@selesai/code 0.13.8 → 0.13.9

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to `@selesai/code` will be documented in this file.
 
+## [0.13.9] - 2026-09-01
+
+### Changed
+- **Auto session naming only names unnamed sessions.** The bundled `auto-session-name` extension now skips naming entirely when the current session already has a name (user-set via `/name` or generated earlier), instead of re-naming on every user message. Previously generated names are never clobbered; empty sessions are still auto-named as before.
+
 ## [0.13.8] - 2026-09-01
 
 ### Changed

package/dist/core/settings-manager.d.ts

@@ -178,6 +178,17 @@ export declare class SettingsManager {
     private static migrateSettings;
     getGlobalSettings(): Settings;
     getProjectSettings(): Settings;
+    /** Merged effective settings (project overrides global, nested objects merge recursively). */
+    getEffectiveSettings(): Settings;
+    /**
+     * Bulk-update global settings and persist. Nested object fields merge
+     * recursively; undefined values are ignored (use null to clear a field).
+     */
+    setGlobalSettings(values: Partial<Settings>): void;
+    /**
+     * Bulk-update project settings and persist. Throws when the project is not trusted.
+     */
+    setProjectSettings(values: Partial<Settings>): void;
     isProjectTrusted(): boolean;
     setProjectTrusted(trusted: boolean): void;
     reload(): Promise<void>;

package/dist/core/settings-manager.js

@@ -263,6 +263,54 @@ export class SettingsManager {
     getProjectSettings() {
         return structuredClone(this.projectSettings);
     }
+    /** Merged effective settings (project overrides global, nested objects merge recursively). */
+    getEffectiveSettings() {
+        return structuredClone(this.settings);
+    }
+    /**
+     * Bulk-update global settings and persist. Nested object fields merge
+     * recursively; undefined values are ignored (use null to clear a field).
+     */
+    setGlobalSettings(values) {
+        const merged = deepMergeSettings(this.globalSettings, values);
+        this.globalSettings = merged;
+        for (const field of Object.keys(values)) {
+            const value = values[field];
+            if (value === undefined)
+                continue;
+            if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+                for (const nestedKey of Object.keys(value)) {
+                    this.markModified(field, nestedKey);
+                }
+            }
+            else {
+                this.markModified(field);
+            }
+        }
+        this.save();
+    }
+    /**
+     * Bulk-update project settings and persist. Throws when the project is not trusted.
+     */
+    setProjectSettings(values) {
+        this.assertProjectTrustedForWrite();
+        const projectSettings = deepMergeSettings(this.projectSettings, values);
+        this.projectSettings = projectSettings;
+        for (const field of Object.keys(values)) {
+            const value = values[field];
+            if (value === undefined)
+                continue;
+            if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+                for (const nestedKey of Object.keys(value)) {
+                    this.markProjectModified(field, nestedKey);
+                }
+            }
+            else {
+                this.markProjectModified(field);
+            }
+        }
+        this.saveProjectSettings(this.projectSettings);
+    }
     isProjectTrusted() {
         return this.projectTrusted;
     }

package/dist/extensions/auto-session-name.test.ts

@@ -35,9 +35,11 @@ function userEntry(text: string, id: string): SessionEntry {
 function createHarness(branch: SessionEntry[] = []) {
 	const handlers = new Map<string, Handler>();
 	const setSessionName = vi.fn();
+	const getSessionName = vi.fn(() => undefined);
 	const pi = {
 		on: vi.fn((event: string, handler: Handler) => handlers.set(event, handler)),
 		setSessionName,
+		getSessionName,
 	} as unknown as ExtensionAPI;
 	const model = { provider: "openai", id: "gpt-5", name: "GPT-5" };
 	const ctx = {
@@ -49,7 +51,7 @@ function createHarness(branch: SessionEntry[] = []) {
 	} as unknown as ExtensionContext;
 
 	autoSessionNameExtension(pi);
-	return { handlers, setSessionName, ctx };
+	return { handlers, setSessionName, getSessionName, ctx };
 }
 
 function textResponse(text: string) {
@@ -70,6 +72,16 @@ describe("auto-session-name", () => {
 		expect(handlers.has("input")).toBe(true);
 	});
 
+	it("skips naming when the session already has a name", async () => {
+		const { handlers, getSessionName, setSessionName, ctx } = createHarness();
+		getSessionName.mockReturnValue("Existing name");
+
+		await handlers.get("input")!({ type: "input", text: "hi", source: "interactive" }, ctx);
+
+		expect(completeMock).not.toHaveBeenCalled();
+		expect(setSessionName).not.toHaveBeenCalled();
+	});
+
 	it("names the session from the user prompt with a small system prompt and 10-token cap", async () => {
 		const { handlers, setSessionName, ctx } = createHarness();
 		completeMock.mockResolvedValue(textResponse("Refactor auth"));

package/dist/extensions/auto-session-name.ts

@@ -1,10 +1,11 @@
 /**
  * auto-session-name
  *
- * Names the session on every user message using the currently selected model.
- * Sends only user messages (current prompt plus previous user messages,
- * truncated) for context, capped at 10 output tokens (1-5 word name).
- * Thinking is never enabled. Equivalent to running /name automatically.
+ * Names the session using the currently selected model, but only when the
+ * session has no name yet — a user-set or previously generated name is never
+ * clobbered. Sends only user messages (current prompt plus previous user
+ * messages, truncated) for context, capped at 10 output tokens (1-5 word
+ * name). Thinking is never enabled. Equivalent to running /name automatically.
  */
 
