@timqi/pier 0.1.1 → 0.1.3

package/dist/agent/pi.js

@@ -2,7 +2,7 @@
 // Implements the AgentFactory/AgentSession seam from src/core/types.ts on the
 // Pi SDK. No Pi type may appear in an exported signature.
 import { realpathSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, sep } from "node:path";
 import { createAgentSession, CredentialSynchronizationError, DefaultResourceLoader, defineTool, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
 import { inlineExtensions } from "../extensions/index.js";
 import { SESSION_TITLE_MAX } from "../core/types.js";
@@ -112,20 +112,30 @@ const bashTimeoutDefault = (pi) => {
         }
     });
 };
+/** What the last session open stood down, by bundled extension name: the
+ *  registry (agent/packages.ts) shows it as the row's state. Known only at
+ *  open, so a built-in no session has loaded since reads nothing. */
+const shadowed = new Map();
+export const shadowedBuiltin = (name) => shadowed.get(name) ?? null;
 /** Pi loads a bundled extension and its on-disk twin both, leaving two tools
  *  of one name; the copy the user put there wins, and the journal says so (§5). */
 export const standDownShadowed = (base) => {
     const inline = (ext) => ext.path.startsWith("<inline:");
-    const onDisk = new Set(base.extensions.filter((ext) => !inline(ext)).flatMap((ext) => [...ext.tools.keys()]));
-    if (!onDisk.size)
-        return base;
+    const onDisk = new Map(base.extensions.filter((ext) => !inline(ext)).flatMap((ext) => [...ext.tools.keys()].map((tool) => [tool, ext.path])));
     return {
         ...base,
         extensions: base.extensions.filter((ext) => {
-            const clash = inline(ext) && [...ext.tools.keys()].filter((tool) => onDisk.has(tool));
-            if (!clash || !clash.length)
+            if (!inline(ext))
                 return true;
-            log.info(`bundled ${ext.path} stood down — ${clash.join(", ")} already loaded from disk`);
+            const name = ext.path.slice("<inline:".length, -1);
+            const clash = [...ext.tools.keys()].filter((tool) => onDisk.has(tool));
+            if (!clash.length) {
+                shadowed.delete(name);
+                return true;
+            }
+            const from = onDisk.get(clash[0]);
+            shadowed.set(name, `stood down — ${clash.join(", ")} from ${from}`);
+            log.info(`bundled ${ext.path} stood down — ${clash.join(", ")} already loaded from ${from}`);
             return false;
         }),
     };
@@ -396,7 +406,7 @@ export class PiAgentFactory {
     credentials;
     providerConfig;
     pinned;
-    enabledExtensions;
+    pier;
     titleModel;
     listings;
     constructor(extraTools = [], 
@@ -408,7 +418,9 @@ export class PiAgentFactory {
     skillPaths = [], 
     /** Optional only for bare test factories; an OAuth refresh persists here,
      *  never to a plaintext auth.json. */
-    credentials, providerConfig = new PiConfigStore(), pinned = () => [], enabledExtensions = () => [], titleModel = () => undefined, 
+    credentials, providerConfig = new PiConfigStore(), pinned = () => [], 
+    /** The built-in `pier` package's switches: bundled extensions on, Pier's own skills off. */
+    pier = () => ({ extensions: [], skillsOff: [] }), titleModel = () => undefined, 
     /** Injected so a test needs no session directory or database. */
     listings = new IndexedListing()) {
         this.extraTools = extraTools;
@@ -417,7 +429,7 @@ export class PiAgentFactory {
         this.credentials = credentials;
         this.providerConfig = providerConfig;
         this.pinned = pinned;
-        this.enabledExtensions = enabledExtensions;
+        this.pier = pier;
         this.titleModel = titleModel;
         this.listings = listings;
     }
@@ -605,19 +617,22 @@ export class PiAgentFactory {
         await (await this.authRuntime()).logout(providerId, { signal: AbortSignal.timeout(15_000) });
     }
     async resourceLoader(cwd) {
+        const { extensions, skillsOff } = this.pier();
         const loader = new DefaultResourceLoader({
             cwd,
             agentDir: defaultAgentDir(),
             // The user's SYSTEM.md is appended after Pier's baseline, so it still wins.
             systemPromptOverride: pierSystemPrompt,
             additionalSkillPaths: this.skillPaths,
+            // Only Pier's own skills answer to the off-list; a user's skill of the
+            // same name is Pi's to switch (settings.json).
             skillsOverride: (base) => ({
                 ...base,
-                skills: standDownUndocumented(this.extraTools, base.skills),
+                skills: standDownUndocumented(this.extraTools, base.skills.filter((skill) => !skillsOff.includes(skill.name) || !this.skillPaths.some((dir) => skill.filePath.startsWith(dir + sep)))),
             }),
             extensionFactories: [
                 { name: "pier-bash-timeout", factory: bashTimeoutDefault, hidden: true },
-                ...inlineExtensions(this.enabledExtensions()),
+                ...inlineExtensions(extensions),
             ],
             extensionsOverride: standDownShadowed,
             agentsFilesOverride: (current) => {
@@ -633,7 +648,7 @@ export class PiAgentFactory {
         return loader;
     }
     open(cwd, sessionManager, opts = { cwd }) {
-        return this.providerConfig.withSnapshot(() => this.openSnapshot(cwd, sessionManager, opts));
+        return this.providerConfig.withWrite(() => this.openSnapshot(cwd, sessionManager, opts));
     }
     async openSnapshot(cwd, sessionManager, opts) {
         let live;

