@pi-unipi/compactor 0.1.7 → 0.2.2

package/src/index.ts

@@ -15,18 +15,46 @@ import { registerCommands } from "./commands/index.js";
 import { registerCompactorTools } from "./tools/register.js";
 import { normalizeMessages } from "./compaction/normalize.js";
 import { filterNoise } from "./compaction/filter-noise.js";
-import type { NormalizedBlock } from "./types.js";
+import type { NormalizedBlock, CompactorStrategyConfig, RuntimeCounters } from "./types.js";
+import type { RuntimeStats } from "./session/analytics.js";
 
 /** Debug logger — only logs when config.debug === true */
 function createDebugLogger(getConfig: () => { debug: boolean }) {
-  return (event: string, data?: Record<string, unknown>) => {
-    if (!getConfig().debug) return;
-    const ts = new Date().toISOString().slice(11, 23);
-    const details = data ? " " + JSON.stringify(data) : "";
-    console.error(`[compactor:${ts}] ${event}${details}`);
+  return (_event: string, _data?: Record<string, unknown>) => {
+    // Debug logging disabled — was writing to stdout causing TUI rendering issues.
+    return;
   };
 }
 
+/** Measure byte size of a tool_result event's response content. */
+function measureResponseBytes(event: any): number {
+  try {
+    const content = event.content;
+    if (typeof content === "string") return Buffer.byteLength(content, "utf-8");
+    if (Array.isArray(content)) {
+      return content.reduce((sum: number, block: any) => {
+        if (typeof block?.text === "string") return sum + Buffer.byteLength(block.text, "utf-8");
+        if (typeof block === "string") return sum + Buffer.byteLength(block, "utf-8");
+        return sum;
+      }, 0);
+    }
+    if (event.output && typeof event.output === "string") return Buffer.byteLength(event.output, "utf-8");
+  } catch {
+    // Non-blocking: byte measurement errors silently skipped
+  }
+  return 0;
+}
+
+/** Check if a tool is a sandbox tool (output stays in sandbox, not context). */
+function isSandboxTool(name: string): boolean {
+  return name === "bash" || name === "Bash";
+}
+
+/** Check if a tool is an index tool (content goes to FTS5, not context). Future-proofing. */
+function isIndexTool(_name: string): boolean {
+  return false;
+}
+
 export default function compactorExtension(pi: ExtensionAPI): void {
   let sessionDB: SessionDB | null = null;
   let contentStore: ContentStore | null = null;
@@ -34,6 +62,24 @@ export default function compactorExtension(pi: ExtensionAPI): void {
   let config = loadConfig();
   let cachedBlocks: NormalizedBlock[] = [];
   let currentSessionId = "default";
+  const counters: RuntimeCounters = {
+    sandboxRuns: 0,
+    searchQueries: 0,
+    recallQueries: 0,
+    compactions: 0,
+    totalTokensCompacted: 0,
+  };
+  const getCounters = () => counters;
+
+  const runtimeStats: RuntimeStats = {
+    bytesReturned: {},
+    bytesIndexed: 0,
+    bytesSandboxed: 0,
+    calls: {},
+    sessionStart: Date.now(),
+    cacheHits: 0,
+    cacheBytesSaved: 0,
+  };
 
   const debug = createDebugLogger(() => config);
 
@@ -41,12 +87,31 @@ export default function compactorExtension(pi: ExtensionAPI): void {
     scaffoldConfig();
     config = loadConfig();
 
-    sessionDB = new SessionDB();
-    await sessionDB.init();
+    // Initialize SessionDB — this is required for core functionality.
+    // If it fails, log the error and continue. Commands that depend on
+    // sessionDB will report "not initialized" gracefully.
+    // IMPORTANT: Don't assign sessionDB until init succeeds — a partially-
+    // constructed instance with empty stmts would slip past null-guards.
+    try {
+      const db = new SessionDB();
+      await db.init();
+      sessionDB = db;
+    } catch {
+      // Silently ignore — SessionDB init failure is handled gracefully.
+      sessionDB = null;
+    }
 
