@junghanacs/entwurf 0.51.0 → 0.53.1

package/pi-extensions/lib/acp/event-mapper.ts

@@ -28,6 +28,9 @@ import type { AssistantMessage, AssistantMessageEventStream } from "@earendil-wo
 
 const NOTICE_TITLE_MAX = 80;
 const NOTICE_SUMMARY_MAX = 160;
+/** #163 M2: a result preview shows at most this many lines and UTF-8 bytes of output. */
+const PREVIEW_MAX_LINES = 5;
+const PREVIEW_MAX_BYTES = 400;
 
 /** Identity fields for the running assistant message. */
 export interface AcpStreamIdentity {
@@ -39,6 +42,8 @@ export interface AcpStreamIdentity {
 type ObservedToolState = {
 	title: string;
 	status?: string;
+	/** #163 M3: the compaction line for this call was already shown. */
+	compactionShown?: boolean;
 };
 
 export type AcpPiStreamState = {
@@ -48,6 +53,13 @@ export type AcpPiStreamState = {
 	openThinkingIndex?: number;
 	/** When false, tool/permission notices are suppressed (kept terse for smokes). */
 	showToolNotifications?: boolean;
+	/**
+	 * #163: no notice of any kind — tool, permission, display-only or lifecycle. Set only for
+	 * Pi's one-shot summary turn. Pi stores that summary as `contentText(response.content)`,
+	 * which joins every text block (pi-ai `dist/utils/text.js`) without reading a signature,
+	 * so a notice here would become part of the summary the session file keeps.
+	 */
+	quiet?: boolean;
 	observedTools?: Map<string, ObservedToolState>;
 	/**
 	 * RAW, UNINTERPRETED observations from this turn's `usage_update` notifications
@@ -162,7 +174,7 @@ function ensureThinkingBlock(state: AcpPiStreamState): number {
  * permission events — informational, NOT structured tool calls.
  */
 function pushNotice(state: AcpPiStreamState, text: string): void {
-	if (!state.showToolNotifications || !text.trim()) return;
+	if (state.quiet || !state.showToolNotifications || !text.trim()) return;
 	closeThinkingBlock(state);
 	closeTextBlock(state);
 	const index = state.output.content.length;
@@ -172,17 +184,60 @@ function pushNotice(state: AcpPiStreamState, text: string): void {
 	state.stream.push({ type: "text_end", contentIndex: index, content: text, partial: state.output });
 }
 
+// #163: terminal escape sequences, the same range Pi strips from tool output before it shows it
+// (pi-coding-agent 1.5.2 `dist/utils/ansi.js` `stripAnsi`, derived from chalk/ansi-regex, MIT,
+// Copyright (c) Sindre Sorhus). OSC runs to its first terminator (BEL, ESC \\ or 0x9C); CSI and
+// its relatives take optional parameters and one final byte. Pi does not export it from its
+// package root, and this bridge imports Pi only by the root (`check-pi-import-surface`).
+const ANSI_SEQUENCE = new RegExp(
+	"(?:\\u001B\\][\\s\\S]*?(?:\\u0007|\\u001B\\u005C|\\u009C))|" +
+		"(?:(?:\\u001B\\[|\\u009B)[<=>]|[\\u001B\\u009B][[\\]()#;?]*)(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]",
+	"g",
+);
+// What is left that a terminal would act on: C0 except tab, LF and CR; DEL and C1; and
+// U+FFF9..U+FFFB, which Pi also drops because they crash width measurement
+// (`dist/utils/shell.js` `sanitizeBinaryOutput`).
+// biome-ignore lint/suspicious/noControlCharactersInRegex: matching these characters is the point.
+const CONTROL_CHARS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F\uFFF9-\uFFFB]/g;
+
+/**
+ * #163: no text that a backend or a tool's output supplies reaches the operator's terminal as a
+ * control sequence. A window-title OSC 0 or a clipboard-write OSC 52 in a command's output would
+ * otherwise pass straight through the notice line and the pi-tui renderer. Every notice text
+ * goes through here: title, summary, preview and permission.
+ */
+function stripTerminalControls(text: string): string {
+	return text.replace(ANSI_SEQUENCE, "").replace(CONTROL_CHARS, "");
+}
+
+/** Neutralize backtick fences (which would swallow following lines in chat renderers) and clip with an ellipsis. */
+function fenceSafeClip(text: string, max: number): string {
+	const fenceSafe = text.replace(/`{3,}/g, "[fence]").replace(/`/g, "'");
+	if (fenceSafe.length <= max) return fenceSafe;
+	return `${fenceSafe.slice(0, max - 1)}…`;
+}
+
 /**
  * Sanitize an inline fragment for the one-line `[tool:*]` / `[permission:*]`
- * notice surface: collapse whitespace, neutralize backtick fences (which would
- * otherwise swallow following lines in chat renderers), truncate with ellipsis.
+ * notice surface: strip terminal controls, collapse whitespace, neutralize
+ * backtick fences, truncate with ellipsis.
  */
 export function sanitizeNoticeFragment(text: string | null | undefined, max: number): string {
 	if (!text) return "";
-	const collapsed = text.replace(/\s+/g, " ").trim();
-	const fenceSafe = collapsed.replace(/`{3,}/g, "[fence]").replace(/`/g, "'");
-	if (fenceSafe.length <= max) return fenceSafe;
-	return `${fenceSafe.slice(0, max - 1)}…`;
+	return fenceSafeClip(stripTerminalControls(text).replace(/\s+/g, " ").trim(), max);
+}
+
+/**
+ * #163: one line of an output preview. Unlike a notice fragment it keeps its indentation, so a
+ * stack trace, YAML or a diff reads as it does in Pi: controls stripped, CR dropped and tabs
+ * expanded to three spaces as Pi's tool renderer does (`dist/core/tools/render-utils.js`
+ * `replaceTabs`), trailing space trimmed.
+ */
+function sanitizePreviewLine(line: string): string {
+	return fenceSafeClip(
+		stripTerminalControls(line).replace(/\r/g, "").replace(/\t/g, "   ").trimEnd(),
+		PREVIEW_MAX_BYTES,
+	);
 }
 
