@piagent/platform 1.2.0 → 1.2.2

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -12,6 +12,7 @@ import {
   extractShellGlobCandidates,
   extractShellPathCandidates,
   findProtectedPathInCommand,
+  unresolvedPathExpansions,
   globMatchesPath,
   matchesProtectedPath,
   normalizePathCandidate,
@@ -42,7 +43,14 @@ import {
 } from "./redaction-core.js";
 import { detectProfileName } from "./project-shape.js";
 import { evaluateUpdateCheck, isInstalledPlatform, readUpdateCache, startUpdateProbe } from "./update-check.js";
-import { REPOSITORY_SCOPES, collectServers } from "../mcp/mcp-config-layers.js";
+import {
+  REPOSITORY_SCOPES,
+  collectServers,
+  configPathForScope,
+  mcpDecisionInputs,
+  unverifiableMcpConfig
+} from "../mcp/mcp-config-layers.js";
+import { attributeDirectTool } from "../mcp/mcp-tool-naming.js";
 import { approvalState } from "../mcp/mcp-approval-store.js";
 import { evaluateServerReadiness, readinessNotice } from "../mcp/mcp-auth-readiness.js";
 import * as mcpActions from "../mcp/mcp-command-actions.js";
@@ -120,6 +128,13 @@ const BOILERPLATE_COLLAPSE_CHARS = 300;
 const MAX_INLINE_COLLAPSED_TASK_CHARS = 2200;
 const MAX_CHAT_IMAGE_ATTACHMENTS = 4;
 const MAX_CHAT_IMAGE_BYTES = 8 * 1024 * 1024;
+const TOOL_RESULT_COMPACT_CHAR_THRESHOLD = 12_000;
+const TOOL_RESULT_COMPACT_LINE_THRESHOLD = 180;
+const TOOL_RESULT_PREVIEW_HEAD_LINES = 24;
+const TOOL_RESULT_PREVIEW_TAIL_LINES = 24;
+const TOOL_RESULT_PREVIEW_INTERESTING_LINES = 24;
+const TOOL_RESULT_PREVIEW_MAX_CHARS = 6_000;
+const TOOL_RESULT_CAPTURE_MAX_CHARS = 500_000;
 const IMAGE_EXTENSIONS = ["png", "jpg", "jpeg", "gif", "webp", "bmp"] as const;
 const ORCHESTRATION_MODES = ["solo-first", "bounded-subagents", "parallel-readonly"] as const;
 const REVIEW_LENSES = ["correctness", "tests", "scope", "security", "docs", "release", "package"] as const;
@@ -1480,6 +1495,14 @@ function observedBashLedgerPath(cwd: string): string {
   return path.join(stateRoot(cwd), "observed-bash.jsonl");
 }
 
+function toolResultCaptureRoot(cwd: string): string {
+  return path.join(stateRoot(cwd), "tool-results");
+}
+
+function toolResultCaptureIndexPath(cwd: string): string {
+  return path.join(toolResultCaptureRoot(cwd), "index.jsonl");
+}
+
 function safeTaskId(taskId: string): string {
   return taskId.trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "task";
 }
@@ -1994,16 +2017,20 @@ function prepareToolInputForPolicy(
 }
 
 // Which MCP server a tool call is addressed to. The adapter exposes one proxy
-// tool named `mcp` that carries the server in `input.server`, and, when a server
-// runs with directTools, individual tools named `mcp__<server>__<tool>`. Both
-// forms are read, because a gate that only covers the proxy is bypassed by
-// turning directTools on.
-function mcpServerFromToolCall(toolName: string, input: Record<string, unknown>): string | undefined {
+// tool named `mcp` that carries the server in `input.server`, and, under
+// directTools, one tool per server tool named `<prefix>_<tool>` where the prefix
+// is derived from the server name. Direct names are matched against the servers
+// this gate is holding rather than against a fixed pattern, because the prefix
+// is the server's own name and there is nothing constant to anchor on.
+function mcpServerFromToolCall(
+  toolName: string,
+  input: Record<string, unknown>,
+  candidates: Iterable<string>
+): string | undefined {
   if (normalizeActionToken(toolName) === "mcp") {
     return typeof input.server === "string" && input.server.trim() ? input.server.trim() : undefined;
   }
-  const direct = toolName.match(/^mcp(?:__|[-_:]+)([^_:.-]+)/i);
-  return direct?.[1];
+  return attributeDirectTool(toolName, candidates);
 }
 
