@jyork0828/pi-pilot 0.0.6 → 0.1.0

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { existsSync } from "fs";
-import { readFile as readFile6 } from "fs/promises";
-import { dirname as dirname6, extname, join as join9, resolve as resolve5, sep as sep3 } from "path";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile10 } from "fs/promises";
+import { dirname as dirname6, extname, join as join17, resolve as resolve8, sep as sep3 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { serve } from "@hono/node-server";
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono6 } from "hono";
 import { cors } from "hono/cors";
 
 // src/config.ts
@@ -41,20 +41,31 @@ function configureHttpProxy() {
 }
 
 // src/api/workspaces.ts
-import { readFile as readFile4, stat as stat2 } from "fs/promises";
-import { basename as basename2, isAbsolute as isAbsolute3, resolve as resolve3 } from "path";
+import { readFile as readFile8, stat as stat3 } from "fs/promises";
+import { basename as basename2, isAbsolute as isAbsolute3, resolve as resolve6 } from "path";
 import { Hono as Hono2 } from "hono";
 
 // src/storage/resource-writer.ts
+import { execFile } from "child_process";
+import { createWriteStream } from "fs";
 import {
+  cp,
   mkdir,
+  mkdtemp,
+  readdir,
   readFile,
   rm,
   stat,
   unlink,
   writeFile
 } from "fs/promises";
-import { dirname, isAbsolute, join as join2, resolve, sep } from "path";
+import { tmpdir } from "os";
+import { basename, dirname, isAbsolute, join as join2, resolve, sep } from "path";
+import { Readable, Transform } from "stream";
+import { pipeline } from "stream/promises";
+import { promisify } from "util";
+import { createGunzip } from "zlib";
+var exec = promisify(execFile);
 var SKILL_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 var PROMPT_NAME_RE = /^[a-z0-9_](?:[a-z0-9_-]{0,62}[a-z0-9_])?$/;
 function ensureSkillName(name) {
@@ -231,6 +242,156 @@ async function deleteSkill(filePath, roots) {
   assertUnder(dir, [roots.userSkills, roots.projectSkills]);
   await rm(dir, { recursive: true, force: true });
 }
+var MAX_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
+var MAX_ENTRIES = 5e3;
+async function installSkillFromZip(opts) {
+  const base = opts.scope === "user" ? opts.roots.userSkills : opts.roots.projectSkills;
+  const maxBytes = opts.limits?.maxUncompressedBytes ?? MAX_UNCOMPRESSED_BYTES;
+  const maxEntries = opts.limits?.maxEntries ?? MAX_ENTRIES;
+  const work = await mkdtemp(join2(tmpdir(), "pi-pilot-skill-"));
+  try {
+    const extractDir = join2(work, "x");
+    await mkdir(extractDir, { recursive: true });
+    await extractArchive(opts.zip, work, extractDir, { maxBytes, maxEntries });
+    const srcDir = await locateSkillDir(extractDir);
+    await assertNoSymlinks(srcDir);
+    const name = await resolveInstalledSkillName(srcDir, extractDir);
+    const dest = join2(base, name);
+    assertUnder(dest, [opts.roots.userSkills, opts.roots.projectSkills]);
+    if (await exists(dest)) {
+      if (!opts.overwrite) {
+        throw new HttpError(409, `a skill named "${name}" already exists \u2014 delete it first or overwrite`);
+      }
+      await rm(dest, { recursive: true, force: true });
+    }
+    await mkdir(base, { recursive: true });
+    await cp(srcDir, dest, {
+      recursive: true,
+      // Strip macOS archive cruft so the installed dir stays clean. (The
+      // tree is already symlink-free — see assertNoSymlinks above.)
+      filter: (src) => {
+        const b = basename(src);
+        return b !== "__MACOSX" && b !== ".DS_Store";
+      }
+    });
+    return { name, filePath: join2(dest, "SKILL.md") };
+  } finally {
+    await rm(work, { recursive: true, force: true });
+  }
+}
+async function extractArchive(zip, work, extractDir, caps) {
+  const isZip = zip.length >= 4 && zip[0] === 80 && zip[1] === 75;
+  const isGzip = zip.length >= 3 && zip[0] === 31 && zip[1] === 139 && zip[2] === 8;
+  if (!isZip && !isGzip) {
+    throw new HttpError(400, "uploaded file is not a .zip or .tar.gz archive");
+  }
+  try {
+    if (isZip) {
+      const zipPath = join2(work, "skill.zip");
+      await writeFile(zipPath, zip);
+      const { stdout } = await exec("unzip", ["-Z", "-t", zipPath]);
+      const m = stdout.match(/(\d+)\s+files?,\s+(\d+)\s+bytes uncompressed/);
+      if (!m) throw new HttpError(400, "could not read the archive's contents");
+      assertEntryCount(Number(m[1]), caps.maxEntries);
+      assertUncompressedSize(Number(m[2]), caps.maxBytes);
+      await exec("unzip", ["-o", "-q", zipPath, "-d", extractDir]);
+    } else {
+      const tarPath = join2(work, "skill.tar");
+      await gunzipToFileCapped(zip, tarPath, caps.maxBytes);
+      const { stdout } = await exec("tar", ["-tf", tarPath], { maxBuffer: 16 * 1024 * 1024 });
+      assertEntryCount(stdout.split("\n").filter((l) => l.length > 0).length, caps.maxEntries);
+      await exec("tar", ["-xf", tarPath, "-C", extractDir]);
+    }
+  } catch (err2) {
+    if (err2 instanceof HttpError) throw err2;
+    const e = err2;
+    if (e.code === "ENOENT") {
+      throw new HttpError(
+        500,
+        `\`${e.path ?? "unzip/tar"}\` is not available on the server host \u2014 install it or place the skill folder under your skills directory manually`
+      );
+    }
+    throw new HttpError(400, `could not extract archive: ${e.stderr?.trim() || e.message}`);
+  }
+}
+async function gunzipToFileCapped(gz, destPath, maxBytes) {
+  let total = 0;
+  const cap = new Transform({
+    transform(chunk, _enc, cb) {
+      total += chunk.length;
+      if (total > maxBytes) {
+        cb(
+          new HttpError(
+            400,
+            `archive expands beyond the ${Math.round(maxBytes / 1024 / 1024)} MB uncompressed cap`
+          )
+        );
+        return;
+      }
+      cb(null, chunk);
+    }
+  });
+  await pipeline(Readable.from([gz]), createGunzip(), cap, createWriteStream(destPath));
+}
+function assertEntryCount(entries, max) {
+  if (entries > max) {
+    throw new HttpError(400, `archive has too many files (${entries} > ${max})`);
+  }
+}
+function assertUncompressedSize(uncompressed, maxBytes) {
+  if (uncompressed > maxBytes) {
+    throw new HttpError(
+      400,
+      `archive expands to ${Math.round(uncompressed / 1024 / 1024)} MB uncompressed (max ${Math.round(maxBytes / 1024 / 1024)} MB)`
+    );
+  }
+}
+async function locateSkillDir(extractDir) {
+  if (await exists(join2(extractDir, "SKILL.md"))) return extractDir;
+  const dirs = (await readdir(extractDir, { withFileTypes: true })).filter(
+    (e) => e.isDirectory() && e.name !== "__MACOSX"
+  );
+  const withSkill = [];
+  for (const e of dirs) {
+    const dir = join2(extractDir, e.name);
+    if (await exists(join2(dir, "SKILL.md"))) withSkill.push(dir);
+  }
+  if (withSkill.length > 1) {
+    throw new HttpError(400, "archive contains multiple skill folders \u2014 install one skill per .zip");
+  }
+  if (withSkill.length === 1) return withSkill[0];
+  throw new HttpError(400, "archive has no SKILL.md (at the root or one level down)");
+}
+async function assertNoSymlinks(dir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const e of entries) {
+    if (e.isSymbolicLink()) {
+      throw new HttpError(
+        400,
+        "archive contains a symbolic link, which is not allowed in a skill package"
+      );
+    }
+    if (e.isDirectory()) await assertNoSymlinks(join2(dir, e.name));
+  }
+}
+async function resolveInstalledSkillName(srcDir, extractDir) {
+  const text = await readFile(join2(srcDir, "SKILL.md"), "utf8");
+  const fmName = parseFile(text).frontmatter.name;
+  if (typeof fmName === "string" && fmName.trim()) {
+    const n2 = fmName.trim();
+    ensureSkillName(n2);
+    return n2;
+  }
+  if (resolve(srcDir) === resolve(extractDir)) {
+    throw new HttpError(
+      400,
+      "SKILL.md has no `name:` field and the archive isn't wrapped in a folder \u2014 add a `name:` to the skill's frontmatter"
+    );
+  }
+  const n = basename(srcDir);
+  ensureSkillName(n);
+  return n;
+}
 async function createPrompt(opts) {
   const file = promptFileFor(opts.scope, opts.name, opts.roots);
   assertUnder(file, [opts.roots.userPrompts, opts.roots.projectPrompts]);
@@ -311,7 +472,7 @@ async function readPromptFile(filePath, roots) {
   assertUnder(filePath, [roots.userPrompts, roots.projectPrompts]);
   const text = await readFile(filePath, "utf8");
   const { frontmatter, body } = parseFile(text);
-  const stem = basename(filePath).replace(/\.md$/, "");
+  const stem = basename(filePath, ".md");
   return {
     body,
     name: stem,
@@ -319,10 +480,6 @@ async function readPromptFile(filePath, roots) {
     argumentHint: stringOr(frontmatter["argument-hint"], void 0)
   };
 }
-function basename(p) {
-  const parts = p.split(sep);
-  return parts.at(-1) || p;
-}
 function stringOr(value, fallback) {
   return typeof value === "string" ? value : fallback;
 }
@@ -338,17 +495,47 @@ async function exists(p) {
   }
 }
 var HttpError = class extends Error {
-  constructor(status, message) {
+  constructor(status2, message) {
     super(message);
-    this.status = status;
+    this.status = status2;
   }
   status;
 };
 
 // src/storage/workspace-registry.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join3 } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join3 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/storage/atomic-json.ts
+import { chmod, mkdir as mkdir2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2 } from "path";
 import { randomUUID } from "crypto";
+async function writeJsonAtomic(filePath, data, opts) {
+  await mkdir2(dirname2(filePath), { recursive: true });
+  const tmp = `${filePath}.${randomUUID()}.tmp`;
+  const text = JSON.stringify(data, null, 2);
+  try {
+    if (opts?.mode !== void 0) {
+      await writeFile2(tmp, text, { encoding: "utf8", mode: opts.mode });
+    } else {
+      await writeFile2(tmp, text, "utf8");
+    }
+    await rename(tmp, filePath);
+  } catch (err2) {
+    await rm2(tmp, { force: true }).catch(() => {
+    });
+    throw err2;
+  }
+  if (opts?.mode !== void 0) {
+    try {
+      await chmod(filePath, opts.mode);
+    } catch {
+    }
+  }
+}
+
+// src/storage/workspace-registry.ts
 var REGISTRY_PATH = join3(config.dataDir, "workspaces.json");
 var cache;
 var writeChain = Promise.resolve();
@@ -373,8 +560,7 @@ async function load() {
 }
 async function save() {
   if (!cache) return;
-  await mkdir2(dirname2(REGISTRY_PATH), { recursive: true });
-  await writeFile2(REGISTRY_PATH, JSON.stringify(cache, null, 2), "utf8");
+  await writeJsonAtomic(REGISTRY_PATH, cache);
 }
 async function listWorkspaces() {
   const r = await load();
@@ -394,7 +580,7 @@ async function addWorkspace(input) {
       return;
     }
     const ws = {
-      id: randomUUID(),
+      id: randomUUID2(),
       name: input.name,
       path: input.path,
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -417,6 +603,19 @@ async function removeWorkspace(id) {
   });
   return removed;
 }
+async function setWorkspaceTrustProjectAgents(id, trusted) {
+  let updated;
+  await serializedWrite(async () => {
+    const r = await load();
+    const ws = r.workspaces.find((w) => w.id === id);
+    if (!ws) return;
+    if (trusted) ws.trustProjectAgents = true;
+    else delete ws.trustProjectAgents;
+    await save();
+    updated = ws;
+  });
+  return updated;
+}
 async function reorderWorkspaces(ids) {
   await serializedWrite(async () => {
     const r = await load();
@@ -439,9 +638,9 @@ async function reorderWorkspaces(ids) {
 }
 
 // src/storage/workspace-stats.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var exec = promisify(execFile);
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var exec2 = promisify2(execFile2);
 var CACHE_TTL_MS = 3e4;
 var cache2 = /* @__PURE__ */ new Map();
 var inflight = /* @__PURE__ */ new Map();
@@ -453,13 +652,14 @@ async function enrichWorkspace(ws) {
     path: ws.path,
     addedAt: ws.addedAt,
     gitBranch: stats.gitBranch,
-    fileCount: stats.fileCount
+    fileCount: stats.fileCount,
+    trustProjectAgents: ws.trustProjectAgents === true
   };
 }
 async function getStats(path) {
   const now = Date.now();
-  const cached = cache2.get(path);
-  if (cached && cached.expiresAt > now) return cached;
+  const cached2 = cache2.get(path);
+  if (cached2 && cached2.expiresAt > now) return cached2;
   const pending2 = inflight.get(path);
   if (pending2) return pending2;
   const probe = probeStats(path).then((stats) => {
@@ -516,7 +716,7 @@ async function probeStats(path) {
   return { gitBranch, fileCount };
 }
 async function runGit(cwd, args) {
-  const { stdout } = await exec("git", args, {
+  const { stdout } = await exec2("git", args, {
     cwd,
     timeout: 2e3,
     maxBuffer: 5 * 1024 * 1024,
@@ -529,15 +729,106 @@ async function runGit(cwd, args) {
 
 // src/workspace-manager.ts
 import { unlink as unlink2 } from "fs/promises";
-import { isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 import {
   createAgentSessionFromServices,
   createAgentSessionRuntime,
   createAgentSessionServices,
-  getAgentDir,
+  getAgentDir as getAgentDir2,
   SessionManager
 } from "@earendil-works/pi-coding-agent";
 
+// src/storage/session-tool-prefs.ts
+import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "path";
+var PREFS_PATH = join4(config.dataDir, "session-tools.json");
+var cache3 = { sessions: {} };
+async function loadSessionToolPrefs() {
+  try {
+    const raw = await readFile3(PREFS_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    cache3 = { sessions: normalizeSessions(parsed.sessions) };
+  } catch (err2) {
+    cache3 = { sessions: {} };
+    if (err2.code !== "ENOENT") {
+      console.warn(`[session-tool-prefs] ignoring unreadable ${PREFS_PATH}:`, err2);
+    }
+  }
+}
+function keyOf(workspaceId, session) {
+  return session.sessionFile ? resolve2(session.sessionFile) : `${workspaceId}:${session.sessionId}`;
+}
+function storedDisabled(workspaceId, session) {
+  return cache3.sessions[keyOf(workspaceId, session)]?.disabled ?? [];
+}
+async function persistActiveTools(workspaceId, session, activeNames) {
+  const registered = session.getAllTools().map((t) => t.name);
+  const registeredSet = new Set(registered);
+  const active = new Set(activeNames);
+  const disabled = /* @__PURE__ */ new Set();
+  for (const name of registered) {
+    if (!active.has(name)) disabled.add(name);
+  }
+  for (const name of storedDisabled(workspaceId, session)) {
+    if (!registeredSet.has(name)) disabled.add(name);
+  }
+  cache3 = {
+    sessions: {
+      ...cache3.sessions,
+      [keyOf(workspaceId, session)]: {
+        disabled: sortUnique(disabled),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    }
+  };
+  await save2();
+  session.setActiveToolsByName(registered.filter((name) => !disabled.has(name)));
+}
+function reapplyToolPrefs(workspaceId, session) {
+  const disabled = storedDisabled(workspaceId, session);
+  if (disabled.length === 0) return;
+  const disabledSet = new Set(disabled);
+  const registered = session.getAllTools().map((t) => t.name);
+  session.setActiveToolsByName(registered.filter((name) => !disabledSet.has(name)));
+}
+async function forgetSessionToolPrefs(sessionPath) {
+  const key = resolve2(sessionPath);
+  if (!(key in cache3.sessions)) return;
+  const next = { ...cache3.sessions };
+  delete next[key];
+  cache3 = { sessions: next };
+  await save2();
+}
+function sortUnique(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+function normalizeSessions(value) {
+  if (!value || typeof value !== "object") return {};
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (!entry || typeof entry !== "object") continue;
+    const disabled = entry.disabled;
+    if (!Array.isArray(disabled)) continue;
+    const updatedAt = entry.updatedAt;
+    out[key] = {
+      disabled: sortUnique(disabled.filter((n) => typeof n === "string")),
+      updatedAt: typeof updatedAt === "string" ? updatedAt : (/* @__PURE__ */ new Date(0)).toISOString()
+    };
+  }
+  return out;
+}
+var writeChain2 = Promise.resolve();
+function save2() {
+  writeChain2 = writeChain2.catch(() => {
+  }).then(async () => {
+    await mkdir3(dirname3(PREFS_PATH), { recursive: true });
+    const tmp = `${PREFS_PATH}.tmp`;
+    await writeFile3(tmp, JSON.stringify(cache3, null, 2), "utf8");
+    await rename2(tmp, PREFS_PATH);
+  });
+  return writeChain2;
+}
+
 // src/extensions/todo/schema.ts
 import { Type } from "typebox";
 var EMPTY_STATE = { tasks: [], nextId: 1 };
@@ -877,7 +1168,7 @@ function waitForAnswer({
   sessionFile,
   signal
 }) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve9, reject) => {
     let settled = false;
     let timeoutHandle;
     const cleanup = () => {
@@ -889,7 +1180,7 @@ function waitForAnswer({
       if (settled) return;
       settled = true;
       cleanup();
-      resolve6(a);
+      resolve9(a);
     };
     const finishErr = (err2) => {
       if (settled) return;
@@ -1027,140 +1318,1468 @@ var artifactExtensionFactory = (pi) => {
   });
 };
 
