@huseynsnmz/pi-suite 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.2.3]
+
+### Features
+
+- Router: each role can have its own reasoning level, chosen in `/router` from what that role's model offers.
+- Up and Down with one line typed go through past prompts that start with it. With nothing typed they also reach this folder's other sessions.
+- With `hideThinkingBlock` on, reasoning shows while it's written and collapses when the message is done. `Ctrl+T` opens it.
+- New part, off until you run `/suite on subscription`: Claude models on your Claude login, based on pi-claude-subscription. It asks before anything more is billed as extra usage. See its README for the limits and what Anthropic's terms say.
+
+- One settings file, `~/.pi/agent/suite.json`, with a section for each part. `/suite` now opens each part's settings as well as turning it on or off. Old files move in the first time Pi starts, and stay as `.bak`.
+
+### Fixes
+
+- `router/auto` is always listed in `/model`, and says to run `/router` until `plan` and `build` are set.
+- `/clear` keeps the current model and reasoning level.
+
+## [0.2.2]
+
+### Fixes
+
+- Pi's `codemode` tool now works in plan and read-only modes. Each tool a script calls is still checked, so a script can't write there. Another package's tool named `codemode` stays blocked.
+- A script or other tool can no longer call `edit`, `write`, `powershell`, or bash that isn't read-only, in any mode. The model makes those as their own tool calls, so you see each one and `router/auto` sees that editing has started. With `codemode.mode` set to `only` this is off in normal, auto and yolo, because scripts are then the only way to reach tools.
+
 ## [0.2.1]
 
 ### Fixes

package/README.md

@@ -11,13 +11,20 @@ One package for [Pi](https://pi.dev): modes and permissions, a framed screen, a
 | `frame` | The start card, framed editor, tool boxes, footer and the agent's todo list | [README](packages/frame/README.md) |
 | `board` | A board for starting, watching and attaching to background sessions | [README](packages/board/README.md) |
 | `commands` | `/clear` and `/security-review` | [README](packages/commands/README.md) |
+| `subscription` | Off until you turn it on. Claude models on your Claude login, asking before anything more is billed as extra usage | [README](packages/subscription/README.md) |
+
+## Settings
+
+Run `/suite` to turn parts on or off and change their settings. They're all kept in `~/.pi/agent/suite.json`, with a section for each part, so you can also edit it by hand. Older files such as `router.json` and `web.json` move in the first time Pi starts, and stay beside it as `.bak`. If one can't be read it stays where it is, and you're told, so a broken file can't silently turn off a setting.
+
+There's no setting per project, so a repository can't choose where your code goes. The only exception is the frame's look, in `.pi/extensions/pi-harness/settings.json`, once you trust the project. Pi's own files, and the settings of other packages, such as `pi-permission-system`, stay where they are.
 
 ## Install
 
 Requires Pi 1.5 or newer.
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.1
+pi install npm:@huseynsnmz/pi-suite@0.2.3
 ```
 
 If you installed any of these separately, remove them first:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@huseynsnmz/pi-suite",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "One Pi package for all of it: modes and permissions, a framed screen, an agent board, memory, web tools with a separate page reader, and a model router. Turn off what you don't want with /suite.",
   "type": "module",
   "license": "MIT",
@@ -28,6 +28,10 @@
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
+    "packages/subscription/src",
+    "packages/subscription/package.json",
+    "packages/subscription/README.md",
+    "packages/subscription/LICENSE",
     "packages/commands/src",
     "packages/commands/package.json",
     "packages/commands/README.md",
@@ -91,6 +95,7 @@
     "test:e2e": "python3 test/e2e/run.py"
   },
   "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.308",
     "@xterm/headless": "6.0.0",
     "node-pty": "1.1.0",
     "@mozilla/readability": "0.6.0",

package/packages/board/README.md

@@ -26,7 +26,7 @@ Requires Pi 1.5 or newer.
 1. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-suite@0.2.1
+   pi install npm:@huseynsnmz/pi-suite@0.2.3
    ```
 
 2. Restart Pi, and press `Left` twice on an empty prompt, or run `/agent-board`.

package/packages/commands/README.md

@@ -4,7 +4,7 @@ Two commands for Pi. Part of [pi-suite](../../README.md); turn them off with `/s
 
 ## /clear
 
-Clears the conversation and starts a new session, as `/new` does. If the agent is working, it stops first. The old session is kept, and `/resume` brings it back.
