@underactive/pi-topping-moa-fusion 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.4.4]
+
+### Added
+
+- Added the opt-in `minimalFanoutHeader` setting to hide the phase/model band and shimmer the active phase name in all progress tables.
+
+### Changed
+
+- Verified compatibility with pi 1.1.0: no pi export this extension imports was removed or changed, and typecheck and the full test suite pass against 1.1.0.
+- Updated all four pi development dependencies from 1.0.3 to 1.1.0.
+- README and related comments clarify planning, verification, and subagent tool behavior.
+
+### Fixed
+
+- Fan-out, synthesis, verification, debate, and implementation cost rows no longer overstate cost for tiered-price models (e.g. Claude Haiku 5.5). The displayed cost is now the sum of the per-response costs the child reports, each priced at its own tier. Registry rates over cumulative tokens are used only when the child reports no cost.
+- On pi 1.0.4 and later, pi's built-in MCP `codemode`/`tool_search` tools stay available under a `--tools` allowlist, so a read-only child that loads all extensions (extension-registered providers) could reach write-capable MCP servers. Those children now run with `--no-mcp`. Support is probed on the pi executable the child spawns, not the locally installed pi package. Default and isolated children already exclude built-in MCP through `--no-extensions` and are unchanged. Failed or indeterminate version probes are not cached, so later children can retry the capability check.
+- Cancelling an implementation while a tool is running no longer starts the verifier; the Implement row settles as cancelled. A provider error before any assistant reply still offers the retry. Hosts without an `agent_before_settle` boundary still dispatch verification for normal completed implementations. Known limit: on pi before 1.1, a cancel that arrives just as the implementation turn finishes can still start the verifier.
+- `/mf-plan` proposers, synthesizer, and verifier, `/mf-opinion`, `/mf-debate`, and the `mf_plan_subagent` tool no longer fail to spawn a child for `litellm-auto/*` (or any extension-registered virtual model). Such models are registered via pi's `registerVirtualModel`, which keeps their provider out of `getRegisteredProviderIds()`, so the child was launched with a plain `--no-extensions`, stripped the autorouter extension, and died with `Model "litellm-auto/auto" not found`. Extension-registered virtual models are now detected by pi's virtual-model api id and load extensions in the child, matching native extension providers such as claude-bridge.
+- Control characters cannot reach verifier or debate tasks, the observer transcript, or the verification findings popup. This prevents malformed child output from breaking a subprocess argument or controlling the terminal.
+- Long newline-delimited child stdout events are no longer truncated before parsing.
+- The minimal fan-out header keeps inactive phase headings dim.
+- The selected conflict tab in the plan review overlay now uses a wider label with wrapping. Inactive tabs keep the short width on the same row.
+
 ## [0.4.3]
 
 ### Changed

package/README.md

@@ -81,7 +81,7 @@ Fanning out a coding task and merging the resulting token streams does not work
 5. If the proposers substantively disagreed, a conflict-review overlay opens first: one tab per conflict, plain-language options, the synthesized pick tagged **(Recommended)**, and a **Chat about this** box for free-text feedback. Your resolutions are fed back for re-synthesis. Esc cancels the whole run.
 6. The plan opens in the same review overlay `exit_plan_mode` uses, where you can inspect any proposer's original plan, edit the synthesized one, or send the synthesizer feedback for a revised version (up to five rounds).
 7. On approval, the synthesizer makes one read-only pass to create a frozen observable checklist at `.pi/mf-plan/<slug>__criteria.md`, then plan mode exits and implementation begins in the current session using the implementer you already picked — there is **no** second picker (the single-model flow picks its implementing model up front when you choose **Single model**, and neither flow shows a model picker after approval — one appears only via `/mf-plan-implement`, or when an MoA run is resumed without a saved roster). If implementation fails (for example, auth expiration or provider error), an automatic recovery dialog prompts to retry, switch to a different model, or continue manually. You can also run `/mf-plan-implement` anytime to resume the approved plan.
-8. Once the implementation turn settles, the **verification phase** runs when a verifier is configured: the project's own `check` / `lint` / `test` scripts run first, then a read-only `moa-verifier` subprocess judges the working tree against the frozen approved plan and scores every frozen criterion pass/fail/cannot-verify. The overall verdict is derived from those scores. If criteria are unavailable, it falls back to judging plan steps directly. If it finds gaps (or a check fails), the repair prompt shows a short Simplified Technical English summary, then the verifier summary, unmet criteria or gaps, and failing project checks, followed in the TUI by three choices in order: *View full findings*, *Send verifier findings to the implementer* (a bounded **repair round**, up to the [max verification repairs](#max-verification-repairs) setting — two by default), and *Accept implementation as-is*. *View full findings* opens the complete verifier report in a read-only, scrollable popup and, when closed, returns to the same three choices, so viewing never consumes a repair round. A repair round sends the findings back to the implementer and re-verifies. The raw verdict is saved next to the plan as `<slug>__verification.md`. Once the repair budget is spent, a handoff file is written as `<slug>__verification-handoff.md` and named in the exhaustion notification. A user-cancelled implementation is never verified.
+8. Once the implementation turn settles, the **verification phase** runs when a verifier is configured: the project's own `check` / `lint` / `test` scripts run first, then a read-only `moa-verifier` subprocess judges the working tree against the frozen approved plan and scores every frozen criterion pass/fail/cannot-verify. The overall verdict is derived from those scores. If criteria are unavailable, it falls back to judging plan steps directly. If it finds gaps (or a check fails), the repair prompt shows a short Simplified Technical English summary, then the verifier summary, unmet criteria or gaps, and failing project checks, followed in the TUI by three choices in order: *View full findings*, *Send verifier findings to the implementer* (a bounded **repair round**, up to the [max verification repairs](#max-verification-repairs) setting — two by default), and *Accept implementation as-is*. *View full findings* opens the complete verifier report in a read-only, scrollable popup and, when closed, returns to the same three choices, so viewing never consumes a repair round. A repair round sends the findings back to the implementer and re-verifies. The raw verdict is saved next to the plan as `<slug>__verification.md`. Once the repair budget is spent, a handoff file is written as `<slug>__verification-handoff.md` and named in the exhaustion notification. The verifier normally skips a user-cancelled implementation. On pi before 1.1, a cancel arriving as the turn settles can still start verification; on pi before 0.87, a mid-tool cancel may also be verified because the before-settle gate is unavailable.
 