 import { complete } from "@earendil-works/pi-ai/compat";
@@ -52,6 +53,9 @@ export default function autoSessionNameExtension(pi: ExtensionAPI): void {
 		const text = event.text.trim();
 		if (!text || text.startsWith("/")) return;
 		if (!ctx.model) return;
+		// Only auto-name sessions that have no name yet; never clobber a
+		// user-set or previously generated name.
+		if (pi.getSessionName()) return;
 
 		const seq = ++namingSeq;
 		void (async () => {

package/dist/modes/rpc/rpc-client.d.ts

@@ -4,11 +4,14 @@
  * Spawns the agent in RPC mode and provides a typed API for all operations.
  */
 import type { AgentMessage, ThinkingLevel } from "@earendil-works/pi-agent-core";
-import type { ImageContent } from "@earendil-works/pi-ai";
+import type { ImageContent, Model } from "@earendil-works/pi-ai";
 import type { AgentSessionEvent, SessionStats } from "../../core/agent-session.ts";
+import type { KeybindingsConfig } from "../../core/keybindings.ts";
+import type { Settings } from "../../core/settings-manager.ts";
 import type { BashResult } from "../../core/bash-executor.ts";
 import type { CompactionResult } from "../../core/compaction/index.ts";
 import type { SessionEntry, SessionTreeNode } from "../../core/session-manager.ts";
+import type { ChangelogEntry } from "../../utils/changelog.ts";
 import type { RpcSessionState, RpcSlashCommand } from "./rpc-types.ts";
 export interface RpcClientOptions {
     /** Path to the CLI entry point (default: searches for dist/cli.js) */
@@ -217,9 +220,9 @@ export declare class RpcClient {
         leafId: string | null;
     }>;
     /**
-     * Get the session entry tree.
+     * Get the session entry tree, optionally filtered.
      */
-    getTree(): Promise<{
+    getTree(filter?: "default" | "no-tools" | "user-only" | "labeled-only" | "all"): Promise<{
         tree: SessionTreeNode[];
         leafId: string | null;
     }>;
@@ -236,9 +239,132 @@ export declare class RpcClient {
      */
     getMessages(): Promise<AgentMessage[]>;
     /**
-     * Get available commands (extension commands, prompt templates).
+     * Get available commands (extension commands, prompt templates, builtins).
      */
     getCommands(): Promise<RpcSlashCommand[]>;
+    /**
+     * Get settings for a scope ("global" | "project" | "effective", default "effective").
+     */
+    getSettings(scope?: "global" | "project" | "effective"): Promise<{
+        scope: string;
+        settings: Settings;
+    }>;
+    /**
+     * Bulk-update settings and persist.
+     */
+    setSettings(values: Partial<Settings>, scope?: "global" | "project"): Promise<void>;
+    /**
+     * Reset settings to bundled factory defaults (backup preserved).
+     */
+    factoryResetSettings(): Promise<void>;
+    /**
+     * List providers and the login methods they support.
+     */
+    getAuthProviders(): Promise<Array<{
+        providerId: string;
+        name: string;
+        authTypes: Array<"oauth" | "api_key">;
+    }>>;
+    /**
+     * Login to a provider. API-key flows emit `extension_ui_request: input` with
+     * `inputKind: "secret"`; OAuth flows open a browser and emit notify events.
+     */
+    login(providerId: string, authType: "oauth" | "api_key"): Promise<{
+        providerId: string;
+        authType: "oauth" | "api_key";
+        message: string;
+    }>;
+    /**
+     * Log out of a provider, removing stored credentials.
+     */
+    logout(providerId: string): Promise<void>;
+    /**
+     * Get providers with configured auth (stored credential or environment).
+     */
+    getAuthState(): Promise<Array<{
+        providerId: string;
+        authType: "oauth" | "api_key";
+        source: string;
+    }>>;
+    /**
+     * Get enabled model patterns (Ctrl+P cycling scope) and available models.
+     */
+    getScopedModels(): Promise<{
+        enabled: string[];
+        models: Model<any>[];
+    }>;
+    /**
+     * Set enabled model patterns and/or reorder them (Ctrl+P cycling order).
+     */
+    setScopedModels(options?: {
+        enabled?: string[];
+        reorder?: string[];
+    }): Promise<string[]>;
+    /**
+     * Import and resume a session from a JSONL file (replaces current session).
+     */
+    importJsonl(path: string): Promise<string>;
+    /**
+     * Run the git helper (worktrees/checkpoints/commits/push). Same behavior as
+     * the `prompt` command: success is reported on preflight, then the normal
+     * agent/message event stream follows.
+     */
+    git(command: string): Promise<void>;
+    /**
+     * Reload keybindings, extensions, skills, prompts, themes, and context files.
+     */
+    reload(): Promise<void>;
+    /**
+     * Set or clear a label on a session entry (undefined/empty clears).
+     */
+    setEntryLabel(entryId: string, label?: string): Promise<string>;
+    /**
+     * Get the current project trust decision and status.
+     */
+    getTrust(): Promise<{
+        cwd: string;
+        savedDecision: {
+            path: string;
+            decision: boolean;
+        } | null;
+        projectTrusted: boolean;
+        trustRequired: boolean;
+    }>;
+    /**
+     * Save a project trust decision. Decision takes full effect after restart.
+     */
+    setTrust(decision: boolean | null): Promise<{
+        decision: boolean | null;
+        restartRequired: boolean;
+    }>;
+    /**
+     * Get the effective keybinding map.
+     */
+    getHotkeys(): Promise<KeybindingsConfig>;
+    /**
+     * Get available themes (built-in + custom) and the current theme setting.
+     */
+    getAvailableThemes(): Promise<{
+        themes: Array<{
+            name: string;
+            path?: string;
+        }>;
+        current: string | undefined;
+    }>;
+    /**
+     * Get the current version and parsed changelog entries.
+     */
+    getVersionInfo(): Promise<{
+        version: string;
+        changelog: ChangelogEntry[];
+    }>;
+    /**
+     * Share the current session as a secret GitHub gist (requires `gh` CLI).
+     */
+    shareGist(): Promise<{
+        url: string;
+        gistUrl: string;
+    }>;
     /**
      * Wait for agent to become idle (no streaming).
      * Resolves when agent_settled event is received.

