@openlines/opl-pi-sht 0.3.0 → 0.3.1

package/README.md

@@ -14,6 +14,13 @@
 
 A portable collection of various Pi coding agent extensions. Repository directories and config files use `opl-`; established Pi-facing commands and tool names stay compatible.
 
+>
+> **Validation**: Pi `1.4.0` passes strict typechecking and 546 tests; the `0.87.0` floor passes strict typechecking and 544 tests, with two >=1.2 host lifecycle cases skipped. All 12 extensions load on both versions. Tests cover resource-loader tab replacement on both and custom/user mode runs on Pi `1.4.0` with synthetic responses.
+>
+> ### v0.3.1 - mode and configurator fixes
+>
+> Plan paths now use the session directory, OFF and execute tool policies apply consistently, and named plans use the configured plan model. Configurator tabs refresh on reload and its failure screen closes with Escape. [CHANGELOG](CHANGELOG.md).
+>
 > ### BIG A👀️ UPDATE
 >
 > ### v0.3.0 - security hardening, fixes, and extension enhancements
@@ -29,11 +36,8 @@ A portable collection of various Pi coding agent extensions. Repository director
 > - **Breaking behavior changes**: loopback access is now opt-in (`allowLoopback: false`), and the entire `64:ff9b:1::/48` local-use translation prefix is blocked even with network opt-ins enabled. The well-known `64:ff9b::/96` prefix still follows embedded-IPv4 policy. Stale browser selections now return an error requiring explicit recovery. [Network policy](extensions/opl-browser/README.md#network-policy), [Page selection](extensions/opl-browser/README.md#extension-features).
 > - **Added**: separate, extensible [`opl-configurator`](extensions/opl-configurator/README.md#extension-features), and [`compactions`](extensions/opl-footer/README.md#available-segments) segment in `opl-footer`.
 >
-> See [CHANGELOG](CHANGELOG.md) for more details.
->
 > Having issues? [Opl a ticket](https://github.com/linellazatin/opl-pi-sht/issues/new).
 >
-> **Validation**: all 12 extensions pass loader checks with Pi `1.1.0`, locked Pi `1.0.0` and the declared `0.87.0` floor.
 
 ## Installation
 
@@ -65,7 +69,7 @@ npx playwright install chromium
 {
   "packages": [
     {
-      "source": "npm:@openlines/opl-pi-sht@0.3.0",
+      "source": "npm:@openlines/opl-pi-sht@0.3.1",
       "extensions": ["extensions/opl-init/index.ts", "extensions/opl-todo/index.ts"]
     }
   ]
@@ -245,6 +249,10 @@ A Pi package (npm or Git) still needs the one-time `npx playwright install chrom
 npm test
 ```
 
-`npm run test:shared` runs the cross-extension checks: agent-directory resolution, parity of the duplicated host and git guards, installer, package metadata, and the `globalThis` seams between `opl-modes`, `opl-footer`, `opl-input` and `opl-configurator`. `npm run typecheck` runs `tsc` in strict mode over all 90 extension sources and is separate from `npm test`. Release validation uses `npm ci`, strict typechecking and the full suite; package tests exercise npm packing to exclude live configs. Run one extension suite with `npm run test:opl-<name>` for `browser`, `configurator`, `footer`, `guardian`, `init`, `input`, `modes`, `questionnaire`, `todo`, `webaccess`, `simplebench`, or `ctxtrim`. `npm run test:pi-host` uses the Pi build this machine actually runs (the installed managed release, falling back to the `>=0.87.0` devDependency when none is present) and its real extension loader to load every entrypoint and assert no loader errors. Every helper, functional, and selected-entrypoint smoke check uses Bun's named-test reporter; output includes per-test status, timings, and pass/fail totals. Functional tests cover deterministic helpers where practical; smoke tests bundle entrypoints and parse config. They do not test live TUI behavior, provider credentials, network access, or PDF extraction.