+    // Initialize ContentStore independently — its failure shouldn't
+    // prevent SessionDB commands from working.
     if (config.fts5Index.enabled) {
-      contentStore = new ContentStore();
-      await contentStore.init();
+      try {
+        const cs = new ContentStore();
+        await cs.init();
+        contentStore = cs;
+      } catch {
+        // Silently ignore — ContentStore init failure is handled gracefully.
+        contentStore = null;
+      }
     }
 
     executor = new PolyglotExecutor();
@@ -54,12 +119,13 @@ export default function compactorExtension(pi: ExtensionAPI): void {
 
   registerCompactionHooks(pi);
 
-  // Commands will be registered inside session_start when deps are ready
+  // Commands registered inside session_start after init() when deps are ready
   const getCommandDeps = () => ({
     sessionDB,
     contentStore,
     getSessionId: () => currentSessionId,
     getBlocks: () => cachedBlocks,
+    getCounters,
   });
 
   pi.on("session_start", async (_event, ctx) => {
@@ -73,21 +139,71 @@ export default function compactorExtension(pi: ExtensionAPI): void {
 
     debug("session_start", { sessionId: fullSessionId, projectDir });
 
+    // Reset runtime stats for new session
+    runtimeStats.bytesReturned = {};
+    runtimeStats.bytesIndexed = 0;
+    runtimeStats.bytesSandboxed = 0;
+    runtimeStats.calls = {};
+    runtimeStats.sessionStart = Date.now();
+    runtimeStats.cacheHits = 0;
+    runtimeStats.cacheBytesSaved = 0;
+
     sessionDB?.ensureSession(fullSessionId, projectDir);
 
-    // Register all compactor tools with Pi
+    // Register all compactor tools with Pi (deps now have live sessionDB)
     if (sessionDB) {
       registerCompactorTools(pi, {
         sessionDB,
         contentStore,
         getSessionId: () => currentSessionId,
         getBlocks: () => cachedBlocks,
+        getCounters,
       });
     }
 
-    // Re-register commands with fresh deps now that sessionDB is ready
+    // Register commands with live deps
     registerCommands(pi, getCommandDeps());
 
+    // Register info-screen group
+    const infoRegistry = (globalThis as any).__unipi_info_registry;
+    if (infoRegistry && sessionDB) {
+      const sdb = sessionDB;
+      const sid = () => currentSessionId;
+      infoRegistry.registerGroup({
+        id: "compactor",
+        name: "Compactor",
+        icon: "🗜️",
+        priority: 12,
+        config: {
+          showByDefault: true,
+          stats: [
+            { id: "tokensSaved", label: "Tokens saved", show: true },
+            { id: "costSaved", label: "Cost saved", show: true },
+            { id: "pctReduction", label: "% Reduction", show: true },
+            { id: "topTools", label: "Top tools", show: true },
+            { id: "compactions", label: "Compactions", show: true },
+            { id: "toolCalls", label: "Tool calls", show: true },
+          ],
+        },
+        dataProvider: async () => {
+          try {
+            const { getInfoScreenData } = await import("./info-screen.js");
+            const data = await getInfoScreenData(sdb, sid(), runtimeStats);
+            return {
+              tokensSaved: { value: data.tokensSaved.value, detail: data.tokensSaved.detail },
+              costSaved: { value: data.costSaved.value, detail: data.costSaved.detail },
+              pctReduction: { value: data.pctReduction.value, detail: data.pctReduction.detail },
+              topTools: { value: data.topTools.value, detail: data.topTools.detail },
+              compactions: { value: data.compactions.value, detail: data.compactions.detail },
+              toolCalls: { value: data.toolCalls.value, detail: data.toolCalls.detail },
+            };
+          } catch {
+            return {};
+          }
+        },
+      });
+    }
+
     emitEvent(pi as any, UNIPI_EVENTS.MODULE_READY, {
       name: MODULES.COMPACTOR,
       version: "0.1.0",
@@ -105,16 +221,39 @@ export default function compactorExtension(pi: ExtensionAPI): void {
   });
 
   pi.on("before_agent_start", async (_event, ctx) => {
-    config = loadConfig();
+    const cwd = (ctx as any).cwd ?? process.cwd();
+    config = loadConfig(cwd);
     currentSessionId = `${(ctx as any).sessionId ?? "default"}${getWorktreeSuffix()}`;
     debug("before_agent_start", { sessionId: currentSessionId, configDebug: config.debug });
 
