@openlines/opl-pi-sht 0.1.21 → 0.2.0

package/README.md

@@ -1,11 +1,15 @@
 # opl-pi-sht
 
+<div align="center">
+
 [![gh stars](https://img.shields.io/github/stars/linellazatin/opl-pi-sht?logo=github&color=ffffe0)](https://github.com/linellazatin/opl-pi-sht)
 [![gh release](https://img.shields.io/github/v/release/linellazatin/opl-pi-sht?display_name=release&logo=github&color=ffffe0)](https://github.com/linellazatin/opl-pi-sht)
 [![npm version](https://img.shields.io/npm/v/%40openlines%2Fopl-pi-sht?logo=npm&color=cb3837)](https://www.npmjs.com/package/@openlines/opl-pi-sht)
-[![npm downloads](https://img.shields.io/npm/dm/@openlines/opl-pi-sht?logo=npm&color=cb3837)](https://www.npmjs.com/package/@openlines/opl-pi-sht)
+[![npm downloads](https://img.shields.io/npm/dt/@openlines/opl-pi-sht?logo=npm&color=cb3837)](https://www.npmjs.com/package/@openlines/opl-pi-sht)
 [![license](https://img.shields.io/npm/l/@openlines/opl-pi-sht)](./LICENSE)
 
+</div>
+
 **Cut token cost, run the agent safely, and drop your MCP servers.**
 
 A portable collection of various Pi coding agent extensions. Repository directories and config files use `opl-`; established Pi-facing commands and tool names stay compatible.
@@ -67,7 +71,7 @@ Copy mode overwrites matching destinations. Link mode skips existing destination
 
 | Extension                                                     | Summary                                                                                                                                                                                                                      | Commands, tools, and configuration                                                                             |
 | ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
-| [`opl-init`](extensions/opl-init/README.md)                   | Fingerprinted repository-guide generator.                                                                                                                                                                                    | `/init`; no config.                                                                                            |
+| [`opl-init`](extensions/opl-init/README.md)                   | Fingerprinted repository-guide generator.                                                                                                                                                                                    | `/init [--refine]`; no config.                                                                                            |
 | [`opl-simplebench`](extensions/opl-simplebench/README.md)     | Auditable provider-aware model benchmark with JSON artifacts and metrics.                                                                                                                                                    | `/simplebench`, `simplebench`; supports Ollama, OpenAI-compatible providers, and Bedrock; optional `opl-simplebench.json`. |
 | [`opl-webaccess`](extensions/opl-webaccess/README.md)         | Search plus readable URL/PDF retrieval with session recovery.                                                                                                                                                                | `web_search`, `fetch_content`, `get_search_content`; `opl-webaccess.json`.                                     |
 | [`opl-browser`](extensions/opl-browser/README.md)             | Chromium automation via Playwright with structured extraction of rendered pages; single dispatcher tool replacing the chrome-devtools MCP.                                                                                   | `browser` (action-based); `opl-browser.json`.                                                                  |
@@ -100,14 +104,14 @@ Cold prompt-cache write, measured /init session (opl-modes lazy tools + MCP adap
 
 ### Run the agent without babysitting it
 
-- **`opl-modes`** chat and plan modes swap the active toolset for read-only lists and gate Bash to safe inspection patterns, with destructive-pattern checks that fire even inside otherwise-safe commands (also `find -delete`, `git clean`, `truncate`, `sudo`, and quote-obfuscated `r"m"`; `env`/`printenv` no longer safe-listed). The plan to execute lifecycle keeps exploration and mutation cleanly separated. Add custom modes (like below) for your workflow needs.
+- **`opl-modes`** chat and plan modes swap the active toolset for read-only lists and gate Bash to safe inspection patterns **per shell segment**, so `cat f && node -e '...'`, `cat x & rm -rf /tmp/x`, and `echo "$(node -e ...)"` can no longer ride the first command's allowance. Destructive checks still fire inside otherwise-safe commands (anchored to command position, so `du -sh` and `find . -name '*.sh'` stay allowed; `find -delete`, `find -fprint`, `git log --output`, `sort -o`, `npm audit fix`, `git clean`, `sudo`, and quote-obfuscated `r"m"`/`-del"ete"` are blocked; `env`/`printenv` are not safe-listed). The plan to execute lifecycle keeps exploration and mutation cleanly separated. Add custom modes (like below) for your workflow needs.
 ![custom mode sample](images/ss-mode-custom.png)
 - `load_tools` activation is bounded by the current mode, so a read-only mode cannot be tricked into enabling a write-capable tool.
 
