@herbertgao/pi-extensions 2026.9.13 → 2026.9.15

package/README.md

@@ -28,9 +28,9 @@ The package bundles 6 active `@herbertgao/*` child packages—`pi-bark`, `pi-cc-
 - `@tifan/pi-rename@0.6.0`
 - `pi-mcp-adapter@2.31.0`
 - `pi-typesafe@0.7.1`
-- `pi-multi-account@1.23.0`
+- `pi-multi-account@1.23.2`
 - `pi-footer@0.5.1`
-- `pi-jev-auto-mode@0.4.1`
+- `pi-jev-auto-mode@0.5.0`
 - `pi-lens@4.2.1`
 - `pi-web-access@0.27.0`
 - `remote-pi@0.7.0`
@@ -43,7 +43,7 @@ Pi loads their extensions and skills through `node_modules/` paths inside one pa
 
 `@narumitw/pi-caffeinate@0.49.7` uses the host platform's sleep inhibitor during each Pi agent run. On macOS, `/caffeinate sleep` keeps the system awake while allowing the display to sleep; `/caffeinate display` also keeps the display awake. It releases the inhibitor when the run or session ends.
 
-`pi-jev-auto-mode@0.4.1` adds fail-closed Jev safety gates for shell commands and file changes. `pi-typesafe@0.7.1` adds the `/typesafe` command and `typesafe_evaluate` tool for explicit structured decisions; both use the TypeSafe API after login.
+`pi-jev-auto-mode@0.5.0` adds fail-closed Jev safety gates for shell commands and file changes. `pi-typesafe@0.7.1` adds the `/typesafe` command and `typesafe_evaluate` tool for explicit structured decisions; both use the TypeSafe API after login.
 
 `@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `@herbertgao/sol-pi@0.1.0` adds opt-in Action Fusion, ObservationPack, Evidence-Preserving Reducer, and Online Context Compact; see its [configuration guide](../sol-pi/docs/configuration.md). `pi-lens@4.2.1` expands language routing and bounds retained diagnostic facts across multi-root sessions. `pi-web-access@0.27.0` adds configurable fetch deadlines and answer models plus isolated GitHub clone runtimes. Preferred Thinking 1.0.1 preserves an explicit subagent `--thinking` choice. Deprecated `@tifan/pi-titlebar-spinner` is no longer bundled; Rename remains the single owner of Herdr tab naming.
 

package/THIRD_PARTY_NOTICES.md

@@ -137,7 +137,7 @@ THE SOFTWARE.
 
 ## `pi-jev-auto-mode`
 
-The aggregate bundles [`pi-jev-auto-mode`](https://github.com/jomatsu/pi-jev-auto-mode) version 0.4.1 under its original MIT license:
+The aggregate bundles [`pi-jev-auto-mode`](https://github.com/jomatsu/pi-jev-auto-mode) version 0.5.0 under its original MIT license:
 
 MIT License
 
@@ -163,7 +163,7 @@ THE SOFTWARE.
 
 ## `pi-multi-account`
 
-The aggregate bundles the MIT-licensed [`pi-multi-account`](https://github.com/Sarrius/pi-multi-account) package version 1.23.0 under its original attribution:
+The aggregate bundles the MIT-licensed [`pi-multi-account`](https://github.com/Sarrius/pi-multi-account) package version 1.23.2 under its original attribution:
 
 MIT License
 

package/node_modules/@herbertgao/pi-bark/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-bark",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Send Bark notifications when Pi finishes or needs user input.",
   "keywords": [
     "bark",
@@ -39,7 +39,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.84.0 || ^0.85.0"
+    "@earendil-works/pi-coding-agent": "^0.87.1"
   },
   "engines": {
     "node": ">=24"

package/node_modules/@herbertgao/pi-cc-extensions/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@herbertgao/pi-cc-extensions",
-	"version": "0.9.4",
+	"version": "0.9.5",
 	"license": "MIT",
 	"description": "A Pi productivity suite with Claude Code-style UI, context inspection, and agent/session references",
 	"type": "module",
@@ -51,9 +51,9 @@
 		"jiti": "^2.7.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": "^0.84.0 || ^0.85.0",
-		"@earendil-works/pi-coding-agent": "^0.84.0 || ^0.85.0",
-		"@earendil-works/pi-tui": "^0.84.0 || ^0.85.0"
+		"@earendil-works/pi-ai": "^0.87.1",
+		"@earendil-works/pi-coding-agent": "^0.87.1",
+		"@earendil-works/pi-tui": "^0.87.1"
 	},
 	"engines": {
 		"node": ">=24"

package/node_modules/@herbertgao/pi-subagents/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.18.3
+
+### Patch Changes
+
+- [#232](https://github.com/HerbertGao/pi-extensions/pull/232) [`9c3c40f`](https://github.com/HerbertGao/pi-extensions/commit/9c3c40f113c62437f76d300042fc59fbf15954c0) Thanks [@HerbertGao](https://github.com/HerbertGao)! - Require the unified Pi 0.87.1 dependency line across published packages.
+
 ## 0.18.2
 