-// src/storage/builtin-extension-prefs.ts
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, join as join4 } from "path";
-var PREFS_PATH = join4(config.dataDir, "builtin-extensions.json");
-var cache3 = { disabled: [] };
-async function loadBuiltinPrefs() {
+// src/extensions/subagent/agents.ts
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join6 } from "path";
+import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
+
+// src/extensions/subagent/builtin-agents.ts
+var COMMON_RULES = `Hard rules:
+- You run headless as a subagent: there is NO user to talk to. Never ask questions, never wait for confirmation \u2014 decide and proceed.
+- NEVER run the \`pi\` CLI or spawn any other agent. No nesting.
+- End with ONE final message that is a complete, self-contained report \u2014 it is the ONLY thing returned to the agent that delegated to you. Keep it under ~8000 characters and reference code as \`path:line\`.`;
+var scout = {
+  name: "scout",
+  source: "builtin",
+  description: "Fast read-only codebase recon: locate files, symbols, flows, conventions, and report compressed findings. Cheap to use; cannot edit anything.",
+  tools: ["read", "grep", "find", "ls"],
+  systemPrompt: `You are "scout", a read-only reconnaissance subagent.
+
+${COMMON_RULES}
+
+Method: start broad (find/ls/grep), then read only the spans that matter. Prefer reading slices over whole files. Stop as soon as you can answer confidently.
+
+Final report shape: a short answer first, then the supporting map \u2014 relevant files with one-line roles, key symbols as \`path:line\`, and any conventions or gotchas the delegator should know. Say explicitly what you did NOT verify.`
+};
+var worker = {
+  name: "worker",
+  source: "builtin",
+  description: "General-purpose implementer with the full default toolset (bash/edit/write). Use for a self-contained change with a precise brief; verifies its own work.",
+  systemPrompt: `You are "worker", an implementation subagent.
+
+${COMMON_RULES}
+
+Method: read the relevant code before changing it; follow the surrounding style exactly; make the smallest change that satisfies the brief. Verify with the project's own commands (typecheck / tests / build) when available \u2014 report what you ran and its outcome honestly.
+
+Final report shape: what changed (file by file, one line each), how it was verified (commands + results), and any caveats or follow-ups. If you could not finish, say precisely how far you got and what is left.`
+};
+var reviewer = {
+  name: "reviewer",
+  source: "builtin",
+  description: "Code review of specific files or diffs: correctness, edge cases, convention drift. Read-mostly (bash for git diff / running tests). Returns prioritized findings.",
+  tools: ["read", "grep", "find", "ls", "bash"],
+  systemPrompt: `You are "reviewer", a code-review subagent. Your job is to FIND problems, not to fix them \u2014 do not edit any file.
+
+${COMMON_RULES}
+
+Method: read the target code fully before judging; use bash only for read-only inspection (git diff/log, running existing tests). Hunt real defects first \u2014 correctness, edge cases, lifecycle/cleanup holes \u2014 then convention drift. Verify each suspicion against the actual code before reporting it.
+
+Final report shape: findings ordered by severity, each with \`path:line\`, what's wrong, why it matters, and a concrete suggested fix. End with what you checked and found clean, so silence isn't ambiguous.`
+};
+var BUILTIN_AGENTS = [scout, worker, reviewer];
+
+// src/extensions/subagent/trust.ts
+import { readFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5, resolve as resolve3 } from "path";
+function isProjectDirTrusted(projectDir) {
+  const registryPath = join5(
+    process.env.PI_PILOT_DATA_DIR ?? join5(homedir2(), ".pi", "webui"),
+    "workspaces.json"
+  );
   try {
-    const raw = await readFile3(PREFS_PATH, "utf8");
-    const parsed = JSON.parse(raw);
-    cache3 = { disabled: Array.isArray(parsed.disabled) ? parsed.disabled : [] };
-  } catch (err2) {
-    cache3 = { disabled: [] };
-    if (err2.code !== "ENOENT") {
-      console.warn(`[builtin-prefs] ignoring unreadable ${PREFS_PATH}:`, err2);
-    }
+    const raw = JSON.parse(readFileSync(registryPath, "utf8"));
+    if (!Array.isArray(raw.workspaces)) return false;
+    const wanted = resolve3(projectDir);
+    return raw.workspaces.some(
+      (w) => typeof w?.path === "string" && resolve3(w.path) === wanted && w.trustProjectAgents === true
+    );
+  } catch {
+    return false;
   }
 }
-function isBuiltinDisabled(id) {
-  if (cache3.disabled.includes(id)) return true;
-  if (id === "todo" && cache3.disabled.includes("plan")) return true;
-  return false;
+
+// src/extensions/subagent/agents.ts
+function userAgentsDir() {
+  return join6(getAgentDir(), "agents");
 }
-function getDisabledBuiltins() {
-  return [...cache3.disabled];
+function projectAgentsDir(projectDir) {
+  return join6(projectDir, ".pi", "agents");
 }
-async function setBuiltinEnabled(id, enabled) {
-  const next = new Set(cache3.disabled);
-  if (enabled) next.delete(id);
-  else next.add(id);
-  cache3 = { disabled: [...next] };
-  await save2();
+function discoverAgents(projectDir) {
+  const roster = /* @__PURE__ */ new Map();
+  for (const agent of BUILTIN_AGENTS) roster.set(agent.name, agent);
+  mergeDir(roster, userAgentsDir(), "user");
+  if (projectDir && isProjectDirTrusted(projectDir)) {
+    mergeDir(roster, projectAgentsDir(projectDir), "project");
+  }
+  return roster;
 }
-async function save2() {
-  await mkdir3(dirname3(PREFS_PATH), { recursive: true });
-  await writeFile3(PREFS_PATH, JSON.stringify(cache3, null, 2), "utf8");
+function mergeDir(roster, dir, source) {
+  let files;
+  try {
+    files = readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    return;
+  }
+  for (const file of files) {
+    const def = parseAgentFile(join6(dir, file), file, source);
+    if (def) roster.set(def.name, def);
+  }
 }
-
-// src/extensions/index.ts
-var BUILTIN_EXTENSIONS = [
-  {
-    id: "todo",
-    name: "Todo",
-    description: "A CRUD task list for tracking multi-step work \u2014 adds the todo tool and the /todos command.",
-    tools: ["todo"],
-    commands: ["todos"],
-    factory: todoExtensionFactory
-  },
-  {
-    id: "ask_user",
-    name: "Ask user",
-    description: "Lets the agent pause and ask you a structured multiple-choice question \u2014 adds the ask_user tool.",
-    tools: ["ask_user"],
-    commands: [],
-    factory: askUserExtensionFactory
-  },
-  {
-    id: "artifact",
-    name: "Artifacts",
-    description: "Lets the agent publish substantial, self-contained content \u2014 web pages, SVG diagrams, documents, code files \u2014 as versioned artifacts rendered in a side panel. Adds the create_artifact tool.",
-    tools: ["create_artifact"],
-    commands: [],
-    factory: artifactExtensionFactory
+function rosterSummary(roster) {
+  return [...roster.values()].map((a) => `- ${a.name}: ${a.description || "(no description)"}`).join("\n");
+}
+function parseAgentFile(path, filename, source) {
+  try {
+    const raw = readFileSync2(path, "utf8");
+    const { frontmatter, body } = parseFrontmatter(raw);
+    const name = strField(frontmatter.name) ?? filename.replace(/\.md$/, "").trim();
+    if (!name) return void 0;
+    return {
+      name,
+      description: strField(frontmatter.description) ?? "",
+      systemPrompt: body.trim(),
+      tools: toolsField(frontmatter.tools),
+      model: strField(frontmatter.model),
+      source
+    };
+  } catch {
+    return void 0;
   }
-];
-function gate(def) {
-  return (pi) => {
-    if (isBuiltinDisabled(def.id)) return;
-    return def.factory(pi);
-  };
 }
-var builtinExtensionFactories = BUILTIN_EXTENSIONS.map(gate);
+function strField(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function toolsField(value) {
+  if (typeof value === "string") {
+    const parts = value.split(",").map((s) => s.trim()).filter(Boolean);
+    return parts.length > 0 ? parts : void 0;
+  }
+  if (Array.isArray(value)) {
+    const parts = value.filter((v) => typeof v === "string" && v.trim() !== "");
+    return parts.length > 0 ? parts.map((s) => s.trim()) : void 0;
+  }
+  return void 0;
+}
 
-// src/extensions/ask_user/cleanup.ts
-var CUSTOM_TYPE = "ask_user-restart-cancelled";
-function reconcileAfterRestart(sessionManager) {
-  const branch = sessionManager.getBranch();
-  if (branch.length === 0) return;
-  const satisfied = /* @__PURE__ */ new Set();
-  const danglingIds = [];
-  const danglingAlreadyHandled = /* @__PURE__ */ new Set();
-  for (let i = branch.length - 1; i >= 0; i--) {
-    const entry = branch[i];
-    if (entry.type === "custom_message") {
-      const cm = entry;
-      if (cm.customType === CUSTOM_TYPE) {
-        const ids = cm.details?.ids;
-        if (Array.isArray(ids)) {
-          for (const id of ids) {
-            if (typeof id === "string") danglingAlreadyHandled.add(id);
-          }
-        }
-      }
-      continue;
-    }
-    if (entry.type !== "message") continue;
-    const msg = entry.message;
-    if (msg.role === "toolResult" && typeof msg.toolCallId === "string") {
-      satisfied.add(msg.toolCallId);
-      continue;
-    }
-    if (msg.role === "assistant" && Array.isArray(msg.content)) {
-      for (const block of msg.content) {
-        if (!block || typeof block !== "object") continue;
-        const b = block;
-        if (b.type !== "toolCall") continue;
-        if (b.name !== "ask_user") continue;
-        if (typeof b.id !== "string") continue;
-        if (satisfied.has(b.id)) continue;
-        if (danglingAlreadyHandled.has(b.id)) continue;
-        danglingIds.push(b.id);
+// src/extensions/subagent/child.ts
+import { spawn } from "child_process";
+import {
+  createWriteStream as createWriteStream2,
+  mkdirSync,
+  mkdtempSync,
+  writeFileSync
+} from "fs";
+import { rm as rm3 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join8 } from "path";
+
+// src/extensions/subagent/schema.ts
+import { Type as Type4 } from "typebox";
+var MAX_TASKS_PER_CALL = 8;
+var taskBriefDescription = "Complete, self-contained task brief. The subagent sees NOTHING of this conversation \u2014 include all relevant paths, constraints, context, and the exact shape of the answer you want back.";
+var subagentParamsSchema = Type4.Object({
+  agent: Type4.Optional(
+    Type4.String({
+      description: "Single mode: agent to delegate to, by name. The roster is listed in the tool description; an unknown name returns the available roster. Use together with `task`; omit when using `tasks`."
+    })
+  ),
+  task: Type4.Optional(Type4.String({ description: taskBriefDescription })),
+  tasks: Type4.Optional(
+    Type4.Array(
+      Type4.Object({
+        agent: Type4.String({ description: "Agent to delegate this task to, by name." }),
+        task: Type4.String({ description: taskBriefDescription })
+      }),
+      {
+        maxItems: MAX_TASKS_PER_CALL,
+        description: `Parallel mode: up to ${MAX_TASKS_PER_CALL} INDEPENDENT task briefs, run concurrently. All results return together in one combined report. Only for tasks with no ordering dependency \u2014 sequence dependent steps as separate subagent calls instead. Omit when using \`agent\`/\`task\`.`
       }
-      break;
+    )
+  )
+});
+function emptyUsage() {
+  return {
+    input: 0,
+    output: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    cost: 0,
+    contextTokens: 0,
+    turns: 0
+  };
+}
+function isSubagentDetails(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return v.version === 1 && (v.mode === "single" || v.mode === "parallel") && Array.isArray(v.tasks);
+}
+
+// src/extensions/subagent/pi-bin.ts
+import { existsSync } from "fs";
+import { dirname as dirname4, join as join7 } from "path";
+import { fileURLToPath } from "url";
+var cached;
+function resolvePinnedPiCli() {
+  if (cached) return cached;
+  try {
+    const entry = fileURLToPath(
+      import.meta.resolve("@earendil-works/pi-coding-agent")
+    );
+    const candidate = join7(dirname4(entry), "cli.js");
+    if (existsSync(candidate)) {
+      cached = candidate;
+      return candidate;
     }
-    if (msg.role === "user") break;
+  } catch {
   }
-  if (danglingIds.length === 0) return;
-  const idList = danglingIds.join(", ");
-  const text = `[pi-pilot] Your previous ask_user call(s) [${idList}] were cancelled because the server restarted before the user answered. Use your best judgement and proceed; you may re-call ask_user if the decision still matters.`;
-  sessionManager.appendCustomMessageEntry(
-    CUSTOM_TYPE,
-    text,
-    true,
-    // display in TUI too (no-op in pi-pilot, but harmless)
-    { ids: danglingIds }
+  const fallback = fileURLToPath(
+    new URL(
+      "../../../node_modules/@earendil-works/pi-coding-agent/dist/cli.js",
+      import.meta.url
+    )
+  );
+  if (existsSync(fallback)) {
+    cached = fallback;
+    return fallback;
+  }
+  throw new Error(
+    "subagent: cannot locate the pinned @earendil-works/pi-coding-agent CLI (tried import.meta.resolve and the package-local node_modules symlink)"
   );
 }
 