 
 ### Move through work faster
 
-- **`opl-init`** writes a fingerprinted `AGENTS.md` so any agent starts already oriented in a repo. It writes a baseline before asking the model to refine the guide, so smaller models cannot leave the update only in chat; it re-runs only when the tree actually changes.
+- **`opl-init`** deterministically writes a fingerprinted `AGENTS.md` so any agent starts already oriented in a repo. It refreshes only when the tree changes, overwriting a stale guide outright, and plain `/init` never sends a synthetic user message; `/init --refine` is the opt-in single request for a model-expanded guide, meant for session start or just before a push, not mid-task.
 ![init](images/ss-init.png)
 - **`opl-browser`** gives full Chromium automation (navigate, snapshot, extract rendered-page markdown, interact, screenshot, console/network capture, evaluate) through a single tool, with handle+preview output for large results — navigation is http(s)-only and screenshots stay in the project directory.
 - **`opl-webaccess`** adds provider-backed search plus readable URL and PDF extraction, with session recovery of earlier results, an http(s)-only fetch, a 10 MB response cap, and a 30s timeout.

package/configs/opl-modes.json.sample

@@ -17,8 +17,8 @@
   "_comment_lazyTools": "Tool names withheld from the active set at rest and enabled on demand via the load_tools tool. Only affects modes that would otherwise include them (off/execute and custom modes that list them). Core built-ins, plan_complete, and load_tools are protected and ignored. Omit or leave empty to keep all tools always active.",
   "lazyTools": [],
   "bashPatterns": {
-    "_comment_safe": "Replace-only: providing bashPatterns.safePatterns replaces the built-in safe list. This is the default safe allowlist for every mode; a mode overrides it with its own safePatterns or opts out of Bash gating with unrestrictedBash. Shown here with the built-in list.",
-    "_comment_destructive": "Replace-only: providing bashPatterns.destructivePatterns replaces the built-in destructive list. This is the default destructive blocklist for every mode; a mode overrides it with its own destructivePatterns or opts out of Bash gating with unrestrictedBash. Shown here with the built-in list.",
+    "_comment_safe": "Replace-only: providing bashPatterns.safePatterns replaces the built-in safe list. This is the default safe allowlist for every mode and it is checked per shell segment (&&, ||, a lone &, |, ;, newline, $(...), backticks, <( and >( each start a segment), so every chained or backgrounded command must be allowed. Quote-aware: grep \\\"a|b\\\" stays one command, but a $(...) or backtick payload still runs inside double quotes, so it is split out and checked too. Interpreters and tools that can write files or exec programs from their own arguments (awk, sed, xargs, perl, python, env) are deliberately not listed. A mode overrides it with its own safePatterns or opts out of Bash gating with unrestrictedBash. Shown here with the built-in list.",
+    "_comment_destructive": "Replace-only: providing bashPatterns.destructivePatterns replaces the built-in destructive list. This is the default destructive blocklist for every mode; a mode overrides it with its own destructivePatterns or opts out of Bash gating with unrestrictedBash. Program-name entries are anchored to command position (match each segment start) so read-only commands that only mention rm/cp/sh in an argument stay allowed, while flag and redirect entries stay unanchored - that is how find -fprint, sort -o in any position, git log --output, npm audit fix, uniq's output operand, and a bare > file are caught even behind a safe command. Descriptor duplication (2>&1, >&2) and redirects into /dev/null are not writes and stay allowed. Shown here with the built-in list.",
     "safePatterns": [
       "^\\s*cat\\b",
       "^\\s*head\\b",
@@ -34,6 +34,9 @@
       "^\\s*printf\\b",
       "^\\s*wc\\b",
       "^\\s*sort\\b",
+      "^\\s*uniq\\b",
+      "^\\s*tr\\b",
+      "^\\s*cut\\b",
       "^\\s*diff\\b",
       "^\\s*file\\b",
       "^\\s*stat\\b",
@@ -53,7 +56,7 @@
       "^\\s*fd\\b",
       "^\\s*bat\\b",
       "^\\s*jq\\b",
-      "^\\s*git\\s+(status|log|diff|show|branch|remote)",
+      "^\\s*git\\s+(status|log|diff|show|branch|remote|rev-parse)",
       "^\\s*node\\s+--version",
       "^\\s*python\\s+--version",
       "^\\s*(npx\\s+)?tsc\\b.*--noEmit",
@@ -61,36 +64,29 @@
       "^\\s*yarn\\s+(list|info|why|audit)"
     ],
     "destructivePatterns": [
-      "\\brm\\b",
-      "\\brmdir\\b",
-      "\\bmv\\b",
-      "\\bcp\\b",
-      "\\bmkdir\\b",
-      "\\btouch\\b",
-      "\\bchmod\\b",
-      "\\bchown\\b",
-      "\\btee\\b",
-      "\\bdd\\b",
-      "\\bshred\\b",
-      "\\btruncate\\b",
-      "\\s-(delete|exec|execdir)\\b",
-      "(^|[^<])>(?!>|&)",
-      ">>",
-      "\\bnpm\\s+(install|uninstall|update|ci)",
+      "^\\s*(rm|rmdir|mv|cp|mkdir|touch|chmod|chown|tee|dd|shred|truncate)\\b",
+      "\\s-{1,2}(delete|exec|execdir|exec-batch|fprint0?|fprintf|fls|output)\\b",
+      "^\\s*fd\\b[^\\n]*\\s-[A-Za-z]*[xX]\\b",
+      "^\\s*rg\\b[^\\n]*\\s--pre\\b",
+      "^\\s*(sort|tree)\\b[^\\n]*\\s-[A-Za-z]*o\\b",
+      "^\\s*jq\\b[^\\n]*(\\$ENV|\\benv\\b)",
+      "(^|[^<])>(?!>)(?!&[0-9-])(?! *\\/dev\\/null(?![^\\s;&|)]))",
+      ">>(?! *\\/dev\\/null(?![^\\s;&|)]))",
+      "^\\s*uniq\\b(?:\\s+-\\S+)*\\s+[^-\\s]\\S*(?:\\s+[^-\\s]\\S*)+",
+      "\\bnpm\\s+(install|uninstall|update|upgrade|ci)",
+      "\\bnpm\\s+audit\\b.*\\bfix\\b",
       "\\byarn\\s+(add|remove|install)",
       "\\bpip\\s+(install|uninstall)",
-      "\\bgit\\s+(add|commit|push|merge|rebase|reset|checkout|branch\\s+-|clean|update-ref|tag\\s+-|cherry-pick|revert|am|apply)",
-      "\\bsudo\\b",
-      "\\bsu\\b",
-      "\\bkill\\b",
-      "\\bpkill\\b",