package/dist/modes/rpc/rpc-client.js

@@ -332,10 +332,10 @@ export class RpcClient {
         return this.getData(response);
     }
     /**
-     * Get the session entry tree.
+     * Get the session entry tree, optionally filtered.
      */
-    async getTree() {
-        const response = await this.send({ type: "get_tree" });
+    async getTree(filter) {
+        const response = await this.send({ type: "get_tree", ...(filter ? { filter } : {}) });
         return this.getData(response);
     }
     /**
@@ -359,13 +359,165 @@ export class RpcClient {
         return this.getData(response).messages;
     }
     /**
-     * Get available commands (extension commands, prompt templates).
+     * Get available commands (extension commands, prompt templates, builtins).
      */
     async getCommands() {
         const response = await this.send({ type: "get_commands" });
         return this.getData(response).commands;
     }
     // =========================================================================
+    // Settings
+    // =========================================================================
+    /**
+     * Get settings for a scope ("global" | "project" | "effective", default "effective").
+     */
+    async getSettings(scope) {
+        const response = await this.send({ type: "get_settings", ...(scope ? { scope } : {}) });
+        return this.getData(response);
+    }
+    /**
+     * Bulk-update settings and persist.
+     */
+    async setSettings(values, scope = "global") {
+        await this.send({ type: "set_settings", scope, values });
+    }
+    /**
+     * Reset settings to bundled factory defaults (backup preserved).
+     */
+    async factoryResetSettings() {
+        await this.send({ type: "factory_reset_settings" });
+    }
+    // =========================================================================
+    // Auth
+    // =========================================================================
+    /**
+     * List providers and the login methods they support.
+     */
+    async getAuthProviders() {
+        const response = await this.send({ type: "get_auth_providers" });
+        return this.getData(response).providers;
+    }
+    /**
+     * Login to a provider. API-key flows emit `extension_ui_request: input` with
+     * `inputKind: "secret"`; OAuth flows open a browser and emit notify events.
+     */
+    async login(providerId, authType) {
+        const response = await this.send({ type: "login", providerId, authType });
+        return this.getData(response);
+    }
+    /**
+     * Log out of a provider, removing stored credentials.
+     */
+    async logout(providerId) {
+        await this.send({ type: "logout", providerId });
+    }
+    /**
+     * Get providers with configured auth (stored credential or environment).
+     */
+    async getAuthState() {
+        const response = await this.send({ type: "get_auth_state" });
+        return this.getData(response).providers;
+    }
+    // =========================================================================
+    // Scoped models
+    // =========================================================================
+    /**
+     * Get enabled model patterns (Ctrl+P cycling scope) and available models.
+     */
+    async getScopedModels() {
+        const response = await this.send({ type: "get_scoped_models" });
+        return this.getData(response);
+    }
+    /**
+     * Set enabled model patterns and/or reorder them (Ctrl+P cycling order).
+     */
+    async setScopedModels(options = {}) {
+        const response = await this.send({ type: "set_scoped_models", ...options });
+        return this.getData(response).enabled;
+    }
+    // =========================================================================
+    // Session import
+    // =========================================================================
+    /**
+     * Import and resume a session from a JSONL file (replaces current session).
+     */
+    async importJsonl(path) {
+        const response = await this.send({ type: "import_jsonl", path });
+        return this.getData(response).sessionPath;
+    }
+    // =========================================================================
+    // Git helper / reload / tree ops
+    // =========================================================================
+    /**
+     * Run the git helper (worktrees/checkpoints/commits/push). Same behavior as
+     * the `prompt` command: success is reported on preflight, then the normal
+     * agent/message event stream follows.
+     */
+    async git(command) {
+        await this.send({ type: "git", command });
+    }
+    /**
+     * Reload keybindings, extensions, skills, prompts, themes, and context files.
+     */
+    async reload() {
+        await this.send({ type: "reload" });
+    }
+    /**
+     * Set or clear a label on a session entry (undefined/empty clears).
+     */
+    async setEntryLabel(entryId, label) {
+        const response = await this.send({ type: "set_entry_label", entryId, label });
+        return this.getData(response).labelId;
+    }
+    // =========================================================================
+    // Trust
+    // =========================================================================
+    /**
+     * Get the current project trust decision and status.
+     */
+    async getTrust() {
+        const response = await this.send({ type: "get_trust" });
+        return this.getData(response);
+    }
+    /**
+     * Save a project trust decision. Decision takes full effect after restart.
+     */
+    async setTrust(decision) {
+        const response = await this.send({ type: "set_trust", decision });
+        return this.getData(response);
+    }
+    // =========================================================================
+    // Hotkeys / version / share
+    // =========================================================================
+    /**
+     * Get the effective keybinding map.
+     */
+    async getHotkeys() {
+        const response = await this.send({ type: "get_hotkeys" });
+        return this.getData(response).hotkeys;
+    }
+    /**
+     * Get available themes (built-in + custom) and the current theme setting.
+     */
+    async getAvailableThemes() {
+        const response = await this.send({ type: "get_available_themes" });
+        return this.getData(response);
+    }
+    /**
+     * Get the current version and parsed changelog entries.
+     */
+    async getVersionInfo() {
+        const response = await this.send({ type: "get_version_info" });
+        return this.getData(response);
+    }
+    /**
+     * Share the current session as a secret GitHub gist (requires `gh` CLI).
+     */
+    async shareGist() {
+        const response = await this.send({ type: "share_gist", public: false });
+        return this.getData(response);
+    }
+    // =========================================================================
     // Helpers
     // =========================================================================
     /**