package/dist/core/types.js

@@ -13,6 +13,13 @@ export const SESSION_TITLE_MAX = 80;
  *  drift, and boundary validators use isThinkingLevel instead of their own copy. */
 export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 export const isThinkingLevel = (v) => typeof v === "string" && THINKING_LEVELS.includes(v);
+export class PackageError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
 // Wire-protocol names, not SDK types — but they are pi-ai's spellings, and a
 // non-Pi backend is bound to them by this seam.
 const PROVIDER_APIS = [

package/dist/extensions/index.js

@@ -3,27 +3,8 @@
 // either clobbers the user's edits or skips them forever.
 import web from "./web/index.js";
 export const BUNDLED = [
-    {
-        name: "web",
-        summary: "The public web through the provider's own hosted web tools — no extra " +
-            "key, no second service, no new dependency.",
-        tools: [
-            { name: "web_search", needs: "an authenticated Anthropic or OpenAI model" },
-            { name: "web_fetch", needs: "an authenticated Anthropic model — OpenAI hosts no fetch tool" },
-        ],
-        factory: web,
-    },
+    { name: "web", factory: web },
 ];
-/** The catalog a surface may show: no Pi types, nothing it cannot render.
- *  Half of one list; src/tools.ts has the other. */
-export const bundledInfo = (enabled) => BUNDLED.map(({ name, summary, tools }) => ({
-    source: "bundled",
-    kind: "extension",
-    name,
-    summary,
-    adds: tools,
-    enabled: enabled.includes(name),
-}));
 /** The enabled ones as Pi inline extensions; unknown names are not ours. */
 export const inlineExtensions = (enabled) => BUNDLED.filter((ext) => enabled.includes(ext.name))
     .map(({ name, factory }) => ({ name, factory }));