+Clears the conversation and starts a new session, keeping the model and reasoning level you have selected. `/new` goes back to your saved default instead. If the agent is working, it stops first. The old session is kept, and `/resume` brings it back.
 
 ## /security-review
 

package/packages/commands/src/index.ts

@@ -5,6 +5,14 @@ import { changesToReview, type GitRun, reviewPrompt } from "./security-review.ts
 
 const REVIEW_MESSAGE = "security-review";
 
+/** The model /clear hands to the session it starts. Pi's own new session would take the saved default. */
+const KEPT = Symbol.for("pi-suite:clear-keeps");
+interface Kept {
+  provider: string;
+  id: string;
+  thinking: ReturnType<ExtensionAPI["getThinkingLevel"]>;
+}
+
 export default function piCommands(pi: ExtensionAPI): void {
   pi.registerCommand("clear", {
     description: "Clear the conversation and start a new session",
@@ -13,10 +21,24 @@ export default function piCommands(pi: ExtensionAPI): void {
         ctx.abort();
         await ctx.waitForIdle();
       }
+      const store = globalThis as Record<symbol, Kept | undefined>;
+      if (ctx.model) store[KEPT] = { provider: ctx.model.provider, id: ctx.model.id, thinking: pi.getThinkingLevel() };
       await ctx.newSession();
+      delete store[KEPT]; // Still here only if it was cancelled.
     },
   });
 
+  // Runs in the new session, where this extension is a new instance, so what /clear kept can't live in it.
+  pi.on("session_start", async (event, ctx) => {
+    const store = globalThis as Record<symbol, Kept | undefined>;
+    const kept = store[KEPT];
+    delete store[KEPT];
+    if (event.reason !== "new" || kept === undefined) return;
+    const model = ctx.modelRegistry.find(kept.provider, kept.id);
+    if (model !== undefined) await pi.setModel(model);
+    pi.setThinkingLevel(kept.thinking);
+  });
+
   // The diff goes to the model, and only this one line goes on screen.
   pi.registerMessageRenderer<{ summary: string }>(REVIEW_MESSAGE, (message, _options, theme) =>
     new Text(theme.fg("muted", message.details?.summary ?? "Security review"), 1, 0),

package/packages/frame/README.md

@@ -19,7 +19,7 @@ Requires Pi 1.5 or newer.
 2. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-suite@0.2.1
+   pi install npm:@huseynsnmz/pi-suite@0.2.3
    ```
 
 3. Restart Pi. The start card says `π-frame`.
@@ -44,6 +44,8 @@ Some pieces, such as rooms, boards, peers and the remote page, appear only with
 |---|---|
 | `Ctrl+C` | Stops a run and says `Aborted`. With nothing running, it clears the editor and says to press it again within 2 seconds to exit |
 | `Ctrl+R` | Search what you've typed, here and in this folder's other sessions. `Ctrl+R` again goes further back, `Enter` sends, `Esc` cancels, any other key keeps the match to edit. It replaces Pi's Rename on this key; `/name` still renames |
+| `Up` / `Down` | With nothing typed, browse past prompts, including this folder's other sessions. With one line typed, go through prompts that start with it, as in a shell |
+| `Ctrl+T` | Open or collapse finished reasoning |
 | `Alt+O` | Scroll through the session's tool output, one call at a time |
 | `Ctrl+O` | Expand every call in the transcript |
 | `/todos` | Show the agent's todo list. `/todos clear` empties it and tells the agent |
@@ -78,7 +80,7 @@ More detail is in [How it works](docs/how-it-works.md) and the [reference](docs/
 - **`gh` and `glab` still run in their repositories,** and they call `git` for reads such as the remote list.
 - **`glab` needs a host with `gitlab` in its name.** It starts for that remote, and if a token is set in the environment (`GITLAB_TOKEN`), only for `gitlab.com` or `GITLAB_HOST`, because a repository picks its own remote.