 // Servers a repository defines are not usable until somebody on this machine has
@@ -2014,25 +2041,71 @@ function mcpServerFromToolCall(toolName: string, input: Record<string, unknown>)
 //
 // Recomputed only when one of the files behind the decision changes, because
 // this runs on every tool call.
-const mcpApprovalCache = new Map<string, { signature: string; blocked: Map<string, string> }>();
+interface RepositoryMcpGate {
+  blocked: Map<string, { state: string; origin: string }>;
+  // Conditions under which no tool call can be checked at all, each with the
+  // sentence to show. These are not "a server is unapproved" — they are "this
+  // repository's config has put the gate in a state where it cannot tell which
+  // server a call belongs to", and the only sound answer to that is to stop.
+  unverifiable: string[];
+}
+
+const mcpApprovalCache = new Map<string, { signature: string; gate: RepositoryMcpGate }>();
 
-function unapprovedMcpServers(cwd: string): Map<string, string> {
+function repositoryMcpGate(cwd: string): RepositoryMcpGate {
+  // Repository scopes plus anything an `imports` key drags in from a file the
+  // clone carries. Collecting those here is the whole point: a server the gate
+  // never enumerates is a server it silently permits.
   const servers = collectServers({ projectPath: cwd, scopes: [...REPOSITORY_SCOPES] });
+  const repositoryFiles = [...REPOSITORY_SCOPES].map((scope) => ({
+    scope,
+    file: configPathForScope(scope, { projectPath: cwd })
+  }));
+  // Every file the decision reads, listed by the module that reads them rather
+  // than restated here. Building this by hand is what went wrong: the scan grew
+  // to read merged settings from all four scopes and to stat import targets
+  // outside the repository, the hand-written list did not, and an already-loaded
+  // guard went on permitting calls after a personal global config had put the
+  // session in the state this gate exists to refuse.
   const signature = [
-    ...servers.map((server) => `${server.scope}:${server.name}:${fileSignature(server.file)}`),
+    ...servers.map((server) => `${server.origin}:${server.name}:${fileSignature(server.file)}`),
+    ...repositoryFiles.map((layer) => `layer:${layer.scope}:${fileSignature(layer.file)}`),
+    ...mcpDecisionInputs({ projectPath: cwd }).map((file) => `input:${file}:${fileSignature(file)}`),
     `store:${fileSignature(path.join(os.homedir(), ".pi", "piagent-mcp-approvals.json"))}`
   ].join("|");
   const cached = mcpApprovalCache.get(cwd);
-  if (cached?.signature === signature) return cached.blocked;
+  if (cached?.signature === signature) return cached.gate;
 
-  const blocked = new Map<string, string>();
+  const blocked = new Map<string, { state: string; origin: string }>();
   for (const server of servers) {
     const state = approvalState({ projectPath: cwd, name: server.name, entry: server.entry });
     if (state.state === "approved") continue;
-    blocked.set(server.name, state.state);
-  }
-  mcpApprovalCache.set(cwd, { signature, blocked });
-  return blocked;
+    // A name defined more than once keeps its blocking entry: the approved copy
+    // does not vouch for the one nobody has looked at.
+    blocked.set(server.name, { state: state.state, origin: server.origin });
+  }
+
+  // Two things a repository-carried config can do that leave nothing to check.
+  //
+  // It can ask for tools with no prefix, so a direct tool arrives under a bare
+  // name carrying no evidence of its server. Refusing only the proxy there was
+  // not a fix: the proxy is the one form that names its server, so blocking it
+  // and allowing the bare names left the hole exactly where it was.
+  //
+  // It can also import a kind whose config this platform cannot enumerate, and
+  // then the set of servers reaching the session is simply unknown. Blocking the
+  // servers that could be listed says nothing about the ones that could not.
+  //
+  // Both stop every tool call. A repository can make a session refuse to run;
+  // it must not be able to make one run a server nobody approved.
+  // Read from the shared module rather than decided here, so `piagent-mcp
+  // doctor` reports exactly what this refuses. The two disagreeing is how an
+  // operator ends up reading "PASS" while every tool call is being stopped.
+  const unverifiable = unverifiableMcpConfig({ projectPath: cwd }).map((problem) => problem.detail);
+
+  const gate = { blocked, unverifiable };
+  mcpApprovalCache.set(cwd, { signature, gate });
+  return gate;
 }
 