 function firstTextItem(arr: unknown[]): string | undefined {
@@ -229,6 +284,24 @@ function titleForTool(update: Record<string, unknown>, previousTitle?: string):
 	return String(update?.title ?? previousTitle ?? meta?.claudeCode?.toolName ?? update?.toolCallId ?? "Tool");
 }
 
+function isTerminalToolStatus(status: string | undefined): boolean {
+	return status === "completed" || status === "failed" || status === "cancelled";
+}
+
+/** The adapter's progress-beat elapsed seconds, or undefined when this update is not a beat. */
+function elapsedSecondsOf(update: Record<string, unknown>): number | undefined {
+	const meta = update?._meta as { claudeCode?: { toolResponse?: { elapsedTimeSeconds?: unknown } } } | undefined;
+	const value = meta?.claudeCode?.toolResponse?.elapsedTimeSeconds;
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+
+function formatElapsed(seconds: number): string {
+	const whole = Math.floor(seconds);
+	if (whole < 60) return `${whole}s`;
+	const rest = whole % 60;
+	return rest === 0 ? `${Math.floor(whole / 60)}m` : `${Math.floor(whole / 60)}m${rest}s`;
+}
+
 /**
  * Render an ACP tool_call / tool_call_update as a text notice (NEVER a
  * structured toolcall — the ACP child already executed it).
@@ -243,22 +316,51 @@ function renderToolUpdate(state: AcpPiStreamState, update: Record<string, unknow
 	const updateContent = Array.isArray(update?.content) ? (update.content as unknown[]) : undefined;
 
 	if (update.sessionUpdate === "tool_call") {
-		observedTools.set(toolCallId, { title, status });
+		const observed: ObservedToolState = { title, status };
+		observedTools.set(toolCallId, observed);
 		pushNotice(state, `\n[tool:start] ${sanitizeNoticeFragment(title, NOTICE_TITLE_MAX)}\n`);
+		// The adapter opens a compaction it saw only at its end as one terminal `tool_call`.
+		if (isTerminalToolStatus(status)) pushCompactionLine(state, update, observed);
 		return;
 	}
 
