@groeponline/pi-wishcraft 1.23.0 → 1.24.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [1.24.0] - 2026-11-12
+
+### Fixed
+- **Git probes no longer race interactive git.** Every read-only `git` spawn (`src/git/status.ts`, `bash-mode/completion.ts`) now runs with `GIT_OPTIONAL_LOCKS=0` and `windowsHide: true`, so status polling can't refresh `.git/index` under a real checkout and orphaned `index.lock` files stop bricking the repo.
+- **Think levels high/xhigh/max got their rainbow back.** The thinking segment collapsed all three into the plain `thinking` color; it now uses dedicated `thinkingHigh`/`thinkingXhigh`/`thinkingMax` semantic colors (default `rainbow`, overridable per preset — the `rainbow` ColorValue itself is new).
+- **Token totals prefer the provider-reported `totalTokens`.** The four-field sum undercounted providers that report reasoning/other tokens only in the total.
+
+
 ## [1.23.0] - 2026-11-08
 
 ### Fixed

package/RELEASE.md

@@ -113,11 +113,34 @@ Measured from this repository on 2026-11-08:
 | `npm whoami` with `secrets.NPM_TOKEN` | `chefgroeponline` — valid |
 | `ACTIONS_ID_TOKEN_REQUEST_URL` in a job with `id-token: write` | present |
 | `POST /-/npm/v1/oidc/token/exchange/package/@groeponline%2fpi-wishcraft` | **401** |
-
-Two consequences: publishes carry no provenance attestation, and the token has
-to be replaced by hand when it expires. Switching to trusted publishing is a
-one-time npmjs.com change, after which the `NODE_AUTH_TOKEN` env comes out of
-the job:
+| `npm publish` with that token (v1.23.0, run 42464125440) | **EOTP** — one-time password required |
+
+**The token authenticates but cannot write.** It is a *Publish* token on an
+account with 2FA enabled, so npm demands an OTP for `npm publish` and a CI
+runner can never answer one.
+
+**Resolved 2026-11-09 03:58 UTC.** The org `NPM_TOKEN` secret was replaced with a
+granular token that has *Bypass 2FA*; run 42559311821 (dispatch on `v1.23.0`)
+then published `1.23.0` and created its GitHub Release. No workflow change was
+needed — `NODE_AUTH_TOKEN` still publishes. `v1.18.0`–`v1.22.0` stay unpublished:
+their tag refs carry unpinned `uses: actions/...@v7` and the org policy rejects
+them, so they cannot be replayed without rewriting tags. `1.23.0` supersedes them.
+
+The two routes that were available, for the record:
+
+- **Token route (unblocks v1.23.0 as tagged):** Access Tokens → Generate New
+  Token → **Granular**, read+write on `@groeponline` (or a classic
+  **Automation** token), with **Bypass 2FA** enabled; store it as the org
+  `NPM_TOKEN` secret. Then replay the tag:
+  `gh workflow run release.yml --ref v1.23.0` — that same job also creates the
+  missing GitHub Release.
+- **OIDC route (no credential at all):** configure the trusted publisher below
+  and drop the `NODE_AUTH_TOKEN` env from the `publish` job. A tag cut *before*
+  that change still carries the token env and cannot be replayed, so this route
+  publishes the next version and leaves the hole.
+
+Switching to trusted publishing is a one-time npmjs.com change, after which the
+`NODE_AUTH_TOKEN` env comes out of the job:
 
 1. Sign in as the maintainer of `@groeponline/pi-wishcraft` (`chefgroeponline
    <joep@chefgroep.online>` — `npm view @groeponline/pi-wishcraft maintainers`).
@@ -149,9 +172,15 @@ Rules that follow from the current (token) configuration:
 
