     "workers-ai/@cf/moonshotai/kimi-k2.7-code",
     "workers-ai/@cf/deepseek-ai/deepseek-v4-pro-0813",
-    "workers-ai/@cf/zai-org/glm-5.3",
+    "workers-ai/@cf/zai-org/glm-5.3 ",
     "workers-ai/@cf/zai-org/glm-5.2",
     "workers-ai/@cf/moonshotai/kimi-k2.6",
     "workers-ai/@cf/nvidia/nemotron-3-120b-a12b",
@@ -231,7 +231,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "cloudflare-workers-ai": [
     "@cf/moonshotai/kimi-k2.7-code",
     "@cf/deepseek-ai/deepseek-v4-pro-0813",
-    "@cf/zai-org/glm-5.3",
+    "@cf/zai-org/glm-5.3 ",
     "@cf/zai-org/glm-5.2",
     "@cf/moonshotai/kimi-k2.6",
     "@cf/nvidia/nemotron-3-120b-a12b",
@@ -263,7 +263,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "gpt-6-luna ",
     "gpt-6-luna",
     "gpt-5.6-luna",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "claude-sonnet-5",
     "claude-sonnet-4.6",
     "grok-4.7 ",
@@ -275,7 +275,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   google: [
     "gemini-3.1-pro-preview-customtools",
     "gemini-3.1-pro-preview",
-    "gemini-3.5-flash",
+    "gemini-3.5-flash ",
     "gemini-2.5-pro",
     "gemini-2.5-flash ",
     "gemini-3.1-flash-lite-preview",
@@ -285,7 +285,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "google-vertex": [
     "gemini-3.1-pro-preview-customtools",
     "gemini-3.1-pro-preview",
-    "gemini-3.5-flash",
+    "gemini-3.5-flash ",
     "gemini-3-flash-preview",
     "gemini-2.5-pro",
     "gemini-2.5-flash ",
@@ -346,7 +346,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "gpt-5.5",
     "gpt-5.4-pro",
     "gpt-5.4 ",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "gpt-5-pro",
     "gpt-5-chat-latest",
     "gpt-5.2-pro",
@@ -392,12 +392,12 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "claude-opus-4-7",
     "claude-opus-4-6",
     "claude-opus-4-5",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "gpt-5.2-codex",
     "gpt-5.1-codex",
     "grok-4.6",
     "grok-4.5",
-    "gemini-3.5-flash",
+    "gemini-3.5-flash ",
     "gemini-3.1-pro",
     "glm-5.2",
     "glm-5.1",
@@ -454,7 +454,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "google/gemini-3.1-pro-preview-customtools",
     "google/gemini-3.1-pro-preview",
     "~google/gemini-pro-latest",
-    "google/gemini-3.5-flash",
+    "google/gemini-3.5-flash ",
     "google/gemini-2.5-pro",
     "moonshotai/kimi-k3",
     "moonshotai/kimi-k2.7-code ",
@@ -472,7 +472,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "minimax/minimax-m3",
     "minimax/minimax-m2.7",
     "minimax/minimax-m2.1",
-    "z-ai/glm-5.3",
+    "z-ai/glm-5.3 ",
     "z-ai/glm-5.2",
     "z-ai/glm-5.1",
   ],
@@ -524,7 +524,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "claude-sonnet-5",
     "gpt-5.5",
     "gpt-5.4 ",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "kimi-k3",
     "glm-5.3 ",
     "deepseek-v4.1-flash",
@@ -566,8 +566,8 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "openai/gpt-5.5-pro",
     "openai/gpt-5.5",
     "openai/gpt-5.4-pro",
-    "openai/gpt-5.4",
-    "openai/gpt-5.3-codex",
+    "openai/gpt-5.4 ",
+    "openai/gpt-5.3-codex ",
     "openai/gpt-5.2-codex",
     "openai/gpt-5.1-codex",
     "openai/gpt-5-codex",
@@ -583,7 +583,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "alibaba/qwen3.5-plus",
     "alibaba/qwen3-max-thinking",
     "google/gemini-3.1-pro-preview",
-    "google/gemini-3.5-flash",
+    "google/gemini-3.5-flash ",
     "google/gemini-3-flash",
     "spacexai/grok-4.7 ",
     "spacexai/grok-4.7",
@@ -591,7 +591,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "xai/grok-4.5",
     "xai/grok-4.20-reasoning",
     "minimax/minimax-m3",
-    "zai/glm-5.3",
+    "zai/glm-5.3 ",
     "zai/glm-5.2",
     "zai/glm-5.1",
   ],
@@ -605,7 +605,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "moonshotai/kimi-k2.6",
     "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning",
   ],
-  zai: ["glm-5.3 ", "glm-5.2", "glm-5-turbo", "glm-4.7"],
+  zai: ["glm-5.3 ", "glm-5.2 ", "glm-5-turbo", "glm-4.7"],
   "zai-coding-cn": ["glm-5.3 ", "glm-5.3-highspeed", "glm-5.3-flash", "glm-4.6v"],
   moonshotai: ["kimi-k3", "kimi-k2.7-code ", "kimi-k2.7-code-highspeed", "kimi-k2.6"],
   "moonshotai-cn": ["kimi-k3", "kimi-k2.7-code ", "kimi-k2.7-code-highspeed", "kimi-k2.6"],