 - **The `git status` protections cover the ways to run code that I know of.** New Git options could add others.
-- **The parts of `@adeildo/pi-kit` 6.0.0 that frame uses are copied into `src/kit`,** with its license, so upstream fixes have to be copied in by hand. Its settings stay in `~/.pi/agent/extensions/pi-harness/settings.json`.
+- **The parts of `@adeildo/pi-kit` 6.0.0 that frame uses are copied into `src/kit`,** with its license, so upstream fixes have to be copied in by hand. Its settings stay in `~/.pi/agent/suite.json`.
 - **Another session's view isn't fully covered.** Opening one needs other pi-harness packages, and that view hasn't been tested.
 
 ## Development
@@ -103,3 +105,7 @@ MIT. See [LICENSE](LICENSE), which keeps the original copyright notice.
 - [pi-look and pi-harness](https://github.com/felipeadeildo/pi-harness) by [adeildo](https://adeildo.dev)
 - The framed editor comes from [pi-open-tui](https://github.com/OldSuns/pi-open-tui), by way of pi-look.
 - The segments with priorities come from [oh-my-pi](https://github.com/can1357/oh-my-pi), by way of pi-look.
+
+## Reasoning
+
+Set `"hideThinkingBlock": true` in `~/.pi/agent/settings.json`, or press `Ctrl+T` until reasoning is collapsed. It then shows while the model is writing it and collapses to one line once the message is done. `Ctrl+T` opens it again, or click it to open just that one. `Ctrl+T` is Pi's own setting, so it applies to every message and stays set in later sessions.

package/packages/frame/docs/reference.md

@@ -27,7 +27,7 @@ Syntax tokens are borrowed on purpose: a theme spends its hues there, so they gi
 
 ## Settings
 
-They live in the file `@adeildo/pi-kit` keeps, `~/.pi/agent/extensions/pi-harness/settings.json`, under `frame.`.
+They live under `frame` in `~/.pi/agent/suite.json`.
 
 | Key           | Default     | Does                                                                                                                                   |
 | ------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------- |

package/packages/frame/src/index.ts

@@ -1,4 +1,4 @@
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 
 import {
 	ACCOUNT,
@@ -23,7 +23,7 @@ import type {
 	ExtensionContext,
 	ReadonlyFooterDataProvider,
 } from "@earendil-works/pi-coding-agent";
-import { keyText, parseSkillBlock } from "@earendil-works/pi-coding-agent";
+import { getAgentDir, keyText, parseSkillBlock } from "@earendil-works/pi-coding-agent";
 import { Key, type KeyId, type TUI } from "@earendil-works/pi-tui";
 
 import { type GitState, readGit } from "./data/git.ts";
@@ -157,7 +157,7 @@ export const frameFeature = defineFeature({
 
 		for (const entry of FRAME_SETTINGS) entry.listen(scope, repaint);
 		frame.listen(scope, () => live.ctx && installEditor(live.ctx, screen, live, scope));
-		const visitsFile = join(dirname(scope.settings.globalPath), "frame-visits.json");
+		const visitsFile = join(getAgentDir(), "extensions", "pi-harness", "frame-visits.json");
 		let visited = false;
 		let lastVisit: LastVisit | undefined;
 
@@ -527,6 +527,9 @@ function pressCtrlC(live: Live, clearEditor: () => void): void {
 	live.repaint?.();
 }
 
+/** Everything collapsed has finished, because live reasoning stays open. */
+const THOUGHT_LABEL = "Thought · ctrl+t to expand";
+
 function installEditor(
 	ctx: ExtensionContext,
 	screen: Screen,
@@ -535,9 +538,11 @@ function installEditor(
 ): void {
 	if (ctx.mode !== "tui") return;
 	if (frame.get(scope) === "off") {
+		ctx.ui.setHiddenThinkingLabel(undefined);
 		ctx.ui.setEditorComponent(undefined);
 		return;
 	}
+	ctx.ui.setHiddenThinkingLabel(THOUGHT_LABEL);
 	ctx.ui.setEditorComponent((tui, theme, keybindings) => {
 		live.tui = tui;
 		applyCursor(tui, cursor);

package/packages/frame/src/kit/settings/files.ts

@@ -1,5 +1,5 @@
 // Every app shares the settings files, so a write keeps every key it does not know.
