@timurproko/a1 0.1.8-dev.157 → 0.1.8-dev.214

package/dist/integrations/pi/engine/index.js

@@ -4,6 +4,9 @@ export * from "./runtime-integration.js";
 export * from "./session-integration.js";
 export * from "./model-auth-integration.js";
 export * from "./settings-integration.js";
+export * from "./settings-effects.js";
+export * from "./project-trust-preflight.js";
+export * from "./http-dispatcher.js";
 export * from "./package-integration.js";
 export * from "./resource-extension-integration.js";
 export * from "./workflow-controllers.js";

package/dist/integrations/pi/engine/model-auth-integration.d.ts

@@ -9,6 +9,7 @@ export interface PiModelAuthenticationOptions {
     readonly timeoutMs?: number;
     readonly scopedModelIds?: () => readonly string[] | undefined;
 }
+/** Adapts the pinned model runtime to neutral model selection and authentication operations. */
 export declare class PiModelAuthenticationIntegration implements AgentModelPort, AgentAuthenticationPort {
     #private;
     private readonly options;

package/dist/integrations/pi/engine/model-auth-integration.js

@@ -1,3 +1,4 @@
+/** Adapts the pinned model runtime to neutral model selection and authentication operations. */
 export class PiModelAuthenticationIntegration {
     options;
     capabilities = { selection: true, refresh: true, scopedCatalog: true, login: true, logout: true };

package/dist/integrations/pi/engine/package-integration.js

@@ -52,7 +52,7 @@ export function createPiPackagesPort(input) {
         },
         async update(source) {
             return await attempt("update", source ?? null, async () => {
-                // Asking first keeps "that package is not installed here" a structural
+                // Rationale: asking first keeps "that package is not installed here" a structural
                 // answer rather than a string a caller would have to recognize.
                 if (source !== undefined && !isConfigured(source))
                     return agentPackageOutcome("update", "not-found", null, source);

package/dist/integrations/pi/engine/project-trust-preflight.d.ts

@@ -0,0 +1,22 @@
+export interface PiProjectTrustPreflightRequest {
+    readonly cwd: string;
+    readonly defaultDecision: "ask" | "always" | "never";
+}
+export type PiProjectTrustPreflightPrompt = (request: PiProjectTrustPreflightRequest) => Promise<boolean | null>;
+export interface PiProjectTrustPreflightResult {
+    readonly trusted: boolean;
+    readonly source: "no-project-resources" | "saved" | "default" | "interactive" | "fail-closed";
+    readonly diagnostic: string | null;
+}
+export interface ResolvePiProjectTrustPreflightOptions {
+    readonly cwd: string;
+    readonly agentDir: string;
+    readonly prompt?: PiProjectTrustPreflightPrompt;
+    readonly hasProjectResources?: (cwd: string) => boolean;
+}
+/**
+ * Resolves trust from global state only. It never constructs a project-trusted
+ * settings manager or resource loader; callers may do that only after this
+ * result exists.
+ */
+export declare function resolvePiProjectTrustPreflight(options: ResolvePiProjectTrustPreflightOptions): Promise<PiProjectTrustPreflightResult>;

package/dist/integrations/pi/engine/project-trust-preflight.js

@@ -0,0 +1,50 @@
+import { hasTrustRequiringProjectResources, ProjectTrustStore, SettingsManager, } from "@earendil-works/pi-coding-agent";
+/**
+ * Resolves trust from global state only. It never constructs a project-trusted
+ * settings manager or resource loader; callers may do that only after this
+ * result exists.
+ */
+export async function resolvePiProjectTrustPreflight(options) {
+    const hasProjectResources = options.hasProjectResources ?? hasTrustRequiringProjectResources;
+    if (!hasProjectResources(options.cwd)) {
+        return { trusted: true, source: "no-project-resources", diagnostic: null };
+    }
+    const trustStore = new ProjectTrustStore(options.agentDir);
+    const saved = trustStore.get(options.cwd);
+    if (saved !== null)
+        return { trusted: saved, source: "saved", diagnostic: null };
+    // Security: projectTrusted:false is the boundary: this read may see global
+    // settings but cannot consume project settings or construct project resources.
+    const globalSettings = SettingsManager.create(options.cwd, options.agentDir, { projectTrusted: false });
+    const fallback = globalSettings.getDefaultProjectTrust();
+    if (fallback === "always")
+        return { trusted: true, source: "default", diagnostic: null };
+    if (fallback === "never")
+        return { trusted: false, source: "default", diagnostic: null };
+    if (options.prompt === undefined) {
+        return {
+            trusted: false,
+            source: "fail-closed",
+            diagnostic: `Project resources in ${options.cwd} were withheld because trust requires interaction`,
+        };
+    }
+    try {
+        const decision = await options.prompt({ cwd: options.cwd, defaultDecision: fallback });
+        if (decision === null) {
+            return {
+                trusted: false,
+                source: "fail-closed",
+                diagnostic: `Project resources in ${options.cwd} were withheld because trust selection was cancelled`,
+            };
+        }
+        trustStore.set(options.cwd, decision);
+        return { trusted: decision, source: "interactive", diagnostic: null };
+    }
+    catch (error) {
+        return {
+            trusted: false,
+            source: "fail-closed",
+            diagnostic: `Project resources in ${options.cwd} were withheld because trust resolution failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}