-// src/ws/bridge.ts
-function translatePiEvent(ev) {
-  switch (ev.type) {
-    case "agent_start":
-      return { kind: "agent_start" };
-    case "agent_end":
-      return { kind: "agent_end", willRetry: ev.willRetry };
+// src/extensions/subagent/registry.ts
+var children = /* @__PURE__ */ new Map();
+function registerChild(toolCallId, handle2) {
+  children.set(toolCallId, handle2);
+}
+function unregisterChild(toolCallId) {
+  children.delete(toolCallId);
+}
+function killChildrenForSession(sessionFile) {
+  let killed = 0;
+  for (const [id, handle2] of children) {
+    if (handle2.sessionFile !== sessionFile) continue;
+    children.delete(id);
+    handle2.kill();
+    killed++;
+  }
+  return killed;
+}
+function killAllChildren() {
+  let killed = 0;
+  for (const [id, handle2] of children) {
+    children.delete(id);
+    handle2.kill();
+    killed++;
+  }
+  return killed;
+}
+var MAX_CONCURRENT_CHILDREN = 8;
+var MAX_CONCURRENT_PER_SESSION = 4;
+var running = 0;
+var runningPerSession = /* @__PURE__ */ new Map();
+var waiters = [];
+function keyOf2(sessionFile) {
+  return sessionFile ?? "<unpersisted>";
+}
+function hasCapacity(sessionKey) {
+  return running < MAX_CONCURRENT_CHILDREN && (runningPerSession.get(sessionKey) ?? 0) < MAX_CONCURRENT_PER_SESSION;
+}
+function take(sessionKey) {
+  running++;
+  runningPerSession.set(sessionKey, (runningPerSession.get(sessionKey) ?? 0) + 1);
+}
+function acquireChildSlot(signal, sessionFile) {
+  const sessionKey = keyOf2(sessionFile);
+  return new Promise((resolve9, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Aborted by user"));
+      return;
+    }
+    if (hasCapacity(sessionKey)) {
+      take(sessionKey);
+      resolve9(makeRelease(sessionKey));
+      return;
+    }
+    const waiter = {
+      grant: () => resolve9(makeRelease(sessionKey)),
+      sessionKey,
+      signal,
+      onAbort: void 0
+    };
+    if (signal) {
+      const onAbort = () => {
+        const i = waiters.indexOf(waiter);
+        if (i >= 0) waiters.splice(i, 1);
+        reject(new Error("Aborted by user"));
+      };
+      waiter.onAbort = onAbort;
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+    waiters.push(waiter);
+  });
+}
+function makeRelease(sessionKey) {
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    running--;
+    const n = (runningPerSession.get(sessionKey) ?? 1) - 1;
+    if (n <= 0) runningPerSession.delete(sessionKey);
+    else runningPerSession.set(sessionKey, n);
+    pump();
+  };
+}
+function pump() {
+  for (let i = 0; i < waiters.length && running < MAX_CONCURRENT_CHILDREN; ) {
+    const waiter = waiters[i];
+    if (waiter.signal?.aborted) {
+      waiters.splice(i, 1);
+      continue;
+    }
+    if (!hasCapacity(waiter.sessionKey)) {
+      i++;
+      continue;
+    }
+    waiters.splice(i, 1);
+    if (waiter.signal && waiter.onAbort) {
+      waiter.signal.removeEventListener("abort", waiter.onAbort);
+    }
+    take(waiter.sessionKey);
+    waiter.grant();
+  }
+}
+
+// src/extensions/subagent/child.ts
+var PROMPT_DIR_PREFIX = "pi-pilot-subagent-";
+var TRANSCRIPTS_DIR = join8(tmpdir2(), "pi-pilot-subagents", "transcripts");
+var ACTIVITY_MAX = 30;
+var LABEL_MAX = 160;
+var STDERR_TAIL_MAX = 2048;
+var FINAL_TEXT_MAX = 2e5;
+var SIGKILL_DELAY_MS = 5e3;
+async function runChild(opts) {
+  const startedAt = Date.now();
+  const cli = opts.cliPath ?? process.env.PI_PILOT_SUBAGENT_CLI ?? resolvePinnedPiCli();
+  const promptDir = mkdtempSync(join8(tmpdir2(), PROMPT_DIR_PREFIX));
+  const promptPath = join8(promptDir, "prompt.md");
+  writeFileSync(promptPath, opts.appendSystemPrompt, { mode: 384 });
+  let transcriptPath;
+  let tee;
+  try {
+    mkdirSync(TRANSCRIPTS_DIR, { recursive: true });
+    transcriptPath = join8(TRANSCRIPTS_DIR, `${sanitizeId(opts.toolCallId)}.ndjson`);
+    tee = createWriteStream2(transcriptPath, { flags: "w" });
+    tee.on("error", () => {
+    });
+  } catch {
+    transcriptPath = void 0;
+  }
+  const args = [cli, "--mode", "json", "-p", "--no-session", "--no-extensions", "--no-skills"];
+  const model = opts.agent.model ?? opts.inheritModel;
+  if (model) args.push("--model", model);
+  if (opts.agent.tools && opts.agent.tools.length > 0) {
+    args.push("--tools", opts.agent.tools.join(","));
+  }
+  args.push("--append-system-prompt", promptPath);
+  args.push(opts.task);
+  const usage = emptyUsage();
+  const activity = [];
+  let modelSeen;
+  let finalText = "";
+  let stopReason;
+  let errorMessage;
+  let stderrAccum = "";
+  let aborted = false;
+  let timedOut = false;
+  let costKilled = false;
+  const child = spawn(process.execPath, args, {
+    cwd: opts.cwd,
+    env: { ...process.env, PI_PILOT_SUBAGENT: opts.toolCallId },
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
+  });
+  if (child.pid !== void 0) {
+    try {
+      writeFileSync(join8(promptDir, "pid"), `${child.pid}
+${process.pid}`);
+    } catch {
+    }
+  }
+  let killed = false;
+  let killTimer;
+  const killGracefully = () => {
+    if (killed) return;
+    killed = true;
+    try {
+      child.kill("SIGTERM");
+    } catch {
+    }
+    killTimer = setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    }, SIGKILL_DELAY_MS);
+  };
+  registerChild(opts.toolCallId, {
+    sessionFile: opts.sessionFile,
+    agent: opts.agent.name,
+    kill: killGracefully
+  });
+  const onAbort = () => {
+    aborted = true;
+    killGracefully();
+  };
+  if (opts.signal?.aborted) onAbort();
+  else opts.signal?.addEventListener("abort", onAbort, { once: true });
+  let stalled = false;
+  const timeoutTimer = setTimeout(() => {
+    timedOut = true;
+    killGracefully();
+  }, opts.timeoutMs);
+  let stallTimer;
+  const armStallTimer = () => {
+    if (killed) return;
+    if (stallTimer) clearTimeout(stallTimer);
+    stallTimer = setTimeout(() => {
+      stalled = true;
+      timedOut = true;
+      killGracefully();
+    }, opts.stallTimeoutMs);
+  };
+  armStallTimer();
+  const emitProgress = () => {
+    opts.onProgress({
+      usage: { ...usage },
+      model: modelSeen,
+      activity: [...activity],
+      lastLabel: activity[activity.length - 1]?.label
+    });
+  };
+  const handleLine = (line) => {
+    if (!line.trim()) return;
+    tee?.write(line + "\n");
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      return;
+    }
+    const ev = event;
+    if (ev.type !== "message_end" || !ev.message || typeof ev.message !== "object") return;
+    const msg = ev.message;
+    if (msg.role !== "assistant") return;
+    usage.turns++;
+    const u = msg.usage;
+    if (u) {
+      usage.input += u.input ?? 0;
+      usage.output += u.output ?? 0;
+      usage.cacheRead += u.cacheRead ?? 0;
+      usage.cacheWrite += u.cacheWrite ?? 0;
+      usage.cost += u.cost?.total ?? 0;
+      usage.contextTokens = u.totalTokens ?? usage.contextTokens;
+    }
+    if (!modelSeen && typeof msg.model === "string") modelSeen = msg.model;
+    if (typeof msg.stopReason === "string") stopReason = msg.stopReason;
+    if (typeof msg.errorMessage === "string") errorMessage = msg.errorMessage;
+    if (Array.isArray(msg.content)) {
+      const textParts = [];
+      for (const block of msg.content) {
+        if (!block || typeof block !== "object") continue;
+        const b = block;
+        if (b.type === "text" && typeof b.text === "string") {
+          textParts.push(b.text);
+        } else if (b.type === "toolCall" && typeof b.name === "string") {
+          pushActivity(activity, b.name, b.arguments);
+        }
+      }
+      const text = textParts.join("").trim();
+      if (text) finalText = text.slice(0, FINAL_TEXT_MAX);
+    }
+    if (usage.cost > opts.costCeilingUsd && !costKilled) {
+      costKilled = true;
+      killGracefully();
+    }
+    emitProgress();
+  };
+  let buf = "";
+  child.stdout?.on("data", (chunk) => {
+    armStallTimer();
+    buf += chunk.toString("utf8");
+    let nl;
+    while ((nl = buf.indexOf("\n")) >= 0) {
+      handleLine(buf.slice(0, nl));
+      buf = buf.slice(nl + 1);
+    }
+  });
+  child.stderr?.on("data", (chunk) => {
+    armStallTimer();
+    stderrAccum = (stderrAccum + chunk.toString("utf8")).slice(-STDERR_TAIL_MAX);
+  });
+  const exitCode = await new Promise((resolve9) => {
+    child.on("error", (err2) => {
+      errorMessage ??= err2 instanceof Error ? err2.message : String(err2);
+      resolve9(-1);
+    });
+    child.on("close", (code) => resolve9(code ?? -1));
+  });
+  if (buf) handleLine(buf);
+  clearTimeout(timeoutTimer);
+  if (stallTimer) clearTimeout(stallTimer);
+  if (killTimer) clearTimeout(killTimer);
+  opts.signal?.removeEventListener("abort", onAbort);
+  unregisterChild(opts.toolCallId);
+  tee?.end();
+  await rm3(promptDir, { recursive: true, force: true }).catch(() => {
+  });
+  if (costKilled && !errorMessage) {
+    errorMessage = `cost ceiling ($${opts.costCeilingUsd}) exceeded \u2014 child terminated`;
+  }
+  if (timedOut && !aborted && !errorMessage) {
+    errorMessage = stalled ? `no output for ${Math.round(opts.stallTimeoutMs / 1e3)}s \u2014 presumed hung` : `wall-clock limit (${Math.round(opts.timeoutMs / 1e3)}s) reached while still active`;
+  }
+  const failed = exitCode !== 0 || stopReason === "error" || stopReason === "aborted" || costKilled;
+  const status2 = aborted ? "aborted" : timedOut ? "timeout" : failed ? "failed" : "done";
+  return {
+    status: status2,
+    finalText,
+    usage,
+    model: modelSeen,
+    stopReason,
+    errorMessage,
+    stderrTail: stderrAccum.trim(),
+    exitCode,
+    durationMs: Date.now() - startedAt,
+    transcriptPath,
+    activity
+  };
+}
+function sanitizeId(id) {
+  return id.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function pushActivity(activity, name, args) {
+  const label = toolLabel(name, args).slice(0, LABEL_MAX);
+  activity.push({ kind: "tool", label });
+  if (activity.length > ACTIVITY_MAX) {
+    activity.splice(0, activity.length - ACTIVITY_MAX);
+  }
+}
+function toolLabel(name, args) {
+  const a = args && typeof args === "object" ? args : {};
+  const pick = (...keys) => {
+    for (const key of keys) {
+      const v = a[key];
+      if (typeof v === "string" && v.trim()) return v;
+    }
+    return void 0;
+  };
+  let detail;
+  switch (name) {
+    case "bash":
+      detail = pick("command");
+      break;
+    case "read":
+    case "write":
+    case "edit":
+      detail = pick("path", "file_path");
+      break;
+    case "grep":
+      detail = pick("pattern");
+      break;
+    case "find":
+      detail = pick("pattern", "path");
+      break;
+    case "ls":
+      detail = pick("path");
+      break;
+    default: {
+      for (const v of Object.values(a)) {
+        if (typeof v === "string" && v.trim()) {
+          detail = v;
+          break;
+        }
+      }
+    }
+  }
+  const clean = detail?.replace(/\s+/g, " ").trim();
+  return clean ? `${name}: ${clean}` : name;
+}
+
+// src/extensions/subagent/factory.ts
+var TASK_OUTPUT_CAP = 12 * 1024;
+var AGGREGATE_OUTPUT_CAP = 48 * 1024;
+var PREVIEW_CAP = 8 * 1024;
+var STDERR_DETAILS_CAP = 1024;
+var UPDATE_THROTTLE_MS = 500;
+function tunable(envName, fallback) {
+  const raw = process.env[envName];
+  if (!raw) return fallback;
+  const n = Number.parseFloat(raw);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+var TASK_TIMEOUT_MS = tunable("PI_PILOT_SUBAGENT_TIMEOUT_SEC", 3600) * 1e3;
+var STALL_TIMEOUT_MS = tunable("PI_PILOT_SUBAGENT_STALL_SEC", 600) * 1e3;
+var COST_CEILING_USD = tunable("PI_PILOT_SUBAGENT_COST_USD", 20);
+var subagentExtensionFactory = (pi) => {
+  const lastDetails = /* @__PURE__ */ new Map();
+  const rosterAtRegistration = discoverAgents();
+  pi.registerTool({
+    name: "subagent",
+    label: "Subagent",
+    description: `Delegate self-contained tasks to subagents running in isolated contexts (separate pi processes that see nothing of this conversation). Returns only the subagents' final reports. Pass \`agent\` + \`task\` for one delegation, or \`tasks\` (up to ${MAX_TASKS_PER_CALL}) to run INDEPENDENT delegations in parallel. Available agents:
+` + rosterSummary(rosterAtRegistration) + `
+The roster is re-read on every call from ${userAgentsDir()}/*.md (builtin presets scout/worker/reviewer; a same-name user file overrides its preset; workspaces with project agents trusted also merge <cwd>/.pi/agents/*.md, which win over both).`,
+    parameters: subagentParamsSchema,
+    executionMode: "parallel",
+    promptSnippet: "subagent: delegate self-contained tasks (recon, a bounded implementation step, a review pass) to isolated child agents \u2014 only their final reports return, keeping large searches and side work out of this context. Independent tasks can fan out in parallel via `tasks`.",
+    promptGuidelines: [
+      "Use subagent when a task is self-contained and would otherwise flood this context (broad codebase recon, a bounded implementation step, a review pass). Don't delegate trivial lookups \u2014 a single read/grep inline is faster and cheaper than a child agent.",
+      "Write complete subagent briefs: the child sees NOTHING of this conversation. Include the relevant paths, constraints, acceptance criteria, and the exact shape of the report you want back.",
+      "Pick the cheapest sufficient agent: scout for read-only recon, reviewer for read-mostly review, worker only when files must change.",
+      `Use \`tasks\` (max ${MAX_TASKS_PER_CALL} per call) ONLY for independent work \u2014 no task's input may depend on another's output, and parallel workers must never edit the same files. All results return together; sequence dependent steps as separate calls instead.`,
+      "Subagents cannot ask the user questions and cannot spawn further subagents. Resolve user decisions (ask_user) BEFORE delegating, and sequence dependent work yourself: delegate, read the report, then issue the next call with the context it needs."
+    ],
+    execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+      const roster = discoverAgents(ctx.cwd);
+      const calls = normalizeCalls(params);
+      if (typeof calls === "string") {
+        return invalidCallResult(calls, params);
+      }
+      const { mode, briefs } = calls;
+      const unknown = [...new Set(briefs.map((b) => b.agent.trim()))].filter(
+        (name) => !roster.has(name)
+      );
+      if (unknown.length > 0) {
+        return invalidCallResult(
+          `Unknown agent${unknown.length > 1 ? "s" : ""} ${unknown.map((n) => `"${n}"`).join(", ")}. Available agents:
+` + rosterSummary(roster) + "\nCall subagent again with one of these names.",
+          params
+        );
+      }
+      if (signal?.aborted) throw new Error("Aborted by user");
+      const sessionFile = ctx.sessionManager.getSessionFile() ?? null;
+      const resolved = briefs.map((b) => ({
+        agent: roster.get(b.agent.trim()),
+        task: b.task
+      }));
+      const tasks = resolved.map((r) => ({
+        agent: r.agent.name,
+        agentSource: r.agent.source,
+        task: r.task,
+        status: "queued",
+        activity: [],
+        usage: emptyUsage()
+      }));
+      const details = { version: 1, mode, tasks };
+      const emitter = makeThrottledEmitter(onUpdate, details);
+      emitter.emit(true);
+      const runOne = async (i) => {
+        const task = tasks[i];
+        const r = resolved[i];
+        let release;
+        try {
+          release = await acquireChildSlot(signal, sessionFile);
+        } catch (err2) {
+          if (!signal?.aborted) throw err2;
+          task.status = "aborted";
+          emitter.emit(true);
+          return void 0;
+        }
+        try {
+          task.status = "running";
+          emitter.emit(true);
+          const outcome = await runChild({
+            // Per-child id: registry entries, pidfiles and transcript
+            // files must not collide across one call's siblings.
+            toolCallId: mode === "single" ? toolCallId : `${toolCallId}.${i}`,
+            agent: r.agent,
+            task: r.task,
+            cwd: ctx.cwd,
+            sessionFile,
+            appendSystemPrompt: composeChildPrompt(r.agent),
+            inheritModel: r.agent.model ?? (ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : void 0),
+            signal,
+            timeoutMs: TASK_TIMEOUT_MS,
+            stallTimeoutMs: STALL_TIMEOUT_MS,
+            costCeilingUsd: COST_CEILING_USD,
+            onProgress: (p) => {
+              task.usage = p.usage;
+              task.model = p.model ?? task.model;
+              task.activity = p.activity;
+              emitter.emit();
+            }
+          });
+          mergeOutcome(task, outcome);
+          emitter.emit(true);
+          return outcome;
+        } finally {
+          release();
+        }
+      };
+      try {
+        const outcomes = await Promise.all(resolved.map((_, i) => runOne(i)));
+        emitter.cancel();
+        lastDetails.set(toolCallId, details);
+        if (tasks.some((t) => t.status === "aborted")) {
+          throw new Error("Aborted by user");
+        }
+        return {
+          content: [{ type: "text", text: combinedParentText(mode, resolved, outcomes) }],
+          details
+        };
+      } finally {
+        emitter.cancel();
+      }
+    }
+  });
+  pi.on("tool_result", (ev) => {
+    if (ev.toolName !== "subagent") return void 0;
+    const fromMap = lastDetails.get(ev.toolCallId);
+    lastDetails.delete(ev.toolCallId);
+    const details = isSubagentDetails(ev.details) ? ev.details : fromMap;
+    if (!details) return void 0;
+    const failed = details.tasks.some(
+      (t) => t.status === "failed" || t.status === "timeout"
+    );
+    const patch = {};
+    if (failed && !ev.isError) patch.isError = true;
+    if (ev.isError && !isSubagentDetails(ev.details) && fromMap) patch.details = fromMap;
+    return patch.isError !== void 0 || patch.details !== void 0 ? patch : void 0;
+  });
+};
+function normalizeCalls(params) {
+  const hasSingle = params.agent !== void 0 || params.task !== void 0;
+  const hasTasks = Array.isArray(params.tasks) && params.tasks.length > 0;
+  if (hasSingle && hasTasks) {
+    return "Pass EITHER `agent` + `task` (single delegation) OR `tasks` (parallel fan-out) \u2014 not both in one call.";
+  }
+  if (hasTasks) {
+    const list = params.tasks;
+    if (list.length > MAX_TASKS_PER_CALL) {
+      return `tasks[] is capped at ${MAX_TASKS_PER_CALL} per call (got ${list.length}). Split the fan-out into multiple subagent calls.`;
+    }
+    if (list.some((t) => !t?.agent?.trim() || !t?.task?.trim())) {
+      return "Every tasks[] entry needs a non-empty `agent` and `task`.";
+    }
+    return { mode: "parallel", briefs: list.map((t) => ({ agent: t.agent, task: t.task })) };
+  }
+  if (params.agent?.trim() && params.task?.trim()) {
+    return { mode: "single", briefs: [{ agent: params.agent, task: params.task }] };
+  }
+  return "Provide either `agent` + `task` (single delegation) or `tasks` (parallel fan-out of independent briefs).";
+}
+function invalidCallResult(text, params) {
+  return {
+    content: [{ type: "text", text }],
+    details: {
+      version: 1,
+      mode: Array.isArray(params.tasks) && params.tasks.length > 0 ? "parallel" : "single",
+      tasks: []
+    }
+  };
+}
+function composeChildPrompt(agent) {
+  const header = `You are running as the "${agent.name}" subagent, delegated one task by another agent via pi-pilot. Work only within the project's working directory.`;
+  return agent.systemPrompt ? `${header}
+
+${agent.systemPrompt}` : header;
+}
+function mergeOutcome(task, outcome) {
+  task.status = outcome.status;
+  task.usage = outcome.usage;
+  task.activity = outcome.activity;
+  task.model = outcome.model ?? task.model;
+  task.stopReason = outcome.stopReason;
+  task.errorMessage = outcome.errorMessage;
+  task.stderrTail = outcome.stderrTail ? outcome.stderrTail.slice(-STDERR_DETAILS_CAP) : void 0;
+  task.exitCode = outcome.exitCode;
+  task.durationMs = outcome.durationMs;
+  task.transcriptPath = outcome.transcriptPath;
+  task.finalPreview = outcome.finalText ? tailCap(outcome.finalText, PREVIEW_CAP) : void 0;
+}
+function combinedParentText(mode, resolved, outcomes) {
+  if (mode === "single") {
+    return formatParentText(resolved[0].agent, outcomes[0], TASK_OUTPUT_CAP);
+  }
+  const n = outcomes.length;
+  const perTaskCap = Math.min(TASK_OUTPUT_CAP, Math.floor(AGGREGATE_OUTPUT_CAP / n));
+  const counts = /* @__PURE__ */ new Map();
+  for (const o of outcomes) {
+    const s = o?.status ?? "aborted";
+    counts.set(s, (counts.get(s) ?? 0) + 1);
+  }
+  const summary = [...counts.entries()].map(([s, c]) => `${c} ${s}`).join(", ");
+  const sections = outcomes.map((o, i) => {
+    const head = `=== task ${i + 1}/${n} ===`;
+    const body = o ? formatParentText(resolved[i].agent, o, perTaskCap) : `[${resolved[i].agent.name}] never started (aborted while queued)`;
+    return `${head}
+${body}`;
+  });
+  return [`[subagent] ${n} parallel tasks: ${summary}`, ...sections].join("\n\n");
+}
+function formatParentText(agent, outcome, outputCap) {
+  const stats = `${Math.round(outcome.durationMs / 1e3)}s \xB7 ${outcome.usage.turns} turns \xB7 ${fmtTokens(outcome.usage.input + outcome.usage.output)} tokens \xB7 $${outcome.usage.cost.toFixed(3)}`;
+  if (outcome.status === "done") {
+    const body = outcome.finalText || "(the subagent produced no final text)";
+    return `[${agent.name}] done in ${stats}
+
+${tailCap(body, outputCap)}`;
+  }
+  const head = outcome.status === "timeout" ? `[${agent.name}] TIMED OUT after ${stats}` : `[${agent.name}] FAILED (stopReason=${outcome.stopReason ?? "?"}, exit ${outcome.exitCode}) after ${stats}`;
+  const parts = [head];
+  if (outcome.errorMessage) parts.push(`error: ${outcome.errorMessage}`);
+  if (outcome.finalText) parts.push(`partial output:
+${tailCap(outcome.finalText, 2 * 1024)}`);
+  if (outcome.stderrTail) parts.push(`stderr tail:
+${outcome.stderrTail.slice(-STDERR_DETAILS_CAP)}`);
+  if (outcome.transcriptPath) parts.push(`full transcript: ${outcome.transcriptPath}`);
+  if (outcome.status === "timeout") {
+    parts.push(
+      "note for the user: limits are env-tunable \u2014 PI_PILOT_SUBAGENT_STALL_SEC (silence detector) / PI_PILOT_SUBAGENT_TIMEOUT_SEC (total ceiling), server restart applies."
+    );
+  }
+  return parts.join("\n");
+}
+function tailCap(text, max) {
+  if (text.length <= max) return text;
+  const dropped = text.length - max;
+  return `\u2026(${dropped} chars truncated \u2014 full transcript in details)
+${text.slice(-max)}`;
+}
+function fmtTokens(n) {
+  return n >= 1e3 ? `${(n / 1e3).toFixed(1)}k` : String(n);
+}
+function makeThrottledEmitter(onUpdate, details) {
+  let lastEmit = 0;
+  let timer;
+  let cancelled = false;
+  const fire = () => {
+    timer = void 0;
+    lastEmit = Date.now();
+    onUpdate?.({
+      content: [{ type: "text", text: statusLine(details) }],
+      details: structuredClone(details)
+    });
+  };
+  return {
+    emit: (force = false) => {
+      if (cancelled || !onUpdate) return;
+      const elapsed = Date.now() - lastEmit;
+      if (force || elapsed >= UPDATE_THROTTLE_MS) {
+        if (timer) {
+          clearTimeout(timer);
+          timer = void 0;
+        }
+        fire();
+      } else if (!timer) {
+        timer = setTimeout(fire, UPDATE_THROTTLE_MS - elapsed);
+      }
+    },
+    cancel: () => {
+      cancelled = true;
+      if (timer) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+    }
+  };
+}
+function statusLine(details) {
+  if (details.tasks.length > 1) {
+    const counts = /* @__PURE__ */ new Map();
+    let cost = 0;
+    let turns = 0;
+    for (const t2 of details.tasks) {
+      counts.set(t2.status, (counts.get(t2.status) ?? 0) + 1);
+      cost += t2.usage.cost;
+      turns += t2.usage.turns;
+    }
+    const bits2 = [`${details.tasks.length} tasks`];
+    for (const status2 of ["running", "queued", "done", "failed", "timeout", "aborted"]) {
+      const c = counts.get(status2);
+      if (c) bits2.push(`${c} ${status2}`);
+    }
+    if (turns > 0) bits2.push(`$${cost.toFixed(3)}`);
+    return bits2.join(" \xB7 ");
+  }
+  const t = details.tasks[0];
+  if (!t) return "subagent";
+  const bits = [t.agent, t.status];
+  if (t.usage.turns > 0) {
+    bits.push(`${t.usage.turns} turns`);
+    bits.push(`${fmtTokens(t.usage.input + t.usage.output)} tok`);
+    bits.push(`$${t.usage.cost.toFixed(3)}`);
+  }
+  const last = t.activity[t.activity.length - 1];
+  if (last && t.status === "running") bits.push(last.label);
+  return bits.join(" \xB7 ");
+}
+
+// src/extensions/web_search/schema.ts
+import { Type as Type5 } from "typebox";
+var webSearchParamsSchema = Type5.Object({
+  query: Type5.String({
+    description: "The search query. Phrase it like a search-engine query (keywords, entities), not a chat sentence."
+  }),
+  max_results: Type5.Optional(
+    Type5.Number({
+      description: "How many results to return (1\u201310). Default 5.",
+      minimum: 1,
+      maximum: 10
+    })
+  ),
+  topic: Type5.Optional(
+    Type5.Union([Type5.Literal("general"), Type5.Literal("news")], {
+      description: 'Search topic. Use "news" for recent/current events. Default "general".'
+    })
+  ),
+  search_depth: Type5.Optional(
+    Type5.Union([Type5.Literal("basic"), Type5.Literal("advanced")], {
+      description: '"advanced" digs deeper (slower, costs more credits); "basic" is usually enough. Default "basic".'
+    })
+  )
+});
+var webFetchParamsSchema = Type5.Object({
+  urls: Type5.Array(
+    Type5.String({ description: "An absolute http(s) URL." }),
+    {
+      description: "URLs to fetch and extract the main text from (1\u20135).",
+      minItems: 1,
+      maxItems: 5
+    }
+  )
+});
+
+// src/storage/web-search-prefs.ts
+import { readFile as readFile4 } from "fs/promises";
+import { join as join9 } from "path";
+var PREFS_PATH2 = join9(config.dataDir, "web-search.json");
+var cache4 = {};
+async function loadWebSearchPrefs() {
+  try {
+    const raw = await readFile4(PREFS_PATH2, "utf8");
+    const parsed = JSON.parse(raw);
+    cache4 = { tavilyApiKey: typeof parsed.tavilyApiKey === "string" ? parsed.tavilyApiKey : void 0 };
+  } catch (err2) {
+    cache4 = {};
+    if (err2.code !== "ENOENT") {
+      console.warn(`[web-search-prefs] ignoring unreadable ${PREFS_PATH2}:`, err2);
+    }
+  }
+}
+function getTavilyApiKey() {
+  const fromSettings = cache4.tavilyApiKey?.trim();
+  if (fromSettings) return fromSettings;
+  const fromEnv = process.env.TAVILY_API_KEY?.trim();
+  return fromEnv || void 0;
+}
+function getKeyStatus() {
+  const fromSettings = cache4.tavilyApiKey?.trim();
+  const fromEnv = process.env.TAVILY_API_KEY?.trim();
+  const live = fromSettings || fromEnv || void 0;
+  const source = fromSettings ? "settings" : fromEnv ? "env" : "none";
+  return {
+    configured: Boolean(live),
+    source,
+    ...live ? { hint: maskKey(live) } : {}
+  };
+}
+function maskKey(key) {
+  return `\u2026${key.slice(-4)}`;
+}
+async function setTavilyApiKey(key) {
+  const trimmed = key.trim();
+  cache4 = trimmed ? { tavilyApiKey: trimmed } : {};
+  await save3();
+}
+async function clearTavilyApiKey() {
+  cache4 = {};
+  await save3();
+}
+async function save3() {
+  await writeJsonAtomic(PREFS_PATH2, cache4, { mode: 384 });
+}
+
+// src/extensions/web_search/client.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+function baseUrl() {
+  return process.env.TAVILY_BASE_URL ?? "https://api.tavily.com";
+}
+var WebSearchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebSearchError";
+  }
+};
+function apiKey() {
+  const key = getTavilyApiKey();
+  if (!key) {
+    throw new WebSearchError(
+      "Web search is not configured: add a Tavily API key in Settings \u2192 Web search, or set the TAVILY_API_KEY environment variable. Get a free key at https://app.tavily.com."
+    );
+  }
+  return key;
+}
+async function postJson(path, body, signal) {
+  const key = apiKey();
+  const ctl = new AbortController();
+  const onAbort = () => ctl.abort(signal?.reason);
+  if (signal) {
+    if (signal.aborted) ctl.abort(signal.reason);
+    else signal.addEventListener("abort", onAbort, { once: true });
+  }
+  const timer = setTimeout(
+    () => ctl.abort(new WebSearchError(`Tavily request timed out after ${DEFAULT_TIMEOUT_MS / 1e3}s.`)),
+    DEFAULT_TIMEOUT_MS
+  );
+  let res;
+  try {
+    res = await fetch(`${baseUrl()}${path}`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${key}`
+      },
+      body: JSON.stringify(body),
+      signal: ctl.signal
+    });
+  } catch (err2) {
+    if (signal?.aborted) throw err2;
+    const reason = ctl.signal.reason;
+    if (reason instanceof WebSearchError) throw reason;
+    throw new WebSearchError(`Tavily request failed: ${errMsg(err2)}`);
+  } finally {
+    clearTimeout(timer);
+    if (signal) signal.removeEventListener("abort", onAbort);
+  }
+  if (!res.ok) {
+    throw new WebSearchError(await describeHttpError(res));
+  }
+  try {
+    return await res.json();
+  } catch {
+    throw new WebSearchError(
+      `Tavily returned a non-JSON response (HTTP ${res.status}) \u2014 the service may be down or returning an error page.`
+    );
+  }
+}
+async function describeHttpError(res) {
+  let detail = "";
+  try {
+    const data = await res.json();
+    const d = data?.detail ?? data?.error;
+    if (typeof d === "string") detail = d;
+    else if (d && typeof d === "object" && typeof d.error === "string") {
+      detail = d.error;
+    }
+  } catch {
+  }
+  const suffix = detail ? `: ${detail}` : "";
+  if (res.status === 401 || res.status === 403) {
+    return `Tavily rejected the API key (HTTP ${res.status})${suffix}. Check TAVILY_API_KEY.`;
+  }
+  if (res.status === 429) {
+    return `Tavily rate limit / quota exceeded (HTTP 429)${suffix}.`;
+  }
+  return `Tavily request failed (HTTP ${res.status})${suffix}.`;
+}
+function errMsg(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function tavilySearch(opts, signal) {
+  return postJson(
+    "/search",
+    {
+      query: opts.query,
+      max_results: opts.maxResults,
+      topic: opts.topic,
+      search_depth: opts.searchDepth,
+      include_answer: true
+    },
+    signal
+  );
+}
+function tavilyExtract(urls, signal) {
+  return postJson("/extract", { urls }, signal);
+}
+
+// src/extensions/web_search/factory.ts
+var SNIPPET_CARD_CAP = 320;
+var SNIPPET_MODEL_CAP = 1024;
+var FETCH_PREVIEW_CAP = 2 * 1024;
+var FETCH_PER_URL_CAP = 8 * 1024;
+var FETCH_TOTAL_CAP = 24 * 1024;
+function clampInt(v, lo, hi, dflt) {
+  if (typeof v !== "number" || !Number.isFinite(v)) return dflt;
+  return Math.max(lo, Math.min(hi, Math.round(v)));
+}
+function truncate(s, cap) {
+  return s.length <= cap ? s : `${s.slice(0, cap)}\u2026`;
+}
+var webSearchExtensionFactory = (pi) => {
+  pi.registerTool({
+    name: "web_search",
+    label: "Web search",
+    description: "Search the web and get back a short answer plus ranked results (title, URL, snippet). Use it for current events, external documentation, or facts you're unsure of or that may have changed since your training cutoff. Follow up with `web_fetch` to read a result's full page when the snippet isn't enough.",
+    parameters: webSearchParamsSchema,
+    executionMode: "parallel",
+    promptSnippet: "web_search: search the web (answer + ranked results) for current or uncertain facts; pair with web_fetch to read a page in full.",
+    promptGuidelines: [
+      "Reach for web_search when the answer depends on current / post-cutoff information, external docs, or facts you can't verify from the repo or your own knowledge \u2014 not for things you already know.",
+      'Phrase `query` like a search-engine query (keywords, entities), not a chat sentence. Set `topic: "news"` for recent events.',
+      "Cite the URLs you relied on, and use web_fetch to read a page in full before trusting details beyond the snippet."
+    ],
+    async execute(_toolCallId, params, signal) {
+      const query = params.query.trim();
+      if (!query) throw new WebSearchError("web_search needs a non-empty query.");
+      const maxResults = clampInt(params.max_results, 1, 10, 5);
+      const topic = params.topic === "news" ? "news" : "general";
+      const searchDepth = params.search_depth === "advanced" ? "advanced" : "basic";
+      const data = await tavilySearch({ query, maxResults, topic, searchDepth }, signal);
+      const raw = (data.results ?? []).filter(
+        (r) => typeof r.url === "string"
+      );
+      const answer = typeof data.answer === "string" && data.answer.trim() ? data.answer.trim() : void 0;
+      const results = raw.map((r) => ({
+        title: (r.title ?? "").trim() || r.url,
+        url: r.url,
+        content: truncate((r.content ?? "").trim(), SNIPPET_CARD_CAP),
+        score: typeof r.score === "number" ? r.score : void 0,
+        publishedDate: typeof r.published_date === "string" ? r.published_date : void 0
+      }));
+      const details = { version: 1, kind: "search", query, answer, results };
+      return { content: [{ type: "text", text: formatSearch(query, answer, raw) }], details };
+    }
+  });
+  pi.registerTool({
+    name: "web_fetch",
+    label: "Web fetch",
+    description: "Fetch one or more web pages and extract their main text as clean, readable content (stripped of HTML/navigation/boilerplate). Use it to read a page in full \u2014 a URL returned by web_search, a documentation link, or a URL the user gave you.",
+    parameters: webFetchParamsSchema,
+    executionMode: "parallel",
+    promptSnippet: "web_fetch: fetch URL(s) and extract the main page text \u2014 read a web_search result or a user-given link in full.",
+    promptGuidelines: [
+      "Use web_fetch to read the full text of a page when a web_search snippet isn't enough, or whenever the user hands you a URL.",
+      "Pass up to 5 absolute http(s) URLs in one call to read them together."
+    ],
+    async execute(_toolCallId, params, signal) {
+      const urls = params.urls.map((u) => u.trim()).filter(Boolean);
+      if (urls.length === 0) throw new WebSearchError("web_fetch needs at least one non-empty URL.");
+      const data = await tavilyExtract(urls, signal);
+      const results = (data.results ?? []).filter((r) => typeof r.url === "string").map((r) => {
+        const full = (r.raw_content ?? "").trim();
+        return { url: r.url, content: truncate(full, FETCH_PREVIEW_CAP), chars: full.length };
+      });
+      const failed = (data.failed_results ?? []).filter((f) => typeof f.url === "string").map((f) => ({ url: f.url, error: (f.error ?? "extraction failed").toString() }));
+      const details = { version: 1, kind: "fetch", results, failed };
+      return { content: [{ type: "text", text: formatFetch(data) }], details };
+    }
+  });
+};
+function formatSearch(query, answer, results) {
+  const lines = [];
+  lines.push(`Search results for "${query}" (${results.length} result${results.length === 1 ? "" : "s"}):`);
+  if (answer) {
+    lines.push("");
+    lines.push(`Answer: ${answer}`);
+  }
+  results.forEach((r, i) => {
+    lines.push("");
+    lines.push(`${i + 1}. ${(r.title ?? "").trim() || r.url}`);
+    lines.push(`   ${r.url}`);
+    const snippet = (r.content ?? "").trim();
+    if (snippet) lines.push(`   ${truncate(snippet, SNIPPET_MODEL_CAP)}`);
+  });
+  if (results.length === 0) {
+    lines.push("");
+    lines.push("No results found.");
+  }
+  return lines.join("\n");
+}
+function formatFetch(data) {
+  const results = (data.results ?? []).filter(
+    (r) => typeof r.url === "string"
+  );
+  const failed = (data.failed_results ?? []).filter(
+    (f) => typeof f.url === "string"
+  );
+  const lines = [];
+  let budget = FETCH_TOTAL_CAP;
+  for (const r of results) {
+    const full = (r.raw_content ?? "").trim();
+    const cap = Math.min(FETCH_PER_URL_CAP, budget);
+    const slice = full.length > cap ? `${full.slice(0, cap)}\u2026` : full;
+    budget -= Math.min(full.length, cap);
+    lines.push(`## ${r.url}`);
+    lines.push(slice || "(no extractable content)");
+    lines.push("");
+    if (budget <= 0) {
+      lines.push("\u2026 (remaining pages omitted to fit the context budget)");
+      break;
+    }
+  }
+  for (const f of failed) {
+    lines.push(`Failed to fetch ${f.url}: ${f.error ?? "extraction failed"}`);
+  }
+  if (results.length === 0 && failed.length === 0) lines.push("No content extracted.");
+  return lines.join("\n").trim();
+}
+
+// src/storage/builtin-extension-prefs.ts
+import { readFile as readFile5 } from "fs/promises";
+import { join as join10 } from "path";
+var PREFS_PATH3 = join10(config.dataDir, "builtin-extensions.json");
+var cache5 = { disabled: [] };
+async function loadBuiltinPrefs() {
+  try {
+    const raw = await readFile5(PREFS_PATH3, "utf8");
+    const parsed = JSON.parse(raw);
+    cache5 = { disabled: Array.isArray(parsed.disabled) ? parsed.disabled : [] };
+  } catch (err2) {
+    cache5 = { disabled: [] };
+    if (err2.code !== "ENOENT") {
+      console.warn(`[builtin-prefs] ignoring unreadable ${PREFS_PATH3}:`, err2);
+    }
+  }
+}
+function isBuiltinDisabled(id) {
+  if (cache5.disabled.includes(id)) return true;
+  if (id === "todo" && cache5.disabled.includes("plan")) return true;
+  return false;
+}
+function getDisabledBuiltins() {
+  return [...cache5.disabled];
+}
+async function setBuiltinEnabled(id, enabled) {
+  const next = new Set(cache5.disabled);
+  if (enabled) next.delete(id);
+  else next.add(id);
+  cache5 = { disabled: [...next] };
+  await save4();
+}
+async function save4() {
+  await writeJsonAtomic(PREFS_PATH3, cache5);
+}
+
+// src/extensions/index.ts
+var BUILTIN_EXTENSIONS = [
+  {
+    id: "todo",
+    name: "Todo",
+    description: "A CRUD task list for tracking multi-step work \u2014 adds the todo tool and the /todos command.",
+    tools: ["todo"],
+    commands: ["todos"],
+    factory: todoExtensionFactory
+  },
+  {
+    id: "ask_user",
+    name: "Ask user",
+    description: "Lets the agent pause and ask you a structured multiple-choice question \u2014 adds the ask_user tool.",
+    tools: ["ask_user"],
+    commands: [],
+    factory: askUserExtensionFactory
+  },
+  {
+    id: "artifact",
+    name: "Artifacts",
+    description: "Lets the agent publish substantial, self-contained content \u2014 web pages, SVG diagrams, documents, code files \u2014 as versioned artifacts rendered in a side panel. Adds the create_artifact tool.",
+    tools: ["create_artifact"],
+    commands: [],
+    factory: artifactExtensionFactory
+  },
+  {
+    id: "subagent",
+    name: "Subagent",
+    description: "Lets the agent delegate self-contained tasks to isolated child agents (separate pinned-pi processes; only their final report returns). Builtin presets scout/worker/reviewer; user agents from ~/.pi/agent/agents/*.md. Adds the subagent tool.",
+    tools: ["subagent"],
+    commands: [],
+    factory: subagentExtensionFactory
+  },
+  {
+    id: "web",
+    name: "Web search",
+    description: "Lets the agent search the web and read pages \u2014 adds the web_search and web_fetch tools (backed by Tavily; needs the TAVILY_API_KEY environment variable).",
+    tools: ["web_search", "web_fetch"],
+    commands: [],
+    factory: webSearchExtensionFactory
+  }
+];
+function gate(def) {
+  return (pi) => {
+    if (isBuiltinDisabled(def.id)) return;
+    return def.factory(pi);
+  };
+}
+var builtinExtensionFactories = BUILTIN_EXTENSIONS.map(gate);
+
+// src/extensions/ask_user/cleanup.ts
+var CUSTOM_TYPE = "ask_user-restart-cancelled";
+function reconcileAfterRestart(sessionManager) {
+  const branch = sessionManager.getBranch();
+  if (branch.length === 0) return;
+  const satisfied = /* @__PURE__ */ new Set();
+  const danglingIds = [];
+  const danglingAlreadyHandled = /* @__PURE__ */ new Set();
+  for (let i = branch.length - 1; i >= 0; i--) {
+    const entry = branch[i];
+    if (entry.type === "custom_message") {
+      const cm = entry;
+      if (cm.customType === CUSTOM_TYPE) {
+        const ids = cm.details?.ids;
+        if (Array.isArray(ids)) {
+          for (const id of ids) {
+            if (typeof id === "string") danglingAlreadyHandled.add(id);
+          }
+        }
+      }
+      continue;
+    }
+    if (entry.type !== "message") continue;
+    const msg = entry.message;
+    if (msg.role === "toolResult" && typeof msg.toolCallId === "string") {
+      satisfied.add(msg.toolCallId);
+      continue;
+    }
+    if (msg.role === "assistant" && Array.isArray(msg.content)) {
+      for (const block of msg.content) {
+        if (!block || typeof block !== "object") continue;
+        const b = block;
+        if (b.type !== "toolCall") continue;
+        if (b.name !== "ask_user") continue;
+        if (typeof b.id !== "string") continue;
+        if (satisfied.has(b.id)) continue;
+        if (danglingAlreadyHandled.has(b.id)) continue;
+        danglingIds.push(b.id);
+      }
+      break;
+    }
+    if (msg.role === "user") break;
+  }
+  if (danglingIds.length === 0) return;
+  const idList = danglingIds.join(", ");
+  const text = `[pi-pilot] Your previous ask_user call(s) [${idList}] were cancelled because the server restarted before the user answered. Use your best judgement and proceed; you may re-call ask_user if the decision still matters.`;
+  sessionManager.appendCustomMessageEntry(
+    CUSTOM_TYPE,
+    text,
+    true,
+    // display in TUI too (no-op in pi-pilot, but harmless)
+    { ids: danglingIds }
+  );
+}
+
+// src/extensions/subagent/cleanup.ts
+import { execFile as execFile3 } from "child_process";
+import { readdir as readdir2, readFile as readFile6, rm as rm4 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join11 } from "path";
+var CUSTOM_TYPE2 = "subagent-restart-cancelled";
+function reconcileAfterRestart2(sessionManager) {
+  const branch = sessionManager.getBranch();
+  if (branch.length === 0) return;
+  const satisfied = /* @__PURE__ */ new Set();
+  const danglingIds = [];
+  const danglingAlreadyHandled = /* @__PURE__ */ new Set();
+  for (let i = branch.length - 1; i >= 0; i--) {
+    const entry = branch[i];
+    if (entry.type === "custom_message") {
+      const cm = entry;
+      if (cm.customType === CUSTOM_TYPE2) {
+        const ids = cm.details?.ids;
+        if (Array.isArray(ids)) {
+          for (const id of ids) {
+            if (typeof id === "string") danglingAlreadyHandled.add(id);
+          }
+        }
+      }
+      continue;
+    }
+    if (entry.type !== "message") continue;
+    const msg = entry.message;
+    if (msg.role === "toolResult" && typeof msg.toolCallId === "string") {
+      satisfied.add(msg.toolCallId);
+      continue;
+    }
+    if (msg.role === "assistant" && Array.isArray(msg.content)) {
+      for (const block of msg.content) {
+        if (!block || typeof block !== "object") continue;
+        const b = block;
+        if (b.type !== "toolCall") continue;
+        if (b.name !== "subagent") continue;
+        if (typeof b.id !== "string") continue;
+        if (satisfied.has(b.id)) continue;
+        if (danglingAlreadyHandled.has(b.id)) continue;
+        danglingIds.push(b.id);
+      }
+      break;
+    }
+    if (msg.role === "user") break;
+  }
+  if (danglingIds.length === 0) return;
+  const idList = danglingIds.join(", ");
+  const text = `[pi-pilot] Your previous subagent delegation(s) [${idList}] were cancelled because the server restarted mid-run. The child agent's work may be partially applied to the working tree \u2014 verify before assuming anything happened. Re-delegate if the task still matters.`;
+  sessionManager.appendCustomMessageEntry(
+    CUSTOM_TYPE2,
+    text,
+    true,
+    // display flag — no-op in pi-pilot, harmless in the TUI
+    { ids: danglingIds }
+  );
+}
+async function sweepOrphanedChildrenOnBoot(rootDir = tmpdir3()) {
+  let dirNames;
+  try {
+    dirNames = (await readdir2(rootDir)).filter((n) => n.startsWith(PROMPT_DIR_PREFIX));
+  } catch {
+    return;
+  }
+  let swept = 0;
+  for (const name of dirNames) {
+    const dir = join11(rootDir, name);
+    const pidRaw = await readFile6(join11(dir, "pid"), "utf8").catch(() => "");
+    const [childLine, ownerLine] = pidRaw.split("\n");
+    const childPid = Number.parseInt((childLine ?? "").trim(), 10);
+    const ownerPid = Number.parseInt((ownerLine ?? "").trim(), 10);
+    if (Number.isInteger(ownerPid) && ownerPid > 1 && await isLiveNodeProcess(ownerPid)) {
+      continue;
+    }
+    try {
+      if (Number.isInteger(childPid) && childPid > 1 && await isLiveNodeProcess(childPid)) {
+        try {
+          process.kill(childPid, "SIGTERM");
+          swept++;
+        } catch {
+        }
+      }
+    } finally {
+      await rm4(dir, { recursive: true, force: true }).catch(() => {
+      });
+    }
+  }
+  if (swept > 0) {
+    console.warn(`[subagent] swept ${swept} orphaned child(ren) from a previous run`);
+  }
+}
+function isLiveNodeProcess(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return Promise.resolve(false);
+  }
+  return new Promise((resolve9) => {
+    execFile3("ps", ["-o", "ucomm=", "-p", String(pid)], (err2, stdout) => {
+      if (err2) {
+        resolve9(false);
+        return;
+      }
+      const name = stdout.trim().toLowerCase();
+      resolve9(name === "node" || name === "pi");
+    });
+  });
+}
+
+// src/ws/bridge.ts
+function translatePiEvent(ev) {
+  switch (ev.type) {
+    case "agent_start":
+      return { kind: "agent_start" };
+    case "agent_end": {
+      const error = ev.willRetry ? void 0 : finalAssistantError(ev.messages);
+      return { kind: "agent_end", willRetry: ev.willRetry, ...error ? { error } : {} };
+    }
     case "turn_start":
       return { kind: "turn_start" };
     case "turn_end":
@@ -1195,13 +2814,16 @@ function translatePiEvent(ev) {
         toolName: ev.toolName,
         args: ev.args
       };
-    case "tool_execution_update":
+    case "tool_execution_update": {
+      const updateDetails = shouldForwardDetails(ev.toolName) ? ev.partialResult?.details : void 0;
       return {
         kind: "tool_execution_update",
         toolCallId: ev.toolCallId,
         toolName: ev.toolName,
-        partialText: extractText(ev.partialResult)
+        partialText: extractText(ev.partialResult),
+        ...updateDetails !== void 0 ? { details: updateDetails } : {}
       };
+    }
     case "tool_execution_end": {
       const details = shouldForwardDetails(ev.toolName) ? ev.result?.details : void 0;
       return {
@@ -1252,6 +2874,21 @@ function translatePiEvent(ev) {
       return void 0;
   }
 }
+function assistantErrorText(message) {
+  const m = message;
+  if (!m || m.stopReason !== "error") return void 0;
+  const text = typeof m.errorMessage === "string" ? m.errorMessage.trim() : "";
+  return text || "The model stream ended with an error.";
+}
+function finalAssistantError(messages) {
+  if (!Array.isArray(messages)) return void 0;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (!m || m.role !== "assistant") continue;
+    return assistantErrorText(m);
+  }
+  return void 0;
+}
 var warnedUnknownRoles = /* @__PURE__ */ new Set();
 function roleOf(message) {
   const role = message?.role;
@@ -1354,22 +2991,119 @@ function inFlightToolCallsSnapshot(sessionFile) {
     args: p.args
   }));
 }
-var DETAILS_FORWARD_WHITELIST = /* @__PURE__ */ new Set(["ask_user", "todo"]);
+var DETAILS_FORWARD_WHITELIST = /* @__PURE__ */ new Set([
+  "ask_user",
+  "todo",
+  "subagent",
+  "web_search",
+  "web_fetch"
+]);
 function shouldForwardDetails(toolName) {
   return DETAILS_FORWARD_WHITELIST.has(toolName);
 }
-function extractText(result) {
-  if (!result || typeof result !== "object") return void 0;
-  const content = result.content;
-  if (!Array.isArray(content)) return void 0;
+function extractText(result) {
+  if (!result || typeof result !== "object") return void 0;
+  const content = result.content;
+  if (!Array.isArray(content)) return void 0;
+  const parts = [];
+  for (const c of content) {
+    if (c && typeof c === "object" && c.type === "text") {
+      const text = c.text;
+      if (typeof text === "string") parts.push(text);
+    }
+  }
+  return parts.length === 0 ? void 0 : parts.join("");
+}
+
+// src/history-builder.ts
+function isAssistantSupersededByRetry(branch, index) {
+  for (let j = index + 1; j < branch.length; j++) {
+    const e = branch[j];
+    if (e?.type !== "message") continue;
+    return e.message?.role === "assistant";
+  }
+  return false;
+}
+function buildHistoryItems(branch) {
+  const items = [];
+  const argsByCallId = /* @__PURE__ */ new Map();
+  for (let i = 0; i < branch.length; i++) {
+    const entry = branch[i];
+    if (!entry || entry.type !== "message") continue;
+    const msg = entry.message;
+    const role = msg.role;
+    if (role === "user") {
+      const text = extractUserText2(msg);
+      if (text) items.push({ kind: "user", text, entryId: entry.id ?? "" });
+    } else if (role === "assistant") {
+      const { text, thinking, toolCalls } = extractAssistantContent(
+        msg
+      );
+      for (const tc of toolCalls) {
+        argsByCallId.set(tc.id, tc.args);
+      }
+      const error = isAssistantSupersededByRetry(branch, i) ? void 0 : assistantErrorText(msg);
+      if (text || thinking || error) {
+        items.push({ kind: "assistant", text, thinking, ...error ? { error } : {} });
+      }
+    } else if (role === "toolResult") {
+      const tr = msg;
+      items.push({
+        kind: "tool",
+        toolCallId: tr.toolCallId,
+        toolName: tr.toolName,
+        args: argsByCallId.get(tr.toolCallId) ?? "",
+        text: extractContentText(tr.content),
+        isError: tr.isError,
+        // Mirror live wire whitelist (bridge.ts): only ship details for
+        // tools whose cards need the structured shape, so the history
+        // payload stays small for bash / edit / read.
+        ...shouldForwardDetails(tr.toolName) && tr.details !== void 0 ? { details: tr.details } : {}
+      });
+    } else if (role === "bashExecution") {
+      const be = msg;
+      items.push({
+        kind: "bash",
+        command: be.command,
+        output: be.output,
+        exitCode: be.exitCode
+      });
+    }
+  }
+  return items;
+}
+function extractUserText2(msg) {
+  if (typeof msg.content === "string") return msg.content;
+  return extractContentText(msg.content);
+}
+function extractAssistantContent(msg) {
+  const textParts = [];
+  const thinkingParts = [];
+  const toolCalls = [];
+  for (const block of msg.content ?? []) {
+    if (!block || typeof block !== "object") continue;
+    const b = block;
+    if (b.type === "text" && typeof b.text === "string") textParts.push(b.text);
+    else if (b.type === "thinking" && typeof b.thinking === "string") thinkingParts.push(b.thinking);
+    else if (b.type === "toolCall" && typeof b.id === "string") {
+      toolCalls.push({
+        id: b.id,
+        args: b.arguments != null ? JSON.stringify(b.arguments) : ""
+      });
+    }
+  }
+  return { text: textParts.join(""), thinking: thinkingParts.join(""), toolCalls };
+}
+function extractContentText(content) {
+  if (!Array.isArray(content)) return "";
   const parts = [];
-  for (const c of content) {
-    if (c && typeof c === "object" && c.type === "text") {
-      const text = c.text;
+  for (const block of content) {
+    if (block && typeof block === "object" && block.type === "text") {
+      const text = block.text;
       if (typeof text === "string") parts.push(text);
     }
   }
-  return parts.length === 0 ? void 0 : parts.join("");
+  return parts.join("");
 }
 