 ### Patch Changes

package/node_modules/@herbertgao/pi-subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-subagents",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Claude Code-style autonomous subagents and workflow orchestration for Pi, with HerbertGao-maintained UI extensions.",
   "keywords": [
     "agent",
@@ -54,9 +54,9 @@
     "@vitest/coverage-istanbul": "^4.1.10"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.84.0",
-    "@earendil-works/pi-coding-agent": ">=0.84.0",
-    "@earendil-works/pi-tui": ">=0.84.0"
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1"
   },
   "engines": {
     "node": ">=24"

package/node_modules/@herbertgao/resume-from/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/resume-from",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Continue a coding session in a different agent, or a different profile.",
   "keywords": [
     "pi-package",
@@ -63,7 +63,7 @@
     "vitest": "^4.1.10"
   },
   "dependencies": {
-    "@earendil-works/pi-tui": "^0.84.1 || ^0.85.0",
+    "@earendil-works/pi-tui": "^0.87.1",
     "gpt-tokenizer": "^3.4.0"
   },
   "pi": {

package/node_modules/@herbertgao/sol-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/sol-pi",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Token-efficient context and tool extensions for Pi, maintained from NVlabs/SoL-Pi.",
   "keywords": [
     "pi-package",
@@ -47,10 +47,10 @@
     "check": "npm run typecheck && npm test && npm pack --dry-run"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.84.2",
-    "@earendil-works/pi-ai": ">=0.84.2",
-    "@earendil-works/pi-coding-agent": ">=0.84.2",
-    "@earendil-works/pi-tui": ">=0.84.2",
+    "@earendil-works/pi-agent-core": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1",
     "typebox": ">=1.3.7"
   },
   "devDependencies": {

package/node_modules/@herbertgao/sol-pi/src/sol-pi/extensions/online-context-compact/extension.ts

@@ -450,6 +450,8 @@ export function createOnlineContextCompactExtension(options: OnlineContextCompac
 						continuation.resolve();
 						throw error;
 					}
+					// triggerTurn starts on the next event-loop turn; checking immediately is racy.
+					await new Promise<void>((resolve) => setTimeout(resolve, 0));
 					if (context.isIdle() && nextContinuation === continuation) {
 						nextContinuation = undefined;
 						continuation.resolve();

package/node_modules/pi-jev-auto-mode/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.5.0 - 2026-09-24
+
+- **Decision records are compact by default.** An approval is drawn as one line — status, tool,
+  latency, and the command — and a block as two, keeping the rationale. Each record used to take
+  five padded blocks, so a long session was mostly gate records. `/jev-auto-mode display full`
+  (or `"display": "full"`) restores the previous view, and the expanded view shows every detail
+  in either mode.
+
 ## 0.4.1 - 2026-09-18
 
 - **An unclear answer passes by default.** `uncertain` defaulted to `deny`, which meant a

package/node_modules/pi-jev-auto-mode/README.md

@@ -113,8 +113,14 @@ Packages are discovered in the [package gallery](https://pi.dev/packages) throug
 /jev-auto-mode uncertain                show what the middle band resolves to
 /jev-auto-mode uncertain deny|ask|allow
 /jev-auto-mode scope all|matched        how far the semantic layer reaches
+/jev-auto-mode display full|compact     how decision records are drawn
 ```
 
+Each decision leaves a record in the transcript. `display: "compact"` (the default) folds an
+approval into one line and a block into two (the rationale stays, because a block is something
+to act on). `display: "full"` shows the heading, the engine line, the command, the reasons, and
+the rationale. The expanded view shows every detail in either mode.
+
 ```
 pi --jev-auto-mode        start with auto mode enabled
 ```
@@ -195,6 +201,7 @@ Policy notes: `$PI_CODING_AGENT_DIR/jev-auto-mode-policy.md`.
   "maxStateCharacters": 120000,
   "uncertain": "deny",
   "gateScope": "all",
+  "display": "compact",
   "thresholds": {}
 }
 ```

package/node_modules/pi-jev-auto-mode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jev-auto-mode",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Jev (TypeSafe System One) backed auto mode for the Pi coding agent: semantically auto-approves bash, write, and edit tool calls and fails closed when a decision cannot be made.",
   "keywords": [
     "pi-package",

package/node_modules/pi-jev-auto-mode/src/extension.ts

@@ -55,6 +55,7 @@ import {
 import {
   DEFAULT_SETTINGS,
   JevAutoModeStore,
+  isDisplayMode,
   isGateScope,
   isUncertainAction,
   parseThreshold,
@@ -64,6 +65,7 @@ import {
 import {
   buildConfirmationDialog,
   describeSettings,
+  DISPLAY_EXPLANATION,
   GATE_SCOPE_EXPLANATION,
   UNCERTAIN_EXPLANATION,
   formatRuleTable,
@@ -571,7 +573,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
     default: false,
   });
 