package/dist/integrations/pi/engine/resource-extension-integration.d.ts

@@ -5,6 +5,7 @@ export interface PiResourceExtensionOptions {
     readonly bindUi: () => Promise<void>;
     readonly unbindUi: () => Promise<void>;
 }
+/** Adapts Pi resource discovery and extension binding while containing extension failures at the port. */
 export declare class PiResourceExtensionIntegration implements AgentResourcesPort, AgentExtensionPort {
     #private;
     private readonly options;

package/dist/integrations/pi/engine/resource-extension-integration.js

@@ -1,3 +1,4 @@
+/** Adapts Pi resource discovery and extension binding while containing extension failures at the port. */
 export class PiResourceExtensionIntegration {
     options;
     capabilities = { reload: true, extensionBinding: true, binding: true, renderers: true };

package/dist/integrations/pi/engine/runtime-integration.d.ts

@@ -1,8 +1,17 @@
-import { type AgentSession, type AgentSessionRuntime, type AgentSessionServices, type ScopedModel } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionServices, SettingsManager, type AgentSession, type AgentSessionRuntime, type AgentSessionServices, type ScopedModel } from "@earendil-works/pi-coding-agent";
+import { resolvePiProjectTrustPreflight, type PiProjectTrustPreflightPrompt } from "./project-trust-preflight.js";
 export interface PiRuntimeIntegrationOptions {
     readonly cwd: string;
     readonly agentDir: string;
     readonly sessionDir?: string;
+    readonly sessionPath?: string;
+    readonly projectTrustPrompt?: PiProjectTrustPreflightPrompt;
+    readonly preflightDependencies?: PiRuntimePreflightDependencies;
+}
+export interface PiRuntimePreflightDependencies {
+    readonly resolveTrust?: typeof resolvePiProjectTrustPreflight;
+    readonly createSettingsManager?: (cwd: string, agentDir: string, projectTrusted: boolean) => SettingsManager;
+    readonly createServices?: typeof createAgentSessionServices;
 }
 export type PiSessionReplacement = {
     readonly kind: "new";
@@ -26,6 +35,12 @@ interface ConfiguredModelScope {
  * saved default when it is in scope, otherwise the first scoped model.
  */
 export declare function resolveConfiguredModelScope(services: Pick<AgentSessionServices, "settingsManager" | "modelRuntime">): Promise<ConfiguredModelScope>;
+export declare function createPiRuntimeServicesAfterTrust(options: Pick<PiRuntimeIntegrationOptions, "agentDir" | "projectTrustPrompt" | "preflightDependencies"> & {
+    readonly cwd: string;
+}): Promise<{
+    readonly services: AgentSessionServices;
+    readonly trust: Awaited<ReturnType<typeof resolvePiProjectTrustPreflight>>;
+}>;
 export declare function createPiRuntimeIntegration(options: PiRuntimeIntegrationOptions): Promise<AgentSessionRuntime>;
 export declare function bindPiRuntimeSession(runtime: AgentSessionRuntime, rebind: (session: AgentSession) => Promise<void>): () => void;
 export declare function replacePiRuntimeSession(runtime: AgentSessionRuntime, replacement: PiSessionReplacement): Promise<{