package/dist/main.js

@@ -9,6 +9,7 @@ import { ConfigSync } from "./config-sync.js";
 import { configSyncTask } from "./config-sync-task.js";
 import { CredentialStore } from "./agent/credentials.js";
 import { IndexedListing } from "./agent/listing.js";
+import { PiPackageStore } from "./agent/packages.js";
 import { PiAgentFactory } from "./agent/pi.js";
 import { defaultBoardsDir, registerBoardRoutes } from "./boards/boards.js";
 import { ChannelStore } from "./channels/config.js";
@@ -24,7 +25,7 @@ import { EventHub } from "./core/hub.js";
 import { splitSpeaker } from "./core/identity.js";
 import { pierDb } from "./db.js";
 import { deliverLedger, drainForRestart, RestartLedger } from "./drain.js";
-import { bundledInfo } from "./extensions/index.js";
+import { BUNDLED } from "./extensions/index.js";
 import { surfacePrompt } from "./core/reply.js";
 import { Router } from "./core/router.js";
 import { acquireInstanceLock } from "./lock.js";
@@ -39,7 +40,7 @@ import { toolsTask } from "./tools-task.js";
 import { Secrets } from "./secrets.js";
 import { startUpdate, unitPath, updaterProblem } from "./service.js";
 import { SettingsStore } from "./settings.js";
-import { startAutoUpdate, UpdateCheck } from "./update.js";
+import { currentVersion, startAutoUpdate, UpdateCheck } from "./update.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
 import { registerConfigShareRoute, registerConfigSyncRoutes } from "./web/config-sync.js";
 import { PushStore, registerPushRoutes } from "./web/push.js";
@@ -84,11 +85,14 @@ let channelStore;
 const slackDirectory = new SlackDirectory((m) => logger("slack").warn(m));
 let readyForConfigReload = false;
 const piConfig = new PiConfigStore();
+// Before anything reads settings.json: a first boot gets Pier's seed file.
+await piConfig.seedSettings();
 const configSync = new ConfigSync({
     db, settings, config: piConfig, normalizeAgent: normalizeAgentSnapshot,
     reload: () => readyForConfigReload ? reloadInstance() : Promise.resolve(),
 });
-const factory = new PiAgentFactory([
+const skillsDir = fileURLToPath(new URL("../skills", import.meta.url));
+const agentTools = [
     taskToolSpec((params, callerSessionId) => tasks.tool(params, callerSessionId)),
     slackToolSpec((params, callerSessionId) => handleSlackTool({
         store: channelStore,
@@ -108,12 +112,13 @@ const factory = new PiAgentFactory([
         },
         log: (m) => logger("slack.tool").warn(m),
     }, params, callerSessionId), () => slackToolAvailable(channelStore)),
-], 
+];
+const factory = new PiAgentFactory(agentTools, 
 // Getters, read per session open: a Console change reaches the next session
 // without a restart.
 () => surfacePrompt({ boardsDir: defaultBoardsDir(), publicUrl: settings.get().publicUrl }), 