-      "\\b(sh|bash|zsh)\\b",
-      "\\b(vim?|nano|emacs|code|subl)\\b"
+      "\\bgit\\s+(add|commit|push|merge|rebase|reset|checkout|clean|update-ref|cherry-pick|revert|am|apply|branch\\s+(-{1,2}[dDmMcC]|--(unset-upstream|edit-description))|tag\\s+-)",
+      "\\bgit\\s+remote\\s+(add|remove|rename|set-url|set-head|setbranches|prune|update)\\b",
+      "^\\s*(sudo|su|kill|pkill)\\b",
+      "^\\s*(sh|bash|zsh)\\b",
+      "^\\s*(vim?|nano|emacs|code|subl)\\b"
     ]
   },
   "_comment_tools": "Set modes.chat.tools or modes.plan.tools to replace their default tools. The legacy top-level chatAllowedTools and planAllowedTools keys remain supported but are deprecated.",
   "_comment_widgetColor": "available colors - accent, border, borderAccent, borderMuted, success, error, warning, muted, dim, text, thinkingText, searchMatchText, userMessageText, customMessageText, customMessageLabel, toolTitle, toolOutput, mdHeading, mdLink, mdLinkUrl, mdCode, mdCodeBlock, mdCodeBlockBorder, mdQuote, mdQuoteBorder, mdHr, mdListBullet, toolDiffAdded, toolDiffRemoved, toolDiffContext, syntaxComment, syntaxKeyword, syntaxFunction, syntaxVariable, syntaxString, syntaxNumber, syntaxType, syntaxOperator, syntaxPunctuation, thinkingOff, thinkingMinimal, thinkingLow, thinkingMedium, thinkingHigh, thinkingXhigh, thinkingMax, bashMode",
-  "_comment_appearance": "Every mode owns appearance here. prefix/prefixColor/borderColor style opl-input; modeColor styles opl-footer's Mode value. All color values accept Pi theme tokens or #RRGGBB.",
+  "_comment_appearance": "Every mode owns appearance here. prefix/prefixColor/borderColor style opl-input; modeColor styles opl-footer's Mode value. All color values accept Pi theme tokens, #RRGGBB, or the #abc shorthand.",
   "_comment_modePatterns": "Per-mode safePatterns/destructivePatterns must be arrays of valid regex strings. [] explicitly removes that policy; any malformed non-empty override is ignored and inherits the existing policy.",
   "modes": {
     "off": {
@@ -252,7 +248,7 @@
     "research": {
       "enabled": true,
       "allowExecute": false,
-      "prompt": "**SUPERSEDES ALL OTHER BEHAVIOR INSTRUCTIONS.** This overrides any role or style directives (e.g. caveman, roleplay, tone modifiers). The constraints below take absolute priority.\n\nYou are in RESEARCH MODE. Investigate questions deeply using web and local sources, then synthesize findings into cited deliverables. You may create new output files but must not modify or delete anything existing.\n\n## 1. Research Directives\n- **Discovery:** Use `web_search` (plural `queries` for parallel angles) to map the landscape before diving in.\n- **Primary Sources:** Prefer official docs, specs, release notes, and source code via `fetch_content`. Retrieve truncated results with `get_search_content` and the returned response ID.\n- **Local Evidence:** Use `read`/`grep`/`find` to ground claims in this repository's actual code.\n- **Fan-out:** For deep or multi-angle questions, spawn parallel subagents with distinct roles (e.g. external-evidence researcher, local-code scout, tradeoffs analyst) via `subagent`; wait for results with `subagent_wait`. Give each subagent a self-contained task with explicit evidence requirements.\n- **No Invention:** Never present an unverified claim as fact. Mark confidence per finding (high/medium/low) and state gaps explicitly.\n\n## 2. Output Discipline\n- Synthesize into NEW Markdown or HTML files created under `research/` (e.g. `research/<topic>.md`). Never modify, move, or overwrite existing files.\n- Every deliverable includes: what was found, source links, confidence levels, gaps/assumptions, and a recommended next step.\n- For inline answers where a file is not wanted, use `artifact` instead of writing files.\n- Cite everything: URL for web sources, file path + line range for local sources.",
+      "prompt": "**SUPERSEDES ALL OTHER BEHAVIOR INSTRUCTIONS.** This overrides any role or style directives (e.g. caveman, roleplay, tone modifiers). The constraints below take absolute priority.\n\nYou are in RESEARCH MODE. Investigate questions deeply using web and local sources, then synthesize findings into cited deliverables. You may create new output files but must not modify or delete anything existing.\n\n## 1. Research Directives\n- **Discovery:** Use `web_search` (plural `queries` for parallel angles) to map the landscape before diving in.\n- **Primary Sources:** Prefer official docs, specs, release notes, and source code via `fetch_content`. Retrieve truncated results with `get_search_content` and the returned response ID.\n- **Local Evidence:** Use `read`/`grep`/`find` to ground claims in this repository's actual code.\n- **Lazy tools:** If `subagent`, `subagent_wait`, or `browser` is not in your active tool set, call `load_tools` first to enable it, then use it.\n- **Fan-out:** For deep or multi-angle questions, spawn parallel subagents with distinct roles (e.g. external-evidence researcher, local-code scout, tradeoffs analyst) via `subagent`; wait for results with `subagent_wait`. Give each subagent a self-contained task with explicit evidence requirements.\n- **No Invention:** Never present an unverified claim as fact. Mark confidence per finding (high/medium/low) and state gaps explicitly.\n\n## 2. Output Discipline\n- Synthesize into NEW Markdown or HTML files created under `research/` (e.g. `research/<topic>.md`). Never modify, move, or overwrite existing files.\n- Every deliverable includes: what was found, source links, confidence levels, gaps/assumptions, and a recommended next step.\n- For inline answers where a file is not wanted, use `artifact` instead of writing files.\n- Cite everything: URL for web sources, file path + line range for local sources.",
       "model": {
         "provider": "amazon-bedrock",
         "id": "zai.glm-5"