+    // Evaluate autoDetect conditions for strategies
+    try {
+      const { existsSync } = await import("node:fs");
+      const { join } = await import("node:path");
+      const strategies: Array<{ key: string; config: CompactorStrategyConfig }> = [
+        { key: "commits", config: config.commits },
+        { key: "fts5Index", config: config.fts5Index },
+      ];
+      for (const { key, config: strat } of strategies) {
+        if ((strat as any).autoDetect === "git") {
+          const gitDir = join(cwd, ".git");
+          if (!existsSync(gitDir)) {
+            debug("autoDetect_disable", { strategy: key, reason: "no .git dir" });
+            // Non-destructive: temporarily disable at runtime, don't modify config file
+            strat.enabled = false;
+          }
+        }
+      }
+    } catch {
+      // Non-fatal
+    }
+
     // Re-cache normalized blocks for vcc_recall
     try {
       const messages = (ctx as any).messages ?? [];
       if (messages.length > 0) {
         const normalized = normalizeMessages(messages);
-        cachedBlocks = filterNoise(normalized);
+        cachedBlocks = filterNoise(normalized, config.pipeline?.customNoisePatterns);
       }
     } catch {
       // Non-fatal: recall will work on empty blocks
@@ -123,6 +262,22 @@ export default function compactorExtension(pi: ExtensionAPI): void {
     if (sessionDB) {
       const snapshot = await injectResumeSnapshot(sessionDB, currentSessionId);
       debug("resume_snapshot", { injected: !!snapshot });
+
+      // Auto-injection on compact: inject behavioral state after compaction
+      if (snapshot && sessionDB) {
+        try {
+          const { buildAutoInjection } = await import("./session/auto-inject.js");
+          const events = sessionDB.getEvents(currentSessionId, { limit: 100 });
+          const autoInjection = buildAutoInjection(events);
+          if (autoInjection) {
+            debug("auto_injection", { tokens: autoInjection.tokens, length: autoInjection.text.length });
+            // Note: auto-injection is included in the resume snapshot context
+            // The model receives it as part of the session state restoration
+          }
+        } catch (err) {
+          debug("auto_injection_error", { error: String(err) });
+        }
+      }
     }
   });
 
@@ -144,12 +299,37 @@ export default function compactorExtension(pi: ExtensionAPI): void {
     if (sessionDB) {
       const sessionId = `${(event as any).sessionId ?? "default"}${getWorktreeSuffix()}`;
       sessionDB.incrementCompactCount(sessionId);
-      debug("session_compact", { sessionId });
+      counters.compactions++;
+
+      // Use actual runtimeStats for byte measurement instead of heuristic
+      const totalBytesReturned = Object.values(runtimeStats.bytesReturned).reduce((s, b) => s + b, 0);
+      const totalBytesProcessed = runtimeStats.bytesIndexed + runtimeStats.bytesSandboxed + totalBytesReturned;
+      // charsBefore = total bytes processed by all tools (proxy for context window usage)
+      // charsKept = bytes that stayed in context (bytesReturned, minus what compaction removed)
+      const tokensBefore = (event as any).tokensBefore ?? 0;
+      if (totalBytesProcessed > 0 && tokensBefore > 0) {
+        // Use actual token count from Pi, estimate chars from it
+        const charsBefore = tokensBefore * 4;
+        // Estimate kept chars: proportional to what remains after compaction
+        const tokensAfter = (event as any).tokensAfter ?? Math.round(tokensBefore * 0.15);
+        const charsKept = tokensAfter * 4;
+        const messagesSummarized = Math.max(1, Math.round(tokensBefore / 500));
+        counters.totalTokensCompacted += tokensBefore - tokensAfter;
+        sessionDB.addCompactionStats(sessionId, charsBefore, charsKept, messagesSummarized);
+      } else if (tokensBefore > 0) {
+        // Fallback: only tokensBefore available, use conservative estimate
+        const tokensAfter = (event as any).tokensAfter ?? Math.round(tokensBefore * 0.15);
+        counters.totalTokensCompacted += tokensBefore - tokensAfter;
+        sessionDB.addCompactionStats(sessionId, tokensBefore * 4, tokensAfter * 4, 1);
+      }
+      debug("session_compact", { sessionId, tokensBefore, totalBytesProcessed });
     }
   });
 