package/dist/modes/rpc/rpc-mode.js

@@ -11,10 +11,23 @@
  * - Extension UI: Extension UI requests are emitted, client responds with extension_ui_response
  */
 import * as crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, existsSync, unlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { generateHandoff } from "../../core/handoff.js";
+import { buildGitCommandPrompt } from "../../core/git-command.js";
+import { KeybindingsManager } from "../../core/keybindings.js";
 import { flushRawStdout, takeOverStdout, waitForRawStdoutBackpressure, writeRawStdout, } from "../../core/output-guard.js";
+import { ProjectTrustStore, hasTrustRequiringProjectResources } from "../../core/trust-manager.js";
+import { BUILTIN_SLASH_COMMANDS } from "../../core/slash-commands.js";
+import { createSyntheticSourceInfo } from "../../core/source-info.js";
 import { killTrackedDetachedChildren } from "../../utils/shell.js";
+import { getChangelogPath, parseChangelog } from "../../utils/changelog.js";
+import { VERSION, getAgentDir, getBundledDefaultsDir, getShareViewerUrl } from "../../config.js";
+import { openBrowser } from "../../utils/open-browser.js";
 import { theme } from "../interactive/theme/theme.js";
+import { getAvailableThemesWithPaths, setRegisteredThemes } from "../interactive/theme/theme.js";
 import { attachJsonlLineReader, serializeJsonLine } from "./jsonl.js";
 /**
  * Run in RPC mode.
@@ -28,6 +41,43 @@ export async function runRpcMode(runtimeHost) {
     const output = (obj) => {
         writeRawStdout(serializeJsonLine(obj));
     };
+    /**
+     * Filter a session tree with the same semantics as the TUI tree selector
+     * (tree-selector.ts FilterMode). Hidden leaf pruning is preserved.
+     */
+    const filterTree = (nodes, mode) => {
+        const passes = (node) => {
+            const entry = node.entry;
+            const isSettingsEntry = entry.type === "label" ||
+                entry.type === "custom" ||
+                entry.type === "model_change" ||
+                entry.type === "thinking_level_change" ||
+                entry.type === "session_info";
+            switch (mode) {
+                case "user-only":
+                    return entry.type === "message" && entry.message.role === "user";
+                case "no-tools":
+                    return !isSettingsEntry && !(entry.type === "message" && entry.message.role === "toolResult");
+                case "labeled-only":
+                    return node.label !== undefined;
+                case "all":
+                    return true;
+                default:
+                    return !isSettingsEntry;
+            }
+        };
+        const visit = (nodes) => {
+            const result = [];
+            for (const node of nodes) {
+                if (!passes(node))
+                    continue;
+                const children = visit(node.children);
+                result.push({ ...node, children });
+            }
+            return result;
+        };
+        return visit(nodes);
+    };
     const success = (id, command, data) => {
         if (data === undefined) {
             return { id, type: "response", command, success: true };
@@ -576,7 +626,10 @@ export async function runRpcMode(runtimeHost) {
             }
             case "get_tree": {
                 const sessionManager = session.sessionManager;
-                return success(id, "get_tree", { tree: sessionManager.getTree(), leafId: sessionManager.getLeafId() });
+                const tree = sessionManager.getTree();
+                const filter = command.filter ?? "default";
+                const filtered = filter === "all" ? tree : filterTree(tree, filter);
+                return success(id, "get_tree", { tree: filtered, leafId: sessionManager.getLeafId() });
             }
             case "get_last_assistant_text": {
                 const text = session.getLastAssistantText();
@@ -617,8 +670,438 @@ export async function runRpcMode(runtimeHost) {
                         sourceInfo: template.sourceInfo,
                     });
                 }
+                // Built-in TUI commands: display-only, cannot be invoked via prompt.
+                for (const builtin of BUILTIN_SLASH_COMMANDS) {
+                    commands.push({
+                        name: builtin.name,
+                        description: builtin.description
+                            + (builtin.argumentHint ? ` ${builtin.argumentHint}` : ""),
+                        source: "builtin",
+                        sourceInfo: createSyntheticSourceInfo(`builtin:${builtin.name}`, { source: "builtin" }),
+                        interactiveOnly: true,
+                    });
+                }
                 return success(id, "get_commands", { commands });
             }
+            // =================================================================
+            // Settings
+            // =================================================================
+            case "get_settings": {
+                const scope = command.scope ?? "effective";
+                const settings = scope === "global"
+                    ? session.settingsManager.getGlobalSettings()
+                    : scope === "project"
+                        ? session.settingsManager.getProjectSettings()
+                        : session.settingsManager.getEffectiveSettings();
+                return success(id, "get_settings", { scope, settings });
+            }
+            case "set_settings": {
+                const scope = command.scope ?? "global";
+                try {
+                    if (scope === "project") {
+                        session.settingsManager.setProjectSettings(command.values);
+                    }
+                    else {
+                        session.settingsManager.setGlobalSettings(command.values);
+                    }
+                    await session.settingsManager.flush();
+                    return success(id, "set_settings", { scope, values: structuredClone(command.values) });
+                }
+                catch (writeError) {
+                    return error(id, "set_settings", writeError instanceof Error ? writeError.message : String(writeError));
+                }
+            }
+            case "factory_reset_settings": {
+                if (session.isStreaming) {
+                    return error(id, "factory_reset_settings", "Wait for the current response to finish before resetting settings.");
+                }
+                if (session.isCompacting) {
+                    return error(id, "factory_reset_settings", "Wait for compaction to finish before resetting settings.");
+                }
+                try {
+                    const agentDir = getAgentDir();
+                    const settingsPath = join(agentDir, "settings.json");
+                    const bundledPath = join(getBundledDefaultsDir(), "settings.json");
+                    if (!existsSync(bundledPath)) {