-	// tool_call_update. There is deliberately no mid-flight `[tool:running]`
-	// notice: it would have to be driven by the adapter's `_meta.terminal_output`,
-	// and that meta is gated upstream on `clientCapabilities._meta.terminal_output
-	// === true` while backend.ts initializes with `clientCapabilities: {}`. So the
-	// branch could never fire for any backend we ship — it claimed a transcript
-	// line the operator was never going to see. Declaring the terminal capability
-	// is a separate axis, not a one-line re-enable: the adapter would then send
-	// terminal widgets/metas this mapper cannot render honestly into a transcript.
+	// tool_call_update. A running tool's only mid-flight signal is the SDK's
+	// `tool_progress` beat, which the adapter forwards WITHOUT any client
+	// capability as `_meta.claudeCode.toolResponse.elapsedTimeSeconds` (#162,
+	// measured 2026-11-13 on claude-agent-acp 0.106.0 with `clientCapabilities: {}`:
+	// a 120 s foreground Bash produced beats at 30/60/90 s, the first one also
+	// carrying `status: "in_progress"`). It carries no stdout: the adapter sends a
+	// foreground command's output only with its completion, even to a client that
+	// declares `_meta.terminal_output` (measured the same day). So the honest
+	// mid-flight line is liveness plus elapsed time, never partial output. It is
+	// display-only, like a lifecycle notice: elapsed beats depend on wall time, so
+	// they stay out of transcript replay and the reuse-compat signature.
+	const elapsed = elapsedSecondsOf(update);
+	const running = !isTerminalToolStatus(status) && !isTerminalToolStatus(previous?.status);
+	// #163 M1: what is running, once it is known. The first `tool_call` is sent before the input
+	// has streamed, so a Bash call opens as "Terminal" (claude-agent-acp 0.107.0
+	// `tool-calls/reporters/bash.js:22`) and the command arrives later as a title-only update.
+	// One display-only line names it. A beat in the same update already names the title, so
+	// that update shows the beat alone; a repeated title shows nothing.
+	if (
+		running &&
+		elapsed === undefined &&
+		previous !== undefined &&
+		typeof update.title === "string" &&
+		sanitizeNoticeFragment(update.title, NOTICE_TITLE_MAX) !== sanitizeNoticeFragment(previous.title, NOTICE_TITLE_MAX)
+	) {
+		pushDisplayOnlyNotice(state, `\n[tool:running] ${sanitizeNoticeFragment(title, NOTICE_TITLE_MAX)}\n`);
+	}
+	if (elapsed !== undefined && running) {
+		pushDisplayOnlyNotice(
+			state,
+			`\n[tool:running] ${sanitizeNoticeFragment(title, NOTICE_TITLE_MAX)} — ${formatElapsed(elapsed)}\n`,
+		);
+	}
 	if (status && status !== previous?.status) {
 		const summary = firstTextContent(update?.rawOutput) ?? firstTextContent(updateContent);
 		const suffix = summary ? ` — ${sanitizeNoticeFragment(summary, NOTICE_SUMMARY_MAX)}` : "";
+		const failed = status !== "completed" || rawOutputHasError(update?.rawOutput);
 		if (status === "completed") {
 			const label = rawOutputHasError(update?.rawOutput) ? "tool:failed" : "tool:done";
 			pushNotice(state, `\n[${label}] ${sanitizeNoticeFragment(title, NOTICE_TITLE_MAX)}${suffix}\n`);
@@ -267,9 +369,109 @@ function renderToolUpdate(state: AcpPiStreamState, update: Record<string, unknow
 		} else if (status === "cancelled") {
 			pushNotice(state, `\n[tool:cancelled] ${sanitizeNoticeFragment(title, NOTICE_TITLE_MAX)}${suffix}\n`);
 		}
+		if (isTerminalToolStatus(status) && summary) {
+			const preview = previewOf(summary, failed);
+			if (preview) {
+				pushDisplayOnlyNotice(
+					state,
+					`\n[tool:output] ${sanitizeNoticeFragment(title, NOTICE_TITLE_MAX)}\n${preview}\n`,
+				);
+			}
+		}
+	}
+
+	const observed: ObservedToolState = { title, status, compactionShown: previous?.compactionShown };
+	observedTools.set(toolCallId, observed);
+	if (isTerminalToolStatus(status)) pushCompactionLine(state, update, observed);
+}
+
+/** The output inside one wrapping code fence; the adapter sends a command's output as "```console\n…\n```". */
+function unfence(text: string): string {
+	const fenced = /^```[^\n]*\n([\s\S]*?)\n?```\s*$/.exec(text);
+	return fenced ? fenced[1] : text;
+}
+
+/** Keep `text` within `maxBytes` UTF-8 bytes, cutting at a character boundary from the head or the tail. */
+function clipBytes(text: string, maxBytes: number, fromTail: boolean): string {
+	if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+	const chars = Array.from(text);
+	if (fromTail) chars.reverse();
+	const kept: string[] = [];
+	let bytes = Buffer.byteLength("…", "utf8");
+	for (const ch of chars) {
+		const size = Buffer.byteLength(ch, "utf8");
+		if (bytes + size > maxBytes) break;
+		kept.push(ch);
+		bytes += size;
+	}
+	if (fromTail) kept.reverse();
+	return fromTail ? `…${kept.join("")}` : `${kept.join("")}…`;
+}
+
+/**
+ * #163 M2: a short look at what a finished tool returned, as Pi shows a tool's output. At most
+ * PREVIEW_MAX_LINES lines and PREVIEW_MAX_BYTES bytes, each line passed through the notice
+ * sanitizer. A failure shows the TAIL, where a command's stderr and its exit status end up
+ * (`stdout` then `stderr`, `reporters/bash.js`); a success shows the head. Nothing when the whole
+ * output already fits on the terminal notice's one line.
+ */
+function previewOf(raw: string, failed: boolean): string | undefined {
+	const lines = unfence(raw)
+		.split("\n")
+		.map((line) => sanitizePreviewLine(line));
+	while (lines.length > 0 && lines[0] === "") lines.shift();
+	while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+	if (lines.length === 0) return undefined;
+	if (lines.length === 1 && lines[0].length <= NOTICE_SUMMARY_MAX) return undefined;
+	const omitted = lines.length > PREVIEW_MAX_LINES;
+	const shown = failed ? lines.slice(-PREVIEW_MAX_LINES) : lines.slice(0, PREVIEW_MAX_LINES);
+	if (omitted) {
+		if (failed) shown.unshift("…");
+		else shown.push("…");
 	}
+	return clipBytes(shown.join("\n"), PREVIEW_MAX_BYTES, failed);
+}
 