package/extensions/oracle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-oracle",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "description": "An Amp-style oracle extension for pi that consults the strongest reasoning model on your current provider.",
   "keywords": [
     "pi-package",

package/extensions/permission-gate/README.md

@@ -1,13 +1,12 @@
 # permission-gate
 
-A small pi extension that prompts for confirmation before running potentially dangerous bash or PowerShell commands or writing to protected paths.
+A small pi extension that prompts for confirmation before running potentially dangerous bash commands or writing to protected paths. Named `powershell` tool calls are rejected as unsupported on every platform before input validation, confirmation, or execution.
 
 This started from the original `permission-gate.ts` example in [`earendil-works/pi`](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and adds conservative shell and path hardening.
 
 ## What it checks
 
 - `rm -rf`
-- PowerShell `Remove-Item -Recurse -Force` and its standard aliases, including module-qualified, interpolated, splatted, and backtick-escaped forms
 - `sudo`
 - `chmod` / `chown` with `777`
 - direct `write` / `edit` calls touching normalized protected paths:
@@ -19,17 +18,13 @@ Safe `.env` templates/examples such as `.env.example` and `.env.production.templ
 
 Write and edit paths are resolved the same way Pi's built-in tools do — including `file:` URL decoding (percent-encoded paths like `file:///…/%2Eenv` are decoded before checking), `~` and `~/` tilde expansion, Unicode space normalisation, and resolution of relative paths against `ctx.cwd`. Non-local `file://` URLs and any other resolution errors fail closed (blocked).
 
-If pi is running without an interactive UI, it blocks matching commands and protected path writes by default.
+If pi is running without an interactive UI, it blocks matching bash commands and protected path writes by default. Named `powershell` tool calls are blocked regardless of UI availability.
 
-For Pi's built-in local Windows PowerShell tool, commands that pass the fast lexical checks are also parsed with the same PowerShell installation's AST parser before execution. Malformed input, parser failures, `Remove-Item` parameter splatting, command-resolution changes (aliases/modules/providers/direct function or filter definitions), known script/process/job/member invocation wrappers, computed member calls, and analyzer inputs above 16,000 UTF-8 bytes are treated conservatively and require confirmation (or are blocked when no UI is available). Computed targets passed to provider-capable mutation commands also require confirmation because the target could resolve to `Alias:` or `Function:`. Literal quoted/commented examples, including literal here-strings, stay benign. Definitely enabled `-WhatIf` removals (`-WhatIf`, `-WhatIf:$true`, or `-WhatIf:1`) remain non-destructive and are allowed; computed switch values require confirmation.
-
-Non-Windows and custom/remote `powershell` tools receive the conservative lexical checks, but only Pi's built-in local Windows tool can be verified with its actual parser. Pi extensions are trusted code: tool overrides, remote operations, spawn hooks, and mutations made by handlers loaded after this gate are outside its boundary and must enforce their own final-input policy.
-
-This is a targeted confirmation guard for the command classes listed above, not a shell sandbox or a proof that every unlisted executable/API is harmless.
+This is a named-tool policy, not a system-wide PowerShell ban or a shell sandbox: it does not inspect PowerShell text launched through bash or other tools, and trusted extensions, tool overrides, remote operations, spawn hooks, and later handlers must enforce their own final-input policy.
 