 // Documents Pier's own tools, so it loads only inside a Pier session.
-[fileURLToPath(new URL("../skills", import.meta.url))], new CredentialStore(db, secrets), piConfig, () => settings.get().modelMenu, () => settings.get().extensions, () => settings.get().titleModel, 
+[skillsDir], new CredentialStore(db, secrets), piConfig, () => settings.get().modelMenu, () => settings.get(), () => settings.get().titleModel, 
 // Transcripts carry the speaker header core wrote for the model.
 new IndexedListing(undefined, undefined, (text) => splitSpeaker(text).text));
 const hub = new EventHub();
@@ -137,6 +142,9 @@ const toolsUpdate = toolsTask(tasks);
 const reconciled = await toolsUpdate.reconcile();
 if ("problem" in reconciled)
     log.error(`tools cannot be managed: ${reconciled.problem}`);
+const packages = new PiPackageStore(piConfig, { version: currentVersion(), settings, tools: agentTools }, [skillsDir]);
+// At boot, not lazily: the answer waits for the next Console open (update.ts).
+packages.watchUpdates();
 channelStore = new ChannelStore(db, secrets);
 const control = createControl({ router, factory, conversations, store: channelStore });
 const channels = new ChannelRuntime(channelStore, router, control);
@@ -280,23 +288,20 @@ app.route("/", createServer({
     hub,
     sessions: sessionState,
     config: piConfig,
+    packages,
     providers: factory,
     settings,
-    // Assembled here so web/ gets names and summaries, not a module that
-    // imports the Pi SDK; extensions and binaries are one kind of switch.
+    // Assembled here: the catalog spawns ubix, which web/ may not.
     catalog: async () => {
-        const { extensions, tools, customTools } = settings.get();
-        return {
-            entries: [...bundledInfo(extensions), ...await managedTools.status(tools, customTools)],
-            toolsTaskId: toolsUpdate.id(),
-        };
+        const { tools, customTools } = settings.get();
+        return { entries: await managedTools.status(tools, customTools), toolsTaskId: toolsUpdate.id() };
     },
     // A switch is validated against what this Pier *can* switch, never against
     // a catalog whose custom half the request may be rewriting.
-    names: { extensions: bundledInfo([]).map((entry) => entry.name), tools: MANAGED.map((tool) => tool.name) },
+    names: MANAGED.map((tool) => tool.name),
     onToolsChanged: toolsUpdate.changed,
     validateCustomTools: (raw) => {
-        const validated = normalizeCustomTools(raw, bundledInfo([]).map((entry) => entry.name));
+        const validated = normalizeCustomTools(raw, BUNDLED.map((ext) => ext.name));
         return validated ? { tools: validated } : { error: CUSTOM_TOOL_RULES };
     },
     secrets,