-	observedTools.set(toolCallId, { title, status });
+function formatTokens(n: number): string {
+	if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1).replace(/\.0$/, "")}M`;
+	if (n >= 1_000) return `${Math.round(n / 1_000)}k`;
+	return String(n);
+}
+
+/**
+ * #163 M3: the backend's own compaction, in numbers. claude-agent-acp reports it as a synthetic
+ * tool call whose `_meta.claudeCode.toolName` is "compact", and gives a client without the AIR
+ * extension the facts as `rawOutput: {trigger, preTokens, postTokens?, durationMs?, error?}`
+ * (0.107.0 `tool-calls/reporters/compaction.js` `finished`, `context-compaction.js:366-376`). One
+ * lifecycle line per compaction, whichever terminal update carries the facts first; a field that
+ * is absent is left out. Shown like the other `[acp: …]` lines, whatever the tool-notice setting.
+ */
+function pushCompactionLine(
+	state: AcpPiStreamState,
+	update: Record<string, unknown>,
+	observed: ObservedToolState,
+): void {
+	if (observed.compactionShown) return;
+	const meta = update?._meta as { claudeCode?: { toolName?: unknown } } | undefined;
+	if (meta?.claudeCode?.toolName !== "compact") return;
+	const facts = update?.rawOutput as
+		| { trigger?: unknown; preTokens?: unknown; postTokens?: unknown; durationMs?: unknown; error?: unknown }
+		| undefined;
+	if (!facts || typeof facts !== "object" || Array.isArray(facts)) return;
+	const parts = ["compaction"];
+	if (typeof facts.trigger === "string" && facts.trigger) parts.push(facts.trigger);
+	if (facts.error !== undefined && facts.error !== null && facts.error !== "") parts.push("failed");
+	const pre = typeof facts.preTokens === "number" ? formatTokens(facts.preTokens) : undefined;
+	const post = typeof facts.postTokens === "number" ? formatTokens(facts.postTokens) : undefined;
+	if (pre && post) parts.push(`${pre}→${post}`);
+	else if (pre) parts.push(pre);
+	if (typeof facts.durationMs === "number" && facts.durationMs >= 0) {
+		const seconds = facts.durationMs / 1000;
+		parts.push(`in ${seconds < 60 ? `${seconds.toFixed(1)}s` : formatElapsed(seconds)}`);
+	}
+	if (parts.length === 1) return;
+	observed.compactionShown = true;
+	pushAcpLifecycleNotice(state, parts.join(" "));
 }
 
 /** Push a permission-decision notice (informational text, not a tool call). */
@@ -286,6 +488,22 @@ export function pushPermissionNotice(state: AcpPiStreamState, title: string, dec
  */
 export const LIFECYCLE_NOTICE_SIGNATURE = "entwurf:lifecycle-notice-v1";
 