 function fileSignature(file: string): string {
@@ -2049,15 +2122,26 @@ function evaluateMcpApproval(
   toolName: string,
   input: Record<string, unknown>
 ): { block: boolean; reason?: string } {
-  const server = mcpServerFromToolCall(toolName, input);
+  const gate = repositoryMcpGate(cwd);
+
+  // Every tool call, not only the ones that look like MCP. Under either of these
+  // conditions a call cannot be traced to a server, so there is no such thing as
+  // a call this gate can clear.
+  if (gate.unverifiable.length > 0) {
+    return { block: true, reason: `Blocked every tool call: ${gate.unverifiable.join(" ")}` };
+  }
+
+  const server = mcpServerFromToolCall(toolName, input, gate.blocked.keys());
   if (!server) return { block: false };
-  const state = unapprovedMcpServers(cwd).get(server);
-  if (!state) return { block: false };
-  const explanation = state === "rejected"
+  const record = gate.blocked.get(server);
+  if (!record) return { block: false };
+  const explanation = record.state === "rejected"
     ? "it was rejected for this project"
-    : state === "changed"
+    : record.state === "changed"
       ? "its definition changed since it was approved"
-      : "this repository defines it and nobody on this machine has approved it";
+      : record.origin.startsWith("import:")
+        ? `this repository imports it from ${record.origin.slice("import:".length)} config and nobody on this machine has approved it here`
+        : "this repository defines it and nobody on this machine has approved it";
   return {
     block: true,
     // Named as commands, because this is read inside a session: the reader can
@@ -2069,6 +2153,18 @@ function evaluateMcpApproval(
   };
 }
 
+// A word whose final path segment glues literal text onto an expansion --
+// `.en$(echo v)`, `${D}.env` -- names a file this process cannot know without
+// running the substitution. Matching the literal half against the protected
+// patterns answers a different question than the one being asked, so refuse
+// rather than let an unknown filename through unchecked.
+function unresolvedExpansionReason(subject: string, words: string[]): string {
+  const listed = words.map((word) => `\`${word}\``).join(", ");
+  return `${subject} builds a filename this guard cannot resolve: ${listed}. `
+    + "The literal text around the expansion makes it a path, but its value is only known at run time, "
+    + "so it cannot be checked against the protected paths. Write the path out, or put the expansion in its own argument.";
+}
+
 function evaluateMcpProxyShellProtectedAccess(
   cwd: string,
   prepared: PreparedToolInput,
@@ -2112,6 +2208,10 @@ function evaluateMcpProxyShellProtectedAccess(
       reason: `MCP command resolves to protected path: ${resolvedProtectedHit.candidate} resolves to ${resolvedProtectedHit.resolved} matching ${resolvedProtectedHit.pattern}`
     };
   }
+  const unresolved = protectedPaths.length > 0 ? unresolvedPathExpansions(command) : [];
+  if (unresolved.length > 0) {
+    return { block: true, reason: unresolvedExpansionReason("MCP command", unresolved) };
+  }
   return { block: false };
 }
 
@@ -3284,6 +3384,321 @@ function modelLabel(ctx: ExtensionContext): string {
   return model.name ?? model.id ?? "unknown";
 }
 