package/dist/settings.js

@@ -99,6 +99,7 @@ export class SettingsStore {
             ...(titleModel ? { titleModel } : {}),
             autoUpdate: this.#value("autoUpdate") === "1",
             extensions: this.#json("extensions", normalizeExtensions, "a list of names") ?? [],
+            skillsOff: this.#json("skillsOff", normalizeNames, "a list of names") ?? [],
             tools: this.#json("tools", normalizeTools, "a list of names") ?? [],
             // `"drop"`: a row the bundled catalog has since taken is redundant, not malformed.
             customTools: this.#json("customTools", (raw) => normalizeCustomTools(raw, [], "drop"), "a list of {name, toml}") ?? [],
@@ -144,6 +145,10 @@ export class SettingsStore {
         this.#set("extensions", JSON.stringify(names));
         return this.get();
     }
+    setSkillsOff(names) {
+        this.#set("skillsOff", JSON.stringify(names));
+        return this.get();
+    }
     setTools(names) {
         this.#set("tools", JSON.stringify(names));
         return this.get();

package/dist/tools.js

@@ -13,37 +13,34 @@ const log = logger("tools");
 const UBIX_LATEST = "https://api.github.com/repos/timqi/ubix/releases/latest";
 export const MANAGED = [
     {
-        kind: "extension",
         name: "rtk",
-        toml: `spec = "github:rtk-ai/rtk"`,
-        summary: "Compresses long bash output before it reaches the model. Ships as a " +
-            "command, and installs its own Pi extension into Pier's agent dir — " +
-            "refreshed on every update.",
-        // Write-if-changed inside rtk: re-running after an upgrade is the extension-update path.
-        provision: ["init", "-g", "--agent", "pi"],
-        deprovision: ["init", "--uninstall", "--agent", "pi", "--global"],
+        // The hooks register and unregister its Pi extension; `--auto-patch` keeps
+        // `rtk init` non-interactive and overwrites a stale copy, which is right
+        // because nothing else writes Pier's agent dir.
+        toml: `spec = "github:rtk-ai/rtk"\n` +
+            `post_install = ["rtk", "init", "-g", "--agent", "pi", "--auto-patch"]\n` +
+            `pre_remove = ["rtk", "init", "--uninstall", "--agent", "pi", "--global", "--auto-patch"]`,
+        summary: "Compresses long bash output before it reaches the model. Its install hook " +
+            "writes its own Pi extension (extensions/rtk.ts, listed under the local " +
+            "package) — refreshed on every update.",
     },
     {
-        kind: "tool",
         name: "rg",
         // `exe`: ubi looks for files named after the project, and ripgrep ships `rg`.
         toml: `spec = "github:BurntSushi/ripgrep"\nexe = "rg"`,
         summary: "ripgrep: searches a tree by content, fast enough to be the default.",
     },
     {
-        kind: "tool",
         name: "fd",
         toml: `spec = "github:sharkdp/fd"`,
         summary: "Finds files by name, respecting .gitignore — what `find` should feel like.",
     },
     {
-        kind: "tool",
         name: "wt",
         toml: `spec = "github:max-sixty/worktrunk"\nexe = "wt"`,
         summary: "worktrunk: git worktrees as one command — branch, switch, merge, clean up.",
     },
     {
-        kind: "tool",
         name: "jq",
         // No `exe`: jq publishes bare per-platform binaries, which ubi installs
         // under the tool's own name.
@@ -339,17 +336,14 @@ export function ubixConfigToml(tools, installDir) {
         lines.push("", `[tools.${tool.name}]`, tool.toml.trim());
     return `${lines.join("\n")}\n`;
 }
-/** clap's unknown-argument message, and ubix's own refusal on a command that
- *  takes no JSON. Nothing else counts as too old. */
-const refusesJson = (stderr) => /unexpected argument\s+'?--json|unrecognized (?:option|argument)\s+'?--json|`--json` is not supported/i
-    .test(stderr);
-/** Pier put that binary in `bin/`, so `sync` re-bootstraps rather than reports. */
-class UbixTooOld extends Error {
-}
+/** The first ubix that runs `post_install` / `pre_remove`. An older one parses
+ *  the keys as unknown and ignores them, so rtk would install without its
+ *  extension and nothing would say so. Release tags are `vYYYYMMDD-<sha>`. */
+const UBIX_MIN = "v20260910-61f07ae";
 /** A name in neither list is not an error: a row a future release drops must
  *  not stop the sync of everything else. */
 function rows(custom) {
-    return [...MANAGED, ...custom.map((tool) => ({ kind: "tool", summary: "", custom: true, ...tool }))];
+    return [...MANAGED, ...custom.map((tool) => ({ summary: "", custom: true, ...tool }))];