+`npm run test:shared` runs the cross-extension checks: agent-directory resolution, parity of the duplicated host and git guards, installer, package metadata, and the `globalThis` seams between `opl-modes`, `opl-footer`, `opl-input` and `opl-configurator`. `npm run typecheck` runs `tsc` in strict mode over all 90 extension sources and is separate from `npm test`. Release validation uses `npm ci`, strict typechecking and the full suite; package tests exercise npm packing to exclude live configs. Run one extension suite with `npm run test:opl-<name>` for `browser`, `configurator`, `footer`, `guardian`, `init`, `input`, `modes`, `questionnaire`, `todo`, `webaccess`, `simplebench`, or `ctxtrim`. `npm run test:pi-host` uses the Pi build this machine actually runs (the installed managed release, falling back to the `>=0.87.0` devDependency when none is present) and its real extension loader to load every entrypoint and assert no loader errors. On Pi >=1.2.0 it also checks custom/user `before_agent_start` events, busy-during-start semantics and mode-prompt persistence after real file-tool execution, using isolated fixtures and synthetic model responses; those host-specific cases are skipped on older Pi. Every helper, functional, and selected-entrypoint smoke check uses Bun's named-test reporter; output includes per-test status, timings, and pass/fail totals. Functional tests cover deterministic helpers where practical; smoke tests bundle entrypoints and parse config. They do not test live TUI behavior, provider credentials, network access, or PDF extraction.
+
+Release tags must match `package.json` as `v<version>`. The release workflow publishes to npm before creating the GitHub release. If npm publication succeeds but GitHub release creation fails, verify the published version and create the GitHub release separately rather than republishing the same npm version.
+
+CI runs strict typechecking and the suite against the committed lockfile, the Pi `0.87.0` floor, and a rolling `current` job that resolves `pi-coding-agent`, `pi-tui` and `pi-ai` from `~1.4.0`. The rolling job ignores the lockfile for range resolution, reports exact resolved versions, disables managed-install discovery and requires the loader to use its selected devDependency. The tilde range selects stable releases >=1.4.0 and <1.5.0, so only 1.4 patches are followed, not later minor releases or every version in that range; patches may still regress extension behavior, so a green run is evidence for its resolved versions, not a blanket compatibility promise. Keep the locked job for reproducibility. New upstream releases are checked on the next push or pull request, not automatically at publication.
 
 For agents/models testing extensions in a running Pi session, follow the [live-test instructions](tests/support/opl-live-test.md): one extension per phase, safe tool probes, operator-assisted UI checks, and separate reporting of live observations, automated coverage, and unverified behavior.

package/extensions/opl-browser/package-lock.json

@@ -1,13 +1,13 @@
 {
   "name": "opl-browser",
-  "version": "1.1.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "opl-browser",
-      "version": "1.1.0",
-      "license": "ISC",
+      "version": "0.2.0",
+      "license": "MIT",
       "dependencies": {
         "@mozilla/readability": "^0.6.0",
         "linkedom": "^0.18.13",

package/extensions/opl-configurator/README.md

@@ -28,7 +28,7 @@ const tab = {
 - `label` is the short text in the tab bar.
 - `create(api)` returns a component with the same contract as `ctx.ui.custom`'s return value. `api` carries `{ ctx, tui, theme, keybindings, done }`.
 
-The shell reads the registry lazily when `/configurator` runs, so extension load order does not matter. Entries are validated rather than trusted: malformed entries and duplicate ids or hotkeys are dropped, and a tab whose `create` throws is skipped without taking the whole configurator down.
+The shell reads the registry lazily when `/configurator` runs, so extension load order does not matter. Entries are validated rather than trusted: malformed entries and duplicate ids or hotkeys are dropped, and a tab whose `create` throws is skipped without taking the whole configurator down. The footer and input replace their own tab entries on reload, so their factories use the current extension instances. If every tab fails to load, Escape closes the diagnostic screen.