+/**
+ * A tool notice that is display-only: suppressed with the tool stream
+ * (`showToolNotifications`), and stamped with LIFECYCLE_NOTICE_SIGNATURE so it
+ * never replays into an ACP prompt nor perturbs the reuse-compat signature.
+ */
+function pushDisplayOnlyNotice(state: AcpPiStreamState, text: string): void {
+	if (state.quiet || !state.showToolNotifications) return;
+	closeThinkingBlock(state);
+	closeTextBlock(state);
+	const index = state.output.content.length;
+	state.output.content.push({ type: "text", text, textSignature: LIFECYCLE_NOTICE_SIGNATURE });
+	state.stream.push({ type: "text_start", contentIndex: index, partial: state.output });
+	state.stream.push({ type: "text_delta", contentIndex: index, delta: text, partial: state.output });
+	state.stream.push({ type: "text_end", contentIndex: index, content: text, partial: state.output });
+}
+
 /**
  * Push a one-line ACP turn-lifecycle progress notice (`[acp: …]`) as its own
  * text block, stamped with LIFECYCLE_NOTICE_SIGNATURE. Two ways it differs from
@@ -297,6 +515,7 @@ export const LIFECYCLE_NOTICE_SIGNATURE = "entwurf:lifecycle-notice-v1";
  *      reuse-compat signature (the two consumers filter on the signature).
  */
 export function pushAcpLifecycleNotice(state: AcpPiStreamState, text: string): void {
+	if (state.quiet) return;
 	const line = `\n[acp: ${sanitizeNoticeFragment(text, NOTICE_TITLE_MAX)}]\n`;
 	closeThinkingBlock(state);
 	closeTextBlock(state);

package/pi-extensions/lib/acp/model-ids.js

@@ -12,12 +12,9 @@
 // would need a `.ts` specifier the root config cannot allow.
 //
 // WHY THE LAUNCH SEAMS ASK AT ALL. Pi's `--model` resolver falls back to a
-// case-insensitive substring match among the provider's rows and prefers the
-// lexically later id. Under one `entwurf` provider a retired `claude-sonnet-5`
-// is a substring of `cortex-claude-sonnet-5`, so a launch Entwurf builds would
-// silently open on the Snowflake Cortex rail instead of the Claude subscription.
-// An exact match against this list is the only admission; nothing is aliased,
-// substituted or rewritten.
+// case-insensitive substring match among provider rows. The old multi-backend
+// surface could silently match a retired Claude id to a Cortex row. Cortex is
+// now disabled; exact membership remains the admission, with no substitution.
 
 /** The single ACP provider id under which every curated row is registered. */
 export const PROVIDER_ID = "entwurf";
@@ -28,15 +25,16 @@ export const SUPPORTED_ANTHROPIC_MODEL_IDS = /** @type {const} */ ([
 	"claude-sonnet-5-5",
 	"claude-opus-5-5",
 	"claude-fable-5-1",
+	"claude-fable-5-2",
 ]);
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
 export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5-5";
 
-// Cortex ids carry the reserved `cortex-` prefix; the rest of each id is the
-// Snowflake-native model name, which is why Cortex still says `claude-opus-5`.
+// These former IDs are retained only as historical refusal inputs. The prefix
+// is reserved so a disabled Cortex request never falls through to Claude.
 export const CORTEX_MODEL_PREFIX = "cortex-";
-export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
+export const LEGACY_CORTEX_MODEL_IDS = /** @type {const} */ ([
 	"cortex-auto",
 	"cortex-claude-opus-5",
 	"cortex-claude-sonnet-5",
@@ -44,7 +42,7 @@ export const SUPPORTED_CORTEX_MODEL_IDS = /** @type {const} */ ([
 ]);
 
 /** @type {ReadonlySet<string>} */
-const CURATED_ACP_MODEL_IDS = new Set([...SUPPORTED_ANTHROPIC_MODEL_IDS, ...SUPPORTED_CORTEX_MODEL_IDS]);
+const CURATED_ACP_MODEL_IDS = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
 
 /**
  * Exact membership only — no trim, no case folding, no prefix.
@@ -60,8 +58,7 @@ export const ACP_MODEL_NOT_CURATED = /** @type {const} */ ("acp-model-not-curate
 
 export const ACP_MODEL_NOT_CURATED_HINT =
 	`an ${PROVIDER_ID} model must be one exact curated ACP id (${[...CURATED_ACP_MODEL_IDS].join(", ")}); ` +
-	"Pi would otherwise pick another row by substring — a retired claude-sonnet-5 lands on cortex-claude-sonnet-5 — " +
-	"so nothing was opened, and nothing is aliased or rewritten";
+	"Cortex ACP is disabled; Pi may otherwise pick another row by substring, so nothing was opened and nothing is aliased or rewritten";
 