package/dist/integrations/pi/engine/runtime-integration.js

@@ -1,4 +1,5 @@
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, resolveModelScopeWithDiagnostics, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, resolveModelScopeWithDiagnostics, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { resolvePiProjectTrustPreflight, } from "./project-trust-preflight.js";
 /**
  * Mirrors pinned Pi's CLI startup: resolve the `models` patterns from settings
  * into a scoped model list, keep the resolver's warnings (e.g. "No models match
@@ -29,10 +30,32 @@ export async function resolveConfiguredModelScope(services) {
         diagnostics: diagnostics.map(diagnostic => ({ type: diagnostic.type, message: diagnostic.message })),
     };
 }
+export async function createPiRuntimeServicesAfterTrust(options) {
+    const resolveTrust = options.preflightDependencies?.resolveTrust ?? resolvePiProjectTrustPreflight;
+    const createSettingsManager = options.preflightDependencies?.createSettingsManager
+        ?? ((targetCwd, agentDir, projectTrusted) => SettingsManager.create(targetCwd, agentDir, { projectTrusted }));
+    const createServices = options.preflightDependencies?.createServices ?? createAgentSessionServices;
+    const trust = await resolveTrust({
+        cwd: options.cwd,
+        agentDir: options.agentDir,
+        ...(options.projectTrustPrompt === undefined ? {} : { prompt: options.projectTrustPrompt }),
+    });
+    const settingsManager = createSettingsManager(options.cwd, options.agentDir, trust.trusted);
+    const services = await createServices({ cwd: options.cwd, agentDir: options.agentDir, settingsManager });
+    return { services, trust };
+}
 export async function createPiRuntimeIntegration(options) {
-    const sessionManager = SessionManager.create(options.cwd, options.sessionDir ?? process.env.PI_CODING_AGENT_SESSION_DIR);
+    const sessionDir = options.sessionDir ?? process.env.PI_CODING_AGENT_SESSION_DIR;
+    const sessionManager = options.sessionPath === undefined
+        ? SessionManager.create(options.cwd, sessionDir)
+        : SessionManager.open(options.sessionPath, sessionDir, options.cwd);
     const createRuntime = async ({ cwd, sessionManager: targetSessionManager, sessionStartEvent, }) => {
-        const services = await createAgentSessionServices({ cwd, agentDir: options.agentDir });
+        const { services, trust } = await createPiRuntimeServicesAfterTrust({
+            cwd,
+            agentDir: options.agentDir,
+            ...(options.projectTrustPrompt === undefined ? {} : { projectTrustPrompt: options.projectTrustPrompt }),
+            ...(options.preflightDependencies === undefined ? {} : { preflightDependencies: options.preflightDependencies }),
+        });
         const modelScope = await resolveConfiguredModelScope(services);
         const hasExistingSession = targetSessionManager.buildSessionContext().messages.length > 0;
         const created = await createAgentSessionFromServices({
@@ -43,7 +66,14 @@ export async function createPiRuntimeIntegration(options) {
             ...(modelScope.thinkingLevel && !hasExistingSession ? { thinkingLevel: modelScope.thinkingLevel } : {}),
             ...(modelScope.scopedModels.length > 0 ? { scopedModels: [...modelScope.scopedModels] } : {}),
         });
-        return { ...created, services, diagnostics: [...modelScope.diagnostics] };
+        return {
+            ...created,
+            services,
+            diagnostics: [
+                ...(trust.diagnostic === null ? [] : [{ type: "warning", message: trust.diagnostic }]),
+                ...modelScope.diagnostics,
+            ],
+        };
     };
     return createAgentSessionRuntime(createRuntime, {
         cwd: options.cwd,

package/dist/integrations/pi/engine/session-integration.d.ts

@@ -31,6 +31,7 @@ export interface PiSessionCommandResult {
     readonly outcome: AgentCommandOutcome;
     readonly value?: unknown;
 }
+/** Routes neutral session commands to Pi while preserving Pi streaming and retry semantics. */
 export declare class PiSessionCommandIntegration {
     #private;
     private readonly session;

package/dist/integrations/pi/engine/session-integration.js

@@ -1,4 +1,5 @@
 import { AGENT_ENGINE_CONTRACT_VERSION, } from "../../../contracts/agent-engine/index.js";
+/** Routes neutral session commands to Pi while preserving Pi streaming and retry semantics. */
 export class PiSessionCommandIntegration {
     session;
     #lastPrompt = null;
@@ -18,7 +19,7 @@ export class PiSessionCommandIntegration {
                 return { outcome: "completed" };
             case "steer":
                 this.#lastPrompt = command.text;
-                // Match interactive Pi: prompt() owns template/extension expansion and
+                // Compatibility: match interactive Pi: prompt() owns template/extension expansion and
                 // turns the accepted steering message into the visible user row while
                 // later messages remain in the pending queue.
                 await this.session.prompt(command.text, {