 
 ## Keyboard model
 

package/extensions/opl-configurator/configurator.ts

@@ -95,6 +95,9 @@ export async function showConfigurator(ctx: ExtensionContext): Promise<void> {
       return {
         render: (width: number) => [truncateToWidth(theme.fg("dim", "No instrumented extensions could be loaded."), width)],
         invalidate() {},
+        handleInput(data: string) {
+          if (matchesKey(data, Key.escape)) done(undefined);
+        },
       };
     }
 

package/extensions/opl-footer/configure.ts

@@ -68,7 +68,9 @@ export function registerFooterConfiguratorTab(onSaved: (ctx: ExtensionContext) =
   const holder = globalThis as Record<string, unknown>;
   const registry = holder[CONFIGURATOR_REGISTRY_KEY];
   if (Array.isArray(registry)) {
-    if (!registry.some((entry) => entry?.id === "opl-footer")) registry.push(tab);
+    const index = registry.findIndex((entry) => entry?.id === "opl-footer");
+    if (index === -1) registry.push(tab);
+    else registry[index] = tab;
   } else {
     holder[CONFIGURATOR_REGISTRY_KEY] = [tab];
   }

package/extensions/opl-input/configure.ts

@@ -81,7 +81,9 @@ export function registerInputConfiguratorTab(): void {
   const holder = globalThis as Record<string, unknown>;
   const registry = holder[CONFIGURATOR_REGISTRY_KEY];
   if (Array.isArray(registry)) {
-    if (!registry.some((entry) => entry?.id === "opl-input")) registry.push(tab);
+    const index = registry.findIndex((entry) => entry?.id === "opl-input");
+    if (index === -1) registry.push(tab);
+    else registry[index] = tab;
   } else {
     holder[CONFIGURATOR_REGISTRY_KEY] = [tab];
   }

package/extensions/opl-modes/README.md

@@ -31,9 +31,11 @@ Any mode can start plan execution via the mode picker's `Execute:` entries or `/
 
 ### Tool inheritance warning
 
-A custom mode with no `tools` array inherits **all** tools, including `write` and `edit` — it is write-capable by default. Always specify an explicit read-only tool list for restrictive modes.
+A custom mode with no `tools` array inherits the resting tool set, including `write` and `edit` when available. A pinned `modes.off.tools` list narrows that baseline. Always specify an explicit read-only tool list for restrictive modes.
 
-`off` behaves the same way: it restores the tools that were active before the mode (never a wider set). Set `modes.off.tools` to pin the resting tool set instead — for example to keep `subagent`/`browser` out of normal mode entirely. Pinning replaces the snapshot taken on mode entry, so a later mode that lists no `tools` inherits the pinned set rather than the older, wider one. `load_tools` is offered in `off` because withheld lazy tools are otherwise unreachable there.
+`off` behaves the same way: it restores the tools that were active before the mode (never a wider set). Set `modes.off.tools` to pin the resting tool set instead — for example to keep `subagent`/`browser` out of normal mode entirely. The pinned set also applies before `--chat` or `--plan` startup takes its snapshot, on startup when no mode entry is restored, and as the inherited baseline when plan or execute state is restored. Pinning replaces the snapshot taken on mode entry, so a later mode that lists no `tools` inherits the pinned set rather than the older, wider one. `load_tools` is offered in `off` because withheld lazy tools are otherwise unreachable there.
+
+Set `modes.execute.tools` to replace the tools available during execution; otherwise execute inherits the pre-plan active set. The configured list is applied on entry and resume, with lazy loading and `allowPlanComplete` still in effect. Exiting restores the previous set or the pinned OFF baseline.