 /** Carries `reason` so callers match a FIELD, never the wording. */
 export class AcpModelNotCuratedError extends Error {

package/pi-extensions/lib/acp/models.ts

@@ -1,18 +1,12 @@
-// ACP plugin — curated model surface (S0 loader/fence slice; cortex rows added
-// in 0.13).
+// ACP plugin — curated Claude model surface. Cortex ACP is disabled.
 //
 // entwurf is an ACP *plugin* on the v2 core, NOT a general-purpose
 // Anthropic provider. It deliberately does not expose the full pi-ai model
 // registry — the surface is curated to the ids the plugin commits to driving
 // through a real ACP backend.
 //
-// Two curated sets live here, one per adapter on the rail
-// (backend-adapter.ts): the unprefixed Claude ids (the reference backend) and
-// the `cortex-` prefixed Snowflake Cortex Code ids (the second backend, landed
-// 0.13.0 — docs/acp-backend-rail.md “Cortex Code audit”). Codex has native
-// delivery-probe evidence but no managed citizen lane; neither it nor Gemini is an ACP backend here.
-// A third governed backend EXTENDS this file the same way — it does not change
-// the pattern.
+// Only the unprefixed Claude IDs are registered. Historical Cortex IDs are
+// reserved refusal inputs; native citizens are independent of this provider.
 
 // pi 0.80 migration: the standalone root `getModels()` moved to the deprecated
 // `@earendil-works/pi-ai/compat` entrypoint (the global-API churn). We import it
@@ -41,9 +35,9 @@ import { CURATED_ANCHOR_MODEL_ID, SUPPORTED_ANTHROPIC_MODEL_IDS } from "./model-
 export {
 	CORTEX_MODEL_PREFIX,
 	CURATED_ANCHOR_MODEL_ID,
+	LEGACY_CORTEX_MODEL_IDS,
 	PROVIDER_ID,
 	SUPPORTED_ANTHROPIC_MODEL_IDS,
-	SUPPORTED_CORTEX_MODEL_IDS,
 } from "./model-ids.js";
 
 // #26 auth-boundary sentinel. `pi.registerProvider` requires an apiKey when a
@@ -84,56 +78,50 @@ function claudeContextWindow(model: { id: string; contextWindow: number }): numb
 	return Math.min(model.contextWindow, CLAUDE_CONTEXT_DEFAULT);
 }
 
-// ── Cortex (Snowflake Cortex Code) curated surface ──────────────────────────
-//
-// entwurf's ACP rail is backend-extensible: Cortex is the first NON-claude
-// backend to land through it (docs/acp-backend-rail.md, “Shipped adapters”). pi-ai carries no
-// snowflake/cortex model source, so this surface is HAND-CURATED. Every id
-// carries the reserved `cortex-` prefix: the prefix is the SINGLE routing
-// authority (backend-adapter.ts `routeModel`) and keeps the ids off the Claude
-// native ids Cortex routes to (`cortex-claude-sonnet-5` vs the unprefixed
-// `claude-sonnet-5-5` the claude adapter owns). `routeModel` strips the prefix to
-// recover the native id, which is enforced per-turn via
-// session/set_config_option — never a launch `-m` pin (CP0-M).
-//
-// The 4-row set is the GLG-decided curation (2026-07-29) — a subset of the 11
-// native ids cortex v1.1.52 exposed live when authenticated. A curated id that
-// the running cortex no longer serves fails LOUD at set-model, before the
-// prompt (measured: `Unsupported model: …` names the live set). Adding an id
-// here is the same verify-both-axes commitment as the Claude set — do not
-// extend casually. The prefix and the four ids are declared in model-ids.js.
+// Cortex ACP is disabled; its former IDs are refusal inputs, not model rows.
+
+/**
+ * What an ACP row declares it can take as input: text only. The rail delivers pi's transcript as
+ * ACP text blocks; an image becomes the marker `[image omitted: <mime>]` (`context.ts`), and no
+ * other path carries image bytes to the backend. pi's catalog lists the Anthropic models as
+ * `["text", "image"]` — true of the model behind the API, not of this transport — so copying it
+ * would advertise a capability the rail does not deliver (#142 landing review). A backend gains
+ * `image` here only together with a real image path and its proof.
+ */
+const ACP_ROW_INPUT: ("text" | "image")[] = ["text"];
+
+/** The retired Cortex adapter contributes no supported model rows. */
+export function curatedCortexModels(): [] {
+	return [];
+}
+
+/**
+ * The effort values claude-agent-acp offers on its `effort` config option (category
+ * `thought_level`). `[측정 2026-11-13]` 0.106.0, authenticated, no prompt (#142): the option lists
+ * `default, low, medium, high, xhigh, max`; `high → low → max` each read back on one live session and
+ * `minimal` was refused `-32602`. `default` is the vendor's own choice, so no pi level maps to it.
+ */
+export const CLAUDE_ACP_EFFORT_VALUES = ["low", "medium", "high", "xhigh", "max"] as const;
 