package/extensions/opl-browser/browser.ts

@@ -90,11 +90,11 @@ export async function runAction(p: BrowserParams, cfg: BrowserConfig): Promise<B
       return { text: tree || "(empty snapshot)" };
     }
     case "extract": {
-      const scoped = Boolean(p.selector);
-      const html = scoped
-        ? await page().locator(p.selector).evaluate((el: Element) => el.outerHTML)
+      const selector = p.selector;
+      const html = selector
+        ? await page().locator(selector).evaluate((el: Element) => el.outerHTML)
         : await page().content();
-      const { markdown } = extractMarkdown(html, { raw: scoped });
+      const { markdown } = extractMarkdown(html, { raw: Boolean(selector) });
       return { text: markdown || "(empty extraction)" };
     }
     case "screenshot": {

package/extensions/opl-footer/README.md

@@ -43,6 +43,13 @@ Create `~/.pi/agent/configs/opl-footer.json` or copy the tracked example from [`
 
 The config is cached for five seconds. Changes normally appear automatically; use `/reload` or restart Pi if needed.
 
+### Git probing
+
+The `git` segment reads branch (500 ms cache) and dirty counts (1 s cache) so an idle footer never spawns more than a couple of `git` processes per second. Two guards keep that floor honest:
+
+- The probes are skipped entirely when no configured row contains `git`, so a layout without the segment pays nothing for it.
+- In a directory that is not a repository, the first failed probe arms a 30 second back-off instead of re-running `git` every second forever. A mid-session `git init` or `git clone` clears it immediately (matched on tool results), as does any `write`/`edit` invalidation; a probe that fails inside a real repository (for example a locked index) is confirmed with `git rev-parse --is-inside-work-tree` and keeps the normal one-second cadence. A probe that finishes after an invalidation is dropped outright, so the failure that happened *before* a `git init` cannot push the fresh repository back into a 30 second back-off.
+
 ```json
 {
   "row1LeftSegments": ["pi", "separator", "model", "separator", "path", "git"],
@@ -54,7 +61,7 @@ The config is cached for five seconds. Changes normally appear automatically; us
 }
 ```
 
-See the tracked [`configs/opl-footer.json.sample`](../../configs/opl-footer.json.sample) for a complete example. Segment IDs, color fields, context-bar options, thinking-level colors, and icon overrides are documented below. Colors accept Pi theme tokens or hex strings.
+See the tracked [`configs/opl-footer.json.sample`](../../configs/opl-footer.json.sample) for a complete example. Segment IDs, color fields, context-bar options, thinking-level colors, and icon overrides are documented below. Colors accept Pi theme tokens, six-digit hex, or the three-digit `#abc` shorthand (expanded to `#aabbcc`); the context bar gradient resolves both forms to RGB. An unknown token or malformed hex renders that text uncolored instead of failing the footer render, so a typo in `colors` or in `opl-modes`' `appearance.modeColor` costs you a color, not the footer.
 