-  registerDecisionEntryRenderer(pi);
+  registerDecisionEntryRenderer(pi, () => state.settings.display);
 
   pi.registerCommand(AUTO_MODE_COMMAND, {
     description: "Show or change the Jev auto mode settings",
@@ -579,7 +581,7 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
       const value = String(argumentPrefix ?? "");
       const tokens = value.split(/\s+/).filter(Boolean);
       if (tokens.length === 0) {
-        return ["status", "on", "off", "policy", "threshold", "scope", "uncertain", "login", "logout"].map((item) => ({
+        return ["status", "on", "off", "policy", "threshold", "scope", "uncertain", "display", "login", "logout"].map((item) => ({
           value: item,
           label: item,
         }));
@@ -756,6 +758,23 @@ export function register(pi: ExtensionAPI, options: RegisterOptions = {}): void
         return;
       }
 
+      if (value.startsWith("display")) {
+        const argument = value.slice("display".length).trim();
+        if (argument === "") {
+          ctx.ui.notify(`display: ${state.settings.display}\n\n${DISPLAY_EXPLANATION}`, "info");
+          return;
+        }
+        if (!isDisplayMode(argument)) {
+          ctx.ui.notify(`Expected one of full, compact.\n\n${DISPLAY_EXPLANATION}`, "error");
+          return;
+        }
+
+        state.settings = { ...state.settings, display: argument };
+        await save(gateContext);
+        ctx.ui.notify(`decision records now display as: ${argument}`, "info");
+        return;
+      }
+
       if (value.startsWith("uncertain")) {
         const argument = value.slice("uncertain".length).trim();
         if (argument === "") {

package/node_modules/pi-jev-auto-mode/src/records.ts

@@ -6,10 +6,11 @@
  * recorded rationale should not become ammunition for the next tool call.
  */
 
-import { Box, Text } from "@earendil-works/pi-tui";
+import { Box, Text, truncateToWidth, type Component } from "@earendil-works/pi-tui";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { ConditionReport, DecisionSource } from "./decide.ts";
 import { formatThreshold } from "./jev/decide.ts";
+import type { DisplayMode } from "./settings.ts";
 
 export const DECISION_ENTRY_TYPE = "jev-auto-mode-decision";
 
@@ -85,12 +86,77 @@ export function formatConditionLines(record: DecisionRecord): string[] {
   });
 }
 
-export function registerDecisionEntryRenderer(pi: Pick<ExtensionAPI, "registerEntryRenderer">): void {
+/** Collapse whitespace so a multi-line command reads as one line. */
+function oneLine(text: string): string {
+  return text.replace(/\s+/g, " ").trim();
+}
+
+export interface CompactDecisionLines {
+  /** `🛡 jev allowed · bash · 299ms · <command>`: everything an approval needs. */
+  readonly headline: string;
+  /**
+   * The rationale, only for a call that did not run. An approval does not need its
+   * reasoning on screen; a block does, because the user has to act on it.
+   */
+  readonly detail?: string;
+}
+
+/**
+ * The compact view: one line for an approval, two for a block.
+ *
+ * Width is applied at render time. This only decides what the lines say.
+ */
+export function formatCompactLines(record: DecisionRecord): CompactDecisionLines {
+  const approved = record.status === "allowed" || record.status === "confirmed";
+  const parts = [`${approved ? "🛡" : "⛔"} jev ${STATUS_LABEL[record.status]}`, record.tool];
+  if (!approved) parts.push(`via ${record.source}`);
+  if (typeof record.latencyMs === "number") parts.push(`${Math.round(record.latencyMs)}ms`);
+  const summary = oneLine(record.summary);
+  if (summary.length > 0) parts.push(summary);
+  const headline = parts.join(" · ");
+  if (approved) return { headline };
+  return { headline, detail: oneLine(record.rationale) };
+}
+
+/** A single line clipped to the viewport instead of wrapped. */
+class ClippedLine implements Component {
+  private readonly text: string;
+
+  constructor(text: string) {
+    this.text = text;
+  }
+
+  render(width: number): string[] {
+    return [truncateToWidth(this.text, Math.max(1, width))];
+  }
+
+  invalidate(): void {}
+}
+
+export type DisplayModeSource = () => DisplayMode;
+
+export function registerDecisionEntryRenderer(
+  pi: Pick<ExtensionAPI, "registerEntryRenderer">,
+  displayMode: DisplayModeSource = () => "compact",
+): void {
   pi.registerEntryRenderer<DecisionRecord>(DECISION_ENTRY_TYPE, (entry, options, theme) => {
     const record = entry.data;
     if (!record) return undefined;
 