-// Hand-set conservative context window. Cortex reports the LIVE window via its
-// own ACP session config, not this curated metadata — this is a floor for the
-// registry surface, deliberately not inflated to the Claude 1M.
-const CORTEX_CONTEXT_DEFAULT = 200_000;
+type ThinkingLevelMap = NonNullable<RegistryModel["thinkingLevelMap"]>;
 
 /**
- * The curated Cortex model rows handed to the single `entwurf` provider via
- * `allCuratedModels()`. The two Claude rows ride their OWN registry base
- * (opus-5 / sonnet-5); `auto` (default family Claude) and the GPT row (no pi-ai
- * source) ride the sonnet-5 base as a metadata floor. id / name / contextWindow
- * are overridden; the `cortex-` prefix keeps them from colliding with the
- * Claude curated ids. Same row shape as `curatedClaudeModels()` (AcpModelRow).
+ * The pi `thinkingLevelMap` an ACP Claude row registers (#142). pi's documented model seam: the
+ * value is what the provider sends for each pi level, `null` marks a level unsupported, and xhigh/max
+ * appear only when mapped (`getSupportedThinkingLevels`). Each supported pi level maps to the effort
+ * value of the same name. `off` and `minimal` have no effort value, so they are `null` and never
+ * offered; a level the registry already marks unsupported for this model stays unsupported, and
+ * xhigh/max stay hidden where the registry does not map them. Nothing here is a model catalog: the
+ * registry decides which levels the model has, this decides which of them ACP can carry.
  */
-export function curatedCortexModels() {
-	const sonnetBase = requireRegistryModel(ANTHROPIC_MODELS_ALL, "claude-sonnet-5");
-	const opusBase = requireRegistryModel(ANTHROPIC_MODELS_ALL, "claude-opus-5");
-	const row = (id: string, name: string, base: RegistryModel) => ({
-		id,
-		name,
-		reasoning: base.reasoning,
-		input: base.input,
-		cost: base.cost,
-		contextWindow: CORTEX_CONTEXT_DEFAULT,
-		maxTokens: base.maxTokens,
-	});
-	return [
-		row("cortex-auto", "Cortex · Auto", sonnetBase),
-		row("cortex-claude-opus-5", "Cortex · Claude Opus 5", opusBase),
-		row("cortex-claude-sonnet-5", "Cortex · Claude Sonnet 5", sonnetBase),
-		row("cortex-openai-gpt-5.4", "Cortex · OpenAI GPT-5.4", sonnetBase),
-	];
+export function claudeAcpThinkingLevelMap(registry: RegistryModel["thinkingLevelMap"]): ThinkingLevelMap {
+	const map: ThinkingLevelMap = { off: null, minimal: null };
+	for (const level of CLAUDE_ACP_EFFORT_VALUES) {
+		const declared = registry?.[level];
+		const unmapped = declared === undefined && (level === "xhigh" || level === "max");
+		map[level] = declared === null || unmapped ? null : level;
+	}
+	return map;
 }
 
 /**
@@ -147,7 +135,8 @@ export function curatedClaudeModels() {
 		id: m.id,
 		name: m.name,
 		reasoning: m.reasoning,
-		input: m.input,
+		thinkingLevelMap: claudeAcpThinkingLevelMap(m.thinkingLevelMap),
+		input: [...ACP_ROW_INPUT],
 		cost: m.cost,
 		contextWindow: claudeContextWindow(m),
 		maxTokens: m.maxTokens,