+                        return error(id, "factory_reset_settings", `Bundled defaults not found at ${bundledPath}`);
+                    }
+                    if (existsSync(settingsPath)) {
+                        copyFileSync(settingsPath, `${settingsPath}.bak`);
+                    }
+                    copyFileSync(bundledPath, settingsPath);
+                    try {
+                        chmodSync(settingsPath, 0o600);
+                    }
+                    catch {
+                        // best-effort
+                    }
+                    await session.reload();
+                    return success(id, "factory_reset_settings");
+                }
+                catch (resetError) {
+                    return error(id, "factory_reset_settings", resetError instanceof Error ? resetError.message : String(resetError));
+                }
+            }
+            // =================================================================
+            // Auth
+            // =================================================================
+            case "get_auth_providers": {
+                const providers = session.modelRuntime
+                    .getProviders()
+                    .map((provider) => {
+                    const authTypes = [];
+                    if (provider.auth.oauth)
+                        authTypes.push("oauth");
+                    if (provider.auth.apiKey)
+                        authTypes.push("api_key");
+                    return { providerId: provider.id, name: provider.name, authTypes };
+                })
+                    .sort((a, b) => a.name.localeCompare(b.name));
+                return success(id, "get_auth_providers", { providers });
+            }
+            case "login": {
+                const provider = session.modelRuntime.getProvider(command.providerId);
+                if (!provider) {
+                    return error(id, "login", `Unknown provider: ${command.providerId}`);
+                }
+                if (command.authType === "oauth" && !provider.auth.oauth) {
+                    return error(id, "login", `Provider ${command.providerId} does not support OAuth login`);
+                }
+                if (command.authType === "api_key" && !provider.auth.apiKey) {
+                    return error(id, "login", `Provider ${command.providerId} does not support API key login`);
+                }
+                try {
+                    const abortController = new AbortController();
+                    await session.modelRuntime.login(command.providerId, command.authType, {
+                        signal: abortController.signal,
+                        prompt: async (prompt) => {
+                            if (prompt.signal?.aborted)
+                                throw new Error("Login cancelled");
+                            const id = crypto.randomUUID();
+                            const result = await new Promise((resolve, reject) => {
+                                const onAbort = () => {
+                                    cleanup();
+                                    resolve({ type: "extension_ui_response", id, cancelled: true });
+                                };
+                                const cleanup = () => {
+                                    prompt.signal?.removeEventListener("abort", onAbort);
+                                    pendingExtensionRequests.delete(id);
+                                };
+                                prompt.signal?.addEventListener("abort", onAbort, { once: true });
+                                pendingExtensionRequests.set(id, {
+                                    resolve: (response) => {
+                                        cleanup();
+                                        resolve(response);
+                                    },
+                                    reject: (err) => {
+                                        cleanup();
+                                        reject(err);
+                                    },
+                                });
+                                const request = {
+                                    type: "extension_ui_request",
+                                    id,
+                                    method: prompt.type === "select" ? "select" : "input",
+                                    title: prompt.message,
+                                };
+                                if (prompt.type === "select") {
+                                    request.options = prompt.options.map((option) => option.description ? `${option.label} (${option.description})` : option.label);
+                                }
+                                else {
+                                    if (prompt.placeholder)
+                                        request.placeholder = prompt.placeholder;
+                                    if (prompt.type === "secret")
+                                        request.inputKind = "secret";
+                                }
+                                output(request);
+                            });
+                            if (result.type === "extension_ui_response" && "cancelled" in result && result.cancelled) {
+                                throw new Error("Login cancelled");
+                            }
+                            if ("value" in result)
+                                return result.value;
+                            if ("values" in result)
+                                return (result.values ? result.values[0] : undefined);
+                            return undefined;
+                        },
+                        notify: (event) => {
+                            if (event.type === "auth_url") {
+                                openBrowser(event.url);
+                                output({
+                                    type: "extension_ui_request",
+                                    id: crypto.randomUUID(),
+                                    method: "notify",
+                                    message: event.instructions
+                                        ? `Open in your browser: ${event.url}\n${event.instructions}`
+                                        : `Open in your browser: ${event.url}`,
+                                    notifyType: "info",
+                                });
+                            }
+                            else if (event.type === "device_code") {
+                                openBrowser(event.verificationUri);
+                                output({
+                                    type: "extension_ui_request",
+                                    id: crypto.randomUUID(),
+                                    method: "notify",
+                                    message: `Open ${event.verificationUri} and enter code: ${event.userCode}`,
+                                    notifyType: "info",
+                                });
+                            }