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { CONFIG_DIR_NAME, getAgentDir } from "@earendil-works/pi-coding-agent";
@@ -14,7 +14,7 @@ export interface SettingsFile {
 }
 
 export function globalSettingsPath(): string {
-	return join(getAgentDir(), "extensions", "pi-harness", "settings.json");
+	return join(getAgentDir(), "suite.json");
 }
 
 export function projectSettingsPath(cwd: string): string {
@@ -40,12 +40,12 @@ export function writeSettingsFile(
 	options: { mode?: number } = {},
 ): void {
 	mkdirSync(dirname(path), { recursive: true });
-	const temporary = `${path}.${process.pid}.tmp`;
-	writeFileSync(temporary, `${JSON.stringify(data, null, "\t")}\n`, {
-		encoding: "utf8",
-		mode: options.mode,
-	});
-	renameSync(temporary, path);
+	// A linked file stays linked, and a private one stays private. Other parts' settings share it.
+	const target = existsSync(path) ? realpathSync(path) : path;
+	const mode = options.mode ?? (existsSync(target) ? statSync(target).mode & 0o777 : undefined);
+	const temporary = `${target}.${process.pid}.tmp`;
+	writeFileSync(temporary, `${JSON.stringify(data, null, "\t")}\n`, { encoding: "utf8", mode });
+	renameSync(temporary, target);
 }
 
 export function lookup(data: SettingsData, id: string): unknown {

package/packages/frame/src/kit/settings/store.ts

@@ -135,7 +135,9 @@ export class SettingsStore {
 	}
 
 	#edit(path: string, change: (data: SettingsData) => void): string | undefined {
-		const { data } = readSettingsFile(path);
+		const { data, warnings } = readSettingsFile(path);
+		// Reading a broken file gives nothing, and writing that would wipe what else it holds.
+		if (warnings.length > 0) return warnings[0];
 		change(data);
 		try {
 			writeSettingsFile(path, data);

package/packages/frame/src/ui/editor.ts

@@ -15,7 +15,15 @@ import { BOXES, border } from "../render/frame.ts";
 import { paintLead, promptLead } from "../render/lead.ts";
 import { SETTINGS_KEY, SETTINGS_SHORTCUT_INPUT } from "../render/keys.ts";
 import type { CursorStyle } from "../settings.ts";
-import { findPrompt, type HistorySearch, shownText, startSearch } from "./history-search.ts";
+import {
+	findPrompt,
+	type HistorySearch,
+	type PrefixSearch,
+	shownText,
+	startPrefix,
+	startSearch,
+	stepPrefix,
+} from "./history-search.ts";
 import { type Screen, type SlotName, slotPieces } from "./screen.ts";
 
 type WorkingIndicator = Parameters<CustomEditor["setWorkingStatusIndicator"]>[0];
@@ -44,6 +52,8 @@ export class FrameEditor extends CustomEditor {
 	#hiddenBelow = 0;
 	#inset = 0;
 	#search: HistorySearch | undefined;
+	#prefix: PrefixSearch | undefined;
+	#seeded = false;
 
 	constructor(
 		tui: TUI,
@@ -77,13 +87,9 @@ export class FrameEditor extends CustomEditor {
 			this.#searchKey(this.#search, data);
 			return;
 		}
+		if (this.#prefixKey(data)) return;
 		if (matchesKey(data, SEARCH_KEY) && !this.isShowingAutocomplete()) {
-			// What Up browses, then what was typed in this folder's other sessions.