package/dist/integrations/pi/engine/settings-effects.d.ts

@@ -0,0 +1,66 @@
+import type { AgentJsonValue, AgentSettingApplicationBoundary, AgentSettingChangeOutcome, AgentSettingOwner } from "../../../contracts/agent-engine/index.js";
+export type PiSettingKey = "autoCompact" | "showImages" | "imageWidthCells" | "autoResizeImages" | "blockImages" | "enableSkillCommands" | "steeringMode" | "followUpMode" | "transport" | "httpIdleTimeoutMs" | "thinkingLevel" | "theme" | "hideThinkingBlock" | "mermaidRenderingMode" | "showCacheMissNotices" | "collapseChangelog" | "enableInstallTelemetry" | "quietStartup" | "defaultProjectTrust" | "doubleEscapeAction" | "treeFilterMode" | "showHardwareCursor" | "editorPaddingX" | "outputPad" | "autocompleteMaxVisible" | "clearOnShrink" | "showTerminalProgress" | "tuiMode" | "fullscreenExitOutput" | "fullscreenScrollbar" | "warnings";
+export type PiSettingVisualClass = "none" | "transcript" | "transcript-geometry" | "editor-menu" | "queue-transcript" | "status-error" | "retry-error" | "footer-transcript" | "markdown" | "transcript-notice" | "startup-transcript" | "startup-selector" | "selector" | "terminal-cursor" | "editor-geometry" | "menu-geometry" | "terminal-frame" | "terminal-status" | "restored-parent-output" | "hidden";
+export interface PiSettingVisualEvidence {
+    /** Reviewed visual family; `none` still names the behavior that can emit styled diagnostics. */
+    readonly class: PiSettingVisualClass;
+    /** Pinned component, lifecycle, or provider-visible failure surface used as the visual authority. */
+    readonly pinnedSurface: string;
+    /** Independent pinned/A1 test or physical checkpoint that owns acceptance. */
+    readonly evidence: string;
+}
+export interface PiSettingEffectDefinition {
+    readonly application: AgentSettingApplicationBoundary;
+    readonly owner: AgentSettingOwner;
+    readonly visual: PiSettingVisualEvidence;
+    /** Bare A1 deliberately replaces this Pi behavior, so its settings UI omits the entry. */
+    readonly hiddenInBare?: true;
+}
+/**
+ * Reviewed effect authority for every generated Pi setting. Presentation remains
+ * generated; this table states who must make each accepted value observable.
+ */
+export declare const PI_SETTING_EFFECTS: Readonly<Record<PiSettingKey, PiSettingEffectDefinition>>;
+export interface PiSettingEffectHandler {
+    /** Install one value in the active owner. Handlers must be idempotent and reversible. */
+    apply(value: AgentJsonValue): void | Promise<void>;
+}
+export type PiSettingOwnerHandlers = Partial<Record<PiSettingKey, PiSettingEffectHandler>>;
+export interface PiSettingStorageOperation {
+    readonly key: PiSettingKey;
+    read(): AgentJsonValue;
+    validate(value: AgentJsonValue): void;
+    write(value: AgentJsonValue): void;
+}
+export interface PiSettingsCoordinatorOptions {
+    readonly productMode?: "bare" | "comparison";
+    readonly flush: () => Promise<void>;
+    readonly drainErrors?: () => readonly {
+        readonly error: Error;
+    }[];
+}
+/**
+ * One transactional authority for Pi setting validation, active effects,
+ * persistence, durability, rollback, and owner lifecycle.
+ */
+export declare class PiSettingsCoordinator {
+    #private;
+    constructor(operations: readonly PiSettingStorageOperation[], options: PiSettingsCoordinatorOptions);
+    bindOwner(owner: AgentSettingOwner, handlers: PiSettingOwnerHandlers): () => void;
+    unbindOwner(owner: AgentSettingOwner, keys?: readonly PiSettingKey[]): void;
+    definition(key: PiSettingKey): PiSettingEffectDefinition;
+    storedValue(key: PiSettingKey): AgentJsonValue;
+    effectiveValue(key: PiSettingKey): AgentJsonValue;
+    limitationReason(key: PiSettingKey): string | null;
+    available(key: PiSettingKey): boolean;
+    validate(key: PiSettingKey, value: AgentJsonValue): void;
+    apply(key: PiSettingKey, value: AgentJsonValue): Promise<AgentSettingChangeOutcome>;
+    flush(): Promise<void>;
+    rollback(key: PiSettingKey, value: AgentJsonValue): Promise<void>;
+}
+export declare function settingsEffectInventoryDrift(presented: readonly string[], reviewed?: readonly string[]): {
+    readonly unmapped: readonly string[];
+    readonly stale: readonly string[];
+    readonly duplicated: readonly string[];
+};
+export declare function settingsVisualInventoryViolations(presented: readonly string[], reviewed?: Readonly<Partial<Record<PiSettingKey, PiSettingEffectDefinition>>>): readonly string[];