 ## Architecture
 
@@ -69,7 +76,7 @@ See the tracked [`configs/opl-footer.json.sample`](../../configs/opl-footer.json
 | `path` | Current working directory | `segmentOptions.path.mode`: `"full"` (default) · `"abbreviated"` · `"basename"` |
 | `git` | Git branch and dirty indicators | `showBranch`, `showStaged`, `showUnstaged`, `showUntracked` (all bool) |
 | `context_pct` | Gradient bar + `X.X%` + max tokens | Bar fully configurable via `segmentOptions.contextBar` (see below). % and max tokens use `contextLabel` colour. Max tokens formatted with K/M suffix (e.g. `128k`, `2M`). Set `DEBUG_PCT` in `context.ts` to a number (0–100) to pin the bar at a fixed value for visual testing. |
-| `cost` | `$<amount>` | `$` dim, amount in `cost` colour (`muted` by default). Shows dim `(no pricing)` when the session total is zero on a non-local model (provider has no pricing configured), and `(local model)` for local models |
+| `cost` | `$<amount>` (4 decimals, e.g. `$0.0123`) | `$` dim, amount in `cost` colour (`muted` by default). Four decimals keep cheap local or short sessions distinguishable instead of pinning at `$0.00`. Shows dim `(no pricing)` when the session total is zero on a non-local model (provider has no pricing configured), and `(local model)` for local models |
 | `thinking` | `Thinking: <LEVEL>` | Dim label, CAPS level with per-level colour; always visible |
 | `mode_switcher` | Unified active mode label | Reads state published by `opl-modes`; `appearance.modeColor` controls the mode value, with hardcoded `muted` fallback |
 | `caveman` | `Caveman mode: <MODE>` | Hidden when caveman extension not loaded |

package/extensions/opl-footer/git-status.ts

@@ -15,12 +15,34 @@ interface CachedBranch {
 
 const CACHE_TTL_MS = 1000;
 const BRANCH_TTL_MS = 500;
+// Outside a repository git exits non-zero on every probe. Arm a long back-off on the first
+// failure so an idle footer stops spawning git once per second, and clear it when
+// `rev-parse --is-inside-work-tree` proves the failure was transient — or when `git init`
+// happens mid-session and a cache invalidation/`git init` match clears it.
+const NOT_A_REPO_TTL_MS = 30_000;
 let cachedStatus: CachedGitStatus | null = null;
 let cachedBranch: CachedBranch | null = null;
 let pendingFetch: Promise<void> | null = null;
 let pendingBranchFetch: Promise<void> | null = null;
 let invalidationCounter = 0;
 let branchInvalidationCounter = 0;
+let repoAbsentUntil = 0;
+let repoCheckInFlight = false;
+
+/** Assume "not a repo" immediately, then confirm asynchronously so a real repo recovers. */
+function noteProbeFailure(): void {
+  repoAbsentUntil = Date.now() + NOT_A_REPO_TTL_MS;
+  if (repoCheckInFlight) return;
+  repoCheckInFlight = true;
+  void runGit(["rev-parse", "--is-inside-work-tree"]).then((out) => {
+    if (out === "true") repoAbsentUntil = 0;
+    repoCheckInFlight = false;
+  });
+}
+
+function repoAbsent(): boolean {
+  return Date.now() < repoAbsentUntil;
+}
 
 function parseGitStatusOutput(output: string): { staged: number; unstaged: number; untracked: number } {
   let staged = 0;
@@ -102,6 +124,10 @@ async function fetchGitStatus(): Promise<{ staged: number; unstaged: number; unt
 export function getCurrentBranch(providerBranch: string | null): string | null {
   const now = Date.now();
 
+  if (now < repoAbsentUntil) {
+    return cachedBranch ? cachedBranch.branch : providerBranch;
+  }
+
   if (cachedBranch && now - cachedBranch.timestamp < BRANCH_TTL_MS) {
     return cachedBranch.branch;
   }
@@ -109,7 +135,10 @@ export function getCurrentBranch(providerBranch: string | null): string | null {
   if (!pendingBranchFetch) {
     const fetchId = branchInvalidationCounter;
     pendingBranchFetch = fetchGitBranch().then((result) => {
+      // Everything below belongs to the pre-invalidation directory state: a probe that
+      // started before `git init` must not re-arm the back-off or publish a null branch.
       if (fetchId === branchInvalidationCounter) {
+        if (result === null) noteProbeFailure();
         cachedBranch = {
           branch: result,
           timestamp: Date.now(),
@@ -124,6 +153,14 @@ export function getCurrentBranch(providerBranch: string | null): string | null {
 
 export function getGitStatus(providerBranch: string | null): GitStatus {
   const now = Date.now();
+
+  if (now < repoAbsentUntil) {
+    const branch = cachedBranch ? cachedBranch.branch : providerBranch;
+    return cachedStatus
+      ? { branch, staged: cachedStatus.staged, unstaged: cachedStatus.unstaged, untracked: cachedStatus.untracked }
+      : { branch, staged: 0, unstaged: 0, untracked: 0 };
+  }
+
   const branch = getCurrentBranch(providerBranch);
 