 }
 export function ubixAsset(tag, platform, arch) {
     const os = platform === "linux" || platform === "darwin" ? platform : null;
@@ -465,26 +459,11 @@ export class ManagedTools {
             return { entries: [], failed: false, summary: "no tools switched on" };
         }
         fence();
-        const ubix = await this.bootstrapUbix();
         const env = this.#env();
+        const ubix = await this.#current(await this.bootstrapUbix(), env);
         const entries = [];
-        // ubix cannot know that rtk must uninstall its own Pi extension *before*
-        // its binary goes; tools leaving the set undo their footprint first.
-        const kept = [];
-        for (const state of await this.#listing(ubix, env)) {
-            const leaving = all.find((tool) => tool.name === state.name);
-            if (!leaving?.deprovision || wanted.some((tool) => tool.name === state.name))
-                continue;
-            fence(); // a tool's own uninstall is a change to the machine
-            const error = await this.#provision(env, leaving, leaving.deprovision);
-            if (error) {
-                // Removing it now would orphan what deprovision failed to remove.
-                kept.push(leaving);
-                entries.push({ name: leaving.name, action: "kept", version: null, error });
-            }
-        }
         fence();
-        this.#writeConfig([...wanted, ...kept]);
+        this.#writeConfig(wanted);
         // `--prune` removes what the config no longer declares; `--wait` lets a
         // hand-typed `pier tools sync` converge behind the managed run.
         fence();
@@ -492,25 +471,19 @@ export class ManagedTools {
         for (const state of states) {
             if (wanted.some((tool) => tool.name === state.name))
                 continue;
-            if (entries.some((entry) => entry.name === state.name))
-                continue;
-            // A failure to remove is as much a failure as one to install.
+            // A failure to remove (a `pre_remove` hook included) is as much a failure as one to install.
             entries.push({ name: state.name, action: state.action ?? "removed", version: null, error: state.error });
         }
         for (const tool of wanted) {
             const state = states.find((s) => s.name === tool.name);
-            const entry = {
+            entries.push({
                 name: tool.name,
                 action: state?.action ?? "missing",
                 version: state?.to ?? state?.version ?? null,
-                // A tool ubix never mentioned is not a tool that is fine.
+                // A tool ubix never mentioned is not a tool that is fine; a failed
+                // `post_install` arrives here as `error` beside an `installed` action.
                 error: state?.error ?? (state ? null : "ubix reported nothing about it"),
-            };
-            if (!entry.error && tool.provision) {
-                fence();
-                entry.error = await this.#provision(env, tool, tool.provision);
-            }
-            entries.push(entry);
+            });
         }
         const failed = entries.some((entry) => entry.error !== null);
         return { entries, failed, summary: summarize(entries) };
@@ -519,8 +492,6 @@ export class ManagedTools {
      *  version is unknown (§5). */
     async status(enabled, custom = []) {
         const base = rows(custom).map((tool) => ({
-            source: "binary",
-            kind: tool.kind,
             name: tool.name,
             summary: tool.summary,
             enabled: enabled.includes(tool.name),
@@ -577,12 +548,20 @@ export class ManagedTools {
         return states;
     }
     /** `UBIX_CONFIG_DIR` / `UBIX_DATA_DIR` name the directories directly — not
-     *  XDG parents, which every child ubix spawns (uv, fnm, cargo) would read too. */
+     *  XDG parents, which every child ubix spawns (uv, fnm, cargo) would read too.
+     *  Hooks inherit this env: `pier tools sync` typed in a shell has no main.ts
+     *  parent exporting PI_CODING_AGENT_DIR, and rtk would then write its
+     *  extension into ~/.pi. */
     #env() {
+        const agentDir = resolveAgentDir(process.env);
+        if (process.env.PI_CODING_AGENT_DIR !== agentDir) {
+            log.info(`PI_CODING_AGENT_DIR was ${process.env.PI_CODING_AGENT_DIR ?? "unset"} — ubix gets ${agentDir}`);
+        }
         const env = {
             ...process.env,
             UBIX_CONFIG_DIR: this.#configDir,
             UBIX_DATA_DIR: join(this.#root, "state"),