+function currentSessionName(ctx: ExtensionContext): string {
+  try {
+    return String(ctx.sessionManager.getSessionName() ?? "").trim();
+  } catch {
+    return "";
+  }
+}
+
+function hasOperatorSessionName(name: string): boolean {
+  const normalized = name.trim().toLowerCase();
+  return Boolean(normalized && normalized !== "session");
+}
+
+function cleanSessionNameInput(input: string): string {
+  let name = input.trim();
+  if ((name.startsWith("\"") && name.endsWith("\"")) || (name.startsWith("'") && name.endsWith("'"))) {
+    name = name.slice(1, -1).trim();
+  }
+  return name;
+}
+
+type ToolResultCaptureSummary = {
+  path?: string;
+  error?: string;
+  source: string;
+  toolName: string;
+  originalChars: number;
+  originalLines: number;
+  previewChars?: number;
+  storedChars?: number;
+  storedTruncated?: boolean;
+  sha256: string;
+};
+
+function normalizeToolResultText(text: string): string {
+  return text.replace(/\r\n/g, "\n");
+}
+
+function toolResultLineCount(text: string): number {
+  if (!text) return 0;
+  return normalizeToolResultText(text).split("\n").length;
+}
+
+function shouldCompactToolResultText(text: string): boolean {
+  return text.length > TOOL_RESULT_COMPACT_CHAR_THRESHOLD
+    || toolResultLineCount(text) > TOOL_RESULT_COMPACT_LINE_THRESHOLD;
+}
+
+function clipPreviewLine(line: string, maxChars = 260): string {
+  if (line.length <= maxChars) return line;
+  return `${line.slice(0, maxChars).trimEnd()} ... [line clipped]`;
+}
+
+function boundedPreview(text: string): string {
+  if (text.length <= TOOL_RESULT_PREVIEW_MAX_CHARS) return text;
+  const marker = "\n[Piagent preview shortened further to stay light.]\n";
+  const edge = Math.floor((TOOL_RESULT_PREVIEW_MAX_CHARS - marker.length) / 2);
+  return `${text.slice(0, edge).trimEnd()}${marker}${text.slice(-edge).trimStart()}`;
+}
+
+function interestingToolResultLines(lines: string[]): string[] {
+  const interesting = /\b(?:error|errors|err!|failed?|failure|warning|warn|exception|traceback|assert(?:ion)?|panic|fatal|timeout|timed out|denied|not found|cannot|eacces|enoent|ts\d{3,5}|err_[a-z0-9_]+)\b/i;
+  const seen = new Set<string>();
+  const result: string[] = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!interesting.test(line)) continue;
+    const rendered = `${index + 1}: ${clipPreviewLine(line)}`;
+    if (seen.has(rendered)) continue;
+    seen.add(rendered);
+    result.push(rendered);
+    if (result.length >= TOOL_RESULT_PREVIEW_INTERESTING_LINES) break;
+  }
+  return result;
+}
+
+function storedToolResultText(text: string): { text: string; truncated: boolean } {
+  if (text.length <= TOOL_RESULT_CAPTURE_MAX_CHARS) return { text, truncated: false };
+  const marker = `\n\n[Piagent capture truncated: omitted ${formatCount(text.length - TOOL_RESULT_CAPTURE_MAX_CHARS)} chars from the middle.]\n\n`;
+  const edge = Math.floor((TOOL_RESULT_CAPTURE_MAX_CHARS - marker.length) / 2);
+  return {
+    text: `${text.slice(0, edge).trimEnd()}${marker}${text.slice(-edge).trimStart()}`,
+    truncated: true
+  };
+}
+
+function compactToolResultPreview(toolName: string, source: string, text: string, capture: ToolResultCaptureSummary): string {
+  const normalized = normalizeToolResultText(text);
+  const lines = normalized.split("\n");
+  const head = lines.slice(0, TOOL_RESULT_PREVIEW_HEAD_LINES).map((line) => clipPreviewLine(line));
+  const tailStart = Math.max(TOOL_RESULT_PREVIEW_HEAD_LINES, lines.length - TOOL_RESULT_PREVIEW_TAIL_LINES);
+  const tail = lines.slice(tailStart).map((line) => clipPreviewLine(line));
+  const omitted = Math.max(0, lines.length - head.length - tail.length);
+  const interesting = interestingToolResultLines(lines);
+  const captureLine = capture.path
+    ? `capture: ${capture.path}${capture.storedTruncated ? " (stored head/tail sample; original too large)" : ""}`
+    : `capture: unavailable (${capture.error ?? "write failed"})`;
+  const sections = [
+    `[Piagent compacted large ${toolName} output from ${source}: ${formatCount(capture.originalChars)} chars / ${formatCount(capture.originalLines)} lines.]`,
+    `[${captureLine}]`,
+    "[Preview keeps head, notable lines, and tail.]",
+    "",
+    "head:",
+    ...head
+  ];
+  if (interesting.length > 0) {
+    sections.push("", "notable:", ...interesting);
+  }
+  if (omitted > 0) {
+    sections.push("", `... ${formatCount(omitted)} middle line${omitted === 1 ? "" : "s"} omitted ...`);
+  }
+  sections.push("", "tail:", ...tail);
+  return boundedPreview(sections.join("\n"));
+}
+
+function maybeNumber(value: unknown): number | undefined {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && /^-?\d+$/.test(value.trim())) return Number.parseInt(value, 10);
+  return undefined;
+}
+
+function currentSessionField(ctx: ExtensionContext, field: "getSessionFile" | "getSessionId" | "getSessionName"): string | undefined {
+  try {
+    const value = ctx.sessionManager[field]?.();
+    return value === undefined || value === null ? undefined : redactText(String(value));
+  } catch {
+    return undefined;
+  }
+}
+
+function writeToolResultCapture(
+  cwd: string,
+  event: any,
+  ctx: ExtensionContext,
+  source: string,
+  text: string,
+  cache: Map<string, ToolResultCaptureSummary>
+): ToolResultCaptureSummary {
+  const normalized = normalizeToolResultText(text);
+  const sha256 = crypto.createHash("sha256").update(normalized).digest("hex");
+  const originalLines = toolResultLineCount(normalized);
+  const cached = cache.get(sha256);
+  if (cached?.path) return { ...cached, source };
+
+  const toolName = String(event?.toolName ?? "tool");
+  const recordedAt = nowIso();
+  const date = recordedAt.slice(0, 10);
+  const filename = `${recordedAt.replace(/[:.]/g, "-")}-${slugify(toolName)}-${sha256.slice(0, 12)}.log`;
+  const relativePath = [".pi", "piagent-state", "tool-results", date, filename].join("/");
+  const absolutePath = path.join(cwd, ".pi", "piagent-state", "tool-results", date, filename);
+  const capture = storedToolResultText(normalized);
+  const details = event?.details && typeof event.details === "object" ? event.details : {};
+  const exitCode = maybeNumber(details.exitCode ?? details.status ?? event?.exitCode);
+  const metadata = {
+    schemaVersion: 1,
+    recordedAt,
+    cwd: redactText(cwd),
+    sessionId: currentSessionField(ctx, "getSessionId"),
+    sessionName: currentSessionField(ctx, "getSessionName"),
+    sessionFile: currentSessionField(ctx, "getSessionFile"),
+    toolName,
+    source,
+    isError: event?.isError === true,
+    exitCode,
+    input: redactForStorage(event?.input),
+    path: relativePath,
+    originalChars: normalized.length,
+    originalLines,
+    storedChars: capture.text.length,
+    storedTruncated: capture.truncated,
+    sha256
+  };
+
+  try {
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, [
+      "# Piagent compacted tool result capture",
+      JSON.stringify(metadata),
+      "---",
+      capture.text
+    ].join("\n"));
+    fs.appendFileSync(toolResultCaptureIndexPath(cwd), `${JSON.stringify(metadata)}\n`);
+    const summary = {
+      path: relativePath,
+      source,
+      toolName,
+      originalChars: normalized.length,
+      originalLines,
+      storedChars: capture.text.length,