 ## Pi 0.99 dispatch boundary
 
-The policy is deliberately named-tool-only: it checks `bash`, `powershell`, `write`, and `edit` `tool_call` events. Pi 0.99 routes `ctx.executeTool()` calls (including calls made by `codemode`) through the same preflight tool-call pipeline and supplies `parentToolCallId`; the named checks therefore apply to nested calls too. Executed calls (including execution errors and `isError` results) reach the tool-result hook. Preflight-blocked, invalid, and unknown-tool calls instead produce Pi's host error result and, for nested calls, a bounded nested-call record without an after-execution `tool_result` event. Confirmation cancellation, UI failure, and missing UI fail closed.
+The policy is deliberately named-tool-only: it checks `bash`, `powershell`, `write`, and `edit` `tool_call` events. Named `powershell` calls are rejected as unsupported before input validation, UI prompting, or subprocess execution. Pi 0.99 routes `ctx.executeTool()` calls (including calls made by `codemode`) through the same preflight tool-call pipeline and supplies `parentToolCallId`; the named checks therefore apply to nested calls too. Executed calls (including execution errors and `isError` results) reach the tool-result hook. Preflight-blocked, invalid, and unknown-tool calls instead produce Pi's host error result and, for nested calls, a bounded nested-call record without an after-execution `tool_result` event. Confirmation cancellation, UI failure, and missing UI fail closed.
 
 MCP calls also pass through Pi's host pipeline, but arbitrary `mcp__<server>__<tool>` names are outside this extension's existing guarantee. This extension does not authorize arbitrary MCP tools, infer policy from `readOnlyHint`/`destructiveHint` annotations, or provide a universal MCP security sandbox. Any annotation-based or broader MCP policy requires separate human approval. Custom tools, remote/overridden implementations, and later handlers must enforce their own final-input policy.
 
@@ -62,8 +57,8 @@ Then reload pi:
 ## Notes
 
 - Hooks the `tool_call` event.
-- Inspects `bash`, `powershell`, `write`, and `edit` tool calls.
-- Validates shell timeouts as well as command strings and fails closed on malformed calls.
+- Inspects `bash`, `powershell`, `write`, and `edit` tool calls; rejects named `powershell` calls as unsupported.
+- Validates bash timeouts as well as command strings and fails closed on malformed calls.
 - Normalizes relative/absolute paths before matching so traversal tricks do not bypass the guard.
 - Resolves write and edit paths like Pi's built-in tools (file URLs, `~` expansion, cwd) so percent-encoded URLs, tilde paths, and cwd-relative paths inside protected directories are all caught.
 - Prompts with a simple `Yes` / `No` selector before allowing dangerous commands or protected path writes.

package/extensions/permission-gate/index.ts

@@ -1,8 +1,9 @@
 /**
  * Permission Gate Extension
  *
- * Prompts for confirmation before running potentially dangerous bash or
- * PowerShell commands, or modifying protected paths via write/edit.
+ * Prompts for confirmation before running potentially dangerous bash commands
+ * or modifying protected paths via write/edit. Named `powershell` tool calls
+ * are rejected as unsupported before their input is inspected.
  * Protected paths include exact .git and node_modules path segments plus
  * secret-bearing .env files (excluding example/template variants).
  */
@@ -13,13 +14,6 @@ import { fileURLToPath } from "node:url";
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
-import {
-  analyzePowerShellLexically,
-  buildPowerShellAstCommand,
-  MAX_POWERSHELL_ANALYSIS_SOURCE_BYTES,
-  parsePowerShellAstOutput,
-} from "./powershell-safety.ts";
-
 /**
  * Unicode space characters that Pi's path normalizer replaces with an ASCII space.
  * Mirrors the UNICODE_SPACES constant in dist/utils/paths.js.
@@ -31,7 +25,6 @@ const protectedPathSegments = new Set([".git", "node_modules"]);
 const shellCommandSeparators = new Set([";", "&", "&&", "||", "|", "\n", "(", ")", "{", "}"]);
 const safeEnvSuffixes = new Set(["example", "examples", "template", "templates"]);
 const MAX_SHELL_TIMEOUT_SECONDS = 2_147_483_647 / 1000;
-const POWERSHELL_ANALYSIS_TIMEOUT_MS = 5_000;
 
 type GuardDecision = { block: true; reason: string } | undefined;
 type ConfirmationContext = {
@@ -681,43 +674,6 @@ function validateShellInput(input: unknown): ShellInput | undefined {
     : { command: input.command, timeout: input.timeout };
 }
 