+            PI_CODING_AGENT_DIR: agentDir,
         };
         prependPath(env, this.bin);
         return env;
@@ -599,8 +578,9 @@ export class ManagedTools {
         renameSync(`${path}.writing`, path);
     }
     /** A non-zero exit still parses: under `--json` a failed tool is in the
-     *  document as `action: "failed"`, and the run exits non-zero. The two must
-     *  agree — an exit code with no failed entry is a failure this file cannot
+     *  document as `action: "failed"` — or as `installed`/`upgraded` with an
+     *  `error`, when its `post_install` hook failed — and the run exits non-zero.
+     *  The two must agree — an exit code with no failed entry is a failure this file cannot
      *  attribute, and passing it on as clean is the one thing it may never do. */
     async #states(ubix, env, args) {
         const result = await this.#exec(ubix, args, env);
@@ -610,43 +590,24 @@ export class ManagedTools {
         }
         catch (err) {
             const failure = failedRun(`ubix ${args.join(" ")}`, result);
-            // Only the flag being unknown means "too old"; re-bootstrapping over a
-            // config error would fix nothing and say something false.
-            if (result.code !== 0 && refusesJson(result.stderr))
-                throw new UbixTooOld(failure);
             throw new Error(result.code === 0 ? String(err) : `${failure} (${String(err)})`);
         }
-        if (result.code !== 0 && !states.some((state) => state.action === "failed")) {
+        if (result.code !== 0 && !states.some((state) => state.error !== null)) {
             throw new Error(`${failedRun(`ubix ${args.join(" ")}`, result)} — and its report names no failure`);
         }
         return states;
     }
-    /** The one place a too-old ubix is repaired rather than reported. */
-    async #listing(ubix, env) {
-        try {
-            return await this.#states(ubix, env, ["list", "--json"]);
-        }
-        catch (err) {
-            if (!(err instanceof UbixTooOld))
-                throw err;
-            log.warn(`the ubix in ${this.bin} is too old for --json — replacing it`);
-            return this.#states(await this.bootstrapUbix(true), env, ["list", "--json"]);
-        }
-    }
-    /** Returns the failure text, or null. */
-    async #provision(env, tool, args) {
-        const exe = join(this.bin, tool.name);
-        if (!existsSync(exe))
-            return `${tool.name} is not in ${this.bin} — ${args.join(" ")} was not run`;
-        // `pier tools sync` typed in a shell has no main.ts parent exporting
-        // PI_CODING_AGENT_DIR; rtk would then write its extension into ~/.pi.
-        const agentDir = resolveAgentDir(env);
-        if (env.PI_CODING_AGENT_DIR !== agentDir) {
-            log.info(`PI_CODING_AGENT_DIR was ${env.PI_CODING_AGENT_DIR ?? "unset"} — ${tool.name} gets ${agentDir}`);
-        }
-        mkdirSync(join(agentDir, "extensions"), { recursive: true });
-        const result = await this.#exec(exe, args, { ...env, PI_CODING_AGENT_DIR: agentDir });
-        return result.code === 0 ? null : failedRun(`${tool.name} ${args.join(" ")}`, result);
+    /** The one place a too-old ubix is repaired rather than reported: Pier put
+     *  that binary in `bin/`, and one below UBIX_MIN would run the config and
+     *  skip its hooks without a word. */
+    async #current(ubix, env) {
+        const result = await this.#exec(ubix, ["--version"], env);
+        const date = /\bv(\d{8})-/.exec(result.stdout)?.[1];
+        if (result.code === 0 && date && date >= UBIX_MIN.slice(1, 9))
+            return ubix;
+        const found = result.code === 0 ? result.stdout.trim() || "(no version)" : failedRun("ubix --version", result);
+        log.warn(`the ubix in ${this.bin} is ${found} and Pier needs ${UBIX_MIN} or newer — replacing it`);
+        return this.bootstrapUbix(true);
     }
     async #getText(url) {
         return new TextDecoder().decode(await this.#getBytes(url));
@@ -662,7 +623,7 @@ export class ManagedTools {
         return new Uint8Array(await res.arrayBuffer());
     }
 }
-const withBinary = (entry, patch) => entry.source === "binary" ? { ...entry, binary: { ...entry.binary, ...patch } } : entry;
+const withBinary = (entry, patch) => ({ ...entry, binary: { ...entry.binary, ...patch } });
 /** Never empty: an exit code with no words is not a report. */
 const failedRun = (what, result) => `${what} exited ${String(result.code)}: ${result.stderr.trim().slice(0, 300) || "(no output)"}`;
 /** `<sha256>  <bare filename>` lines, as `sha256sum` writes them. */