+      storedTruncated: capture.truncated,
+      sha256
+    };
+    cache.set(sha256, summary);
+    return summary;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const summary = {
+      error: message,
+      source,
+      toolName,
+      originalChars: normalized.length,
+      originalLines,
+      sha256
+    };
+    cache.set(sha256, summary);
+    return summary;
+  }
+}
+
+function compactToolResultTextContent(
+  cwd: string,
+  event: any,
+  ctx: ExtensionContext,
+  content: unknown,
+  cache: Map<string, ToolResultCaptureSummary>
+): { content: unknown; captures: ToolResultCaptureSummary[] } {
+  if (!Array.isArray(content)) return { content, captures: [] };
+  const captures: ToolResultCaptureSummary[] = [];
+  const compacted = content.map((block, index) => {
+    if (!block || typeof block !== "object") return block;
+    const typed = block as { type?: unknown; text?: unknown };
+    if (typed.type !== "text" || typeof typed.text !== "string" || !shouldCompactToolResultText(typed.text)) return block;
+    const source = `content[${index}].text`;
+    const capture = writeToolResultCapture(cwd, event, ctx, source, typed.text, cache);
+    captures.push(capture);
+    return {
+      ...block,
+      text: compactToolResultPreview(String(event?.toolName ?? "tool"), source, typed.text, capture)
+    };
+  });
+  return { content: compacted, captures };
+}
+
+function compactToolResultDetails(
+  cwd: string,
+  event: any,
+  ctx: ExtensionContext,
+  value: unknown,
+  cache: Map<string, ToolResultCaptureSummary>,
+  captures: ToolResultCaptureSummary[],
+  source = "details",
+  depth = 0
+): unknown {
+  if (typeof value === "string") {
+    if (!shouldCompactToolResultText(value)) return value;
+    const capture = writeToolResultCapture(cwd, event, ctx, source, value, cache);
+    captures.push(capture);
+    return compactToolResultPreview(String(event?.toolName ?? "tool"), source, value, capture);
+  }
+  if (Array.isArray(value)) {
+    if (depth >= 6) return value;
+    return value.map((item, index) => compactToolResultDetails(cwd, event, ctx, item, cache, captures, `${source}[${index}]`, depth + 1));
+  }
+  if (isPlainRecord(value)) {
+    if (depth >= 6) return value;
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key,
+        compactToolResultDetails(cwd, event, ctx, item, cache, captures, `${source}.${key}`, depth + 1)
+      ])
+    );
+  }
+  return value;
+}
+
+function attachToolResultCompactionDetails(details: unknown, captures: ToolResultCaptureSummary[]): unknown {
+  if (captures.length === 0) return details;
+  const compacted = captures.map((capture) => ({
+    path: capture.path,
+    error: capture.error,
+    source: capture.source,
+    toolName: capture.toolName,
+    originalChars: capture.originalChars,
+    originalLines: capture.originalLines,
+    storedChars: capture.storedChars,
+    storedTruncated: capture.storedTruncated,
+    sha256: capture.sha256
+  }));
+  if (isPlainRecord(details)) return { ...details, piagentCompactedToolResults: compacted };
+  if (details === undefined) return { piagentCompactedToolResults: compacted };
+  return { value: details, piagentCompactedToolResults: compacted };
+}
+
+function readRecentToolResultCaptures(cwd: string, limit = 5): Record<string, unknown>[] {
+  const indexPath = toolResultCaptureIndexPath(cwd);
+  if (!fs.existsSync(indexPath)) return [];
+  const lines = fs.readFileSync(indexPath, "utf8").trim().split(/\n/).filter(Boolean);
+  const captures: Record<string, unknown>[] = [];
+  for (const line of lines.slice(-Math.max(limit * 3, limit))) {
+    try {
+      const parsed = JSON.parse(line);
+      if (isPlainRecord(parsed)) captures.push(redactForStorage(parsed) as Record<string, unknown>);
+    } catch {
+      // A partial JSONL line should not make a status command noisy or unusable.
+    }
+  }
+  return captures.slice(-limit);
+}
+
+function formatToolResultCaptureStatus(cwd: string, captures: Record<string, unknown>[]): string {
+  const root = normalizeRelative(cwd, toolResultCaptureRoot(cwd)) ?? ".pi/piagent-state/tool-results";
+  const lines = [
+    `logPolicy: compact above ${formatCount(TOOL_RESULT_COMPACT_CHAR_THRESHOLD)} chars or ${formatCount(TOOL_RESULT_COMPACT_LINE_THRESHOLD)} lines`,
+    `captureRoot: ${root}`,
+    `recent: ${captures.length || "none"}`
+  ];
+  for (const capture of captures) {
+    const originalLines = typeof capture.originalLines === "number" ? formatCount(capture.originalLines) : "unknown";
+    const originalChars = typeof capture.originalChars === "number" ? formatCount(capture.originalChars) : "unknown";
+    const exit = capture.exitCode === undefined ? "" : ` exit=${capture.exitCode}`;
+    lines.push(`- ${capture.recordedAt ?? "unknown"} ${capture.toolName ?? "tool"}${exit}: ${originalLines} lines / ${originalChars} chars -> ${capture.path ?? "no capture path"}`);
+  }
+  return lines.join("\n");
+}
+
 function buildUsageSnapshot(ctx: ExtensionContext, thinkingLevel?: string): UsageSnapshot {
   const contextUsage = ctx.getContextUsage();
   const contextWithThinking = ctx as ExtensionContext & { getThinkingLevel?: () => string };
@@ -3310,7 +3725,8 @@ function buildUsageSnapshot(ctx: ExtensionContext, thinkingLevel?: string): Usag
       availableInCommand: false,
       howToRead: [
         "Inside Pi TUI: run /session for exact tokens and cost.",
-        "Outside Pi: run piagent-usage /path/to/project or scripts/pi-session-stats.sh /path/to/project."
+        "Outside Pi: run piagent-usage /path/to/project or scripts/pi-session-stats.sh /path/to/project.",
+        "Historical totals: run piagent-usage --history /path/to/project --days 7."
       ]
     }
   };
@@ -3321,24 +3737,13 @@ function formatUsageSnapshot(snapshot: UsageSnapshot): string {
     ? `${formatCount(snapshot.contextUsage.tokens)} / ${formatCount(snapshot.contextUsage.contextWindow)} tokens (${formatPercent(snapshot.contextUsage.percent)})`
     : "unavailable";
   return [
-    "# Piagent usage snapshot",
-    "",
-    `- Session: ${snapshot.sessionName ?? "unnamed"} (${snapshot.sessionId ?? "unknown"})`,
-    `- Session file: ${snapshot.sessionFile ?? "not persisted"}`,
-    `- CWD: ${snapshot.cwd}`,
-    `- Mode: ${snapshot.mode}`,
-    `- Model: ${snapshot.model}`,
-    `- Thinking: ${snapshot.thinkingLevel}`,
-    `- Entries: ${formatCount(snapshot.entries.branch)} on active branch / ${formatCount(snapshot.entries.total)} total`,
-    `- Live context: ${context}`,
-    "",
-    "Exact billed input/output/cache/cost totals are exposed by Pi via `/session` or RPC `get_session_stats`, not directly inside this command context.",
-    "",
-    "From another terminal:",
-    "",
-    "```bash",
-    "piagent-usage /path/to/project",
-    "```"
+    `usage: ${context}`,
+    `session: ${snapshot.sessionName ?? "unnamed"} (${snapshot.sessionId ?? "unknown"})`,
+    `model: ${snapshot.model}; thinking: ${snapshot.thinkingLevel}`,
+    `entries: ${formatCount(snapshot.entries.branch)} active / ${formatCount(snapshot.entries.total)} total`,
+    `file: ${snapshot.sessionFile ?? "not persisted"}`,
+    "exact: /session | piagent-usage /path/to/project",
+    "history: piagent-usage --history /path/to/project --days 7"
   ].join("\n");
 }
 