package/dist/integrations/pi/engine/settings-effects.js

@@ -0,0 +1,249 @@
+/**
+ * Reviewed effect authority for every generated Pi setting. Presentation remains
+ * generated; this table states who must make each accepted value observable.
+ */
+export const PI_SETTING_EFFECTS = Object.freeze({
+    autoCompact: effect("live", "agent", "transcript", "compaction status, summary, completion, and failure rows", "pinned-transcript-lifecycle-parity"),
+    showImages: effect("live", "shell", "transcript", "pinned inline image and textual fallback components", "pinned-transcript-image-parity"),
+    imageWidthCells: effect("live", "shell", "transcript-geometry", "pinned image component width and clipping", "pinned-transcript-image-parity"),
+    autoResizeImages: effect("live", "agent", "none", "provider image preparation and pinned warning row", "settings-effects-provider-parity"),
+    blockImages: effect("live", "agent", "none", "provider context conversion and pinned blocked-image notice", "settings-effects-provider-parity"),
+    enableSkillCommands: effect("live", "shell", "editor-menu", "pinned command autocomplete list", "pinned-editor-input-parity"),
+    steeringMode: effect("live", "agent", "queue-transcript", "pinned steering queue and submitted prompt rows", "pinned-status-indicator-parity"),
+    followUpMode: effect("live", "agent", "queue-transcript", "pinned follow-up queue and submitted prompt rows", "pinned-status-indicator-parity"),
+    transport: effect("live", "agent", "status-error", "pinned provider request status and failure rows", "settings-effects-provider-parity"),
+    httpIdleTimeoutMs: effect("live", "agent", "retry-error", "pinned timeout, retry, and terminal failure rows", "pinned-transcript-lifecycle-parity"),
+    thinkingLevel: effect("live", "agent", "footer-transcript", "pinned footer indicator, thinking rows, and clamp notice", "pinned-status-indicator-parity"),
+    theme: hiddenEffect("live", "shell", "pinned theme selector and complete themed shell", "pinned-theme-parity"),
+    hideThinkingBlock: effect("live", "shell", "transcript", "pinned thinking block presence and spacing", "pinned-transcript-lifecycle-parity"),
+    mermaidRenderingMode: effect("live", "shell", "markdown", "pinned Mermaid Markdown transformation", "pinned-assistant-content-parity"),
+    showCacheMissNotices: effect("live", "shell", "transcript-notice", "pinned cache-miss transcript notice", "pinned-transcript-lifecycle-parity"),
+    collapseChangelog: effect("next-start", "startup", "startup-transcript", "pinned startup and command changelog components", "pi-startup-composition-parity"),
+    enableInstallTelemetry: effect("next-start", "installation", "none", "install lifecycle and its pinned failure diagnostic", "settings-effects-installation-parity"),
+    quietStartup: hiddenEffect("next-start", "startup", "pinned startup suppression lifecycle", "pi-startup-composition-parity"),
+    defaultProjectTrust: effect("next-start", "startup", "startup-selector", "pinned pre-resource project trust selector", "project-trust-startup-parity"),
+    doubleEscapeAction: effect("live", "shell", "selector", "pinned tree or fork selector", "pinned-selector-parity"),
+    treeFilterMode: effect("live", "shell", "selector", "pinned tree selector filter, rows, and hints", "pinned-selector-parity"),
+    showHardwareCursor: effect("live", "terminal", "terminal-cursor", "pinned editor, overlay, blur, failure, and exit cursor operations", "pi-terminal-operation-parity"),
+    editorPaddingX: effect("live", "shell", "editor-geometry", "pinned editor border, padding, wrapping, and cursor column", "pinned-editor-input-parity"),
+    outputPad: effect("live", "shell", "transcript-geometry", "pinned transcript, tool, status, and error horizontal padding", "pinned-transcript-lifecycle-parity"),
+    autocompleteMaxVisible: effect("live", "shell", "menu-geometry", "pinned autocomplete clipping and editor anchoring", "pinned-editor-input-parity"),
+    clearOnShrink: effect("live", "terminal", "terminal-frame", "pinned resize clearing and resulting terminal frame", "pi-terminal-operation-parity"),
+    showTerminalProgress: effect("live", "terminal", "terminal-status", "pinned OSC progress lifecycle", "pi-terminal-operation-parity"),
+    tuiMode: hiddenEffect("next-session", "shell", "pinned regular/fullscreen selector and terminal lifecycle", "pi-terminal-operation-parity"),
+    fullscreenExitOutput: effect("current-exit", "shutdown", "restored-parent-output", "pinned styled transcript and compact dim resume hint", "pinned-fullscreen-exit-parity"),
+    fullscreenScrollbar: hiddenEffect("live", "shell", "pinned fullscreen scrollbar reservation", "pi-terminal-operation-parity"),