     const approved = record.status === "allowed" || record.status === "confirmed";
+
+    // The expanded view is the place to read a decision in full, so it ignores the
+    // compact setting.
+    if (displayMode() === "compact" && !options.expanded) {
+      const lines = formatCompactLines(record);
+      const box = new Box(1, 0, (text) => theme.bg("customMessageBg", text));
+      box.addChild(new ClippedLine(theme.fg(approved ? "muted" : "error", lines.headline)));
+      if (lines.detail !== undefined) {
+        box.addChild(new ClippedLine(theme.fg("dim", `rationale: ${lines.detail}`)));
+      }
+      return box;
+    }
+
     const icon = approved ? "🛡" : "⛔";
     const heading = `${icon} ${theme.bold("jev auto mode")} ${theme.fg(
       approved ? "success" : "error",

package/node_modules/pi-jev-auto-mode/src/settings.ts

@@ -45,6 +45,23 @@ export interface JevAutoModeSettings {
    * visible in `/jev-auto-mode threshold` instead of silently resetting the rule.
    */
   readonly thresholds: Readonly<Record<string, number>>;
+  /**
+   * How decision records are drawn in the transcript.
+   *
+   * `compact` (the default) folds an approval into one line and a block into two, so
+   * a long session is not dominated by gate records. `full` shows the heading, the
+   * engine line, the command, the reasons, and the rationale. The expanded view (the tool
+   * expansion key) always shows every detail, whichever mode is set.
+   */
+  readonly display: DisplayMode;
+}
+
+export type DisplayMode = "full" | "compact";
+
+export const DISPLAY_MODES: readonly DisplayMode[] = ["full", "compact"];
+
+export function isDisplayMode(value: unknown): value is DisplayMode {
+  return typeof value === "string" && DISPLAY_MODES.includes(value as DisplayMode);
 }
 
 export type SettingsScope = "global" | "project";
@@ -90,6 +107,7 @@ export const DEFAULT_SETTINGS: JevAutoModeSettings = {
   uncertain: "allow",
   gateScope: "all",
   thresholds: {},
+  display: "compact",
 };
 
 const MAX_PATTERN_ENTRIES = 200;
@@ -193,6 +211,10 @@ export function parseSettingsPatch(value: unknown): SettingsPatch {
     patch.gateScope = record.gateScope;
   }
 
+  if (record.display !== undefined && isDisplayMode(record.display)) {
+    patch.display = record.display;
+  }
+
   const safeCommands = record.safeCommands === undefined ? undefined : readStringArray(record.safeCommands);
   if (safeCommands !== undefined) patch.safeCommands = safeCommands;
 

package/node_modules/pi-jev-auto-mode/src/ui.ts

@@ -44,6 +44,7 @@ export function describeSettings(settings: JevAutoModeSettings, scope: SettingsS
     `max state characters: ${settings.maxStateCharacters}`,
     `uncertain band: ${settings.uncertain}`,
     `gate scope: ${settings.gateScope}`,
+    `display: ${settings.display}`,
   ].join("\n");
 }
 
@@ -149,6 +150,15 @@ export const USAGE_TEXT = [
   "  /jev-auto-mode uncertain            show what the middle band resolves to",
   "  /jev-auto-mode uncertain deny|ask|allow",
   "  /jev-auto-mode scope all|matched    which calls reach Jev",
+  "  /jev-auto-mode display full|compact how decision records are drawn",
+].join("\n");
+
+export const DISPLAY_EXPLANATION = [
+  "How decision records are drawn in the transcript.",
+  "  compact - one line for an approval, two for a block (with the rationale) (default).",
+  "  full    - heading, engine line, command, reasons, and rationale.",
+  "The expanded view always shows every detail. New records use the mode at once;",
+  "records already on screen switch when Pi redraws them (e.g. toggling expansion).",
 ].join("\n");
 