@@ -3405,30 +3810,14 @@ function formatContextPreflight(preflight: ContextPreflight, snapshot: UsageSnap
     ? `${formatCount(preflight.projectedContext.tokens)} (${formatPercent(preflight.projectedContext.percent)})`
     : "unavailable";
   return [
-    "# Piagent task preflight",
-    "",
-    `- Workflow: ${preflight.workflow}`,
-    `- Session: ${snapshot.sessionName ?? "unnamed"} (${snapshot.sessionId ?? "unknown"})`,
-    `- Model: ${snapshot.model}`,
-    `- Thinking: ${snapshot.thinkingLevel}`,
-    `- Entries: ${formatCount(snapshot.entries.branch)} active / ${formatCount(snapshot.entries.total)} total`,
-    `- Live context: ${live}`,
-    `- Incoming input estimate: ${formatCount(preflight.inputTokenEstimate)} tokens from ${formatCount(preflight.inputChars)} chars`,
-    `- Projected context: ${projected}`,
-    `- Recommendation: ${preflight.recommendation}`,
-    `- Reason: ${preflight.reason}`,
-    "",
-    "Commands:",
-    "",
-    "```text",
-    ...preflight.commands,
-    "```",
-    "",
-    "Notes:",
-    "",
-    "- Do not paste the full mandatory flow into every task. Platform prompts and piagent tools already carry it.",
-    "- Use `/scout` for read-only risk mapping. Use `/fresh-scout` when the current session is already heavy.",
-    "- If exact billed token/cost totals are needed, run `/session` in Pi or `piagent-usage <project-path>` from another terminal."
+    `preflight: ${preflight.recommendation}`,
+    `workflow: ${preflight.workflow}`,
+    `session: ${snapshot.sessionName ?? "unnamed"} (${snapshot.sessionId ?? "unknown"})`,
+    `model: ${snapshot.model}; thinking: ${snapshot.thinkingLevel}`,
+    `context: ${live}; projected: ${projected}`,
+    `input: ~${formatCount(preflight.inputTokenEstimate)} tokens from ${formatCount(preflight.inputChars)} chars`,
+    `reason: ${preflight.reason}`,
+    `next: ${preflight.commands.join(" | ")}`
   ].join("\n");
 }
 