+    warnings: effect("live", "agent", "transcript-notice", "pinned warning rows by warning part", "pinned-transcript-lifecycle-parity"),
+});
+function effect(application, owner, visualClass, pinnedSurface, evidence) {
+    return { application, owner, visual: { class: visualClass, pinnedSurface, evidence } };
+}
+function hiddenEffect(application, owner, pinnedSurface, evidence) {
+    return { application, owner, hiddenInBare: true, visual: { class: "hidden", pinnedSurface, evidence } };
+}
+/**
+ * One transactional authority for Pi setting validation, active effects,
+ * persistence, durability, rollback, and owner lifecycle.
+ */
+export class PiSettingsCoordinator {
+    #operations;
+    #handlers = new Map();
+    #state = new Map();
+    #productMode;
+    #flushStorage;
+    #drainErrors;
+    constructor(operations, options) {
+        this.#operations = new Map(operations.map(operation => [operation.key, operation]));
+        this.#productMode = options.productMode ?? "bare";
+        this.#flushStorage = options.flush;
+        this.#drainErrors = options.drainErrors;
+        for (const operation of operations) {
+            const stored = operation.read();
+            this.#state.set(operation.key, { stored, effective: stored, inconsistentReason: null });
+        }
+    }
+    bindOwner(owner, handlers) {
+        const bound = [];
+        for (const [candidate, handler] of Object.entries(handlers)) {
+            if (handler === undefined)
+                continue;
+            const key = candidate;
+            const definition = PI_SETTING_EFFECTS[key];
+            if (definition === undefined)
+                throw new Error(`unknown Pi setting effect: ${key}`);
+            if (definition.owner !== owner)
+                throw new Error(`${key} belongs to ${definition.owner}, not ${owner}`);
+            if (this.#productMode === "bare" && definition.hiddenInBare === true) {
+                throw new Error(`${key} is hidden in bare A1`);
+            }
+            this.#handlers.set(key, handler);
+            bound.push(key);
+        }
+        return () => this.unbindOwner(owner, bound);
+    }
+    unbindOwner(owner, keys) {
+        const candidates = keys ?? [...this.#handlers.keys()];
+        for (const key of candidates)
+            if (PI_SETTING_EFFECTS[key].owner === owner)
+                this.#handlers.delete(key);
+    }
+    definition(key) {
+        return PI_SETTING_EFFECTS[key];
+    }
+    storedValue(key) {
+        const operation = this.#requireOperation(key);
+        const stored = operation.read();
+        const state = this.#requireState(key);
+        state.stored = stored;
+        return stored;
+    }
+    effectiveValue(key) {
+        return this.#requireState(key).effective;
+    }
+    limitationReason(key) {
+        const definition = PI_SETTING_EFFECTS[key];
+        if (this.#productMode === "bare" && definition.hiddenInBare === true)
+            return "setting is not available in the active product mode";
+        const inconsistent = this.#requireState(key).inconsistentReason;
+        if (inconsistent !== null)
+            return inconsistent;
+        if (!this.#handlers.has(key))
+            return `${definition.owner} effect is not bound for ${definition.application} application`;
+        return null;
+    }
+    available(key) {
+        return this.limitationReason(key) === null;
+    }
+    validate(key, value) {
+        this.#requireOperation(key).validate(value);
+    }
+    async apply(key, value) {
+        const operation = this.#requireOperation(key);
+        operation.validate(value);
+        const definition = PI_SETTING_EFFECTS[key];
+        const previousStored = operation.read();
+        const state = this.#requireState(key);
+        const previousEffective = state.effective;
+        const limitationReason = this.limitationReason(key);
+        if (limitationReason !== null) {
+            return outcome("unavailable", definition.application, previousStored, previousEffective, null, limitationReason);
+        }
+        const handler = this.#handlers.get(key);
+        if (definition.application !== "live") {
+            try {
+                operation.write(value);
+                await this.flush();
+                state.stored = value;
+                return outcome("deferred", definition.application, value, previousEffective, null, null);
+            }
+            catch (error) {
+                const failure = await this.#restorePersistence(operation, previousStored, error);
+                state.stored = operation.read();