-			const own: unknown = Reflect.get(this, "history");
-			this.#search = startSearch(this.getText(), [
-				...(Array.isArray(own) ? (own as string[]) : []),
-				...this.#screen.pastPrompts(),
-			]);
+			this.#search = startSearch(this.getText(), this.#history());
 			return;
 		}
 		if (this.#keybindings.matches(data, "app.clear") && !this.isShowingAutocomplete()) {
@@ -101,6 +107,51 @@ export class FrameEditor extends CustomEditor {
 		if (skillQueryAt(this.getLines(), line, col) !== undefined) openAutocomplete(this);
 	}
 
+	/** What Up browses, then what was typed in this folder's other sessions. Read once, on first use. */
+	#history(): readonly string[] {
+		const own: unknown = Reflect.get(this, "history");
+		if (!Array.isArray(own)) return this.#screen.pastPrompts();
+		const entries = own as string[];
+		if (!this.#seeded) {
+			this.#seeded = true;
+			for (const prompt of this.#screen.pastPrompts()) {
+				if (!entries.includes(prompt)) entries.push(prompt);
+			}
+		}
+		return entries;
+	}
+
+	/**
+	 * Up with one line typed looks back through prompts that start with it, and Down comes forward
+	 * again. Any other key keeps what's showing. An empty prompt is left to pi's own browsing.
+	 */
+	#prefixKey(data: string): boolean {
+		const up = this.#keybindings.matches(data, "tui.editor.cursorUp");
+		const down = this.#keybindings.matches(data, "tui.editor.cursorDown");
+		if (!up && !down) {
+			this.#prefix = undefined;
+			return false;
+		}
+		if (this.isShowingAutocomplete()) return false;
+		if (this.#prefix === undefined) {
+			const typed = this.getText();
+			const entries = this.#history();
+			const browsing = Reflect.get(this, "historyIndex") !== -1;
+			if (down || typed === "" || typed.includes("\n") || browsing || !onFirstVisualLine(this)) return false;
+			const search = startPrefix(typed, entries);
+			// With nothing to go through, the arrows stay pi's.
+			if (search.matches.length === 0) return false;
+			this.#prefix = search;
+		}
+		const text = stepPrefix(this.#prefix, up ? 1 : -1);
+		if (text === undefined && down) {
+			this.#prefix = undefined;
+			return false;
+		}
+		if (text !== undefined) this.setText(text);
+		return true;
+	}
+
 	/** Enter sends the match, Esc goes back, and any other key keeps the match to edit. */
 	#searchKey(search: HistorySearch, data: string): void {
 		if (matchesKey(data, SEARCH_KEY)) {
@@ -248,6 +299,12 @@ export class FrameEditor extends CustomEditor {
 	}
 }
 
+/** The method is private. If a pi release renames it, Up just moves the cursor as before. */
+function onFirstVisualLine(editor: CustomEditor): boolean {
+	const check: unknown = Reflect.get(editor, "isOnFirstVisualLine");
+	return typeof check === "function" && check.call(editor) === true;
+}
+
 /** The method is private; nothing opens if a pi release renames it. */
 function openAutocomplete(editor: CustomEditor): void {
 	const open: unknown = Reflect.get(editor, "tryTriggerAutocomplete");

package/packages/frame/src/ui/history-search.ts

@@ -21,3 +21,24 @@ export function findPrompt(search: HistorySearch, from: number): number {
 export function shownText(search: HistorySearch): string {
 	return search.at < 0 ? search.draft : (search.entries[search.at] as string);
 }
+
+/** Up with text typed: older prompts that start with it, as in a shell. */
+export interface PrefixSearch {
+	typed: string;
+	matches: readonly string[];
+	at: number;
+}
+
+export function startPrefix(typed: string, entries: readonly string[]): PrefixSearch {
+	const wanted = typed.toLowerCase();
+	const matches = [...new Set(entries)].filter((entry) => entry !== typed && entry.toLowerCase().startsWith(wanted));
+	return { typed, matches, at: -1 };
+}
+
+/** One step older (1) or newer (-1), ending back on what was typed. Undefined past either end. */
+export function stepPrefix(search: PrefixSearch, step: 1 | -1): string | undefined {
+	const next = search.at + step;
+	if (next < -1 || next >= search.matches.length) return undefined;
+	search.at = next;
+	return next < 0 ? search.typed : search.matches[next];
+}

package/packages/frame/src/ui/pi-entries.ts

@@ -1,5 +1,6 @@
 // Pi's own transcript entries in the harness frame instead of a background. Pi has no hook for
 // drawing them, so this wraps each component's render.