+                            else if (event.type === "info") {
+                                output({
+                                    type: "extension_ui_request",
+                                    id: crypto.randomUUID(),
+                                    method: "notify",
+                                    message: event.message,
+                                    notifyType: "info",
+                                });
+                            }
+                            else if (event.type === "progress") {
+                                output({
+                                    type: "extension_ui_request",
+                                    id: crypto.randomUUID(),
+                                    method: "notify",
+                                    message: event.message,
+                                    notifyType: "info",
+                                });
+                            }
+                        },
+                    });
+                    const actionLabel = command.authType === "oauth" ? `Logged in to ${provider.name}` : `Saved API key for ${provider.name}`;
+                    const authType = command.authType;
+                    const isUnknownModel = session.model?.provider === "unknown" && session.model?.id === "unknown";
+                    if (isUnknownModel) {
+                        const available = await session.modelRuntime.getAvailable();
+                        const providerModels = available.filter((model) => model.provider === command.providerId);
+                        if (providerModels.length > 0) {
+                            await session.setModel(providerModels[0]);
+                        }
+                    }
+                    return success(id, "login", {
+                        providerId: command.providerId,
+                        authType,
+                        message: `${actionLabel}. Credentials saved.`,
+                    });
+                }
+                catch (loginError) {
+                    const message = loginError instanceof Error ? loginError.message : String(loginError);
+                    if (message === "Login cancelled") {
+                        return error(id, "login", "Login cancelled");
+                    }
+                    return error(id, "login", message);
+                }
+            }
+            case "logout": {
+                const provider = session.modelRuntime.getProvider(command.providerId);
+                if (!provider) {
+                    return error(id, "logout", `Unknown provider: ${command.providerId}`);
+                }
+                try {
+                    await session.modelRuntime.logout(command.providerId);
+                    return success(id, "logout", { providerId: command.providerId });
+                }
+                catch (logoutError) {
+                    return error(id, "logout", logoutError instanceof Error ? logoutError.message : String(logoutError));
+                }
+            }
+            case "get_auth_state": {
+                try {
+                    const credentials = await session.modelRuntime.listCredentials();
+                    const providers = credentials.map(({ providerId, type }) => ({
+                        providerId,
+                        authType: type,
+                        source: "stored",
+                    }));
+                    // Environment/configured auth not in the credential store.
+                    for (const provider of session.modelRuntime.getProviders()) {
+                        if (providers.some((entry) => entry.providerId === provider.id))
+                            continue;
+                        const status = session.modelRuntime.getProviderAuthStatus(provider.id);
+                        if (status.configured) {
+                            providers.push({
+                                providerId: provider.id,
+                                authType: session.modelRuntime.isUsingOAuth(provider.id) ? "oauth" : "api_key",
+                                source: status.label ?? status.source ?? "environment",
+                            });
+                        }
+                    }
+                    return success(id, "get_auth_state", { providers });
+                }
+                catch (authStateError) {
+                    return error(id, "get_auth_state", authStateError instanceof Error ? authStateError.message : String(authStateError));
+                }
+            }
+            // =================================================================
+            // Scoped Models
+            // =================================================================
+            case "get_scoped_models": {
+                const enabled = session.settingsManager.getEnabledModels() ?? [];
+                const scoped = session.scopedModels.map((entry) => entry.model);
+                const models = scoped.length > 0 ? scoped : await session.modelRuntime.getAvailable();
+                return success(id, "get_scoped_models", { enabled, models: [...models] });
+            }
+            case "set_scoped_models": {
+                if (command.enabled !== undefined) {
+                    session.settingsManager.setEnabledModels(command.enabled.length > 0 ? command.enabled : undefined);
+                }
+                const enabled = session.settingsManager.getEnabledModels() ?? [];
+                if (command.reorder !== undefined && command.reorder.length > 0) {
+                    const patternSet = new Set(command.reorder);
+                    const kept = enabled.filter((pattern) => patternSet.has(pattern));
+                    const added = command.reorder.filter((pattern) => !kept.includes(pattern));
+                    session.settingsManager.setEnabledModels([...kept, ...added]);
+                }
+                await session.settingsManager.flush();
+                return success(id, "set_scoped_models", { enabled: session.settingsManager.getEnabledModels() ?? [] });
+            }
+            // =================================================================
+            // Session Import
+            // =================================================================
+            case "import_jsonl": {
+                try {
+                    await runtimeHost.importFromJsonl(command.path);
+                    await rebindSession();
+                    const sessionFile = session.sessionFile;
+                    return success(id, "import_jsonl", { sessionPath: sessionFile ?? command.path });
+                }
+                catch (importError) {
+                    return error(id, "import_jsonl", importError instanceof Error ? importError.message : String(importError));
+                }
+            }
+            // =================================================================
+            // Git helper
+            // =================================================================
+            case "git": {