 For a scoped package npm answers a PUT with **404, not 403**, when the caller
 may not publish. That means the credential is missing, revoked, read-only or
-(`EOTP`) 2FA-blocked, or does not own the scope. It is not "package not found",
-and it is not a retryable transient. `ENEEDAUTH` instead means npm had no
-credential at all: `NODE_AUTH_TOKEN` was empty and the OIDC exchange refused.
+does not own the scope. It is not "package not found", and it is not a
+retryable transient. Two neighbours are distinct and have their own fix:
+
+- `ENEEDAUTH` — npm had no credential at all: `NODE_AUTH_TOKEN` was empty and
+  the OIDC exchange refused.
+- `EOTP` — the credential authenticates but the account requires a one-time
+  password for writes, which CI cannot supply. This is what v1.23.0 hit. The
+  token needs 2FA bypass (granular token with *Bypass 2FA*, or a classic
+  Automation token); retrying with the same token only burns another run.
 
 `scripts/npm-publish.sh` prints that diagnosis instead of the raw 404. Recovery:
 

package/bash-mode/completion.ts

@@ -246,6 +246,8 @@ function runGit(args: string[], cwd: string): string[] {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
+      env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      windowsHide: true,
     });
     if (result.status !== 0 || !result.stdout) return [];
     return result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);

package/build-stamp.json

@@ -1 +1 @@
-{"source_sha":"a12a4900dbbf32823e1c2c6261c850eb21834d38"}
+{"source_sha":"1e85fa41738909a1dd3d098ad8ef0986ae76a298"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groeponline/pi-wishcraft",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "description": "Pi coding agent extension: operator cockpit with a live powerline status bar, idea queue, skill search, sticky Bash, hooks, policy guardrails, and TUI session UX.",
   "type": "module",
   "packageManager": "bun@1.4.2",

package/src/config/tokens.ts

@@ -29,11 +29,20 @@ export type { TokenRole, WishcraftTokens };
 /**
  * Which token each legacy semantic color reads from.
  *
- * `thinking*` is deliberately absent: those four are Pi's own thinking-level
+ * `thinking*` is deliberately absent: those seven are Pi's own thinking-level
  * colors, not part of the Wishcraft palette, so they pass through untouched.
  */
 export const SEMANTIC_TOKEN_ROLE: Record<
-  Exclude<SemanticColor, "thinking" | "thinkingMinimal" | "thinkingLow" | "thinkingMedium">,
+  Exclude<
+    SemanticColor,
+    | "thinking"
+    | "thinkingMinimal"
+    | "thinkingLow"
+    | "thinkingMedium"
+    | "thinkingHigh"
+    | "thinkingXhigh"
+    | "thinkingMax"
+  >,
   TokenRole
 > = {
   model: "primary",
@@ -54,12 +63,21 @@ export const SEMANTIC_TOKEN_ROLE: Record<
 /** Pi thinking-level colors, passed through rather than tokenised. */
 export const THINKING_COLORS: Pick<
   Required<ColorScheme>,
-  "thinking" | "thinkingMinimal" | "thinkingLow" | "thinkingMedium"
+  | "thinking"
+  | "thinkingMinimal"
+  | "thinkingLow"
+  | "thinkingMedium"
+  | "thinkingHigh"
+  | "thinkingXhigh"
+  | "thinkingMax"
 > = {
   thinking: "thinkingOff",
   thinkingMinimal: "thinkingMinimal",
   thinkingLow: "thinkingLow",
   thinkingMedium: "thinkingMedium",
+  thinkingHigh: "rainbow",
+  thinkingXhigh: "rainbow",
+  thinkingMax: "rainbow",
 };
 
 /**

package/src/config/types.ts

@@ -3,7 +3,7 @@ import type { MotionEvent } from "../motion/types.ts";
 import type { CostCurrencyCode } from "../usage/rates.ts";
 
 // Theme color - either a pi theme color name or a custom hex color
-export type ColorValue = ThemeColor | `#${string}`;
+export type ColorValue = ThemeColor | `#${string}` | "rainbow";
 export type ThemeLike = Pick<Theme, "fg">;
 