+                return outcome("failed", definition.application, state.stored, previousEffective, failure, null);
+            }
+        }
+        try {
+            await handler.apply(value);
+        }
+        catch (error) {
+            return outcome("failed", definition.application, previousStored, previousEffective, describe(error), null);
+        }
+        state.effective = value;
+        try {
+            operation.write(value);
+            await this.flush();
+            state.stored = value;
+            state.inconsistentReason = null;
+            return outcome("applied", definition.application, value, value, null, null);
+        }
+        catch (error) {
+            const persistenceFailure = await this.#restorePersistence(operation, previousStored, error);
+            try {
+                await handler.apply(previousEffective);
+                state.effective = previousEffective;
+                state.stored = operation.read();
+                return outcome("failed", definition.application, state.stored, previousEffective, persistenceFailure, null);
+            }
+            catch (rollbackError) {
+                state.stored = operation.read();
+                state.inconsistentReason = `rollback failed after ${persistenceFailure}: ${describe(rollbackError)}`;
+                return outcome("failed", definition.application, state.stored, state.effective, state.inconsistentReason, state.inconsistentReason);
+            }
+        }
+    }
+    async flush() {
+        await this.#flushStorage();
+        const errors = this.#drainErrors?.() ?? [];
+        if (errors.length > 0)
+            throw new Error(errors.map(value => value.error.message).join("; "));
+    }
+    async rollback(key, value) {
+        const handler = this.#handlers.get(key);
+        if (handler === undefined)
+            throw new Error(`cannot roll back unbound setting: ${key}`);
+        await handler.apply(value);
+        this.#requireState(key).effective = value;
+    }
+    async #restorePersistence(operation, previous, cause) {
+        const original = describe(cause);
+        try {
+            operation.write(previous);
+            await this.flush();
+            return original;
+        }
+        catch (rollbackError) {
+            return `${original}; persistence rollback failed: ${describe(rollbackError)}`;
+        }
+    }
+    #requireOperation(key) {
+        const operation = this.#operations.get(key);
+        if (operation === undefined)
+            throw new Error(`setting is unavailable: ${key}`);
+        return operation;
+    }
+    #requireState(key) {
+        const state = this.#state.get(key);
+        if (state === undefined)
+            throw new Error(`setting state is unavailable: ${key}`);
+        return state;
+    }
+}
+export function settingsEffectInventoryDrift(presented, reviewed = Object.keys(PI_SETTING_EFFECTS)) {
+    const reviewedSet = new Set(reviewed);
+    const presentedSet = new Set(presented);
+    const counts = new Map();
+    for (const key of reviewed)
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    return {
+        unmapped: presented.filter(key => !reviewedSet.has(key)),
+        stale: reviewed.filter(key => !presentedSet.has(key)),
+        duplicated: [...counts].filter(([, count]) => count > 1).map(([key]) => key),
+    };
+}
+export function settingsVisualInventoryViolations(presented, reviewed = PI_SETTING_EFFECTS) {
+    const violations = [];
+    for (const candidate of presented) {
+        const key = candidate;
+        const definition = reviewed[key];
+        if (definition === undefined) {
+            violations.push(`${candidate}: missing visual classification`);
+            continue;
+        }
+        const visual = definition.visual;
+        if (!visual || visual.pinnedSurface.trim().length === 0)
+            violations.push(`${candidate}: missing pinned visual source`);
+        if (!visual || visual.evidence.trim().length === 0)
+            violations.push(`${candidate}: missing independent visual evidence`);
+        if (definition.hiddenInBare === true && visual?.class !== "hidden")
+            violations.push(`${candidate}: hidden setting declares a visible frame`);
+        if (definition.hiddenInBare !== true && visual?.class === "hidden")
+            violations.push(`${candidate}: visible setting declares hidden evidence`);
+    }
+    return violations;
+}
+function outcome(status, application, storedValue, effectiveValue, failure, limitationReason) {
+    return { status, application, storedValue, effectiveValue, failure, limitationReason };
+}
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/integrations/pi/engine/settings-integration.d.ts