   if (cachedStatus && now - cachedStatus.timestamp < CACHE_TTL_MS) {
@@ -138,7 +175,10 @@ export function getGitStatus(providerBranch: string | null): GitStatus {
   if (!pendingFetch) {
     const fetchId = invalidationCounter;
     pendingFetch = fetchGitStatus().then((result) => {
+      // Same as the branch probe: a failure from before an invalidation is stale, and
+      // arming the 30 s not-a-repo back-off from it would hide a just-created repository.
       if (fetchId === invalidationCounter) {
+        if (result === null) noteProbeFailure();
         cachedStatus = result
           ? { staged: result.staged, unstaged: result.unstaged, untracked: result.untracked, timestamp: Date.now() }
           : { staged: 0, unstaged: 0, untracked: 0, timestamp: Date.now() };
@@ -162,9 +202,11 @@ export function getGitStatus(providerBranch: string | null): GitStatus {
 export function invalidateGitStatus(): void {
   cachedStatus = null;
   invalidationCounter++;
+  repoAbsentUntil = 0;
 }
 
 export function invalidateGitBranch(): void {
   cachedBranch = null;
   branchInvalidationCounter++;
+  repoAbsentUntil = 0;
 }

package/extensions/opl-footer/index.ts

@@ -13,10 +13,21 @@ import { getDefaultColors, fg } from "./theme.js";
 import { showFooterConfigurator } from "./configure.js";
 
 const GIT_BRANCH_PATTERNS: RegExp[] = [
-  /\bgit\s+(checkout|switch|branch\s+-[dDmM]|merge|rebase|pull|reset|worktree)/,
+  // init/clone included: creating a repo mid-session must clear the not-a-repo back-off.
+  /\bgit\s+(init|clone|checkout|switch|branch\s+-[dDmM]|merge|rebase|pull|reset|worktree)/,
   /\bgit\s+stash\s+(pop|apply)/,
 ];
 
+/** Row keys whose configured segments decide whether git must be probed at all. */
+const GIT_LAYOUT_ROWS = [
+  "row1LeftSegments",
+  "row1RightSegments",
+  "row2LeftSegments",
+  "row2RightSegments",
+  "row3LeftSegments",
+  "row3RightSegments",
+] as const;
+
 // ═══════════════════════════════════════════════════════════════════════════
 // Status Line Builder
 // ═══════════════════════════════════════════════════════════════════════════
@@ -260,9 +271,12 @@ export default function footer(pi: ExtensionAPI) {
 
     const isThinkingEvent = (e: SessionEvent): e is ThinkingLevelEvent =>
       e.type === "thinking_level_change";
-    const thinkingLevelFromSession = branch
-      .filter(isThinkingEvent)
-      .reduce((_, e) => e.thinkingLevel ?? "off", "off");
+    const thinkingEvents = branch.filter(isThinkingEvent);
+    // Seed null, not "off": a truthy seed made the ?? fallback below unreachable, so a
+    // branch with no thinking_level_change entry rendered "off" instead of Pi's real level.
+    const thinkingLevelFromSession = thinkingEvents.length
+      ? thinkingEvents.reduce((_, e) => e.thinkingLevel ?? "off", "off")
+      : null;
 
     const lastAssistant = completedMessages.at(-1);
 
@@ -274,9 +288,13 @@ export default function footer(pi: ExtensionAPI) {
     const contextWindow = ctx.model?.contextWindow || 0;
     const contextPercent = contextWindow > 0 ? (contextTokens / contextWindow) * 100 : 0;
 
-    // Get git status (cached)
-    const gitBranch = footerDataRef?.getGitBranch() ?? null;
-    const gitStatus = getGitStatus(gitBranch);
+    // Get git status (cached). Skip the probes entirely when no visible row renders the
+    // git segment — otherwise an unused cell keeps spawning git once per second.
+    const usesGit = GIT_LAYOUT_ROWS.some((row) => effectiveConfig[row]?.includes("git"));
+    const gitBranch = usesGit ? footerDataRef?.getGitBranch() ?? null : null;
+    const gitStatus = usesGit
+      ? getGitStatus(gitBranch)
+      : { branch: null, staged: 0, unstaged: 0, untracked: 0 };
 
     // Check if using OAuth subscription
     const usingSubscription = ctx.model
@@ -303,7 +321,7 @@ export default function footer(pi: ExtensionAPI) {
     return {
       model: ctx.model,
       isLocalModel,
-      thinkingLevel: thinkingLevelFromSession || pi.getThinkingLevel(),
+      thinkingLevel: thinkingLevelFromSession ?? pi.getThinkingLevel(),
       sessionId: ctx.sessionManager?.getSessionId?.(),
       usageStats,
       contextPercent,

package/extensions/opl-footer/segments/cost.ts

@@ -9,12 +9,12 @@ export const costSegment = {
 
     if (cost === 0 && !ctx.isLocalModel) {
       return {
-        content: color(ctx, "cost", "$0.00") + applyColor(ctx.theme, "dim", " (no pricing)"),
+        content: color(ctx, "cost", "$0.0000") + applyColor(ctx.theme, "dim", " (no pricing)"),
         visible: true,
       };
     }
 