 // src/ws/extension-ui.ts
@@ -1503,7 +3237,7 @@ var SessionRuntimeManager = class {
   /** `runtimeKey` for a built runtime, from its session file (or sessionId). */
   keyForRuntime(workspaceId, runtime) {
     const file = runtime.session.sessionFile;
-    return this.keyOf(workspaceId, file ? resolve2(file) : runtime.session.sessionId);
+    return this.keyOf(workspaceId, file ? resolve4(file) : runtime.session.sessionId);
   }
   /** Public so the WS hub derives the exact same key for a returned runtime. */
   runtimeKeyFor(workspaceId, runtime) {
@@ -1526,17 +3260,18 @@ var SessionRuntimeManager = class {
   async buildState(workspaceId, cwd, makeSessionManager) {
     const runtime = await createAgentSessionRuntime(createRuntime, {
       cwd,
-      agentDir: getAgentDir(),
+      agentDir: getAgentDir2(),
       sessionManager: makeSessionManager()
     });
     const bridge = new ExtensionUIBridge();
     await this.bindExtensions(workspaceId, runtime, bridge);
-    safeReconcileAskUser(workspaceId, runtime.session.sessionManager);
+    reapplyToolPrefs(workspaceId, runtime.session);
+    safeReconcileBuiltins(workspaceId, runtime.session.sessionManager);
     return {
       runtime,
       bridge,
       workspaceId,
-      sessionPath: runtime.session.sessionFile ? resolve2(runtime.session.sessionFile) : null,
+      sessionPath: runtime.session.sessionFile ? resolve4(runtime.session.sessionFile) : null,
       touchedAt: ++this.touchSeq
     };
   }
@@ -1586,7 +3321,7 @@ ${err2.stack}` : "")
     if (!ws) throw new Error(`Workspace not found: ${workspaceId}`);
     if (sessionPath) {
       if (!isAbsolute2(sessionPath)) throw new Error("Session path must be absolute");
-      const resolved = resolve2(sessionPath);
+      const resolved = resolve4(sessionPath);
       const key = this.keyOf(workspaceId, resolved);
       const existing2 = this.runtimes.get(key);
       if (existing2) {
@@ -1649,7 +3384,7 @@ ${err2.stack}` : "")
     const state = await this.buildState(
       workspaceId,
       ws.path,
-      () => SessionManager.open(resolve2(sourceSessionPath), void 0, ws.path)
+      () => SessionManager.open(resolve4(sourceSessionPath), void 0, ws.path)
     );
     let result;
     try {
@@ -1663,8 +3398,8 @@ ${err2.stack}` : "")
       return { cancelled: true };
     }
     await this.bindExtensions(workspaceId, state.runtime, state.bridge);
-    safeReconcileAskUser(workspaceId, state.runtime.session.sessionManager);
-    state.sessionPath = state.runtime.session.sessionFile ? resolve2(state.runtime.session.sessionFile) : null;
+    safeReconcileBuiltins(workspaceId, state.runtime.session.sessionManager);
+    state.sessionPath = state.runtime.session.sessionFile ? resolve4(state.runtime.session.sessionFile) : null;
     const winner = await this.adopt(state);
     return { cancelled: false, runtime: winner.runtime };
   }
@@ -1683,7 +3418,7 @@ ${err2.stack}` : "")
   }
   /** The runtime bound to a specific (workspace, session), if live. */
   getForSession(workspaceId, sessionPath) {
-    return this.runtimes.get(this.keyOf(workspaceId, resolve2(sessionPath)))?.runtime;
+    return this.runtimes.get(this.keyOf(workspaceId, resolve4(sessionPath)))?.runtime;
   }
   /** Mark `runtime` as the active session for its workspace (hub on primary
    *  bind), so per-workspace routes resolve to it. */
@@ -1724,8 +3459,8 @@ ${err2.stack}` : "")
     const ws = await getWorkspace(workspaceId);
     if (!ws) return `workspace not found: ${workspaceId}`;
     const sessions = await SessionManager.list(ws.path);
-    const resolved = resolve2(sessionPath);
-    const found = sessions.some((s) => resolve2(s.path) === resolved);
+    const resolved = resolve4(sessionPath);
+    const found = sessions.some((s) => resolve4(s.path) === resolved);
     if (!found) return `session not found in workspace: ${sessionPath}`;
     return null;
   }
@@ -1740,55 +3475,14 @@ ${err2.stack}` : "")
       }
     }
     const sessions = await SessionManager.list(ws.path);
-    return sessions.slice().sort((a, b) => b.modified.getTime() - a.modified.getTime()).map((info) => toSessionSummary(info, streaming.has(resolve2(info.path))));
+    return sessions.slice().sort((a, b) => b.modified.getTime() - a.modified.getTime()).map((info) => toSessionSummary(info, streaming.has(resolve4(info.path))));
   }
   getSessionHistory(workspaceId, sessionPath) {
     const runtime = sessionPath ? this.getForSession(workspaceId, sessionPath) : this.get(workspaceId);
     if (!runtime) return { items: [], isStreaming: false };
     const isStreaming = runtime.session.isStreaming ?? false;
     const branch = runtime.session.sessionManager.getBranch();
-    const items = [];
-    const argsByCallId = /* @__PURE__ */ new Map();
-    for (const entry of branch) {
-      if (entry.type !== "message") continue;
-      const msg = entry.message;
-      const role = msg.role;
-      if (role === "user") {
-        const text = extractUserText2(msg);
-        if (text) items.push({ kind: "user", text, entryId: entry.id });
-      } else if (role === "assistant") {
-        const { text, thinking, toolCalls } = extractAssistantContent(
-          msg
-        );
-        for (const tc of toolCalls) {
-          argsByCallId.set(tc.id, tc.args);
-        }
-        if (text || thinking) items.push({ kind: "assistant", text, thinking });
-      } else if (role === "toolResult") {
-        const tr = msg;
-        items.push({
-          kind: "tool",
-          toolCallId: tr.toolCallId,
-          toolName: tr.toolName,
-          args: argsByCallId.get(tr.toolCallId) ?? "",
-          text: extractContentText(tr.content),
-          isError: tr.isError,
-          // Mirror live wire whitelist (bridge.ts): only ship details
-          // for tools whose cards need the structured shape, so the
-          // history payload stays small for bash / edit / read.
-          ...shouldForwardDetails(tr.toolName) && tr.details !== void 0 ? { details: tr.details } : {}
-        });
-      } else if (role === "bashExecution") {
-        const be = msg;
-        items.push({
-          kind: "bash",
-          command: be.command,
-          output: be.output,
-          exitCode: be.exitCode
-        });
-      }
-    }
-    return { items, isStreaming };
+    return { items: buildHistoryItems(branch), isStreaming };
   }
   /**
    * Delete a session JSONL file belonging to this workspace.
@@ -1808,8 +3502,8 @@ ${err2.stack}` : "")
       throw new HttpError(400, "Session path must be absolute");
     }
     const sessions = await SessionManager.list(ws.path);
-    const resolved = resolve2(sessionPath);
-    const target = sessions.find((session) => resolve2(session.path) === resolved);
+    const resolved = resolve4(sessionPath);
+    const target = sessions.find((session) => resolve4(session.path) === resolved);
     if (!target) {
       throw new HttpError(404, `Session not found: ${sessionPath}`);
     }
@@ -1831,10 +3525,12 @@ ${err2.stack}` : "")
         console.warn(
           `[wm] deleteSession: ${resolved} was already gone at unlink time`
         );
+        await forgetSessionToolPrefs(resolved);
         return;
       }
       throw err2;
     }
+    await forgetSessionToolPrefs(resolved);
   }
   /** Dispose every runtime for a workspace (e.g. when it's removed). */
   async dispose(workspaceId) {
@@ -1871,6 +3567,12 @@ ${err2.stack}` : "")
     } catch (e) {
       console.error(`[wm] dispose ${state.workspaceId} failed:`, e);
     }
+    const sweptChildren = killChildrenForSession(state.runtime.session.sessionFile ?? null);
+    if (sweptChildren > 0) {
+      console.warn(
+        `[wm] killed ${sweptChildren} lingering subagent child(ren) for ${state.workspaceId}`
+      );
+    }
   }
   /**
    * Keep the live-runtime count under `MAX_LIVE_RUNTIMES` by disposing the
@@ -1898,56 +3600,28 @@ ${err2.stack}` : "")
     }
   }
 };
-function safeReconcileAskUser(workspaceId, sm) {
+function safeReconcileBuiltins(workspaceId, sm) {
   try {
     reconcileAfterRestart(sm);
   } catch (e) {
     console.error(`[wm] ask_user cleanup for ${workspaceId} failed:`, e);
   }
+  try {
+    reconcileAfterRestart2(sm);
+  } catch (e) {
+    console.error(`[wm] subagent cleanup for ${workspaceId} failed:`, e);
+  }
 }
-function toSessionSummary(info, running) {
+function toSessionSummary(info, running2) {
   const preview = info.firstMessage.replace(/\s+/g, " ").trim();
   return {
     path: info.path,
     name: info.name,
     updatedAt: info.modified.toISOString(),
     preview: preview ? preview.slice(0, 160) : void 0,
-    ...running ? { running: true } : {}
+    ...running2 ? { running: true } : {}
   };
 }
-function extractUserText2(msg) {
-  if (typeof msg.content === "string") return msg.content;
-  return extractContentText(msg.content);
-}
-function extractAssistantContent(msg) {
-  const textParts = [];
-  const thinkingParts = [];
-  const toolCalls = [];
-  for (const block of msg.content ?? []) {
-    if (!block || typeof block !== "object") continue;
-    const b = block;
-    if (b.type === "text" && typeof b.text === "string") textParts.push(b.text);
-    else if (b.type === "thinking" && typeof b.thinking === "string") thinkingParts.push(b.thinking);
-    else if (b.type === "toolCall" && typeof b.id === "string") {
-      toolCalls.push({
-        id: b.id,
-        args: b.arguments != null ? JSON.stringify(b.arguments) : ""
-      });
-    }
-  }
-  return { text: textParts.join(""), thinking: thinkingParts.join(""), toolCalls };
-}
-function extractContentText(content) {
-  if (!Array.isArray(content)) return "";
-  const parts = [];
-  for (const block of content) {
-    if (block && typeof block === "object" && block.type === "text") {
-      const text = block.text;
-      if (typeof text === "string") parts.push(text);
-    }
-  }
-  return parts.join("");
-}
 var workspaceManager = new SessionRuntimeManager();
 function broadcastTo(subscribers, msg) {
   const wire = JSON.stringify(msg);
@@ -1961,6 +3635,9 @@ function broadcastTo(subscribers, msg) {
 }
 