 // Semantic color names for segments
@@ -17,6 +17,9 @@ export type SemanticColor =
   | "thinkingMinimal"
   | "thinkingLow"
   | "thinkingMedium"
+  | "thinkingHigh"
+  | "thinkingXhigh"
+  | "thinkingMax"
   | "context"
   | "contextWarn"
   | "contextError"

package/src/extension/ui/deck/component.ts

@@ -370,6 +370,16 @@ export function createDeckComponent(
       if (state.route === "ideas") {
         const ideas = filteredIdeas(liveSnapshot(), state);
         if (!state.navMode && handleList(data, "selectedIdea", ideas.length)) return;
+        // Nav ↑↓ must reach the route-column handlers below, like every other
+        // list route; the body below used to swallow them (trailing return),
+        // stranding the cursor on Ideas forever.
+        if (matchesKey(data, "up") || matchesKey(data, "down")) {
+          if (state.navMode || ideas.length === 0) {
+            // fall through to the nav handlers at the bottom
+          } else {
+            return;
+          }
+        } else {
         const cursor = Math.min(state.selectedIdea, Math.max(0, ideas.length - 1));
         const idea = ideas[cursor];
         if (!idea?.id) return;
@@ -404,6 +414,7 @@ export function createDeckComponent(
           return;
         }
         return;
+        }
       }
 
       if (state.route === "ports") {

package/src/git/status.ts

@@ -94,6 +94,10 @@ function runGit(args: string[], timeoutMs = 200): Promise<string | null> {
   return new Promise((resolve) => {
     const proc = spawn("git", args, {
       stdio: ["ignore", "pipe", "pipe"],
+      // Read-only probes must not refresh .git/index — a stray index.lock
+      // there races interactive git and bricks the repo (upstream #156/#180).
+      env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      windowsHide: true,
     });
 
     let stdout = "";

package/src/segments/system.ts

@@ -32,7 +32,13 @@ export const thinkingSegment: StatusLineSegment = {
     const content = `think:${label}`;
 
     if (level === "high" || level === "xhigh" || level === "max") {
-      return { content: color(ctx, "thinking", content), visible: true };
+      const highKey =
+        level === "high"
+          ? "thinkingHigh"
+          : level === "xhigh"
+            ? "thinkingXhigh"
+            : "thinkingMax";
+      return { content: color(ctx, highKey, content), visible: true };
     }
 
     if (level === "minimal") {

package/src/theme/theme.ts

@@ -25,6 +25,9 @@ const DEFAULT_COLORS: Required<ColorScheme> = {
   thinkingMinimal: "thinkingMinimal",
   thinkingLow: "thinkingLow",
   thinkingMedium: "thinkingMedium",
+  thinkingHigh: "rainbow",
+  thinkingXhigh: "rainbow",
+  thinkingMax: "rainbow",
   context: "dim",
   contextWarn: "warning",
   contextError: "error",
@@ -189,6 +192,9 @@ export function applyColor(
   color: ColorValue,
   text: string,
 ): string {
+  if (color === "rainbow") {
+    return rainbow(text);
+  }
   if (typeof color === "string" && /^#[0-9a-fA-F]{6}$/.test(color)) {
     return `${hexToRgbAnsi(color)}${text}\x1b[0m`;
   }

package/src/usage/ledger.ts

@@ -36,6 +36,11 @@ export function isSessionAssistantMessage(value: unknown): value is AssistantMes
 }
 
 export function getUsageTokenTotal(usage: SessionAssistantUsage): number {
+  // Prefer the provider-reported total: it can cover token kinds the four
+  // fields miss (e.g. reasoning on providers that don't itemize).
+  if (typeof usage.totalTokens === "number" && usage.totalTokens > 0) {
+    return usage.totalTokens;
+  }
   return usage.input + usage.output + usage.cacheRead + usage.cacheWrite;
 }