@@ -3496,7 +3885,7 @@ function isPiagentWorkflowInput(text: string): boolean {
 }
 
 function isFreshOrUtilityInput(text: string): boolean {
-  return /^\/(?:fresh-task|fresh-scout|fresh-be-to-fe|task-preflight|piagent-usage|session|compact)\b/i.test(text.trim());
+  return /^\/(?:fresh-task|fresh-scout|fresh-be-to-fe|task-preflight|piagent-usage|piagent-logs|setname|session|compact)\b/i.test(text.trim());
 }
 
 function taskInboxDir(cwd: string): string {
@@ -3823,7 +4212,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
     const explicitProfile = Boolean(process.env.PIAGENT_PROFILE?.trim());
     const profile = loadProfile(ctx.cwd, projectTrusted);
     const name = profile.displayName || profile.projectId || path.basename(ctx.cwd);
-    pi.setSessionName(`pi:${name}`);
+    const operatorSessionName = currentSessionName(ctx);
+    if (!hasOperatorSessionName(operatorSessionName)) {
+      pi.setSessionName(`pi:${name}`);
+    }
     const profileHint = explicitProfile || (projectTrusted && fs.existsSync(projectProfilePath(ctx.cwd)))
       ? ""
       : " (run /onboard-project to select a profile)";
@@ -3965,6 +4357,24 @@ export default function piagentGuard(pi: ExtensionAPI) {
       resultChanged = true;
     }
 