 // src/api/config.ts
+var BUILTIN_TOOL_SOURCE = new Map(
+  BUILTIN_EXTENSIONS.flatMap((d) => d.tools.map((tool) => [tool, d.name]))
+);
 function buildConfigResponse(workspaceId) {
   const runtime = workspaceManager.get(workspaceId);
   if (!runtime) throw new Error("runtime not initialized");
@@ -1978,10 +3655,14 @@ function buildConfigResponse(workspaceId) {
     name: m.name,
     reasoning: m.reasoning
   }));
-  const allTools = session.getAllTools().map((t) => ({
-    name: t.name,
-    description: t.description
-  }));
+  const allTools = session.getAllTools().map((t) => {
+    const builtinExtension = BUILTIN_TOOL_SOURCE.get(t.name);
+    return {
+      name: t.name,
+      description: t.description,
+      ...builtinExtension ? { builtinExtension } : {}
+    };
+  });
   return {
     currentModel,
     thinkingLevel: session.thinkingLevel,
@@ -2105,7 +3786,7 @@ function mountConfigRoutes(app2) {
       if (!runtime) {
         return c.json({ ok: false, error: "runtime not initialized" }, 500);
       }
-      runtime.session.setActiveToolsByName(body.tools);
+      await persistActiveTools(id, runtime.session, body.tools);
       return c.json(buildConfigResponse(id));
     } catch (err2) {
       const message = err2 instanceof Error ? err2.message : String(err2);
@@ -2144,11 +3825,11 @@ function mountConfigRoutes(app2) {
 }
 