 export const GATE_SCOPE_EXPLANATION = [

package/node_modules/pi-mcp-adapter/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.37.0] - 2026-09-23
+
+### Highlights
+
+- Use Jev semantic search with other System One providers, such as OpenCode Zen, Command Code, or OpenRouter, by setting `SYSTEMONE_ENDPOINT`.
+- Stop agents from installing new MCP servers with `settings.allowInstall: false`.
+- Turn off resource tools for every server with one `settings.exposeResources: false` setting.
+- Start Pi without waiting on MCP servers even when cached tool metadata is missing, with `settings.deferWithMissingMetadata`.
+
+### Added
+
+- Jev can send System One requests to any HTTPS provider endpoint set in `SYSTEMONE_ENDPOINT`. TypeSafe stays the default. API keys are stored per endpoint, and an invalid endpoint turns Jev off instead of quietly falling back to TypeSafe. Thanks to [@jagaliano](https://github.com/jagaliano) for [PR #645](https://github.com/nicobailon/pi-mcp-adapter/pull/645).
+- `settings.deferWithMissingMetadata: true` lets Pi start without connecting to MCP servers even when their cached metadata is missing or out of date. Those servers show no tools until the first MCP call loads them. Thanks to [@j62268781-alt](https://github.com/j62268781-alt) for [#641](https://github.com/nicobailon/pi-mcp-adapter/issues/641).
+- `settings.allowInstall: false` blocks agents from installing remote MCP servers with `mcp({ action: "install" })`, for headless or locked-down setups. Thanks to [@gastmaier](https://github.com/gastmaier) for [#638](https://github.com/nicobailon/pi-mcp-adapter/issues/638).
+- `settings.exposeResources: false` hides resource tools for every server. A server's own `exposeResources` setting still wins. Thanks to [@rakesh-vs](https://github.com/rakesh-vs) for [PR #636](https://github.com/nicobailon/pi-mcp-adapter/pull/636).
+
+### Changed
+
+- The Jev key command is now `pi-mcp-adapter key set systemone`, and the environment variable is `SYSTEMONE_API_KEY`. The old `key set typesafe` command still works, and `TYPESAFE_API_KEY` still works with the default TypeSafe endpoint.
+- Supports Pi 0.87.
+
+### Fixed
+
+- `getMcpOAuthTokensForUrl` no longer returns an expired access token when no refresh token is stored, so other extensions see a signed-out server instead of sending a dead token. Thanks to [@benjaminsirb](https://github.com/benjaminsirb) for [#644](https://github.com/nicobailon/pi-mcp-adapter/issues/644).
+- Tools in `directTools: "search"` mode now stay inactive until a search selects them, even if another extension turns them back on. Tools a search activates stay on until the session ends. Thanks to [@VoidInTheShell](https://github.com/VoidInTheShell) for [PR #640](https://github.com/nicobailon/pi-mcp-adapter/pull/640).
+
 ## [2.36.0] - 2026-09-21
 
 ### Highlights

package/node_modules/pi-mcp-adapter/README.md

@@ -394,7 +394,7 @@ Secret values in `headers`, `bearerToken`, `oauth.clientSecret`, and stdio `env`
 
 For local desktop bearer tokens, `bearerTokenStore: true` can opt in to the adapter-owned credential-store namespace. It never falls back to plaintext if the store is unavailable, if the stored record is malformed, or if the stored URL differs from the effective server URL. Literal tokens, command tokens, and environment tokens keep precedence so existing configs do not change. Create or rotate a stored token with `pi-mcp-adapter token set <server>` (masked prompt on a terminal, or piped stdin such as `security find-generic-password -s my-token -w | pi-mcp-adapter token set <server>`); the record binds to the effective configured URL at write time. Token commands need Node 22.18+.
 
-On Linux, bearer-token and TypeSafe key storage also recover automatically when a native operation fails with `KeyRevoked`, including wrapped errors from a revoked inherited session keyring. Each failed read/write/remove is retried once through `keyctl session - <current runtime> <packaged helper>`, with a 10-second timeout and no plaintext fallback. This requires `keyctl` on `PATH` and a working credential store in the fresh session; other storage errors still fail closed. Set `PI_MCP_ADAPTER_DISABLE_KEYRING_RECOVERY=1` to disable this recovery. Normal Pi and token CLI launches need no special wrapper.
+On Linux, bearer-token and System One key storage also recover automatically when a native operation fails with `KeyRevoked`, including wrapped errors from a revoked inherited session keyring. Each failed read/write/remove is retried once through `keyctl session - <current runtime> <packaged helper>`, with a 10-second timeout and no plaintext fallback. This requires `keyctl` on `PATH` and a working credential store in the fresh session; other storage errors still fail closed. Set `PI_MCP_ADAPTER_DISABLE_KEYRING_RECOVERY=1` to disable this recovery. Normal Pi and token CLI launches need no special wrapper.
 
 ### Shared MCP processes with rmcp-mux
 
@@ -422,6 +422,8 @@ mcp({ action: "install", url: "https://example.com/mcp" })
 
 Install validates and connects the endpoint. New entries use a name derived from the hostname and are saved to Pi's global MCP config; existing URL entries are reused without rewriting. Pass `server` to choose a name or `target: "project"` to save to the project's `.mcp.json`. Unsafe URLs, name collisions, and failed connections are not persisted.
 