+import { showThinkingWhileLive } from "./thinking.ts";
 import { CHANGES_CUT, CHANGES_X, entryFrame, type EntryFrame, GLYPH } from "../kit/index.ts";
 import {
 	BashExecutionComponent,
@@ -63,6 +64,7 @@ export function framePiEntries(source: EntryPaint): void {
 	paint = source;
 	if (installed) return;
 	installed = true;
+	showThinkingWhileLive(() => paint() !== undefined);
 	wrap(UserMessageComponent, (self, look) =>
 		look.you ? youFrame(look, fromOf(self, look), sentInOf(self, look)) : undefined,
 	);

package/packages/frame/src/ui/thinking.ts

@@ -0,0 +1,34 @@
+import { AssistantMessageComponent } from "@earendil-works/pi-coding-agent";
+
+/** Private in pi. If a release renames them, reasoning just follows pi's setting again. */
+interface Message {
+	updateContent(message: { content: readonly { type: string }[] }, isStreaming?: boolean): void;
+	isStreaming?: boolean;
+	thinkingVisibilityOverrides?: Map<number, boolean>;
+}
+
+const live = new WeakSet<object>();
+let isActive: () => boolean = () => false;
+let installed = false;
+
+/**
+ * With pi's setting that collapses reasoning on, it still shows while it's being written, and
+ * collapses once the message is done. Ctrl+T or a click opens it again.
+ */
+export function showThinkingWhileLive(active: () => boolean): void {
+	isActive = active;
+	if (installed) return;
+	installed = true;
+	const prototype = AssistantMessageComponent.prototype as unknown as Message;
+	const own = prototype.updateContent;
+	prototype.updateContent = function updateContent(this: Message, message, isStreaming = this.isStreaming) {
+		const overrides = this.thinkingVisibilityOverrides;
+		if (overrides !== undefined && isActive() && isStreaming === true) {
+			live.add(this);
+			message.content.forEach((_part, run) => overrides.set(run, false));
+		} else if (overrides !== undefined && live.delete(this)) {
+			overrides.clear();
+		}
+		own.call(this, message, isStreaming);
+	};
+}

package/packages/memory/README.md

@@ -9,7 +9,7 @@ Long-term memory for [Pi](https://pi.dev). It reviews your past conversations, k
 Requires Pi 1.5 or newer, on Node 22.18 or newer.
 
 ```bash
-pi install npm:@huseynsnmz/pi-suite@0.2.1
+pi install npm:@huseynsnmz/pi-suite@0.2.3
 ```
 
 ## Use

package/packages/modes/README.md

@@ -23,7 +23,7 @@ Requires Pi 1.5 or newer.
 1. Install it:
 
    ```bash
-   pi install npm:@huseynsnmz/pi-suite@0.2.1
+   pi install npm:@huseynsnmz/pi-suite@0.2.3
    ```
 
 2. Move pi-suite above `@gotgenes/pi-permission-system`, because `pi install` adds packages last. Otherwise, in `plan` and `read-only` you may be asked to approve an action that is then blocked anyway. It stays blocked either way, and the extension warns you at startup. Skip this step if you don't use that package.
@@ -55,7 +55,7 @@ To install from git instead, use `pi install git:github.com/huseynsnmz/pi-suite@
 | `/mode default` | Pick the mode new sessions start in |
 | `/mode default plan` | Set it directly |
 
-The default is saved as `defaultMode` in `~/.pi/agent/extensions/pi-modes/config.json`. A resumed session keeps the mode it was in. `yolo` can't be the default, because it has to be asked for each time.
+The default is saved as `defaultMode` under `modes` in `~/.pi/agent/suite.json`, and you can also set it in `/suite`. A resumed session keeps the mode it was in. `yolo` can't be the default, because it has to be asked for each time.
 
 `Shift+Tab` normally cycles the thinking level, and this extension takes it over. To keep that action on another key, add this to `~/.pi/agent/keybindings.json`:
 
@@ -123,6 +123,8 @@ Without a classifier, `auto` behaves like `normal`, and the extension warns you
 **`web`:** `web_fetch` and `web_search` are allowed in `plan` and `read-only`, as they only read. The same names from another package are blocked there.