 // src/api/files.ts
-import { execFile as execFile2 } from "child_process";
-import { readdir } from "fs/promises";
-import { join as join5, relative, sep as sep2 } from "path";
-import { promisify as promisify2 } from "util";
-var exec2 = promisify2(execFile2);
+import { execFile as execFile4 } from "child_process";
+import { readdir as readdir3, readFile as readFile7, realpath, stat as stat2, writeFile as writeFile4 } from "fs/promises";
+import { join as join12, relative, resolve as resolve5, sep as sep2 } from "path";
+import { promisify as promisify3 } from "util";
+var exec3 = promisify3(execFile4);
 var LIST_TTL_MS = 1e4;
 var MAX_CACHED_WORKSPACES = 16;
 var MAX_FILES_TRACKED = 2e4;
@@ -2176,8 +3857,8 @@ var listCache = /* @__PURE__ */ new Map();
 var inflight2 = /* @__PURE__ */ new Map();
 async function getFileList(workspacePath) {
   const now = Date.now();
-  const cached = listCache.get(workspacePath);
-  if (cached && cached.expiresAt > now) return cached.files;
+  const cached2 = listCache.get(workspacePath);
+  if (cached2 && cached2.expiresAt > now) return cached2.files;
   const pending2 = inflight2.get(workspacePath);
   if (pending2) return (await pending2).files;
   const probe = probeFileList(workspacePath).then((files) => {
@@ -2199,7 +3880,7 @@ async function getFileList(workspacePath) {
 }
 async function probeFileList(workspacePath) {
   try {
-    const { stdout } = await exec2(
+    const { stdout } = await exec3(
       "git",
       ["ls-files", "--cached", "--others", "--exclude-standard"],
       {
@@ -2228,14 +3909,14 @@ async function walkDir(root, dir, depth, out) {
   if (depth > WALK_MAX_DEPTH) return;
   let dirents;
   try {
-    dirents = await readdir(dir, { withFileTypes: true });
+    dirents = await readdir3(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const d of dirents) {
     if (out.length >= MAX_FILES_TRACKED) return;
     if (WALK_IGNORES.has(d.name)) continue;
-    const abs = join5(dir, d.name);
+    const abs = join12(dir, d.name);
     if (d.isDirectory()) {
       await walkDir(root, abs, depth + 1, out);
     } else if (d.isFile()) {
@@ -2258,6 +3939,21 @@ async function ensureWorkspaceExists(id) {
   const ws = await getWorkspace(id);
   return ws ? ws.path : null;
 }
+var MAX_EDIT_BYTES = 1024 * 1024;
+var TREE_MAX_FILES = 5e3;
+function resolveInWorkspace(workspacePath, relPath) {
+  const root = resolve5(workspacePath);
+  const abs = resolve5(root, relPath);
+  if (abs !== root && !abs.startsWith(root + sep2)) return null;
+  return abs;
+}
+async function resolveExistingInWorkspace(workspacePath, relPath) {
+  const abs = resolveInWorkspace(workspacePath, relPath);
+  if (!abs) return null;
+  const [rootReal, targetReal] = await Promise.all([realpath(workspacePath), realpath(abs)]);
+  if (targetReal !== rootReal && !targetReal.startsWith(rootReal + sep2)) return null;
+  return targetReal;
+}
 function mountFilesRoute(app2) {
   app2.get("/:id/files/search", async (c) => {
     const id = c.req.param("id");
@@ -2275,7 +3971,7 @@ function mountFilesRoute(app2) {
       if (!qRaw) {
         const slice = all.slice(0, limit);
         entries = slice.map((relPath) => ({
-          path: join5(workspacePath, relPath),
+          path: join12(workspacePath, relPath),
           relPath
         }));
         truncated = all.length > limit;
@@ -2292,7 +3988,7 @@ function mountFilesRoute(app2) {
         scored.sort((a, b) => b.score - a.score);
         const top = scored.slice(0, limit);
         entries = top.map((e) => ({
-          path: join5(workspacePath, e.relPath),
+          path: join12(workspacePath, e.relPath),
           relPath: e.relPath
         }));
         truncated = matchCount > limit;
@@ -2305,12 +4001,81 @@ function mountFilesRoute(app2) {
       return c.json({ ok: false, error: message }, 500);
     }
   });
+  app2.get("/:id/files/list", async (c) => {
+    const id = c.req.param("id");
+    const workspacePath = await ensureWorkspaceExists(id);
+    if (!workspacePath) return c.json({ ok: false, error: "not found" }, 404);
+    try {
+      const all = await getFileList(workspacePath);
+      const entries = all.slice(0, TREE_MAX_FILES);
+      const body = {
+        workspacePath,
+        entries,
+        truncated: all.length > TREE_MAX_FILES
+      };
+      return c.json(body);
+    } catch (err2) {
+      const message = err2 instanceof Error ? err2.message : String(err2);
+      console.error(`[api/files] list for ${id} failed:`, err2);
+      return c.json({ ok: false, error: message }, 500);
+    }
+  });
+  app2.get("/:id/file", async (c) => {
+    const id = c.req.param("id");
+    const workspacePath = await ensureWorkspaceExists(id);
+    if (!workspacePath) return c.json({ ok: false, error: "not found" }, 404);
+    const relPath = c.req.query("path");
+    if (!relPath) return c.json({ ok: false, error: "path query is required" }, 400);
+    try {
+      const abs = await resolveExistingInWorkspace(workspacePath, relPath);
+      if (!abs) return c.json({ ok: false, error: "path escapes workspace" }, 400);
+      const st = await stat2(abs);
+      if (!st.isFile()) return c.json({ ok: false, error: "not a file" }, 400);
+      if (st.size > MAX_EDIT_BYTES) {
+        return c.json({ ok: false, error: "file too large to edit (>1 MB)" }, 400);
+      }
+      const buf = await readFile7(abs);
+      if (buf.includes(0)) return c.json({ ok: false, error: "binary file" }, 400);
+      const body = { relPath, content: buf.toString("utf-8") };
+      return c.json(body);
+    } catch (err2) {
+      const code = err2.code;
+      const msg = code === "ENOENT" ? "not found" : code === "EACCES" ? "permission denied" : "read failed";
+      return c.json({ ok: false, error: msg }, 400);
+    }
+  });
+  app2.put("/:id/file", async (c) => {
+    const id = c.req.param("id");
+    const workspacePath = await ensureWorkspaceExists(id);
+    if (!workspacePath) return c.json({ ok: false, error: "not found" }, 404);
+    const body = await c.req.json().catch(() => null);
+    if (!body || typeof body.path !== "string" || typeof body.content !== "string") {
+      return c.json({ ok: false, error: "path and content are required" }, 400);
+    }
+    if (Buffer.byteLength(body.content, "utf-8") > MAX_EDIT_BYTES) {
+      return c.json({ ok: false, error: "content too large (>1 MB)" }, 400);
+    }
+    try {
+      const abs = await resolveExistingInWorkspace(workspacePath, body.path);
+      if (!abs) return c.json({ ok: false, error: "path escapes workspace" }, 400);
+      const st = await stat2(abs);
+      if (!st.isFile()) return c.json({ ok: false, error: "not a file" }, 400);
+      await writeFile4(abs, body.content, "utf-8");
+      const ok = { ok: true };
+      return c.json(ok);
+    } catch (err2) {
+      const code = err2.code;
+      const msg = code === "ENOENT" ? "not found" : code === "EACCES" ? "permission denied" : "write failed";
+      return c.json({ ok: false, error: msg }, 400);
+    }
+  });
 }
 