+Set `settings.allowInstall` to `false` in an MCP config file (`mcp.json` or `.mcp.json`, not Pi's `settings.json`) to block `mcp({ action: "install" })` for constrained or headless agents. Connect, search, tool calls, authentication, runtime registration, and interactive setup are unaffected.
+
 In exclusive config mode, a project target must be the active config path; otherwise use the global target. URL install cannot promote runtime-registered servers: save their complete definitions manually so required headers and transport/auth settings are retained.
 
 Public servers are ready immediately. For OAuth servers, the same action opens the authorization page and watches a reachable loopback callback. After the user grants consent, an `mcp-oauth-status` message returns the agent to connect the server and verify its discovered tools. Remote/headless callbacks retain the manual completion fallback below.
@@ -469,8 +471,10 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 {
   "settings": {
     "toolPrefix": "server",
+    "allowInstall": false,
     "idleTimeout": 10,
     "requestTimeoutMs": 30000,
+    "deferWithMissingMetadata": false,
     "showStatusIcon": true,
     "mcpFooterStatus": "full",
     "toolResultRendering": "compact",
@@ -494,8 +498,10 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 | Setting | Description |
 |---------|-------------|
 | `toolPrefix` | `"server"` (default), `"short"` (strips `-mcp` suffix), `"none"`, or `"mcp"` (prefixes with `mcp__`, using server-mode normalization). Per-server `toolPrefix` overrides this for that server. |
+| `allowInstall` | Allow URL installation through the `mcp` tool (default: `true`). Set to `false` to block it. |
 | `idleTimeout` | Global idle timeout in minutes (default: 10, 0 to disable) |
 | `requestTimeoutMs` | Global request timeout in milliseconds for live MCP calls (if omitted or `<= 0`, the MCP SDK default timeout is used) |
+| `deferWithMissingMetadata` | Allow lazy startup to defer when persisted metadata is missing or invalid (default: `false`). See [Direct Tools](#direct-tools) for the startup tradeoff. |
 | `showStatusIcon` | Show the plug icon in MCP status and connection text (default: `true`). Set to `false` for plain `MCP: ...` text. |
 | `mcpFooterStatus` | MCP footer verbosity: `"full"` (default), `"compact"` for `MCP connected/enabled`, or `"off"` to clear the persistent footer status. `/mcp status` remains available. |
 | `toolResultRendering` | MCP tool result row style: `"compact"` (default) uses self-rendered rows, or `"boxed"` restores the legacy Pi boxed tool row. |
@@ -515,7 +521,8 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 | `warnOnLargeDirectTools` | Show the advisory when 75 or more direct tools resolve (default: `true`). Set to `false` to suppress only this advisory. |
 | `freezeDirectTools` | Keep direct-tool registration stable after the initial sync so metadata updates and explicit reconnects do not rebuild the system prompt. Proxy/search/cache metadata still refreshes. Default: false. |
 | `scriptMode` | Register the MCP-only `mcpScript` plain-JavaScript tool (default: true). Set to `false` to hide it. |
-| `jev` | Optional TypeSafe Jev settings. A valid TypeSafe key enables semantic search across every enabled MCP server by default; `semanticSearch: false` disables it. `scriptEvaluation` remains disabled by default and requires an `allowedServers` source allowlist when enabled. Run `/mcp jev setup` for guided configuration. |
+| `exposeResources` | Expose MCP resources as tools (default: `true`). Set to `false` to disable globally across all servers. Per-server `exposeResources` overrides this. |
+| `jev` | Optional System One Jev settings. A valid System One key enables semantic search across every enabled MCP server by default; `semanticSearch: false` disables it. `scriptEvaluation` remains disabled by default and requires an `allowedServers` source allowlist when enabled. `jev: false` disables both. Run `/mcp jev setup` for guided configuration. |
 | `disableProxyTool` | Hide the `mcp` proxy tool once configured direct tools are fully available from cache. Ignored while any server uses `directTools: "search"`, whose tools are registered inactive and can only be activated through `mcp({ search })`. |
 | `autoAuth` | Auto-run OAuth on `connect`/tool calls when a server needs auth, then retry once (default: false). |
 | `sampling` | Allow MCP servers to sample through Pi models, honoring `modelPreferences.hints` before current/default fallback (default: true when UI approval is available). |
@@ -524,7 +531,7 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 | `outputGuard` | Guard oversized MCP output: `true` (default), `false`, or `{ maxBytes, maxLines, detailsMaxBytes }`. See [Output Guard](#output-guard). |
 | `trace` | Opt-in metadata-only protocol tracing. Set `{ enabled: true }` globally or `trace: true` on a server. The per-session JSONL file defaults to `.pi/mcp-traces/`; `file`, `maxBytes` (default 262144), and `maxEvents` (default 10000) can be set. Raw MCP payloads, prompts, tool arguments/results, auth data, and URLs are never persisted. |
 
-Per-server `idleTimeout`, `requestTimeoutMs`, and `approveTools` override the global settings. `debug` remains stderr display and is unrelated to protocol tracing.
+Per-server `idleTimeout`, `requestTimeoutMs`, `approveTools`, and `exposeResources` override the global settings. `debug` remains stderr display and is unrelated to protocol tracing.
 