 
 Model overrides are resolved through Pi's model registry when entering a mode. A blank or partial `model` (for example `{ "provider": "", "id": "" }`) is treated as **no override**, so the mode keeps the current model instead of warning `Model not found: /`. The previously active model is captured once per mode and restored on exit; the restore point is persisted in the mode session entry, so `/reload` and `/resume` inside a mode no longer lose it. If the restore target is gone from the registry it is dropped immediately; if it exists but has no credentials (before `/login`, say) the restore is retried once and then released, so a stale point cannot block future captures indefinitely. `pi.setModel` is session-scoped: it never rewrites your configured `defaultProvider`/`defaultModel`, but it does append a model change to the session transcript, which is why the restore point is persisted alongside the mode. Changes are serialized, so a rapid mode exit cannot leave a superseded mode model active. Note that setting `modes.off.model` makes OFF a pinned baseline: it is applied on every mode exit *and* at session start, overriding `--model` and the configured default. Use Pi theme color tokens for widget label colors.
 
@@ -127,9 +129,9 @@ Use `modes.<name>.appearance` to keep any mode's visual identity with its defini
 
 Behavior:
 
-- Listed tools are removed from the active set wherever opl-modes computes it. In practice this only affects modes that would otherwise include them: `off`/`execute` (which inherit all tools) and custom modes that list them. Read-only `chat`/`plan` already exclude these tools, so nothing changes there.
+- Listed tools are removed from the active set wherever opl-modes computes it. In practice this only affects modes that would otherwise include them: `off`/`execute` (which inherit the resting tool set unless overridden) and custom modes that permit them. Read-only `chat`/`plan` already exclude these tools, so nothing changes there.
 - When at least one lazy tool is withheld from a mode, opl-modes registers and activates a `load_tools` tool. The model calls `load_tools({ tools: [...] })` (or with no argument to enable all currently-allowed lazy tools) to activate them before use.
-- `load_tools` is bounded by the current mode's tool policy: it can only enable a lazy tool the active mode already permits, so a read-only mode cannot enable a write-capable tool.
+- `load_tools` is bounded by the current mode's tool policy: explicit tool lists take precedence; execute and custom modes without a list inherit `modes.off.tools` when pinned. Both named requests and load-all respect that baseline.
 - Core built-ins (`read`, `edit`, `write`, `bash`, `powershell`, `grep`, `find`, `ls`), `plan_complete`, and `load_tools` itself are protected and silently ignored if listed in `lazyTools`.
 - Switching modes re-applies the policy, so a lazy tool enabled earlier returns to inactive on the next mode change and must be re-enabled.
 - A mode `prompt` that instructs the model to use a lazy tool must also tell it to call `load_tools` first, otherwise the instruction names a tool the model cannot see. The bundled `research` mode does exactly that.

package/extensions/opl-modes/index.ts

@@ -111,7 +111,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
       async execute(_toolCallId, params) {
         const mode = getMode();
         const modeDef = getModeDefinition(mode);
-        const modeAllowed = modeDef?.tools ?? null; // null = mode inherits all tools
+        const modeAllowed = modeDef?.tools ?? getModeDefinition("off")?.tools ?? null; // Unlisted modes inherit the pinned baseline, if any.
         const current = pi.getActiveTools();
         const enable = lazyToolsToEnable(params.tools as string[] | undefined, current, modeAllowed);
         if (enable.length > 0) pi.setActiveTools([...current, ...enable]);
@@ -129,6 +129,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
   // ─── Saved model for restoring ─────────────────────────────────────────────
   let savedModel: Model<any> | null = null;
   const queueModelChange = createLatestModelQueue();
+  let pendingPlanModel: Promise<void> | null = null;
   // Consecutive restore failures for the same model, so an un-authable restore point is
   // retried once and then released instead of blocking future captures forever.