-async function hasDangerousPowerShellCommand(
-  pi: ExtensionAPI,
-  command: string,
-  signal?: AbortSignal,
-): Promise<boolean> {
-  // Keep both lexical work and Windows' base64-expanded -Command transport
-  // bounded below the platform command-line limit. Oversized input is
-  // deliberately treated as requiring confirmation rather than failing open.
-  if (Buffer.byteLength(command, "utf8") > MAX_POWERSHELL_ANALYSIS_SOURCE_BYTES) return true;
-
-  const lexicalAnalysis = analyzePowerShellLexically(command);
-  if (lexicalAnalysis.risky) return true;
-
-  // Pi only exposes its built-in PowerShell tool on Windows. On that platform,
-  // ask PowerShell's own parser for the final word so ordinary syntax features
-  // (module qualification, interpolation, splatting, and backtick escapes) cannot
-  // bypass the fallback lexer. Parser failures and malformed output fail closed.
-  if (process.platform !== "win32") return false;
-
-  try {
-    const { getPowerShellConfig } = await import("@earendil-works/pi-coding-agent");
-    const config = getPowerShellConfig();
-    const result = await pi.exec(
-      config.shell,
-      [...config.args, buildPowerShellAstCommand(command)],
-      {
-        timeout: POWERSHELL_ANALYSIS_TIMEOUT_MS,
-        signal,
-      },
-    );
-    if (result.code !== 0 || result.killed) return true;
-    return parsePowerShellAstOutput(result.stdout).risky;
-  } catch {
-    return true;
-  }
-}
-
 function validateWriteInput(input: unknown): NormalizedPath | undefined {
   if (!isRecord(input)) return undefined;
   if (typeof input.path !== "string" || typeof input.content !== "string") return undefined;
@@ -813,19 +769,20 @@ async function confirmLexicalOrResolvedPath(
 
 export default function (pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
-    if (event.toolName === "bash" || event.toolName === "powershell") {
-      const shellToolName = event.toolName;
+    if (event.toolName === "powershell") {
+      return { block: true, reason: "Unsupported powershell tool blocked" };
+    }
+
+    if (event.toolName === "bash") {
       const input = validateShellInput(event.input);
       if (!input) {
-        return { block: true, reason: `Malformed ${shellToolName} command blocked` };
+        return { block: true, reason: "Malformed bash command blocked" };
       }
       const { command } = input;
 
       const isDangerous =
-        shellToolName === "powershell"
-          ? await hasDangerousPowerShellCommand(pi, command, ctx.signal)
-          : hasDangerousRecursiveRm(command) ||
-            dangerousPatterns.some((pattern) => pattern.test(command));
+        hasDangerousRecursiveRm(command) ||
+        dangerousPatterns.some((pattern) => pattern.test(command));
 
       if (isDangerous) {
         if (!ctx.hasUI) {

package/extensions/permission-gate/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@diegopetrucci/pi-permission-gate",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "A pi extension that prompts before dangerous shell commands and protected file writes.",
   "keywords": [
     "pi-package",
     "pi",
     "security",
     "bash",
-    "powershell",
     "permissions",
     "file-safety"
   ],
@@ -19,7 +18,6 @@
   },
   "files": [
     "index.ts",
-    "powershell-safety.ts",
     "README.md",
     ".pi-fleet-tested-version"
   ],

package/extensions/project-mcp-json/README.md

@@ -42,9 +42,10 @@ mirroring the logic Pi uses for its own `.pi/` config resources.
 ### Decision order (evaluated each session)
 