 // src/api/resources.ts
-import { readdir as readdir2 } from "fs/promises";
-import { join as join6 } from "path";
-import { getAgentDir as getAgentDir2 } from "@earendil-works/pi-coding-agent";
+import { readdir as readdir4 } from "fs/promises";
+import { join as join13 } from "path";
+import { getAgentDir as getAgentDir3 } from "@earendil-works/pi-coding-agent";
+var MAX_SKILL_ZIP_BYTES = 25 * 1024 * 1024;
 function toResourceSource(info) {
   return {
     scope: info.scope,
@@ -2319,16 +4084,16 @@ function toResourceSource(info) {
   };
 }
 async function scanExtensionDirs(workspaceCwd) {
-  const dirs = [join6(getAgentDir2(), "extensions"), join6(workspaceCwd, ".pi", "extensions")];
+  const dirs = [join13(getAgentDir3(), "extensions"), join13(workspaceCwd, ".pi", "extensions")];
   const found = [];
   for (const dir of dirs) {
     try {
-      const entries = await readdir2(dir, { withFileTypes: true });
+      const entries = await readdir4(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".js"))) {
-          found.push(join6(dir, entry.name));
+          found.push(join13(dir, entry.name));
         } else if (entry.isDirectory()) {
-          found.push(join6(dir, entry.name));
+          found.push(join13(dir, entry.name));
         }
       }
     } catch {
@@ -2410,7 +4175,7 @@ async function snapshot(workspaceId, roots, workspaceCwd) {
 async function rootsFor(workspaceId) {
   const ws = await getWorkspace(workspaceId);
   if (!ws) throw new HttpError(404, "workspace not found");
-  const roots = resolveResourceRoots({ agentDir: getAgentDir2(), workspaceCwd: ws.path });
+  const roots = resolveResourceRoots({ agentDir: getAgentDir3(), workspaceCwd: ws.path });
   return { roots, workspaceCwd: ws.path };
 }
 function respondError(c, err2) {
@@ -2503,6 +4268,39 @@ function mountResourcesRoute(app2) {
       return respondError(c, err2);
     }
   });
+  app2.post("/:id/resources/skills/install", async (c) => {
+    const id = c.req.param("id");
+    const ws = await getWorkspace(id);
+    if (!ws) return c.json({ ok: false, error: "not found" }, 404);
+    const scope = c.req.query("scope");
+    if (!isScope(scope)) {
+      return c.json({ ok: false, error: "scope query must be 'user' or 'project'" }, 400);
+    }
+    const overwrite = c.req.query("overwrite") === "1";
+    const declared = Number(c.req.header("content-length") ?? "0");
+    if (declared > MAX_SKILL_ZIP_BYTES) {
+      return c.json({ ok: false, error: "archive too large (max 25 MB)" }, 400);
+    }
+    let zip;
+    try {
+      zip = Buffer.from(await c.req.arrayBuffer());
+    } catch {
+      return c.json({ ok: false, error: "could not read upload" }, 400);
+    }
+    if (zip.length === 0) return c.json({ ok: false, error: "empty upload" }, 400);
+    if (zip.length > MAX_SKILL_ZIP_BYTES) {
+      return c.json({ ok: false, error: "archive too large (max 25 MB)" }, 400);
+    }
+    try {
+      await workspaceManager.getOrCreate(id);
+      const { roots, workspaceCwd } = await rootsFor(id);
+      await installSkillFromZip({ roots, scope, zip, overwrite });
+      await reload(id);
+      return c.json(await snapshot(id, roots, workspaceCwd));
+    } catch (err2) {
+      return respondError(c, err2);
+    }
+  });
   app2.put("/:id/resources/skills", async (c) => {
     const id = c.req.param("id");
     const ws = await getWorkspace(id);
@@ -2657,6 +4455,7 @@ function mountResourcesRoute(app2) {
       }
       await setBuiltinEnabled(body.id, body.enabled);
       await runtime.session.reload();
+      reapplyToolPrefs(id, runtime.session);
       const { roots, workspaceCwd } = await rootsFor(id);
       return c.json(await snapshot(id, roots, workspaceCwd));
     } catch (err2) {
@@ -2775,9 +4574,9 @@ function extractPreview(entry) {
     case "message":
       return extractMessagePreview(entry["message"]);
     case "compaction":
-      return truncate(String(entry["summary"] ?? "Compaction"), PREVIEW_MAX);
+      return truncate2(String(entry["summary"] ?? "Compaction"), PREVIEW_MAX);
     case "branch_summary":
-      return truncate(String(entry["summary"] ?? "Branch summary"), PREVIEW_MAX);
+      return truncate2(String(entry["summary"] ?? "Branch summary"), PREVIEW_MAX);
     case "model_change":
       return `${entry["provider"] ?? ""}/${entry["modelId"] ?? ""}`;
     case "thinking_level_change":
@@ -2785,7 +4584,7 @@ function extractPreview(entry) {
     case "session_info":
       return entry["name"] ? `Name: ${entry["name"]}` : "Session info";
     case "custom_message":
-      return truncate(extractContentText2(entry["content"]), PREVIEW_MAX) || "Extension message";
+      return truncate2(extractContentText2(entry["content"]), PREVIEW_MAX) || "Extension message";
     case "custom":
       return `Custom: ${entry["customType"] ?? ""}`;
     case "label":
@@ -2798,9 +4597,9 @@ function extractMessagePreview(msg) {
   if (!msg || typeof msg !== "object") return "";
   const m = msg;
   if (m.role === "bashExecution") {
-    return truncate(`$ ${m.command ?? ""}`, PREVIEW_MAX);
+    return truncate2(`$ ${m.command ?? ""}`, PREVIEW_MAX);
   }
-  return truncate(extractContentText2(m.content), PREVIEW_MAX);
+  return truncate2(extractContentText2(m.content), PREVIEW_MAX);
 }
 function extractContentText2(content) {
   if (typeof content === "string") return content.replace(/\s+/g, " ").trim();
@@ -2817,7 +4616,7 @@ function extractContentText2(content) {
   }
   return parts.join(" ").replace(/\s+/g, " ").trim();
 }
-function truncate(text, max) {
+function truncate2(text, max) {
   if (text.length <= max) return text;
   return text.slice(0, max) + "\u2026";
 }
@@ -2913,7 +4712,7 @@ workspacesRoute.get("/:id/export", async (c) => {
     }
     const runtime = await workspaceManager.getOrCreate(id, sessionPath || void 0);
     const outputPath = await runtime.session.exportToHtml();
-    const html = await readFile4(outputPath, "utf-8");
+    const html = await readFile8(outputPath, "utf-8");
     const filename = basename2(outputPath);
     const body = { html, filename };
     return c.json(body);
@@ -2946,9 +4745,9 @@ workspacesRoute.post("/", async (c) => {
   if (!isAbsolute3(body.path)) {
     return c.json({ ok: false, error: "path must be absolute" }, 400);
   }
-  const resolved = resolve3(body.path);
+  const resolved = resolve6(body.path);
   try {
-    const st = await stat2(resolved);
+    const st = await stat3(resolved);
     if (!st.isDirectory()) {
       return c.json({ ok: false, error: "path is not a directory" }, 400);
     }
@@ -2972,24 +4771,35 @@ workspacesRoute.delete("/:id", async (c) => {
   const body = { ok: true };
   return c.json(body);
 });
+workspacesRoute.patch("/:id", async (c) => {
+  const id = c.req.param("id");
+  const body = await c.req.json();
+  if (typeof body?.trustProjectAgents !== "boolean") {
+    return c.json({ ok: false, error: "trustProjectAgents must be a boolean" }, 400);
+  }
+  const updated = await setWorkspaceTrustProjectAgents(id, body.trustProjectAgents);
+  if (!updated) return c.json({ ok: false, error: "not found" }, 404);
+  const res = { workspace: await enrichWorkspace(updated) };
+  return c.json(res);
+});
 mountConfigRoutes(workspacesRoute);
 mountResourcesRoute(workspacesRoute);
 mountFilesRoute(workspacesRoute);
 workspacesRoute.route("/:id/tree", treeRoute);
 
 // src/api/fs.ts
-import { readdir as readdir3 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join7, resolve as resolve4 } from "path";
+import { readdir as readdir5 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join14, resolve as resolve7 } from "path";
 import { Hono as Hono3 } from "hono";
 var fsRoute = new Hono3();
 fsRoute.get("/browse", async (c) => {
   const rawPath = c.req.query("path");
   const showHidden = c.req.query("showHidden") === "1";
-  const target = rawPath && isAbsolute4(rawPath) ? resolve4(rawPath) : homedir2();
+  const target = rawPath && isAbsolute4(rawPath) ? resolve7(rawPath) : homedir3();
   let dirents;
   try {
-    dirents = await readdir3(target, { withFileTypes: true });
+    dirents = await readdir5(target, { withFileTypes: true });
   } catch (err2) {
     const code = err2.code;
     const msg = code === "EACCES" ? "permission denied" : code === "ENOENT" ? "not found" : "read failed";
@@ -2997,11 +4807,11 @@ fsRoute.get("/browse", async (c) => {
   }
   const entries = dirents.filter((d) => d.isDirectory()).filter((d) => showHidden || !d.name.startsWith(".")).map((d) => ({
     name: d.name,
-    path: join7(target, d.name),
+    path: join14(target, d.name),
     type: "dir"
   })).sort((a, b) => a.name.localeCompare(b.name));
   const parent = (() => {
-    const p = dirname4(target);
+    const p = dirname5(target);
     return p === target ? null : p;
   })();
   const body = { path: target, parent, entries };
@@ -3009,12 +4819,48 @@ fsRoute.get("/browse", async (c) => {
 });
 
 // src/api/model-configs.ts
-import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir4 } from "fs/promises";
-import { dirname as dirname5, join as join8 } from "path";
+import { readFile as readFile9 } from "fs/promises";
+import { join as join15 } from "path";
 import { Hono as Hono4 } from "hono";
 import {
-  getAgentDir as getAgentDir3
+  getAgentDir as getAgentDir4
 } from "@earendil-works/pi-coding-agent";
+
+// src/api/model-config-keys.ts
+var MASKED_KEY_RE = /^….{1,8}$/;
+function maskApiKey(key) {
+  return `\u2026${key.slice(-4)}`;
+}
+function isPreservedApiKey(key) {
+  return key === "" || MASKED_KEY_RE.test(key);
+}
+function maskConfigForResponse(config2) {
+  const providers = {};
+  for (const [name, provider] of Object.entries(config2.providers)) {
+    providers[name] = {
+      ...provider,
+      apiKey: provider.apiKey ? maskApiKey(provider.apiKey) : ""
+    };
+  }
+  return { providers };
+}
+function preserveApiKeys(incoming, existing) {
+  const providers = { ...incoming.providers };
+  for (const [name, provider] of Object.entries(providers)) {
+    if (!isPreservedApiKey(provider.apiKey)) continue;
+    const prev = existing.providers[name]?.apiKey;
+    if (prev) {
+      providers[name] = { ...provider, apiKey: prev };
+    }
+  }
+  return { providers };
+}
+function resolveUpsertApiKey(incomingKey, existingKey) {
+  if (!isPreservedApiKey(incomingKey)) return incomingKey;
+  return existingKey || void 0;
+}
+
+// src/api/model-configs.ts
 var modelConfigsRoute = new Hono4();
 var writeLock = Promise.resolve();
 function withWriteLock(fn) {
@@ -3025,11 +4871,11 @@ function withWriteLock(fn) {
   return next;
 }
 function modelsPath() {
-  return join8(getAgentDir3(), "models.json");
+  return join15(getAgentDir4(), "models.json");
 }
 async function readModelsJson() {
   try {
-    const raw = await readFile5(modelsPath(), "utf-8");
+    const raw = await readFile9(modelsPath(), "utf-8");
     return JSON.parse(raw);
   } catch (err2) {
     if (err2?.code === "ENOENT") {
@@ -3039,14 +4885,12 @@ async function readModelsJson() {
   }
 }
 async function writeModelsJson(config2) {
-  const p = modelsPath();
-  await mkdir4(dirname5(p), { recursive: true });
-  await writeFile4(p, JSON.stringify(config2, null, 2), "utf-8");
+  await writeJsonAtomic(modelsPath(), config2, { mode: 384 });
 }
 var ValidationError = class extends Error {
-  constructor(message, status) {
+  constructor(message, status2) {
     super(message);
-    this.status = status;
+    this.status = status2;
   }
   status;
 };
@@ -3064,7 +4908,7 @@ function refreshRegistry(workspaceId) {
 modelConfigsRoute.get("/", async (c) => {
   try {
     const config2 = await readModelsJson();
-    const body = { config: config2 };
+    const body = { config: maskConfigForResponse(config2) };
     return c.json(body);
   } catch (err2) {
     const message = err2 instanceof Error ? err2.message : String(err2);
@@ -3077,12 +4921,15 @@ modelConfigsRoute.put("/", async (c) => {
     return c.json({ ok: false, error: "config.providers is required" }, 400);
   }
   try {
-    await withWriteLock(async () => {
-      await writeModelsJson(body.config);
+    const config2 = await withWriteLock(async () => {
+      const existing = await readModelsJson();
+      const merged = preserveApiKeys(body.config, existing);
+      await writeModelsJson(merged);
+      return merged;
     });
     const workspaceId = c.req.query("workspaceId");
     refreshRegistry(workspaceId ?? void 0);
-    const resp = { config: body.config };
+    const resp = { config: maskConfigForResponse(config2) };
     return c.json(resp);
   } catch (err2) {
     const message = err2 instanceof Error ? err2.message : String(err2);
@@ -3094,8 +4941,8 @@ modelConfigsRoute.post("/providers", async (c) => {
   if (!body?.name || !body?.provider) {
     return c.json({ ok: false, error: "name and provider are required" }, 400);
   }
-  if (!body.provider.baseUrl || !body.provider.api || !body.provider.apiKey) {
-    return c.json({ ok: false, error: "provider must have baseUrl, api, and apiKey" }, 400);
+  if (!body.provider.baseUrl || !body.provider.api) {
+    return c.json({ ok: false, error: "provider must have baseUrl and api" }, 400);
   }
   if (!Array.isArray(body.provider.models)) {
     return c.json({ ok: false, error: "provider.models must be an array" }, 400);
@@ -3103,15 +4950,22 @@ modelConfigsRoute.post("/providers", async (c) => {
   try {
     const config2 = await withWriteLock(async () => {
       const cfg = await readModelsJson();
-      cfg.providers[body.name] = body.provider;
+      const apiKey2 = resolveUpsertApiKey(body.provider.apiKey, cfg.providers[body.name]?.apiKey);
+      if (!apiKey2) {
+        throw new ValidationError("apiKey is required for a new provider", 400);
+      }
+      cfg.providers[body.name] = { ...body.provider, apiKey: apiKey2 };
       await writeModelsJson(cfg);
       return cfg;
     });
     const workspaceId = c.req.query("workspaceId");
     refreshRegistry(workspaceId ?? void 0);
-    const resp = { config: config2 };
+    const resp = { config: maskConfigForResponse(config2) };
     return c.json(resp);
   } catch (err2) {
+    if (err2 instanceof ValidationError) {
+      return c.json({ ok: false, error: err2.message }, err2.status);
+    }
     const message = err2 instanceof Error ? err2.message : String(err2);
     return c.json({ ok: false, error: message }, 500);
   }
@@ -3133,7 +4987,7 @@ modelConfigsRoute.delete("/providers", async (c) => {
     });
     const workspaceId = c.req.query("workspaceId");
     refreshRegistry(workspaceId ?? void 0);
-    const resp = { config: config2 };
+    const resp = { config: maskConfigForResponse(config2) };
     return c.json(resp);
   } catch (err2) {
     if (err2 instanceof ValidationError) {
@@ -3165,7 +5019,7 @@ modelConfigsRoute.post("/providers/:provider/models", async (c) => {
     });
     const workspaceId = c.req.query("workspaceId");
     refreshRegistry(workspaceId ?? void 0);
-    const resp = { config: config2 };
+    const resp = { config: maskConfigForResponse(config2) };
     return c.json(resp);
   } catch (err2) {
     if (err2 instanceof ValidationError) {
@@ -3201,7 +5055,7 @@ modelConfigsRoute.put("/providers/:provider/models/:modelId", async (c) => {
     });
     const workspaceId = c.req.query("workspaceId");
     refreshRegistry(workspaceId ?? void 0);
-    const resp = { config: config2 };
+    const resp = { config: maskConfigForResponse(config2) };
     return c.json(resp);
   } catch (err2) {
     if (err2 instanceof ValidationError) {
@@ -3230,7 +5084,7 @@ modelConfigsRoute.delete("/providers/:provider/models/:modelId", async (c) => {
     });
     const workspaceId = c.req.query("workspaceId");
     refreshRegistry(workspaceId ?? void 0);
-    const resp = { config: config2 };
+    const resp = { config: maskConfigForResponse(config2) };
     return c.json(resp);
   } catch (err2) {
     if (err2 instanceof ValidationError) {
@@ -3241,8 +5095,197 @@ modelConfigsRoute.delete("/providers/:provider/models/:modelId", async (c) => {
   }
 });
 