-    const content = color(ctx, "cost", `$${cost.toFixed(2)}`);
+    const content = color(ctx, "cost", `$${cost.toFixed(4)}`);
 
     if (ctx.isLocalModel) {
       return { content: content + applyColor(ctx.theme, "dim", " (local model)"), visible: true };

package/extensions/opl-footer/segments/helpers.ts

@@ -3,9 +3,7 @@ import { fg } from "../theme.js";
 
 export function formatTokens(n: number): string {
   if (n < 1000) return n.toString();
-  if (n < 10000) return `${(n / 1000).toFixed(2)}k`;
   if (n < 1000000) return `${(n / 1000).toFixed(2)}k`;
-  if (n < 10000000) return `${(n / 1000000).toFixed(2)}M`;
   return `${(n / 1000000).toFixed(2)}M`;
 }
 

package/extensions/opl-footer/segments/mode-switcher.ts

@@ -1,4 +1,4 @@
-import type { RenderedSegment, SegmentContext } from "../types.js";
+import type { ColorValue, RenderedSegment, SegmentContext } from "../types.js";
 import { applyColor } from "../theme.js";
 
 interface AgentModeState {
@@ -18,7 +18,9 @@ export const modeSwitcherSegment = {
 
     const label = applyColor(ctx.theme, "dim", "Mode:");
     const value = mode === "off" ? "Normal" : mode.charAt(0).toUpperCase() + mode.slice(1);
-    const valueStr = applyColor(ctx.theme, state?.appearance?.modeColor ?? "muted", value);
+    // modeColor is authored in opl-modes config (theme token or hex); applyColor() renders an
+    // unknown value uncolored, so the cross-extension string is passed through as-is.
+    const valueStr = applyColor(ctx.theme, (state?.appearance?.modeColor ?? "muted") as ColorValue, value);
     return { content: `${label} ${valueStr}`, visible: true };
   },
 };

package/extensions/opl-footer/theme.ts

@@ -31,7 +31,10 @@ function isHexColor(color: ColorValue): color is `#${string}` {
 }
 
 function hexToAnsi(hex: string): string {
-  const h = hex.replace("#", "");
+  // Accept the #abc shorthand so a three-digit value renders the same as #aabbcc
+  // instead of falling through as an (unknown) theme token.
+  let h = hex.replace("#", "");
+  if (/^[0-9a-fA-F]{3}$/.test(h)) h = h.split("").map((c) => c + c).join("");
   if (!/^[0-9a-fA-F]{6}$/.test(h)) return "";
   const r = parseInt(h.slice(0, 2), 16);
   const g = parseInt(h.slice(2, 4), 16);
@@ -45,9 +48,19 @@ export function applyColor(
   text: string
 ): string {
   if (isHexColor(color)) {
-    return `${hexToAnsi(color)}${text}\x1b[0m`;
+    // hexToAnsi() returns "" for a malformed value: emit no escape at all, not an empty
+    // color plus a stray reset.
+    const ansi = hexToAnsi(color);
+    if (!ansi) return text;
+    return `${ansi}${text}\x1b[0m`;
+  }
+  // theme.fg() throws on an unknown token; a bad color in opl-footer.json or in an
+  // opl-modes appearance must never take down the footer render.
+  try {
+    return theme.fg(color as ThemeColor, text);
+  } catch {
+    return text;
   }
-  return theme.fg(color as ThemeColor, text);
 }
 
 export function fg(
@@ -102,11 +115,17 @@ export function resolveColorToRgb(
   color: ColorValue
 ): { r: number; g: number; b: number } | null {
   if (isHexColor(color)) {
-    const h = color.replace("#", "");
+    let h = color.replace("#", "");
+    if (/^[0-9a-fA-F]{3}$/.test(h)) h = h.split("").map((c) => c + c).join("");
     if (!/^[0-9a-fA-F]{6}$/.test(h)) return null;
     return { r: parseInt(h.slice(0, 2), 16), g: parseInt(h.slice(2, 4), 16), b: parseInt(h.slice(4, 6), 16) };
   }
-  const probed = theme.fg(color as ThemeColor, "X");
+  let probed: string;
+  try {
+    probed = theme.fg(color as ThemeColor, "X");
+  } catch {
+    return null;
+  }
   const match = probed.match(/\x1b\[38;2;(\d+);(\d+);(\d+)m/);
   if (!match) return null;
   return { r: parseInt(match[1]), g: parseInt(match[2]), b: parseInt(match[3]) };

package/extensions/opl-init/README.md

@@ -4,20 +4,34 @@ Generates or refreshes a repository-specific `AGENTS.md` guide through `/init`.
 