+                const prompt = buildGitCommandPrompt(command.command);
+                let gitPreflightSucceeded = false;
+                void session
+                    .prompt(prompt, {
+                    streamingBehavior: "steer",
+                    source: "rpc",
+                    preflightResult: (didSucceed) => {
+                        if (didSucceed) {
+                            gitPreflightSucceeded = true;
+                            output(success(id, "git"));
+                        }
+                    },
+                })
+                    .catch((e) => {
+                    if (!gitPreflightSucceeded) {
+                        output(error(id, "git", e.message));
+                    }
+                });
+                return undefined;
+            }
+            // =================================================================
+            // Reload
+            // =================================================================
+            case "reload": {
+                if (session.isStreaming) {
+                    return error(id, "reload", "Wait for the current response to finish before reloading.");
+                }
+                if (session.isCompacting) {
+                    return error(id, "reload", "Wait for compaction to finish before reloading.");
+                }
+                try {
+                    await session.reload();
+                    return success(id, "reload");
+                }
+                catch (reloadError) {
+                    return error(id, "reload", reloadError instanceof Error ? reloadError.message : String(reloadError));
+                }
+            }
+            // =================================================================
+            // Tree ops
+            // =================================================================
+            case "set_entry_label": {
+                try {
+                    const labelId = session.sessionManager.appendLabelChange(command.entryId, command.label);
+                    return success(id, "set_entry_label", { labelId });
+                }
+                catch (labelError) {
+                    return error(id, "set_entry_label", labelError instanceof Error ? labelError.message : String(labelError));
+                }
+            }
+            // =================================================================
+            // Trust
+            // =================================================================
+            case "get_trust": {
+                const cwd = session.sessionManager.getCwd();
+                const trustStore = new ProjectTrustStore(runtimeHost.services.agentDir);
+                const entry = trustStore.getEntry(cwd);
+                return success(id, "get_trust", {
+                    cwd,
+                    savedDecision: entry ? { path: entry.path, decision: entry.decision } : null,
+                    projectTrusted: session.settingsManager.isProjectTrusted(),
+                    trustRequired: hasTrustRequiringProjectResources(cwd),
+                });
+            }
+            case "set_trust": {
+                const cwd = session.sessionManager.getCwd();
+                const trustStore = new ProjectTrustStore(runtimeHost.services.agentDir);
+                try {
+                    if (command.decision === null) {
+                        trustStore.set(cwd, null);
+                    }
+                    else {
+                        trustStore.set(cwd, command.decision);
+                    }
+                    return success(id, "set_trust", { decision: command.decision, restartRequired: command.decision !== null });
+                }
+                catch (trustError) {
+                    return error(id, "set_trust", trustError instanceof Error ? trustError.message : String(trustError));
+                }
+            }
+            // =================================================================
+            // Hotkeys / version / share
+            // =================================================================
+            case "get_hotkeys": {
+                const keybindings = KeybindingsManager.create();
+                const hotkeys = keybindings.getEffectiveConfig();
+                return success(id, "get_hotkeys", { hotkeys });
+            }
+            case "get_available_themes": {
+                // Mirror TUI startup: register extension/package themes before listing.
+                setRegisteredThemes(session.resourceLoader.getThemes().themes);
+                const themes = getAvailableThemesWithPaths().map(({ name, path }) => ({ name, path }));
+                const currentSetting = session.settingsManager.getThemeSetting();
+                const current = currentSetting?.includes("/") ? undefined : currentSetting;
+                return success(id, "get_available_themes", { themes, current });
+            }
+            case "get_version_info": {
+                const changelog = parseChangelog(getChangelogPath());
+                return success(id, "get_version_info", { version: VERSION, changelog });
+            }
+            case "share_gist": {
+                try {
+                    const authResult = spawnSync("gh", ["auth", "status"], { encoding: "utf-8" });
+                    if (authResult.status !== 0) {
+                        return error(id, "share_gist", "GitHub CLI is not logged in. Run 'gh auth login' first.");
+                    }
+                    const tmpFile = join(tmpdir(), `selesai-session-${crypto.randomUUID()}.html`);
+                    await session.exportToHtml(tmpFile);
+                    const result = spawnSync("gh", ["gist", "create", "--public=false", tmpFile], { encoding: "utf-8" });
+                    try {
+                        unlinkSync(tmpFile);
+                    }
+                    catch {
+                        // best-effort cleanup
+                    }
+                    if (result.status !== 0) {
+                        return error(id, "share_gist", (result.stderr ?? "Unknown error").trim() || "Failed to create gist");
+                    }
+                    const gistUrl = (result.stdout ?? "").trim();
+                    const gistId = gistUrl.split("/").pop();
+                    if (!gistId) {
+                        return error(id, "share_gist", "Failed to parse gist ID from gh output");
+                    }
+                    const previewUrl = getShareViewerUrl(gistId);
+                    return success(id, "share_gist", { url: previewUrl, gistUrl });
+                }
+                catch (shareError) {
+                    return error(id, "share_gist", shareError instanceof Error ? shareError.message : String(shareError));
+                }
+            }
             default: {
                 const unknownCommand = command;
                 return error(id, unknownCommand.type, `Unknown command: ${unknownCommand.type}`);