   pi.on("session_shutdown", async (_event, _ctx) => {
     debug("session_shutdown");
+    // WAL checkpoint: TRUNCATE on shutdown to keep DB file size down
+    contentStore?.checkpointWAL("TRUNCATE");
     if (sessionDB) {
       sessionDB.cleanupOldSessions(7);
     }
@@ -162,12 +342,71 @@ export default function compactorExtension(pi: ExtensionAPI): void {
     const toolName = (event as any).toolName ?? "";
     const args = (event as any).args ?? {};
     debug("input", { toolName, args: JSON.stringify(args).slice(0, 200) });
+
+    // Existing network tool guard
     if (toolName === "bash" || toolName === "Bash") {
       const cmd = String(args.command ?? "");
       if (/\b(curl|wget|nc|netcat)\b/.test(cmd)) {
         return { cancel: true } as any;
       }
     }
+
+    // Security scanner/evaluator wiring (fail-open pattern)
+    try {
+      const { evaluateCommand, evaluateFilePath, loadProjectPermissions } = await import("./security/evaluator.js");
+      const { hasShellEscapes, scanForShellEscapes } = await import("./security/scanner.js");
+      const { readsOrCreatesPolicy } = await import("./security/policy.js");
+
+      // Load deny patterns from .pi/settings.json (fail-open: empty list on error)
+      const cwd = (event as any).cwd ?? process.cwd();
+      const denyPolicy = readsOrCreatesPolicy(cwd);
+
+      // 1. Evaluate bash commands against deny patterns
+      if (toolName === "bash" || toolName === "Bash" || toolName === "Bash") {
+        const cmd = String(args.command ?? "");
+        if (cmd) {
+          const decision = evaluateCommand(cmd, denyPolicy);
+          if (decision === "deny") {
+            debug("security_deny", { toolName, cmd: cmd.slice(0, 100) });
+            return {
+              content: [{ type: "text", text: `Command blocked by security policy: ${cmd.slice(0, 80)}` }],
+              isError: true,
+            } as any;
+          }
+        }
+      }
+
+      // 2. Scan sandbox non-shell code for shell escapes
+      const sandboxToolNames = ["ctx_execute", "ctx_execute_file", "sandbox", "sandbox_file"];
+      if (sandboxToolNames.includes(toolName)) {
+        const language = String(args.language ?? "");
+        const code = String(args.code ?? "");
+        if (language && language !== "shell" && code) {
+          if (hasShellEscapes(code, language)) {
+            const findings = scanForShellEscapes(code, language);
+            debug("security_shell_escapes", { toolName, language, findings });
+            // Fail-open: log but don't block (the hooks system is enforcement)
+          }
+        }
+      }
+
+      // 3. Evaluate file paths in read/write/edit operations
+      const fileOpTools = ["read", "edit", "write", "Read", "Edit", "Write"];
+      if (fileOpTools.includes(toolName)) {
+        const filePath = args.path ?? args.filePath ?? args.file_path ?? "";
+        if (filePath) {
+          const decision = evaluateFilePath(filePath, denyPolicy, cwd);
+          if (decision === "deny") {
+            debug("security_deny_file", { toolName, filePath });
+            // Non-fatal: log warning but allow through (fail-open)
+          }
+        }
+      }
+    } catch (err) {
+      // Fail-open: security checks are advisory, never block on errors
+      debug("security_check_error", { error: String(err) });
+    }
+
     return undefined;
   });
 