 ## Commands, flags, and shortcuts
 
-- `/init`: crawl the current repository and create or update `AGENTS.md` when its fingerprint is missing or stale.
-- No flags or shortcuts.
+- `/init`: crawl the current repository and write `AGENTS.md` when its fingerprint is missing or stale. A stale guide is **overwritten** wholesale, hand-edited prose included; version control is the recovery path.
+- `/init --refine`: same write, then one injected user turn asking the model to expand the guide into a fuller, evidence-based version. Opt-in only: plain `/init` never touches the transcript.
+- No shortcuts.
 
 ## Extension features
 
-- Produces evidence-based guidance for project purpose, commands, architecture, configuration, testing, operational quirks, and key files.
+- Produces a deterministic repository guide with package commands and a file-type inventory.
 - Crawls deterministically to depth 3, ignores generated/dependency directories, caps directory listings at 40 entries, and caps the rendered tree at 300 lines with explicit omission markers.
-- Re-walks declared `pnpm-workspace.yaml` and Cargo workspace members with their own depth-3 budget; reports `turbo.json` and `nx.json` as contextual manifests.
-- Collects extension counts, known manifests, and npm scripts without embedding full manifest bodies.
-- Incorporates relevant Cursor, Copilot, Claude Code, Windsurf, Cline, and Devin rule sources without copying them verbatim or treating them as more authoritative than repository evidence.
-- Writes a deterministic baseline `AGENTS.md` before dispatching the model turn, so lower-capability models cannot leave the guide only in chat; the model is then prompted to refine it with repository-specific guidance and verify the file.
-- Skips the model turn when the final `<!-- opl-init:fp <fingerprint> -->` marker is current.
+- Re-walks declared `pnpm-workspace.yaml` and Cargo workspace members with their own depth-3 budget.
+- Reads known manifests to include package scripts when present.
+- Writes the deterministic fingerprinted `AGENTS.md` directly. It sends no synthetic user message on its own; `/init --refine` is the single, explicit request for a model-refined guide.
+- Skips the write when the final `<!-- opl-init:fp <fingerprint> -->` marker is current.
 - Excludes `AGENTS.md` itself from the Git status fingerprint, preventing the act of updating the guide from making it immediately stale.
 
+## Session timing, reiterations, and re-injections
+
+`/init` is an initialization command: run it at the **start** of a session, before the work begins, and again at the **very end** to fold the session's changes into the guide before pushing to the remote. Both are quiet moments, and `--refine` needs a quiet moment.
+
+What a `--refine` injection does to a live session:
+
+- It is a **user-role turn**. It is persisted in the session and replayed as context on every later turn and on resume, so two `--refine` runs in one session leave two instruction blocks behind and the transcript keeps paying for both.
+- It **always triggers a turn**. With an idle agent the refinement starts immediately. With an agent already streaming it is queued as a follow-up (`deliverAs: "followUp"`), so the guide is rewritten *after* the current turn finishes — later than you asked, and possibly after you have moved on to something else. An injection with no `deliverAs` makes Pi throw `Agent is already processing` and the request is lost.
+- It **cannot be fulfilled in a read-only mode**. Chat and plan modes carry no `write` tool, so the model can only describe the guide it was asked to write: the turn is spent and `AGENTS.md` stays at the deterministic baseline. Run `--refine` in normal (OFF) mode.
+- In **execute mode it ends the plan**. `opl-modes` leaves execute mode when a turn completes without `plan_complete`, so the refinement turn finishing drops the session to OFF mid-plan.
+- A refined guide is **not sticky**. The fingerprint is `HEAD` plus `git status`, so the next commit or dirty file makes the guide stale, and the next plain `/init` overwrites the refined prose with the baseline. Refine last, then commit `AGENTS.md`; if you refine and keep working, expect to refine once more at the end of the session.
+- The refinement's own write does **not** invalidate the marker: `AGENTS.md` is filtered out of the status fingerprint, so a successful `--refine` leaves `/init` reporting "current".
+- There is **no recursion and no automatic re-injection**. The message is sent with `expandPromptTemplates: false`, so a `/init` appearing inside it is not re-dispatched, and the extension registers no event handlers: every injection comes from you typing `--refine`.
+
 ## Architecture
 
-`index.ts` owns crawling, fingerprinting, baseline writing, foreign-rule discovery, and prompt dispatch. Git repositories fingerprint `HEAD` plus relevant `git status --porcelain=v1 --untracked-files=all` output, excluding `AGENTS.md` itself; non-Git repositories use sorted path, size, and mtime tuples. Crawl context remains in the active Pi transcript only; cross-session structured retrieval is not implemented. The model prompt explicitly requires a write-tool call and a read-back verification, but the baseline write is the reliability boundary.
+`index.ts` owns crawling, fingerprinting, and deterministic guide writing. Git repositories fingerprint `HEAD` plus relevant `git status --porcelain=v1 --untracked-files=all` output, excluding `AGENTS.md` itself; non-Git repositories use sorted path, size, and mtime tuples. `/init` writes its guide locally and leaves the Pi transcript alone; `--refine` adds one small user message that points the model at the written file instead of re-sending the crawl.