 ### Tool Approval
 
@@ -592,7 +599,7 @@ Set `"outputGuard": false` — or the env kill switch `MCP_OUTPUT_GUARD=0` — t
 
 #### Jev semantic search and opt-in script evaluation
 
-A valid TypeSafe key makes semantic search available across every enabled MCP server; it does not run Jev searches automatically. A search uses Jev only when `searchMode: "semantic"` is explicitly requested. Jev ranks matching tools but never executes them. Script evaluation remains disabled until `scriptEvaluation: true` is configured. Requests use pinned model `jev-1.13.0` at the fixed origin `https://api.typesafe.ai`. Review TypeSafe's current [legal terms](https://docs.typesafe.ai/legal), including privacy and retention; a no-training commitment does not mean zero retention.
+A valid System One key makes semantic search available across every enabled MCP server; it does not run Jev searches automatically. A search uses Jev only when `searchMode: "semantic"` is explicitly requested. Jev ranks matching tools but never executes them. Script evaluation remains disabled until `scriptEvaluation: true` is configured. Requests use the pinned model from `settings.jev.model` (`jev-1.13.0` by default) against the endpoint in `SYSTEMONE_ENDPOINT`, which defaults to TypeSafe at `https://api.typesafe.ai/v1/systemone`. Review your provider's current legal terms — for TypeSafe, [legal terms](https://docs.typesafe.ai/legal), including privacy and retention; a no-training commitment does not mean zero retention.
 
 ```text
 Normal search
@@ -611,14 +618,35 @@ mcp({ search: "calendar", searchMode: "semantic" })
 The quickest desktop setup is:
 
 ```sh
-pi-mcp-adapter key set typesafe
+pi-mcp-adapter key set systemone
 ```
 
-That is enough to use semantic search across all enabled MCP tools. Run `/mcp jev setup` in Pi when you want to restrict which enabled servers may share semantic-search data. The command saves a project-scoped allowlist and reloads Pi automatically. Verify the stored credential at any time with `pi-mcp-adapter key status typesafe`.
+That is enough to use semantic search across all enabled MCP tools. Run `/mcp jev setup` in Pi when you want to restrict which enabled servers may share semantic-search data. The command saves a project-scoped allowlist and reloads Pi automatically. Verify the stored credential at any time with `pi-mcp-adapter key status systemone`.
+
+`SYSTEMONE_API_KEY` is for CI/headless use and overrides the keyring. Stdio MCP subprocesses inherit the host environment by default, so set `inheritEnv: false` where they must not receive it. The script worker receives no key, SDK, endpoint, headers, or environment.
+
+##### Choosing a provider endpoint
 
-`TYPESAFE_API_KEY` is for CI/headless use and overrides the keyring. Stdio MCP subprocesses inherit the host environment by default, so set `inheritEnv: false` where they must not receive it. The script worker receives no key, SDK, endpoint, headers, or environment.
+System One decisions are the same API at different origins, so pointing at another provider needs an endpoint and, usually, a model:
 
-Semantic search sends the query text, server names, normalized and original tool names, tool paths, and descriptions to TypeSafe. It does not send tool results. `allowedServers` restricts semantic search to named servers. `scriptEvaluation` is a separate opt-in that may send the state and MCP-derived results declared in each evaluation; when enabled, it requires an explicit source allowlist.
+| Provider | `SYSTEMONE_ENDPOINT` | Model |
+| --- | --- | --- |
+| TypeSafe (default) | `https://api.typesafe.ai/v1/systemone` | `jev-1.13.0` |
+| OpenCode Zen | `https://opencode.ai/zen/v1/systemone` | `jev-1.13` |
+| Command Code | `https://api.commandcode.ai/provider/v1/systemone` | `typesafe/jev` |
+| OpenRouter | `https://openrouter.ai/api/alpha/decisions` | `typesafe/jev-1.13` |
+
+These are example configurations, subject to each provider's current documentation ([OpenCode Zen](https://opencode.ai/docs/zen/), [Command Code](https://commandcode.ai/docs/provider), [TypeSafe](https://docs.typesafe.ai/)).
+
+The endpoint must be an absolute `https` URL with a path. A set-but-invalid `SYSTEMONE_ENDPOINT` disables Jev instead of falling back to the default. Treat the endpoint as trusted configuration: it receives the API key and the judgment payload. Credentials are stored per endpoint, so switching endpoints does not overwrite a saved key. Set the model with:
+
+```json
+{ "settings": { "jev": { "model": "jev-1.13" } } }
+```
+
+The older `TYPESAFE_API_KEY` variable still works for the default TypeSafe endpoint and is never sent to any other endpoint.
+
+Semantic search sends the query text, server names, normalized and original tool names, tool paths, and descriptions to the configured endpoint. It does not send tool results. `allowedServers` restricts semantic search to named servers. `scriptEvaluation` is a separate opt-in that may send the state and MCP-derived results declared in each evaluation; when enabled, it requires an explicit source allowlist.
 