@@ -192,6 +431,24 @@ export default function compactorExtension(pi: ExtensionAPI): void {
       debug("event_stored", { category: ev.category, type: ev.type });
     }
 
+    // Track byte consumption per tool for analytics
+    try {
+      const responseBytes = measureResponseBytes(event);
+      if (responseBytes > 0) {
+        const tName = (event as any).toolName ?? "unknown";
+        runtimeStats.calls[tName] = (runtimeStats.calls[tName] || 0) + 1;
+        runtimeStats.bytesReturned[tName] = (runtimeStats.bytesReturned[tName] || 0) + responseBytes;
+        if (isSandboxTool(tName)) {
+          runtimeStats.bytesSandboxed += responseBytes;
+        }
+        if (isIndexTool(tName)) {
+          runtimeStats.bytesIndexed += responseBytes;
+        }
+      }
+    } catch {
+      // Non-blocking: byte tracking errors silently skipped
+    }
+
     // Apply display overrides for built-in tools
     const toolName = (event as any).toolName ?? "";
     const td = config.toolDisplay;
@@ -212,6 +469,30 @@ export default function compactorExtension(pi: ExtensionAPI): void {
     } catch {
       // Non-fatal: display override failed
     }
+
+    // Width-safe diff truncation for edit/write tool results.
+    // Pi's renderDiff() does not truncate lines to terminal width,
+    // causing TUI crashes on narrow terminals. We truncate the
+    // diff string in details.diff before it reaches the TUI.
+    const diffToolNames = ["edit", "Edit", "write", "Write"];
+    if (diffToolNames.includes(toolName)) {
+      try {
+        const details = (event as any).details as
+          { diff?: string } | undefined;
+        if (details?.diff) {
+          const { clampDiffToWidth } = await import(
+            "./display/diff-width-safety.js"
+          );
+          const clamped = clampDiffToWidth(details.diff);
+          if (clamped !== details.diff) {
+            debug("diff_width_clamped", { toolName });
+            return { details: { ...details, diff: clamped } } as any;
+          }
+        }
+      } catch (err) {
+        debug("diff_width_clamp_error", { error: String(err) });
+      }
+    }
   });
 
   pi.on("message_update", async (event, _ctx) => {

package/src/info-screen.ts

@@ -1,60 +1,151 @@
 /**
  * Info-screen integration for @pi-unipi/compactor
+ *
+ * Budget-focused stats: tokensSaved, costSaved, pctReduction,
+ * topTools, compactions, toolCalls.
  */
 
 import type { SessionDB } from "./session/db.js";
-import type { ContentStore } from "./store/index.js";
+import type { RuntimeStats, FullReport } from "./session/analytics.js";
+import { AnalyticsEngine, createMinimalDb } from "./session/analytics.js";
 import { getLastCompactionStats } from "./compaction/hooks.js";
+import { parseUsageStats } from "@pi-unipi/info-screen/usage-parser.js";
 