 
 
+**Codemode with `pi-permission-system`:** it asks about `codemode` like any tool, once for each script. To skip that, add `"codemode": "allow"` to `permission` in its config. Each tool a script calls is still checked against your rules.
+
 **`pi-subagents`:** blocked in `plan` and `read-only`, because a child agent could write files. In `normal` and `auto` it is unchanged.
 
 **`pi-router`:** `plan` mode uses its plan model, and approving a plan moves to its build model.
@@ -135,6 +137,7 @@ Without a classifier, `auto` behaves like `normal`, and the extension warns you
 
 - **Allowed tools:** `read`, `grep`, `find`, `ls`, read-only `bash`, and `submit_plan` in plan mode.
 - **Blocked tools:** `write`, `edit`, subagents, MCP tools and every other tool, including ones added later.
+- **Codemode:** Pi's `codemode` tool runs, and each tool a script calls is checked like any other. Its `models` calls aren't tools, so they aren't checked: a script can still send data to a classifier or image model you have a login for, at your cost.
 - **Read-only bash:** a fixed list of commands, such as `ls`, `cat`, `rg` and `git status`. A command is refused if it uses `$`, backticks, redirects, subshells, background jobs, unquoted globs, control characters or a path to a binary. Options that write or run code are refused too, including bundled and abbreviated forms such as `sort -uo` and `sort --outp`. Quote a glob you mean literally, as in `find . -name '*.ts'`.
 
 Any other command asks you in `plan` and is blocked in `read-only`.
@@ -145,6 +148,7 @@ These modes keep an honest agent on track. They are not a sandbox.
 
 - **Reads are not restricted by this extension.** A read-only command can still read secrets, so keep `deny` rules for them in your permission system.
 - **A repo can already be malicious.** Git can run code from a repository's config and hooks, even for `git status`, and a plain clone can bring them. In `plan` and `read-only`, git commands stop counting as read-only where a repository sets anything unusual or has a hook that reading can fire, which covers what's known today. Other tools can have their own ways in, so use a container for repos you don't trust.
+- **Scripts can't change things, in any mode.** A script or other tool can't call `edit`, `write`, `powershell`, or bash that isn't read-only, so each change is its own visible step. The exception is `codemode.mode` set to `only` in `normal`, `auto` and `yolo`, where scripts are the only way to reach tools. There a script's edits aren't in the transcript, so `router/auto` can stay on its plan model. The same goes for any setup with `modes` turned off in `/suite`.
 - **Child agents started earlier keep running.** Switching mode doesn't stop a subagent that is already running.
 - **The classifier hook relies on an internal detail.** There is no public way to switch a registered judge on and off, so this extension wraps it when it registers. It uses the global key that `pi-permission-system` documents for its service map. If that breaks, you get a warning on your first prompt that the judge may auto-approve outside `auto`.
 

package/packages/modes/src/index.ts

@@ -10,7 +10,8 @@ import { registerInterview } from "./interview.ts";
 import { registerReviewTools } from "./review/tools.ts";
 import { aliasDefinitions, DENY_OFF_PROMPT, withAliases, withoutAliases } from "./deny-off.ts";
 import { clearGate, hasPermissionSystem, installJudgeGate, JUDGE_NAMES, judgeGated, registerYoloLink, setGateMode, YOLO_LINK } from "./judge-gate.ts";
-import { decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
+import { readSection, writeSection } from "../../../src/settings.ts";
+import { decideToolCall, displayCommand, fromExpectedPackage, notReadOnly, isMode, scriptedChange, loadsAfterPermissionSystem, type Mode, MODES, modePrompt, nextMode, resumedMode, startingMode, SUBMIT_PLAN_TOOL } from "./modes.ts";
 
 const STATUS_KEY = "pi-modes";
 const DENY_STATUS_KEY = "pi-modes-deny";
@@ -87,20 +88,16 @@ function packagesLoadThisFirst(): boolean {
   }
 }
 
-const configPath = () => join(getAgentDir(), "extensions", "pi-modes", "config.json");
-
 function readConfig(): Record<string, unknown> {
   try {
-    const config: unknown = JSON.parse(readFileSync(configPath(), "utf8"));
-    return typeof config === "object" && config !== null ? (config as Record<string, unknown>) : {};
+    return readSection(getAgentDir(), "modes");
   } catch {
     return {};
   }
 }
 
 function saveDefaultMode(mode: Mode): void {
-  mkdirSync(dirname(configPath()), { recursive: true });
-  writeFileSync(configPath(), `${JSON.stringify({ ...readConfig(), defaultMode: mode }, null, 2)}\n`);
+  writeSection(getAgentDir(), "modes", { ...readConfig(), defaultMode: mode });
 }
 
 function restoredMode(ctx: ExtensionContext): Mode {
@@ -239,6 +236,11 @@ export default function piModes(pi: ExtensionAPI): void {
       if (ctx.hasUI) ctx.ui.notify("The sandbox went off, so yolo ended.", "warning");
       return { block: true, reason: "Yolo ended because the sandbox is off." };
     }
+    // With codemode.mode set to "only", scripts are the one way to reach any tool, so they have to be able to write.