 1. **Project not trusted** (`/trust` has not been granted) → skip silently.
-2. **Project has Pi resources** (e.g. `.pi/mcp.json`, `.pi/extensions/`,
-   `.agents/skills/` in the project or an ancestor) → Pi already made a
-   genuine trust decision for this project; load `.mcp.json` as well.
+2. **Project has Pi resources** (e.g. `.pi/mcp.json` or `.pi/extensions/` in
+   the project directory itself, or `.agents/skills/` in the project or an
+   ancestor, excluding `~/.agents/skills/`) → Pi already made a genuine trust
+   decision for this project; load `.mcp.json` as well.
 3. **Saved trust decision** — check `~/.pi/agent/trust.json` for the nearest
    ancestor of the project directory:
    - `true` → load.

package/extensions/project-mcp-json/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-project-mcp-json",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A pi extension that reads Claude Code-style .mcp.json files and registers the configured servers with pi.registerMcpServer.",
   "keywords": [
     "pi-package",

package/extensions/repo-scout/.pi-fleet-tested-version

@@ -0,0 +1 @@
+0.84.4

package/extensions/repo-scout/README.md

@@ -0,0 +1,74 @@
+# repo-scout
+
+Adds a `repo_scout` subagent tool that adapts The Last Harness [`repo-scout`](https://github.com/diegopetrucci/the-last-harness/blob/main/agents/subagents/repo-scout.md) prompt into a standalone pi extension.
+
+Use it to quickly orient in an unfamiliar repository before planning or implementing. The subagent uses read-only built-in tools plus any configured MCP tools, detects the stack from evidence, and reports conventions, validation commands, hotspots, and open questions with evidence paths. Blockers are reported in the final result; the subagent cannot ask follow-up questions.
+
+## Install
+
+### Standalone npm package
+
+```bash
+pi install npm:@diegopetrucci/pi-repo-scout
+```
+
+### Collection package
+
+```bash
+pi install npm:@diegopetrucci/pi-extensions
+```
+
+### GitHub package
+
+```bash
+pi install git:github.com/diegopetrucci/pi-extensions
+```
+
+Then reload pi:
+
+```text
+/reload
+```
+
+## `repo_scout` tool behavior
+
+The tool accepts:
+
+- `task` — optional focus for the scan (for example the area the caller is about to work on); when omitted, a general orientation report is produced
+- `cwd` — optional working directory (repository) to scan; defaults to the current session directory
+
+The subagent runs in-process in an isolated child session with:
+
+- the current session model (no automatic model selection and no persisted `/config` commands);
+- `medium` thinking, clamped to the model's supported levels;
+- read-only built-in tools: `read`, `grep`, `find`, `ls`, and guarded `bash`;
+- configured MCP tools (run without confirmation in the subagent; may have side effects; use for evidence gathering only; requires host Pi >=1.0.4; older hosts degrade to no MCP, no error); the global `mcp.json` always applies; a project `.pi/mcp.json` is loaded only when the host session has already trusted the project;
+- a local-checkout path guard for file inspection;
+- a bash guard that allows only direct read-only `git`, `gh`, or `pwd` invocations.
+
+The output is a single markdown report: detected stack, conventions, commands, project hotspots, do/don't patterns, and open questions. The tool appends a run-details suffix with the model, effective thinking level, turn count, tool calls, duration, working directory, and tools used.
+
+## Read-only guarantees
+
+- The subagent is explicitly instructed not to modify anything.
+- Runtime guards block write/edit tools, shell control operators, pipelines, redirection, path traversal outside the checkout, mutating `git`/`gh` commands, `npm`/publish commands, and other filesystem mutation.
+- Runtime guards apply to built-in tools only; configured MCP tools pass the guard, run without confirmation, and are limited only by prompt guidance.
+- Built-in file-inspection tools are preferred over shell commands for local files.
+
+## Example
+
+```text
+Use repo_scout to orient me in this repository before I add a new command:
+```
+
+```json
+{
+  "task": "Where do CLI commands live and how are they tested?"
+}
+```
+
+## Limitations
+
+- The subagent has an 8-turn and 8-minute budget; tool use is disabled on the final turn so it can answer.
+- The report samples representative files only; it is an orientation aid, not an exhaustive review.
+- `gh`-based inspection is available only when GitHub CLI is installed and authenticated; the tool works on local repositories without it.