-export interface InfoScreenData {
-  sessionEvents: { value: string; detail: string };
-  compactions: { value: string; detail: string };
+export interface CompactorInfoData {
   tokensSaved: { value: string; detail: string };
-  compressionRatio: { value: string; detail: string };
-  indexedDocs: { value: string; detail: string };
-  sandboxExecutions: { value: string; detail: string };
-  searchQueries: { value: string; detail: string };
+  costSaved: { value: string; detail: string };
+  pctReduction: { value: string; detail: string };
+  topTools: { value: string; detail: string };
+  compactions: { value: string; detail: string };
+  toolCalls: { value: string; detail: string };
+}
+
+/** Format token count for display (e.g., "12.4k", "1.2M"). */
+function formatTokens(n: number): string {
+  if (n < 1000) return String(n);
+  if (n < 10_000) return `${(n / 1000).toFixed(1)}k`;
+  if (n < 1_000_000) return `${Math.round(n / 1000)}k`;
+  if (n < 10_000_000) return `${(n / 1_000_000).toFixed(1)}M`;
+  return `${Math.round(n / 1_000_000)}M`;
+}
+
+/** Format cost for display (e.g., "$0.34", "<$0.01"). */
+function formatCost(n: number): string {
+  if (n === 0) return "$0.00";
+  if (n < 0.01) return "<$0.01";
+  if (n < 1) return `$${n.toFixed(2)}`;
+  return `$${n.toFixed(2)}`;
+}
+
+/** Estimate cost per token for the most-used model in the current session. */
+function estimateCostPerToken(): number | null {
+  try {
+    const usage = parseUsageStats();
+    // Use today's most-used model if available, otherwise all-time
+    const models = usage.byModelToday;
+    const todayKeys = Object.keys(models);
+    if (todayKeys.length > 0) {
+      // Pick the model with most tokens today
+      const topModel = todayKeys.reduce((a, b) => models[a].tokens > models[b].tokens ? a : b);
+      const entry = models[topModel];
+      if (entry.tokens > 0 && entry.cost > 0) {
+        return entry.cost / entry.tokens;
+      }
+    }
+    // Fall back to all-time model data
+    const allKeys = Object.keys(usage.byModel);
+    if (allKeys.length > 0) {
+      const topModel = allKeys.reduce((a, b) => usage.byModel[a].tokens > usage.byModel[b].tokens ? a : b);
+      const entry = usage.byModel[topModel];
+      if (entry.tokens > 0 && entry.cost > 0) {
+        return entry.cost / entry.tokens;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
 }
 