 ```json
 {
@@ -634,7 +662,7 @@ Semantic search sends the query text, server names, normalized and original tool
 
 Request semantic discovery explicitly with `mcp({ search: "triage customer reports", searchMode: "semantic" })` or `tools.search({ query: "triage customer reports", searchMode: "semantic" })`. Regex is incompatible. Timeout, rate-limit, and service failures return marked lexical fallback; credential, policy, configuration, and response failures do not. If no allowed server has cached tools, search explains how to connect a server or update the allowlist; if Jev decides no tool fits, the result says that Jev abstained.
 
-Optional `jev` controls bound timeout/retries, request and script budgets, semantic candidates (at most 127), and minimum probability. The cumulative token budget uses provider-reported input plus output usage. Exact pre-response admission is unavailable without the provider tokenizer, so byte/question/state limits bound requests before dispatch; a response that exceeds the remaining token budget is discarded and exhausts it. The endpoint, headers, and SDK logging are not configurable.
+Optional `jev` controls bound timeout/retries, request and script budgets, semantic candidates (at most 127), and minimum probability. The cumulative token budget uses provider-reported input plus output usage. Exact pre-response admission is unavailable without the provider tokenizer, so byte/question/state limits bound requests before dispatch; a response that exceeds the remaining token budget is discarded and exhausts it. The endpoint is set by `SYSTEMONE_ENDPOINT`; headers and SDK logging are not configurable.
 
 `await jev.evaluate({ state, questions, sources })` returns `{ ok, data }` or `{ ok: false, error }`. `sources` must name every MCP server represented in `state`. The host also conservatively taints the whole script with every server-attributed MCP call result or error: declared and observed sources must all be enabled and in `allowedServers`, so copying data or omitting/mislabeling `sources` cannot bypass policy. The taint remains for later direct evaluations and semantic searches even when the script did not retain the call result. Direct and semantic provider attempts share the per-script count, UTF-8 request-byte, token, and deadline budgets; later `tools.call` operations still require normal authentication and approval. See `examples/jev-semantic-filter.mjs` and `examples/jev-accessibility-loop.mjs`.
 
@@ -792,6 +820,8 @@ Each direct tool costs ~150-300 tokens in the system prompt (name + description
 
 Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup. On the first session after adding `directTools` to a new server, the cache won't exist yet — tools fall back to proxy-only while the cache populates, then the extension hot-loads the refreshed direct tools into the current session. When `mcp({ connect: "<server>" })` is what discovers them, the connect result lists the new tools in `addedToolNames`, so Pi can load their definitions from that point in the transcript instead of rewriting the active tool list. Servers that advertise MCP list-change notifications refresh the current session when their tool or resource list changes. On Pi versions that expose `pi.unregisterTool()`, stale direct tools are removed from the registry during refresh; older Pi versions still deactivate them from the active tool set. To force a refresh: `/mcp reconnect <server>`.
 
+For faster startup, set `settings.deferWithMissingMetadata` to `true`. Servers with missing or invalid metadata (expired, mismatched, or non-cacheable) then contribute no tools, prompts, resources, or search entries until the first MCP operation starts the runtime and loads live metadata; the `mcp` gateway stays available. Because Pi cannot unregister slash commands, cached prompt commands also wait for live metadata under this setting. `eager`/`keep-alive` servers and cold `MCP_DIRECT_TOOLS` selections still start immediately.
+
 Models sometimes encode an object or array argument as a JSON string. Set `settings.strictDirectToolArguments` to `true` to recover one such layer for schema-declared object and array properties, then validate the complete input against the advertised schema before execution.
 
 Set `settings.directToolResultDetails` to `"bounded"` when an extension needs structured MCP result fields in Pi's direct-tool result details. The same output guard limits apply. Small leading structured fields stay available, while large fields receive bounded summaries and the complete guarded result follows the output guard's spill-file policy. The default `"lean"` mode keeps the existing server and tool metadata only.