package/dist/web/config.js

@@ -1,5 +1,7 @@
 // The agent files a scope is configured by, through the ConfigStore. Not via
 // web/fs.ts: a scope is "global" or a cwd Pi already knows, never a browser path.
+import { isThinkingLevel } from "../core/types.js";
+import { normalizeModelRef } from "../settings.js";
 import { guarded } from "./route.js";
 export function registerConfigRoutes(app, { factory, config, onConfigWritten }) {
     // Only cwds Pi already knows are accepted — never an arbitrary path.
@@ -18,7 +20,6 @@ export function registerConfigRoutes(app, { factory, config, onConfigWritten })
             // Where this scope's files live on disk — the UI labels "Global" with it.
             dir: scope.kind === "global" ? config.globalDir : scope.cwd,
             files: await config.listFiles(scope),
-            resources: await config.listResources(scope),
         });
     });
     guarded(app, "GET", "/api/config/files/:name", 400, async (c) => {
@@ -41,17 +42,30 @@ export function registerConfigRoutes(app, { factory, config, onConfigWritten })
         onConfigWritten?.();
         return c.json({ ok: true, content: await config.readFile(scope, name) });
     });
-    // Resource names may contain slashes — query params, not path params.
-    guarded(app, "GET", "/api/config/resource", 400, async (c) => {
+    // settings.json is read-only as a file; its two deployment keys go through here.
+    guarded(app, "GET", "/api/config/defaults", 400, async (c) => {
         c.header("cache-control", "no-store");
-        const scope = await parseScope(c.req.query("scope"));
-        if (!scope)
-            return c.json({ error: "unknown scope" }, 400);
-        const kind = c.req.query("kind");
-        const name = c.req.query("name");
-        if ((kind !== "extensions" && kind !== "skills") || !name) {
-            return c.json({ error: "kind and name required" }, 400);
+        return c.json(await config.readDefaults());
+    });
+    guarded(app, "PUT", "/api/config/defaults", 400, async (c) => {
+        const defaults = parseDefaults(await c.req.json().catch(() => null));
+        if (!defaults) {
+            return c.json({ error: "defaultModel must be {provider, id} or null; defaultThinkingLevel a reasoning level or null" }, 400);
         }
-        return c.json({ content: await config.readResource(scope, kind, name) });
+        await config.writeDefaults(defaults);
+        onConfigWritten?.();
+        return c.json(await config.readDefaults());
     });
 }
+/** Both fields, each stated: null is "Pi's own default", absent is a malformed body. */
+function parseDefaults(body) {
+    if (typeof body !== "object" || body === null)
+        return null;
+    const { defaultModel, defaultThinkingLevel } = body;
+    const model = defaultModel === null ? null : normalizeModelRef(defaultModel);
+    if (model === null && defaultModel !== null)
+        return null;
+    if (defaultThinkingLevel !== null && !isThinkingLevel(defaultThinkingLevel))
+        return null;
+    return { defaultModel: model, defaultThinkingLevel };
+}

package/dist/web/explorer.js

@@ -11,7 +11,7 @@ const REF_RE = /^[^-\s][^\s]*$/;
 /** Output capped: a diff is display data, not an archive. */
 const git = async (root, ...args) => (await run("git", ["-C", root, ...args], { maxBuffer: MAX_DIFF_BYTES })).stdout;
 export function registerExplorerRoutes(app) {
-    // Not a repo → { branch: null }, which the UI renders as "no git".
+    // Not a repo → { branch: null }: the Files view draws no compare, no filter.
     guarded(app, "GET", "/api/explorer/git", 404, async (c) => {
         c.header("cache-control", "no-store");
         const root = await scoped(c.req.query("root"));
@@ -71,9 +71,11 @@ export function registerExplorerRoutes(app) {
         const file = c.req.query("file");
         if (file === undefined) {
             // name-status carries the letter, numstat the +/- counts; joined by path.
+            // --relative: the root may be a directory inside the checkout (Browse
+            // files on a skill), and the tree reads every path from that root.
             const [nameStatus, numstat] = await Promise.all([
-                git(root, "diff", "--name-status", ...range, "--"),
-                git(root, "diff", "--numstat", ...range, "--"),
+                git(root, "diff", "--relative", "--name-status", ...range, "--"),
+                git(root, "diff", "--relative", "--numstat", ...range, "--"),
             ]);
             // numstat spells a rename "a/{old => new}.ts" — reduce it to the new path.
             const newPath = (p) => p.replace(/\{([^{}]*) => ([^{}]*)\}/g, "$2").replace(/^(.*) => (.*)$/, "$2");