package/dist/modes/rpc/rpc-types.d.ts

@@ -7,10 +7,13 @@
 import type { AgentMessage, ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { ImageContent, Model } from "@earendil-works/pi-ai";
 import type { SessionStats } from "../../core/agent-session.ts";
+import type { KeybindingsConfig } from "../../core/keybindings.ts";
+import type { Settings, SettingsScope } from "../../core/settings-manager.ts";
 import type { BashResult } from "../../core/bash-executor.ts";
 import type { CompactionResult } from "../../core/compaction/index.ts";
 import type { SessionEntry, SessionTreeNode } from "../../core/session-manager.ts";
 import type { SourceInfo } from "../../core/source-info.ts";
+import type { ChangelogEntry } from "../../utils/changelog.ts";
 export type RpcCommand = {
     id?: string;
     type: "prompt";
@@ -137,6 +140,7 @@ export type RpcCommand = {
 } | {
     id?: string;
     type: "get_tree";
+    filter?: "default" | "no-tools" | "user-only" | "labeled-only" | "all";
 } | {
     id?: string;
     type: "get_last_assistant_text";
@@ -144,6 +148,77 @@ export type RpcCommand = {
     id?: string;
     type: "set_session_name";
     name: string;
+} | {
+    id?: string;
+    type: "get_settings";
+    scope?: "global" | "project" | "effective";
+} | {
+    id?: string;
+    type: "set_settings";
+    scope?: SettingsScope;
+    values: Partial<Settings>;
+} | {
+    id?: string;
+    type: "factory_reset_settings";
+} | {
+    id?: string;
+    type: "get_auth_providers";
+} | {
+    id?: string;
+    type: "login";
+    providerId: string;
+    authType: "oauth" | "api_key";
+} | {
+    id?: string;
+    type: "logout";
+    providerId: string;
+} | {
+    id?: string;
+    type: "get_auth_state";
+} | {
+    id?: string;
+    type: "get_scoped_models";
+} | {
+    id?: string;
+    type: "set_scoped_models";
+    enabled?: string[];
+    reorder?: string[];
+} | {
+    id?: string;
+    type: "import_jsonl";
+    path: string;
+} | {
+    id?: string;
+    type: "git";
+    command: string;
+} | {
+    id?: string;
+    type: "reload";
+} | {
+    id?: string;
+    type: "set_entry_label";
+    entryId: string;
+    label?: string;
+} | {
+    id?: string;
+    type: "get_trust";
+} | {
+    id?: string;
+    type: "set_trust";
+    decision: boolean | null;
+} | {
+    id?: string;
+    type: "get_hotkeys";
+} | {
+    id?: string;
+    type: "get_available_themes";
+} | {
+    id?: string;
+    type: "get_version_info";
+} | {
+    id?: string;
+    type: "share_gist";
+    public?: boolean;
 } | {
     id?: string;
     type: "get_messages";
@@ -158,9 +233,11 @@ export interface RpcSlashCommand {
     /** Human-readable description */
     description?: string;
     /** What kind of command this is */
-    source: "extension" | "prompt" | "skill";
+    source: "extension" | "prompt" | "skill" | "builtin";
     /** Source metadata for the owning resource */
     sourceInfo: SourceInfo;
+    /** True for interactive-TUI-only builtins that cannot be invoked via prompt */
+    interactiveOnly?: boolean;
 }
 export interface RpcSessionState {
     model?: Model<any>;
@@ -434,6 +511,175 @@ export type RpcResponse = {
     data: {
         commands: RpcSlashCommand[];
     };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_settings";
+    success: true;
+    data: {
+        scope: "global" | "project" | "effective";
+        settings: Settings;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "set_settings";
+    success: true;
+    data: {
+        scope: SettingsScope;
+        values: Partial<Settings>;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "factory_reset_settings";
+    success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "get_auth_providers";
+    success: true;
+    data: {
+        providers: Array<{
+            providerId: string;
+            name: string;
+            authTypes: Array<"oauth" | "api_key">;
+        }>;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "login";
+    success: true;
+    data: {
+        providerId: string;
+        authType: "oauth" | "api_key";
+        message: string;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "logout";
+    success: true;
+    data: {
+        providerId: string;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_auth_state";
+    success: true;
+    data: {
+        providers: Array<{
+            providerId: string;
+            authType: "oauth" | "api_key";
+            source: string;
+        }>;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_scoped_models";
+    success: true;
+    data: {
+        enabled: string[];
+        models: Model<any>[];
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "set_scoped_models";
+    success: true;
+    data: {
+        enabled: string[];
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "import_jsonl";
+    success: true;
+    data: {
+        sessionPath: string;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "git";
+    success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "reload";
+    success: true;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_entry_label";
+    success: true;
+    data: {
+        labelId: string;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_trust";
+    success: true;
+    data: {
+        cwd: string;
+        savedDecision: {
+            path: string;
+            decision: boolean;
+        } | null;
+        projectTrusted: boolean;
+        trustRequired: boolean;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "set_trust";
+    success: true;
+    data: {
+        decision: boolean | null;
+        restartRequired: boolean;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_hotkeys";
+    success: true;
+    data: {
+        hotkeys: KeybindingsConfig;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_available_themes";
+    success: true;
+    data: {
+        themes: Array<{
+            name: string;
+            path?: string;
+        }>;
+        current: string | undefined;
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "get_version_info";
+    success: true;
+    data: {
+        version: string;
+        changelog: ChangelogEntry[];
+    };
+} | {
+    id?: string;
+    type: "response";
+    command: "share_gist";
+    success: true;
+    data: {
+        url: string;
+        gistUrl: string;
+    };
 } | {
     id?: string;
     type: "response";
@@ -469,6 +715,8 @@ export type RpcExtensionUIRequest = {
     method: "input";
     title: string;
     placeholder?: string;
+    /** "secret": render as single-line password (e.g. API key entry). Defaults to "text". */
+    inputKind?: "text" | "secret";
     timeout?: number;
 } | {
     type: "extension_ui_request";

package/docs/rpc.md

@@ -740,7 +740,7 @@ Each command has:
   - `"path"`: Explicit path via CLI or settings
 - `path`: Absolute file path to the command source (optional)
 
-**Note**: Built-in TUI commands (`/settings`, `/hotkeys`, etc.) are not included. They are handled only in interactive mode and would not execute if sent via `prompt`.
+**Note**: Built-in TUI commands (`/settings`, `/hotkeys`, etc.) are included with `source: "builtin"` and `interactiveOnly: true`. They are display-only: they are handled only in interactive mode and would not execute if sent via `prompt`.
 
 ## Events
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selesai/code",
-  "version": "0.13.8",
+  "version": "0.13.9",
   "description": "Maintained, extension-first Pi coding agent with built-in workflows, subagents, web research, questions, skills, and an enhanced terminal UI.",
   "type": "module",
   "repository": {