   let restoreAttempts = 0;
@@ -363,7 +364,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
     transition("plan", pi);
     const modeDef = getModeDefinition("plan");
     saveAndSetActiveTools(planModeTools());
-    applyModeModel(ctx, modeDef);
+    pendingPlanModel = applyModeModel(ctx, modeDef);
     updateStatus(ctx);
     if (ctx.hasUI && !USER_CONFIG.ui.hideNotify) {
       const notify = modeDef?.labels?.notify ?? USER_CONFIG.labels.plan.notify;
@@ -374,10 +375,15 @@ export default function modeSwitcher(pi: ExtensionAPI) {
 
   async function enterExecuteMode(ctx: ExtensionContext): Promise<void> {
     transition("execute", pi);
-    const baseNames = savedToolNames ?? pi.getActiveTools();
-    pi.setActiveTools(applyLazyPolicy([...toolsWithoutPlanComplete(baseNames), "plan_complete"]));
-    savedToolNames = null;
     const modeDef = getModeDefinition("execute");
+    if (modeDef?.tools) {
+      saveAndSetActiveTools(withPlanComplete("execute", toolsWithoutPlanComplete(modeDef.tools)));
+    } else {
+      const baseNames = savedToolNames ?? pi.getActiveTools();
+      pi.setActiveTools(applyLazyPolicy(withPlanComplete("execute", toolsWithoutPlanComplete(baseNames))));
+      savedToolNames = null;
+    }
+    await pendingPlanModel;
     await applyModeModel(ctx, modeDef);
     updateStatus(ctx);
     const title = getPlanDisplayTitle();
@@ -397,6 +403,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
    */
   function enterOffMode(ctx: ExtensionContext, message?: string, silent = false): void {
     transition("off", pi);
+    pendingPlanModel = null;
     const offModeDef = getModeDefinition("off");
     // OFF gates tools only when the user declares modes.off.tools; otherwise it restores
     // whatever was active before the mode.
@@ -511,7 +518,9 @@ export default function modeSwitcher(pi: ExtensionAPI) {
 
     if (!restored) {
       resetState();
-      restoreAllTools();
+      const offTools = getModeDefinition("off")?.tools;
+      if (offTools) saveAndSetActiveTools(withPlanComplete("off", offTools), true);
+      else restoreAllTools();
       applyOffModel(ctx);
       updateStatus(ctx);
       return;
@@ -528,13 +537,21 @@ export default function modeSwitcher(pi: ExtensionAPI) {
     const mode = getMode();
     const modeDef = getModeDefinition(mode);
 
+    // A restored plan or execution needs the pinned resting set as its inherited baseline,
+    // not the host tools active before this branch was restored.
+    const offTools = getModeDefinition("off")?.tools;
+    if ((mode === "plan" || mode === "execute") && offTools) {
+      saveAndSetActiveTools(withPlanComplete("off", offTools), true);
+    }
+
     if (modeDef?.tools) {
       // Honor allowPlanComplete here too, otherwise a resume drops the tool a mode was given.
       // OFF's declared list is the resting baseline, so it must not keep a stale snapshot.
-      saveAndSetActiveTools(withPlanComplete(mode, modeDef.tools), mode === "off");
+      const tools = mode === "execute" ? toolsWithoutPlanComplete(modeDef.tools) : modeDef.tools;
+      saveAndSetActiveTools(withPlanComplete(mode, tools), mode === "off");
     } else if (mode === "execute") {
       const allNames = pi.getActiveTools();
-      pi.setActiveTools(applyLazyPolicy([...toolsWithoutPlanComplete(allNames), "plan_complete"]));
+      pi.setActiveTools(applyLazyPolicy(withPlanComplete(mode, toolsWithoutPlanComplete(allNames))));
     } else {
       // Default: the active set minus plan_complete, re-added when the mode allows it.
       const allNames = pi.getActiveTools();
@@ -558,9 +575,14 @@ export default function modeSwitcher(pi: ExtensionAPI) {
   // ─── Event: session_start ──────────────────────────────────────────────────────
 
   pi.on("session_start", async (event, ctx) => {
+    setSessionCwd(ctx.cwd);
     // Re-publish the footer seam: a previous session in this process cleared it on shutdown.