package/pi-extensions/lib/acp/tool-surface.ts

@@ -12,13 +12,10 @@
 //
 // The module's TWO jobs have different backend scopes — do not collapse them:
 //   - `buildClaudeSessionMeta` is claude-only by CONSTRUCTION, with exactly one
-//     caller (`claudeAdapter.buildSessionMeta`). Cortex exposes no
-//     `_meta.systemPrompt` and no tools/permission declaration surface (native
-//     tools + its own overlay mcp.json projection), so its adapter returns
-//     `undefined` and that function is never reached for a cortex turn.
+//     caller (`claudeAdapter.buildSessionMeta`).
 //   - `assertExcludeToolsHonored` is BACKEND-INVARIANT: backend.ts runs it for
-//     every adapter before any spawn, passing `backend: adapter.backend` and the
-//     resolved `config.tools`. A cortex turn DOES enter this module through it.
+//     every admitted adapter before any spawn, passing `backend: adapter.backend`
+//     and the resolved `config.tools`. Cortex ACP is disabled.
 // That split is why the `backend` field exists: the honest-divergence logic stays
 // explicit and the matrix gate can exercise both the "claude narrows via tools"
 // and "native always exposes" branches.
@@ -120,6 +117,29 @@ export function assertExcludeToolsHonored(activeToolNames: readonly string[], re
 	}
 }
 
+/**
+ * #163: is this Pi's own summarization request — the one tool-less turn the preflight above
+ * honours instead of refusing?
+ *
+ * Pi summarizes for `/compact`, the compaction threshold, overflow recovery and `/tree` branch
+ * summaries through one call (pi-coding-agent 1.5.2 `dist/core/compaction/compaction.js:476-489`,
+ * `completeSummarization`; branch summaries at `compaction/branch-summarization.js:233-237`). Its
+ * context declares no tools (`buildSummarizationContext`, `compaction.js:499-509`) and its options
+ * carry `cacheRetention: "none"` (`compaction.js:482`), which an ordinary agent-loop turn does not
+ * (pi-agent-core `dist/agent.js:306-330`).
+ *
+ * BOTH are required. An empty surface alone is also an operator who excluded every tool on an
+ * ordinary turn, which keeps today's refusal; `cacheRetention` alone is a request option, not a
+ * surface. Neither the summarization prompt's text nor a missing session id is read: Pi fills the
+ * id with a fresh `uuidv7()` (`compaction.js:481`), and matching its prompt would copy it.
+ * `cacheRetention` is a Pi convention, not a contract — the oracle beside this calls Pi's own
+ * `completeSummarization` so a Pi upgrade that drops it turns that test red rather than this
+ * path silently back into a refusal.
+ */
+export function isPiSummaryRequest(activeToolNames: readonly string[], cacheRetention: unknown): boolean {
+	return activeToolNames.length === 0 && cacheRetention === "none";
+}
+
 /** Inputs to the Claude `_meta` builder. */
 export interface ClaudeSessionMetaParams {
 	modelId?: string;
@@ -174,6 +194,14 @@ export function buildClaudeSessionMeta(
 			// the carrier's "doesn't-know" — keeping both means a future preset/SDK
 			// change cannot silently re-open memory through a channel the strip misses.
 			autoMemoryEnabled: false,
+			// No turn of the adapter's own (#142). claude-agent-acp 0.101.0 compacts an idle session
+			// before its 1h prompt cache expires by sending `/compact` as a prompt nobody here issued;
+			// a retained session's callbacks drop updates that arrive with no active turn, so that
+			// model turn would spend quota and replace context invisibly to pi. 0.106.0 (#1555) reads
+			// this inline key when no managed tier sets one. Only the IDLE trigger is off:
+			// `autoCompactEnabled` stays untouched, so Claude Code's own compaction inside a prompt
+			// we sent keeps working.
+			idleCompaction: false,
 		},
 	};
 	if (params.skillPlugins.length > 0) {

package/pi-extensions/lib/entwurf-control-rpc.ts

@@ -50,7 +50,11 @@ export interface SenderEnvelope {
  * renders nothing (etiquette marker, not transport contract).
  */
 export function formatSenderInfoBlock(sender: SenderEnvelope, wantsReply = false): string {
-	return `\n\n<sender_info>${JSON.stringify({
+	const replyGuidance =
+		sender.replyable === true
+			? "\n\n[entwurf: When a reply is requested, send the result via entwurf_v2 to the requested recipient (default: sender_info.sessionId); a local final is not delivery. Honor routing and no-send instructions; an absent or false wants_reply does not cancel a request. A replyable address alone needs no acknowledgment.]"
+			: "";
+	return `${replyGuidance}\n\n<sender_info>${JSON.stringify({
 		sessionId: sender.sessionId,
 		agentId: sender.agentId,
 		cwd: sender.cwd,