@@ -1,43 +1,28 @@
 import type { SettingsManager } from "@earendil-works/pi-coding-agent";
-import type { AgentJsonValue, AgentSettingDescriptor, AgentSettingsPort } from "../../../contracts/agent-engine/index.js";
-/**
- * Values only the running engine knows: the themes installed on this machine and
- * the thinking levels this session supports. The boundary asks for them as it is
- * read, so no layer above has to know they are not fixed.
- */
+import type { AgentJsonValue, AgentSettingChangeOutcome, AgentSettingDescriptor, AgentSettingOwner, AgentSettingsPort } from "../../../contracts/agent-engine/index.js";
+import { type PiSettingOwnerHandlers } from "./settings-effects.js";
+/** Values only the running engine knows. */
 export interface PiSettingsProviders {
     readonly themes?: () => readonly string[];
     readonly thinkingLevels?: () => readonly string[];
+    readonly productMode?: "bare" | "comparison";
 }
-/**
- * The engine stores a theme as one string with two forms: a theme's name, or a
- * `light/dark` pair meaning "follow the terminal". That grammar is the engine's,
- * so it is parsed and composed here and reaches the surfaces above as ordinary
- * settings — a theme entry that offers `automatic`, and, while automatic, one
- * entry per terminal appearance.
- */
 export declare const AUTOMATIC_THEME = "automatic";
 interface AutomaticTheme {
     readonly light: string;
     readonly dark: string;
 }
-/** A stored theme is automatic when it names one theme per terminal appearance. */
 export declare function parseAutomaticTheme(stored: string): AutomaticTheme | null;
-/**
- * The settings A1 exposes: the ones the engine presents. Kept as the engine's
- * own inventory rather than a list beside it, so a setting it adds or renames
- * shows up as a named test failure instead of quietly going missing.
- */
 export declare const EXPOSED_SETTING_KEYS: readonly string[];
-/**
- * What has drifted between the settings the engine presents and the settings A1
- * maps to its API: the ones A1 has not caught up with, and the ones it kept
- * after the engine dropped them. Either is a build failure with a name in it.
- */
 export declare function settingsInventoryDrift(presented: readonly string[], mapped: readonly string[]): {
     readonly unmapped: readonly string[];
     readonly stale: readonly string[];
 };
+/**
+ * Pi settings boundary backed by the transactional settings coordinator. The
+ * generated metadata owns presentation while the reviewed effect registry owns
+ * timing, availability, and active behavior.
+ */
 export declare class PiSettingsIntegration implements AgentSettingsPort {
     #private;
     private readonly settings;
@@ -46,10 +31,13 @@ export declare class PiSettingsIntegration implements AgentSettingsPort {
         flush: boolean;
     };
     constructor(settings: SettingsManager, providers?: PiSettingsProviders);
+    bindOwner(owner: AgentSettingOwner, handlers: PiSettingOwnerHandlers): () => void;
+    unbindOwner(owner: AgentSettingOwner): void;
     listSettings(): Promise<readonly AgentSettingDescriptor[]>;
     readSetting(key: string): Promise<AgentJsonValue | undefined>;
-    writeSetting(key: string, value: AgentJsonValue): Promise<void>;
-    writeSettingNow(key: string, value: AgentJsonValue): void;
+    writeSetting(key: string, value: AgentJsonValue): Promise<AgentSettingChangeOutcome>;
+    /** Shared route used by the pinned selector and owned settings surface. */
+    writeSettingNow(key: string, value: AgentJsonValue): Promise<AgentSettingChangeOutcome>;
     flush(): Promise<void>;
 }
 export {};