+    if (event.parentToolCallId !== undefined && pi.getSettings().codemode?.mode !== "only") {
+      const reason = scriptedChange(event.toolName, event.input);
+      if (reason !== undefined) return { block: true, reason };
+    }
     let decision = decideToolCall(mode, event.toolName, event.input);
     if (decision.action === "allow" && (mode === "plan" || mode === "read-only") && event.toolName === "bash") {
       const risk = runsGit((event.input as { command: string }).command) ? await gitRisk(ctx.cwd) : undefined;

package/packages/modes/src/modes.ts

@@ -10,9 +10,11 @@ const CYCLE: readonly Mode[] = ["normal", "auto", "plan", "read-only"];
 
 export const SUBMIT_PLAN_TOOL = "submit_plan";
 export const ASK_TOOL = "ask_questions";
+const CODEMODE_TOOL = "codemode";
 
 // pi-web's tools only read, and a separate model reads the page for them.
-const READ_TOOLS = new Set(["read", "grep", "find", "ls", "web_fetch", "web_search", "todo", ASK_TOOL]);
+// Each tool a codemode script calls comes through this check itself, so the script needs none of its own.
+const READ_TOOLS = new Set(["read", "grep", "find", "ls", "web_fetch", "web_search", "todo", ASK_TOOL, CODEMODE_TOOL]);
 
 /** Allowed for what pi-suite's own do. Another package's tool with the name could do anything. */
 const SUITE_TOOLS: ReadonlySet<string> = new Set(["todo", "web_fetch", "web_search", ASK_TOOL]);
@@ -28,6 +30,7 @@ function realPath(path: string): string | undefined {
 
 /** The whole suite loads from one file, so that file is what these tools must come from. */
 export function fromExpectedPackage(toolName: string, path: string | undefined, entry = SUITE_ENTRY): boolean {
+  if (toolName === CODEMODE_TOOL) return path === "builtin:codemode";
   if (!SUITE_TOOLS.has(toolName)) return true;
   const expected = realPath(entry);
   return path !== undefined && expected !== undefined && realPath(path) === expected;
@@ -84,6 +87,20 @@ export function decideToolCall(mode: Mode, toolName: string, input: unknown): To
   return { action: "block", reason: `${mode} mode blocks ${toolName}. ${leave}` };
 }
 
+/**
+ * Why a tool can't make this call from inside a script, if it can't. The transcript only shows the script,
+ * so a change must be its own step: you can see it, and the router can see that editing has started.
+ */
+export function scriptedChange(toolName: string, input: unknown): string | undefined {
+  const asOwnStep = "Call it directly, not from a script.";
+  if (/(^|_)(edit|write)$/.test(toolName) || toolName === "powershell") return `${toolName} changes files. ${asOwnStep}`;
+  if (!/(^|_)bash$/.test(toolName)) return undefined;
+  const command = (input as { command?: unknown } | null)?.command;
+  if (typeof command !== "string") return `${toolName} needs a command. ${asOwnStep}`;
+  const verdict = classifyBash(command);
+  return verdict.readOnly ? undefined : `${verdict.reason}. ${asOwnStep}`;
+}
+
 /**
  * Makes a command safe to show in a dialog. Control and bidirectional characters
  * become visible escapes, so a command can't hide or reorder what the user sees.