     publishModeGlobals();
     if (event.reason === "startup") {
+      if (getMode() === "off" && (pi.getFlag("chat") === true || pi.getFlag("plan") === true)) {
+        const offTools = getModeDefinition("off")?.tools;
+        if (offTools) saveAndSetActiveTools(withPlanComplete("off", offTools), true);
+      }
       if (pi.getFlag("chat") === true && getMode() === "off") {
         enterChatMode(ctx);
         return;
@@ -799,6 +821,8 @@ export default function modeSwitcher(pi: ExtensionAPI) {
       const filename = `${PLAN_FILE_PREFIX}${sanitized}.md`;
       enterPlanWithFile(filename, pi);
       saveAndSetActiveTools(planModeTools());
+      pendingPlanModel = applyModeModel(ctx, getModeDefinition("plan"));
+      await pendingPlanModel;
       updateStatus(ctx);
       const createTitle = titleFromFilename(filename);
       if (ctx.hasUI && !USER_CONFIG.ui.hideNotify) {
@@ -865,9 +889,11 @@ export default function modeSwitcher(pi: ExtensionAPI) {
   }
 
   /** Load an existing plan file and show the action menu. */
-  function loadPlanAndShowMenu(ctx: ExtensionContext, filename: string, displayName: string): void {
+  async function loadPlanAndShowMenu(ctx: ExtensionContext, filename: string, displayName: string): Promise<void> {
     enterPlanWithFile(filename, pi);
     saveAndSetActiveTools(planModeTools());
+    pendingPlanModel = applyModeModel(ctx, getModeDefinition("plan"));
+    await pendingPlanModel;
     updateStatus(ctx);
     if (ctx.hasUI && !USER_CONFIG.ui.hideNotify) {
       ctx.ui.notify(USER_CONFIG.labels.plan.notifyLoaded.replace("{title}", displayName), "info");
@@ -1024,7 +1050,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
             if (choice === "__new__") {
               await promptNameAndEnterPlanMode(ctx);
             } else {
-              loadPlanAndShowMenu(ctx, choice, titleFromFilename(choice));
+              await loadPlanAndShowMenu(ctx, choice, titleFromFilename(choice));
               await showPlanMenu(ctx);
             }
           }
@@ -1058,7 +1084,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
 
       if (existsSync(filePath)) {
         if (getMode() !== "off") enterOffMode(ctx, undefined, true);
-        loadPlanAndShowMenu(ctx, filename, titleFromFilename(filename));
+        await loadPlanAndShowMenu(ctx, filename, titleFromFilename(filename));
         await showPlanMenu(ctx);
       } else {
         if (getMode() === "plan" || getMode() === "execute") {
@@ -1068,6 +1094,8 @@ export default function modeSwitcher(pi: ExtensionAPI) {
         if (getMode() !== "off") enterOffMode(ctx, undefined, true);
         enterPlanWithFile(filename, pi);
         saveAndSetActiveTools(planModeTools());
+        pendingPlanModel = applyModeModel(ctx, getModeDefinition("plan"));
+        await pendingPlanModel;
         updateStatus(ctx);
         if (ctx.hasUI && !USER_CONFIG.ui.hideNotify) {
           ctx.ui.notify(USER_CONFIG.labels.plan.notifyWithTitle.replace("{title}", titleFromFilename(filename)), USER_CONFIG.labels.plan.notifyType as "info" | "warning" | "error");

package/extensions/opl-webaccess/package-lock.json

@@ -1,13 +1,13 @@
 {
   "name": "opl-webaccess",
-  "version": "1.0.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "opl-webaccess",
-      "version": "1.0.0",
-      "license": "ISC",
+      "version": "0.2.0",
+      "license": "MIT",
       "dependencies": {
         "@mozilla/readability": "^0.6.0",
         "linkedom": "^0.18.13",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlines/opl-pi-sht",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "opl-pi-sht (shouldHaveThat) Pi coding-agent extension kit: token-efficient context, tool and session safety, fingerprinted /init, model benchmarking, web access, and browser automation.",
   "repository": {
     "type": "git",