+// src/api/web-search.ts
+import { Hono as Hono5 } from "hono";
+var webSearchRoute = new Hono5();
+function status() {
+  return getKeyStatus();
+}
+webSearchRoute.get("/", (c) => c.json(status()));
+webSearchRoute.put("/", async (c) => {
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body.apiKey !== "string") {
+    return c.json({ ok: false, error: "apiKey (string) is required" }, 400);
+  }
+  try {
+    await setTavilyApiKey(body.apiKey);
+    return c.json(status());
+  } catch (err2) {
+    const message = err2 instanceof Error ? err2.message : String(err2);
+    return c.json({ ok: false, error: message }, 500);
+  }
+});
+webSearchRoute.delete("/", async (c) => {
+  try {
+    await clearTavilyApiKey();
+    return c.json(status());
+  } catch (err2) {
+    const message = err2 instanceof Error ? err2.message : String(err2);
+    return c.json({ ok: false, error: message }, 500);
+  }
+});
+
 // src/ws/hub.ts
 import { WebSocketServer } from "ws";
+
+// src/security.ts
+var LOOPBACK_HOSTNAMES = ["127.0.0.1", "localhost"];
+function buildAllowedHosts() {
+  const ports = /* @__PURE__ */ new Set([config.port, 5173]);
+  const hosts = /* @__PURE__ */ new Set();
+  for (const name of LOOPBACK_HOSTNAMES) {
+    for (const port of ports) {
+      hosts.add(`${name}:${port}`);
+    }
+  }
+  return hosts;
+}
+function buildAllowedWsOrigins() {
+  const origins = /* @__PURE__ */ new Set([config.corsOrigin]);
+  for (const name of LOOPBACK_HOSTNAMES) {
+    origins.add(`http://${name}:${config.port}`);
+    origins.add(`http://${name}:5173`);
+  }
+  return origins;
+}
+var allowedHosts = buildAllowedHosts();
+var allowedWsOrigins = buildAllowedWsOrigins();
+function isAllowedHost(host) {
+  if (!host) return false;
+  return allowedHosts.has(host.toLowerCase());
+}
+function isAllowedWsOrigin(origin) {
+  if (!origin) return false;
+  return allowedWsOrigins.has(origin);
+}
+
+// src/ws/terminals.ts
+import { createRequire } from "module";
+import { accessSync, chmodSync, constants, statSync } from "fs";
+import { join as join16 } from "path";
+import { spawn as spawn2 } from "node-pty";
+var FALLBACK_SHELL = process.platform === "win32" ? "powershell.exe" : "/bin/bash";
+function send(ws, msg) {
+  if (ws.readyState !== ws.OPEN) return;
+  ws.send(JSON.stringify(msg));
+}
+function ptyEnv() {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (typeof v === "string") env[k] = v;
+  }
+  env.TERM = "xterm-256color";
+  env.COLORTERM = "truecolor";
+  return env;
+}
+async function handleTerminalMessage(ws, terminals, msg) {
+  switch (msg.type) {
+    case "terminal_open": {
+      ensureSpawnHelperExecutable();
+      const existing = terminals.get(msg.terminalId);
+      if (existing) {
+        try {
+          existing.kill();
+        } catch {
+        }
+        terminals.delete(msg.terminalId);
+      }
+      const ws_ = await getWorkspace(msg.workspaceId);
+      if (!ws_) {
+        send(ws, { type: "terminal_error", terminalId: msg.terminalId, message: "workspace not found" });
+        return;
+      }
+      const shell = process.env.SHELL || FALLBACK_SHELL;
+      let pty;
+      try {
+        pty = spawn2(shell, [], {
+          name: "xterm-256color",
+          cols: clampDim(msg.cols, 80),
+          rows: clampDim(msg.rows, 24),
+          cwd: ws_.path,
+          env: ptyEnv()
+        });
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        send(ws, { type: "terminal_error", terminalId: msg.terminalId, message });
+        return;
+      }
+      terminals.set(msg.terminalId, pty);
+      pty.onData((data) => {
+        send(ws, { type: "terminal_output", terminalId: msg.terminalId, data });
+      });
+      pty.onExit(({ exitCode }) => {
+        terminals.delete(msg.terminalId);
+        send(ws, { type: "terminal_exit", terminalId: msg.terminalId, exitCode });
+      });
+      return;
+    }
+    case "terminal_input": {
+      terminals.get(msg.terminalId)?.write(msg.data);
+      return;
+    }
+    case "terminal_resize": {
+      const pty = terminals.get(msg.terminalId);
+      if (pty) {
+        try {
+          pty.resize(clampDim(msg.cols, 80), clampDim(msg.rows, 24));
+        } catch {
+        }
+      }
+      return;
+    }
+    case "terminal_close": {
+      const pty = terminals.get(msg.terminalId);
+      if (pty) {
+        terminals.delete(msg.terminalId);
+        try {
+          pty.kill();
+        } catch {
+        }
+      }
+      return;
+    }
+  }
+}
+function closeAllTerminals(terminals) {
+  for (const pty of terminals.values()) {
+    try {
+      pty.kill();
+    } catch {
+    }
+  }
+  terminals.clear();
+}
+function clampDim(n, fallback) {
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
+}
+var spawnHelperChecked = false;
+function ensureSpawnHelperExecutable() {
+  if (spawnHelperChecked || process.platform === "win32") return;
+  spawnHelperChecked = true;
+  try {
+    const require2 = createRequire(import.meta.url);
+    const root = join16(require2.resolve("node-pty/package.json"), "..");
+    const candidates = [
+      join16(root, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper"),
+      join16(root, "build", "Release", "spawn-helper")
+    ];
+    for (const path of candidates) {
+      try {
+        accessSync(path, constants.X_OK);
+      } catch {
+        try {
+          const mode = statSync(path).mode;
+          chmodSync(path, mode | 73);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+
+// src/ws/hub.ts
 var BACKGROUND_CAP = 4;
 var replacementLocks = /* @__PURE__ */ new Map();
 function withReplacementLock(workspaceId, fn) {
@@ -3258,23 +5301,40 @@ function withReplacementLock(workspaceId, fn) {
   return next;
 }
 function attachWsHub(httpServer) {
-  const wss = new WebSocketServer({ server: httpServer, path: "/ws" });
-  wss.on("connection", (ws) => {
-    const state = { background: /* @__PURE__ */ new Map() };
-    ws.on("message", async (raw) => {
-      let msg;
-      try {
-        msg = JSON.parse(raw.toString());
-      } catch {
-        send(ws, { type: "error", message: "invalid JSON" });
+  const wss = new WebSocketServer({
+    server: httpServer,
+    path: "/ws",
+    verifyClient: (info, cb) => {
+      const host = info.req.headers.host;
+      const origin = info.origin;
+      if (!isAllowedHost(host) || !isAllowedWsOrigin(origin)) {
+        cb(false, 403, "Forbidden");
         return;
       }
-      try {
-        await handle(ws, state, msg);
-      } catch (err2) {
-        const message = err2 instanceof Error ? err2.message : String(err2);
-        send(ws, { type: "error", message, command: msg.type });
-      }
+      cb(true);
+    }
+  });
+  wss.on("connection", (ws) => {
+    const state = { background: /* @__PURE__ */ new Map(), terminals: /* @__PURE__ */ new Map() };
+    let inbound = Promise.resolve();
+    ws.on("message", (raw) => {
+      inbound = inbound.then(async () => {
+        let msg;
+        try {
+          msg = JSON.parse(raw.toString());
+        } catch {
+          send2(ws, { type: "error", message: "invalid JSON" });
+          return;
+        }
+        try {
+          await handle(ws, state, msg);
+        } catch (err2) {
+          const message = err2 instanceof Error ? err2.message : String(err2);
+          send2(ws, { type: "error", message, command: msg.type });
+        }
+      }).catch((err2) => {
+        console.error("[ws] inbound chain error:", err2);
+      });
     });
     ws.on("close", () => {
       detach(state, ws);
@@ -3290,12 +5350,12 @@ async function handle(ws, state, msg) {
         runtime = await workspaceManager.getOrCreate(msg.workspaceId, msg.sessionPath);
       } catch (err2) {
         const message = err2 instanceof Error ? err2.message : String(err2);
-        send(ws, { type: "error", message, command: "subscribe" });
-        send(ws, { type: "ack", command: "subscribe" });
+        send2(ws, { type: "error", message, command: "subscribe" });
+        send2(ws, { type: "ack", command: "subscribe" });
         return;
       }
       promoteToPrimary(ws, state, msg.workspaceId, runtime);
-      send(ws, { type: "ack", command: "subscribe" });
+      send2(ws, { type: "ack", command: "subscribe" });
       return;
     }
     case "unsubscribe": {
@@ -3307,23 +5367,23 @@ async function handle(ws, state, msg) {
     case "prompt": {
       const primary = state.primary;
       if (!primary) {
-        send(ws, { type: "error", message: "not subscribed", command: "prompt" });
+        send2(ws, { type: "error", message: "not subscribed", command: "prompt" });
         return;
       }
       if (replacementLocks.has(primary.workspaceId)) {
-        send(ws, { type: "error", message: "session switching in progress", command: "prompt" });
+        send2(ws, { type: "error", message: "session switching in progress", command: "prompt" });
         return;
       }
       void primary.runtime.session.prompt(msg.message, { streamingBehavior: msg.streamingBehavior }).catch((err2) => {
         const message = err2 instanceof Error ? err2.message : String(err2);
-        send(ws, { type: "error", message, command: "prompt" });
+        send2(ws, { type: "error", message, command: "prompt" });
       });
       return;
     }
     case "abort": {
       const primary = state.primary;
       if (!primary) {
-        send(ws, { type: "error", message: "not subscribed", command: "abort" });
+        send2(ws, { type: "error", message: "not subscribed", command: "abort" });
         return;
       }
       await primary.runtime.session.abort();
@@ -3337,7 +5397,7 @@ async function handle(ws, state, msg) {
           runtime = await workspaceManager.createSession(workspaceId);
         } catch (err2) {
           const message = err2 instanceof Error ? err2.message : String(err2);
-          send(ws, { type: "error", message, command: "new_session" });
+          send2(ws, { type: "error", message, command: "new_session" });
           return;
         }
         promoteToPrimary(ws, state, workspaceId, runtime);
@@ -3347,22 +5407,22 @@ async function handle(ws, state, msg) {
     case "fork": {
       const primary = state.primary;
       if (!primary) {
-        send(ws, { type: "error", message: "not subscribed", command: "fork" });
+        send2(ws, { type: "error", message: "not subscribed", command: "fork" });
         return;
       }
       const workspaceId = primary.workspaceId;
       await withReplacementLock(workspaceId, async () => {
         const source = state.primary;
         if (!source) {
-          send(ws, { type: "error", message: "not subscribed", command: "fork" });
+          send2(ws, { type: "error", message: "not subscribed", command: "fork" });
           return;
         }
         if (!source.sessionPath) {
-          send(ws, { type: "error", message: "cannot fork an unsaved session", command: "fork" });
+          send2(ws, { type: "error", message: "cannot fork an unsaved session", command: "fork" });
           return;
         }
         if (source.runtime.session.isStreaming) {
-          send(ws, { type: "error", message: "cannot fork while streaming", command: "fork" });
+          send2(ws, { type: "error", message: "cannot fork while streaming", command: "fork" });
           return;
         }
         let result;
@@ -3370,11 +5430,11 @@ async function handle(ws, state, msg) {
           result = await workspaceManager.fork(workspaceId, source.sessionPath, msg.entryId);
         } catch (err2) {
           const message = err2 instanceof Error ? err2.message : String(err2);
-          send(ws, { type: "error", message, command: "fork" });
+          send2(ws, { type: "error", message, command: "fork" });
           return;
         }
         if (result.cancelled || !result.runtime) {
-          send(ws, { type: "error", message: "fork cancelled", command: "fork" });
+          send2(ws, { type: "error", message: "fork cancelled", command: "fork" });
           return;
         }
         promoteToPrimary(ws, state, workspaceId, result.runtime);
@@ -3384,7 +5444,7 @@ async function handle(ws, state, msg) {
     case "answer_question": {
       const primary = state.primary;
       if (!primary) {
-        send(ws, { type: "error", message: "not subscribed", command: "answer_question" });
+        send2(ws, { type: "error", message: "not subscribed", command: "answer_question" });
         return;
       }
       resolveAnswer(msg.toolCallId, msg.answer, primary.runtime.session.sessionFile ?? null);
@@ -3393,28 +5453,28 @@ async function handle(ws, state, msg) {
     case "navigate_tree": {
       const primary = state.primary;
       if (!primary) {
-        send(ws, { type: "error", message: "not subscribed", command: "navigate_tree" });
+        send2(ws, { type: "error", message: "not subscribed", command: "navigate_tree" });
         return;
       }
       if (msg.workspaceId !== primary.workspaceId) {
-        send(ws, { type: "error", message: "workspace mismatch", command: "navigate_tree" });
+        send2(ws, { type: "error", message: "workspace mismatch", command: "navigate_tree" });
         return;
       }
       await withReplacementLock(primary.workspaceId, async () => {
         const current = state.primary;
         if (!current) {
-          send(ws, { type: "error", message: "not subscribed", command: "navigate_tree" });
+          send2(ws, { type: "error", message: "not subscribed", command: "navigate_tree" });
           return;
         }
         if (current.runtime.session.isStreaming) {
-          send(ws, { type: "error", message: "cannot navigate tree while streaming", command: "navigate_tree" });
+          send2(ws, { type: "error", message: "cannot navigate tree while streaming", command: "navigate_tree" });
           return;
         }
         const result = await current.runtime.session.navigateTree(msg.targetId, {
           summarize: msg.summarize,
           customInstructions: msg.customInstructions
         });
-        send(ws, {
+        send2(ws, {
           type: "navigate_tree_result",
           workspaceId: current.workspaceId,
           editorText: result.editorText,
@@ -3426,27 +5486,34 @@ async function handle(ws, state, msg) {
     case "compact": {
       const primary = state.primary;
       if (!primary) {
-        send(ws, { type: "error", message: "not subscribed", command: "compact" });
+        send2(ws, { type: "error", message: "not subscribed", command: "compact" });
         return;
       }
       if (primary.runtime.session.isStreaming) {
-        send(ws, { type: "error", message: "cannot compact while streaming", command: "compact" });
+        send2(ws, { type: "error", message: "cannot compact while streaming", command: "compact" });
         return;
       }
       if (primary.runtime.session.isCompacting) {
-        send(ws, { type: "error", message: "compaction already in progress", command: "compact" });
+        send2(ws, { type: "error", message: "compaction already in progress", command: "compact" });
         return;
       }
       primary.runtime.session.compact().catch((err2) => {
         const message = err2 instanceof Error ? err2.message : String(err2);
-        send(ws, { type: "error", message, command: "compact" });
+        send2(ws, { type: "error", message, command: "compact" });
       });
       return;
     }
+    case "terminal_open":
+    case "terminal_input":
+    case "terminal_resize":
+    case "terminal_close": {
+      await handleTerminalMessage(ws, state.terminals, msg);
+      return;
+    }
     default: {
       const _ = msg;
       void _;
-      send(ws, { type: "error", message: "unknown command" });
+      send2(ws, { type: "error", message: "unknown command" });
     }
   }
 }
@@ -3478,7 +5545,7 @@ function bindPrimary(ws, state, workspaceId, runtime) {
     } else if (payload.kind === "message_update" && payload.delta.kind === "text" && assistantStartAt !== void 0 && assistantFirstTokenAt === void 0) {
       assistantFirstTokenAt = performance.now();
     }
-    send(ws, { type: "event", workspaceId, sessionPath, payload });
+    send2(ws, { type: "event", workspaceId, sessionPath, payload });
     if (payload.kind === "message_end" && payload.role === "assistant" && assistantStartAt !== void 0) {
       const now = performance.now();
       const timing = {
@@ -3486,7 +5553,7 @@ function bindPrimary(ws, state, workspaceId, runtime) {
         firstTokenMs: assistantFirstTokenAt !== void 0 ? Math.round(assistantFirstTokenAt - assistantStartAt) : null,
         totalMs: Math.round(now - assistantStartAt)
       };
-      send(ws, { type: "event", workspaceId, sessionPath, payload: timing });
+      send2(ws, { type: "event", workspaceId, sessionPath, payload: timing });
       assistantStartAt = void 0;
       assistantFirstTokenAt = void 0;
     }
@@ -3502,16 +5569,16 @@ function bindPrimary(ws, state, workspaceId, runtime) {
     runtime.session.state.pendingToolCalls,
     scanMessages
   )) {
-    send(ws, { type: "event", workspaceId, sessionPath, payload });
+    send2(ws, { type: "event", workspaceId, sessionPath, payload });
   }
   const inFlight = inFlightAssistantSnapshot(streamingMessage);
   if (inFlight) {
     for (const payload of inFlight) {
-      send(ws, { type: "event", workspaceId, sessionPath, payload });
+      send2(ws, { type: "event", workspaceId, sessionPath, payload });
     }
   }
   for (const payload of inFlightToolCallsSnapshot(sessionPath)) {
-    send(ws, { type: "event", workspaceId, sessionPath, payload });
+    send2(ws, { type: "event", workspaceId, sessionPath, payload });
   }
   sendContextUsage(ws, runtime, workspaceId, sessionPath);
 }
@@ -3525,7 +5592,7 @@ function demotePrimaryToBackground(ws, state) {
   const unsubscribeSession = session.subscribe((ev) => {
     const payload = translatePiEvent(ev);
     if (!payload) return;
-    send(ws, { type: "event", workspaceId: primary.workspaceId, sessionPath, payload });
+    send2(ws, { type: "event", workspaceId: primary.workspaceId, sessionPath, payload });
     if (payload.kind === "agent_end" || payload.kind === "compaction_end" || payload.kind === "session_info_changed" || payload.kind === "thinking_level_changed") {
       sendContextUsage(ws, primary.runtime, primary.workspaceId, sessionPath);
     }
@@ -3541,7 +5608,7 @@ function demotePrimaryToBackground(ws, state) {
     const evicted = state.background.get(oldestKey);
     teardownBackground(state, oldestKey, ws);
     if (evicted) {
-      send(ws, {
+      send2(ws, {
         type: "background_evicted",
         workspaceId: evicted.workspaceId,
         sessionPath: evicted.sessionPath
@@ -3557,7 +5624,7 @@ function teardownBackground(state, runtimeKey, ws) {
   if (ws) unrefWorkspaceSubscriber(state, bg.workspaceId, ws);
 }
 function sendSubscribed(ws, workspaceId, runtime) {
-  send(ws, {
+  send2(ws, {
     type: "subscribed",
     workspaceId,
     sessionPath: runtime.session.sessionFile ?? null,
@@ -3577,7 +5644,7 @@ function sendContextUsage(ws, runtime, workspaceId, sessionPath) {
     contextWindow: usage.contextWindow,
     percent: usage.percent
   };
-  send(ws, { type: "event", workspaceId, sessionPath, payload });
+  send2(ws, { type: "event", workspaceId, sessionPath, payload });
 }
 function detachPrimary(state, ws) {
   const primary = state.primary;
@@ -3591,18 +5658,19 @@ function detach(state, ws) {
   for (const runtimeKey of [...state.background.keys()]) {
     teardownBackground(state, runtimeKey, ws);
   }
+  closeAllTerminals(state.terminals);
 }
-function send(ws, msg) {
+function send2(ws, msg) {
   if (ws.readyState !== ws.OPEN) return;
   ws.send(JSON.stringify(msg));
 }
 
 // src/index.ts
 configureHttpProxy();
-var app = new Hono5();
-var distDir = dirname6(fileURLToPath(import.meta.url));
-var webRoot = resolve5(process.env.PI_PILOT_WEB_ROOT ?? join9(distDir, "..", "public"));
-var webIndexPath = join9(webRoot, "index.html");
+var app = new Hono6();
+var distDir = dirname6(fileURLToPath2(import.meta.url));
+var webRoot = resolve8(process.env.PI_PILOT_WEB_ROOT ?? join17(distDir, "..", "public"));
+var webIndexPath = join17(webRoot, "index.html");
 var mimeTypes = {
   ".css": "text/css; charset=utf-8",
   ".html": "text/html; charset=utf-8",
@@ -3628,7 +5696,7 @@ function safeResolveWebPath(pathname) {
     return void 0;
   }
   const relativePath = decoded === "/" ? "index.html" : decoded.replace(/^\/+/, "");
-  const candidate = resolve5(webRoot, relativePath);
+  const candidate = resolve8(webRoot, relativePath);
   if (candidate !== webRoot && !candidate.startsWith(`${webRoot}${sep3}`)) {
     return void 0;
   }
@@ -3636,7 +5704,7 @@ function safeResolveWebPath(pathname) {
 }
 async function readWebFile(path) {
   try {
-    return await readFile6(path);
+    return await readFile10(path);
   } catch (err2) {
     const code = err2.code;
     if (code === "ENOENT" || code === "EISDIR") return void 0;
@@ -3649,7 +5717,7 @@ async function serveWeb(c) {
   const assetPath = safeResolveWebPath(pathname);
   if (!assetPath) return c.text("invalid asset path", 400);
   const asset = await readWebFile(assetPath);
-  const body = asset ?? await readFile6(webIndexPath);
+  const body = asset ?? await readFile10(webIndexPath);
   const filePath = asset ? assetPath : webIndexPath;
   const headers = {
     "Content-Type": mimeTypes[extname(filePath)] ?? "application/octet-stream",
@@ -3657,6 +5725,12 @@ async function serveWeb(c) {
   };
   return new Response(body, { headers });
 }
+app.use("*", async (c, next) => {
+  if (!isAllowedHost(c.req.header("host"))) {
+    return c.text("Forbidden", 403);
+  }
+  await next();
+});
 app.use(
   "/api/*",
   cors({
@@ -3668,7 +5742,8 @@ app.get("/api/health", (c) => c.json({ ok: true }));
 app.route("/api/workspaces", workspacesRoute);
 app.route("/api/fs", fsRoute);
 app.route("/api/model-configs", modelConfigsRoute);
-if (existsSync(webIndexPath)) {
+app.route("/api/web-search", webSearchRoute);
+if (existsSync2(webIndexPath)) {
   app.get("*", serveWeb);
 } else {
   app.get(
@@ -3680,6 +5755,9 @@ if (existsSync(webIndexPath)) {
   );
 }
 await loadBuiltinPrefs();
+await loadSessionToolPrefs();
+await loadWebSearchPrefs();
+await sweepOrphanedChildrenOnBoot();
 var server = serve(
   {
     fetch: app.fetch,
@@ -3698,9 +5776,20 @@ async function shutdown(reason) {
   } catch (e) {
     console.error("[pi-pilot] disposeAll error:", e);
   }
+  const sweptChildren = killAllChildren();
+  if (sweptChildren > 0) {
+    console.warn(`[pi-pilot] killed ${sweptChildren} lingering subagent child(ren)`);
+  }
   server.close(() => process.exit(0));
   setTimeout(() => process.exit(1), 3e3).unref();
 }
+process.on("unhandledRejection", (reason) => {
+  console.error("[pi-pilot] unhandled rejection (process kept alive):", reason);
+});
+process.on("uncaughtException", (err2) => {
+  console.error("[pi-pilot] uncaught exception:", err2);
+  void shutdown("uncaughtException");
+});
 process.on("SIGINT", () => void shutdown("SIGINT"));
 process.on("SIGTERM", () => void shutdown("SIGTERM"));
 //# sourceMappingURL=index.js.map