+    const captureCache = new Map<string, ToolResultCaptureSummary>();
+    const compactedContent = compactToolResultTextContent(ctx.cwd, event, ctx, resultContent, captureCache);
+    const compactionCaptures = [...compactedContent.captures];
+    if (compactedContent.captures.length > 0) {
+      resultContent = compactedContent.content;
+      resultChanged = true;
+    }
+    if (resultDetails !== undefined) {
+      const compactedDetails = compactToolResultDetails(ctx.cwd, event, ctx, resultDetails, captureCache, compactionCaptures);
+      if (compactionCaptures.length > compactedContent.captures.length) {
+        resultDetails = compactedDetails;
+        resultChanged = true;
+      }
+    }
+    if (compactionCaptures.length > 0) {
+      resultDetails = attachToolResultCompactionDetails(resultDetails, compactionCaptures);
+    }
+
     if (resultChanged) {
       return resultDetails === undefined
         ? { content: resultContent }
@@ -4047,6 +4457,12 @@ export default function piagentGuard(pi: ExtensionAPI) {
           reason: `Command resolves to protected path: ${resolvedProtectedHit.candidate} resolves to ${resolvedProtectedHit.resolved} matching ${resolvedProtectedHit.pattern}`
         };
       }
+      const unresolvedExpansions = pathPolicy.shellProtectedPaths.length > 0
+        ? unresolvedPathExpansions(command)
+        : [];
+      if (unresolvedExpansions.length > 0) {
+        return { block: true, reason: unresolvedExpansionReason("Command", unresolvedExpansions) };
+      }
 
       const confirmationReasons = execDecision.mode !== "off" && execDecision.decision === "prompt"
         ? [...execDecision.reasons]
@@ -4263,8 +4679,8 @@ export default function piagentGuard(pi: ExtensionAPI) {
     }
   });
 
-	  pi.registerTool({
-	    name: "piagent_exec_policy_check",
+  pi.registerTool({
+    name: "piagent_exec_policy_check",
     label: "Piagent Exec Policy Check",
     description: "Evaluate a shell command against piagent exec policy before running it.",
     promptSnippet: "Use this before high-impact, complex, generated, or unfamiliar shell commands.",
@@ -6147,6 +6563,59 @@ export default function piagentGuard(pi: ExtensionAPI) {
     }
   });
 
+  pi.registerCommand("piagent-logs", {
+    description: "Show compact log policy and recent captured large tool outputs",
+    handler: async (_args, ctx) => {
+      const captures = readRecentToolResultCaptures(ctx.cwd, 5);
+      ctx.ui.notify(`Piagent logs: ${captures.length ? `${captures.length} recent capture(s)` : "no compacted captures yet"}`, "info");
+      pi.sendMessage(
+        {
+          customType: "piagent-log-captures",
+          content: formatToolResultCaptureStatus(ctx.cwd, captures),
+          display: true,
+          details: {
+            policy: {
+              compactAboveChars: TOOL_RESULT_COMPACT_CHAR_THRESHOLD,
+              compactAboveLines: TOOL_RESULT_COMPACT_LINE_THRESHOLD,
+              previewMaxChars: TOOL_RESULT_PREVIEW_MAX_CHARS,
+              captureMaxChars: TOOL_RESULT_CAPTURE_MAX_CHARS
+            },
+            captures
+          }
+        },
+        { triggerTurn: false }
+      );
+    }
+  });
+
+  pi.registerCommand("setname", {
+    description: "Set the current Pi session name for reports and resume lists",
+    handler: async (args, ctx) => {
+      const name = cleanSessionNameInput(String(args ?? ""));
+      if (!name) {
+        ctx.ui.notify("Usage: /setname <task/session name>", "warning");
+        return;
+      }
+      const previousName = currentSessionName(ctx);
+      pi.setSessionName(name);
+      appendSessionTrace(pi, {
+        event: "session_name_set",
+        previousName: previousName || undefined,
+        sessionName: name
+      });
+      ctx.ui.notify(`Session name set: ${name}`, "info");
+      pi.sendMessage(
+        {
+          customType: "piagent-session-name-set",
+          content: `sessionName: ${name}`,
+          display: true,
+          details: { sessionName: name, previousName: previousName || undefined }
+        },
+        { triggerTurn: false }
+      );
+    }
+  });
+
   pi.registerCommand("task-preflight", {
     description: "Check context health before a large task; optionally compact",
     handler: async (args, ctx) => {