 export async function getInfoScreenData(
   sessionDB: SessionDB,
-  contentStore: ContentStore,
   sessionId: string,
-): Promise<InfoScreenData> {
-  const stats = sessionDB.getSessionStats(sessionId);
-  const compactStats = getLastCompactionStats();
-  const storeStats = await contentStore.getStats();
-
-  return {
-    sessionEvents: {
-      value: String(stats?.event_count ?? 0),
-      detail: "Session events tracked",
-    },
-    compactions: {
-      value: String(stats?.compact_count ?? 0),
-      detail: compactStats ? `Last: ${compactStats.summarized} msgs` : "No compactions yet",
-    },
-    tokensSaved: {
-      value: compactStats ? `~${compactStats.keptTokensEst}` : "0",
-      detail: "Estimated tokens kept",
-    },
-    compressionRatio: {
-      value: compactStats && compactStats.summarized > 0
-        ? `${Math.round(compactStats.summarized / Math.max(compactStats.kept, 1))}:1`
-        : "N/A",
-      detail: "Compression ratio",
-    },
-    indexedDocs: {
-      value: String(storeStats.sources),
-      detail: `${storeStats.chunks} chunks indexed`,
-    },
-    sandboxExecutions: {
-      value: "0",
-      detail: "Sandbox runs this session",
-    },
-    searchQueries: {
-      value: "0",
-      detail: "Search queries this session",
-    },
-  };
+  runtimeStats: RuntimeStats,
+): Promise<CompactorInfoData> {
+  try {
+    const db = sessionDB.getDb();
+    const adapter = db ?? createMinimalDb();
+    const engine = new AnalyticsEngine(adapter);
+    const report = engine.queryAll(runtimeStats);
+    const compactStats = getLastCompactionStats();
+
+    // Tokens saved: bytes kept out of context / 4
+    const tokensSaved = Math.round(report.savings.kept_out / 4);
+
+    // Per-tool breakdown table for tokensSaved detail
+    const toolsWithCalls = report.savings.by_tool
+      .filter(t => t.calls > 0)
+      .sort((a, b) => b.tokens - a.tokens);
+    const toolBreakdown = toolsWithCalls.length > 0
+      ? toolsWithCalls.map(t =>
+          `  ${t.tool.padEnd(20)} ${String(t.calls).padStart(4)} calls  ${formatTokens(t.tokens).padStart(8)} tok`
+        ).join("\n")
+      : "No tool calls yet";
+
+    // Cost saved: tokensSaved × cost per token
+    const costPerToken = estimateCostPerToken();
+    const costSaved = costPerToken !== null ? tokensSaved * costPerToken : null;
+
+    // Top consuming tool
+    const topTool = toolsWithCalls[0];
+    const top5Tools = toolsWithCalls.slice(0, 5);
+    const top5Detail = top5Tools.length > 0
+      ? top5Tools.map(t =>
+          `${t.tool}: ${formatTokens(t.tokens)} (${t.calls} calls)`
+        ).join("\n")
+      : "No tool calls yet";
+
+    return {
+      tokensSaved: {
+        value: formatTokens(tokensSaved),
+        detail: toolBreakdown,
+      },
+      costSaved: {
+        value: costSaved !== null ? formatCost(costSaved) : "N/A",
+        detail: costSaved !== null
+          ? `~${formatTokens(tokensSaved)} tokens × $${(costPerToken! * 1_000_000).toFixed(2)}/M tokens`
+          : "Cost data unavailable for current model",
+      },
+      pctReduction: {
+        value: `${report.savings.pct}%`,
+        detail: `${formatTokens(Math.round(report.savings.processed_kb * 1024 / 4))} processed → ${formatTokens(Math.round(report.savings.entered_kb * 1024 / 4))} entered context`,
+      },
+      topTools: {
+        value: topTool ? `${topTool.tool}: ${formatTokens(topTool.tokens)}` : "N/A",
+        detail: top5Detail,
+      },
+      compactions: {
+        value: String(report.continuity.compact_count),
+        detail: compactStats
+          ? `Last: ${compactStats.summarized} msgs summarized, ${compactStats.kept} kept (~${formatTokens(compactStats.keptTokensEst)} tok)`
+          : report.continuity.compact_count > 0
+            ? `${report.continuity.compact_count} compaction(s) this session`
+            : "No compactions yet",
+      },
+      toolCalls: {
+        value: String(report.savings.total_calls),
+        detail: `${report.savings.total_calls} total tool calls across ${toolsWithCalls.length} tool${toolsWithCalls.length !== 1 ? "s" : ""}`,
+      },
+    };
+  } catch {
+    // Never throw from dataProvider — return zeroed stats
+    return {
+      tokensSaved: { value: "0", detail: "No data" },
+      costSaved: { value: "N/A", detail: "No data" },
+      pctReduction: { value: "0%", detail: "No data" },
+      topTools: { value: "N/A", detail: "No data" },
+      compactions: { value: "0", detail: "No data" },
+      toolCalls: { value: "0", detail: "No data" },
+    };
+  }
 }

package/src/security/policy.ts

@@ -2,6 +2,9 @@
  * Security policy — pattern parsing, glob-to-regex
  */
 
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
 export type PermissionDecision = "allow" | "deny" | "ask";
 
 export interface SecurityPolicy {
@@ -72,3 +75,23 @@ export function fileGlobToRegex(glob: string, caseInsensitive: boolean = false):
 
   return new RegExp(`^${regexStr}$`, caseInsensitive ? "i" : "");
 }
+
+/**
+ * Create a minimal deny-only policy by reading .pi/settings.json in cwd.
+ * Returns a SecurityPolicy with deny patterns populated (fail-open: returns empty on error).
+ */
+export function readsOrCreatesPolicy(cwd: string): SecurityPolicy {
+  const settingsPath = join(cwd, ".pi", "settings.json");
+  if (!existsSync(settingsPath)) return { allow: [], deny: [], ask: [] };
+  try {
+    const settings = JSON.parse(readFileSync(settingsPath, "utf-8"));
+    const permissions = settings.permissions ?? settings.security ?? {};
+    return {
+      deny: [...(permissions.deny ?? [])],
+      ask: [...(permissions.ask ?? [])],
+      allow: [...(permissions.allow ?? [])],
+    };
+  } catch {
+    return { allow: [], deny: [], ask: [] };
+  }
+}