 Before building the full verification task, MoA Fusion runs a cheap verifier preflight that asks for a one-word response. Auth, quota, model, and liveness problems therefore surface quickly with an actionable child error instead of after the full audit attempt.
 
@@ -122,7 +122,9 @@ Rows are grouped under `── Plan`, `── Synthesize`, `── Implement`, a
 - **CTX** — how much of that model's context window its latest turn is using.
 - **MONITOR** — an activity meter of *generated output* rate, independent of CTX: an agent can be deep into its context window and idle, or near empty and generating hard. Uses provider-reported token counts when available, otherwise word counts of the streamed deltas. Each row's meter is tinted with the thinking level that row is running under, using that level's native theme colour (`off` through `max`), so you can read a row's effort at a glance; the hue is tracked per row, so the same model can show different colours in different slots and it follows retries, model swaps, verifier fallback, and resumed runs. A row whose level is unknown falls back to the neutral accent colour, and idle cells and settled traces keep their usual dimming under whichever hue applies.
 - **ACTIVITY** — what the agent is doing, with its current tool call beneath, its tool name and argument highlighted with pi's own bold `toolTitle`/`accent` theme colours.
-- **TURNS** / **TOOLS** / **COST** / **TIME** — assistant turns completed, tool calls started, registry-rate model cost, and elapsed time. All freeze when the agent settles.
+- **TURNS** / **TOOLS** / **COST** / **TIME** — assistant turns completed, tool calls started, model cost (the sum of the cost reported for each response; registry rates over the token totals only when no cost is reported), and elapsed time. All freeze when the agent settles.
+
+With the [minimal fan-out header](#minimal-fan-out-header) setting on, the band is hidden and the active phase's heading (for example `── Plan`) shimmers instead; per-phase models then appear only in each row's MODEL cell.
 
 While an agent is working, its row also shows a dim, guttered preview of the latest four wrapped lines from the same transcript used by Observe. The preview follows the newest output automatically; short terminals reduce or drop preview lines after preserving tool activity, and narrow terminals omit previews entirely.
 
@@ -248,7 +250,12 @@ Seven agent definitions ship with the extension. Two belong to the single-model
 
 MoA never invokes `moa-explore` or `mf-plan` — each `moa-proposer` is a self-contained fusion of both roles, doing its own exploration so the proposals stay independent. The plan-only tools (`write_plan`, `exit_plan_mode`, and `mf_plan_subagent`) are active only while `/mf-plan` or single-model plan mode is on.
 
-Every planning subprocess is forced through a runtime `read,grep,find,ls` allowlist, even when an installed agent definition is stale, customized, or omits its `tools` field.
+Every planning subprocess is forced through a runtime `read,grep,find,ls` allowlist, even when an installed agent definition is stale, customized, or omits its `tools` field. Pi's built-in MCP is also kept out of every child: `--no-extensions` excludes it, and children that must load all extensions (extension-registered providers) run with `--no-mcp` on pi 1.0.4 and later, where MCP tools would otherwise stay available under the allowlist.
+
+**Agentic provider bridges.** Some pi providers are not plain chat-completion APIs but bridges to full coding agents with their *own* local edit/shell tools (e.g. pi-cursor-bridge, whose models run Cursor agents in the repo cwd). Pi's tool allowlist cannot restrain those agent-side tools, so plan mode adds two more layers:
+
+- **Read-only env handshake** — every planning subprocess is spawned with `PI_CURSOR_FORCE_MODE=plan`, and the parent session sets it while plan mode is active. cursor-bridge maps this to Cursor's native read-only *plan* mode (SDK `mode: "plan"`; CLI `--mode plan` without `--force`).
+- **Mutation tripwire** — `git status --porcelain` is snapshotted before subagents launch and re-checked after every phase. If the working tree changed while planning agents ran, a warning lists the touched files so rogue edits are never silently absorbed.
 
 ### Choosing their models
 
@@ -266,6 +273,8 @@ thinking: off
 
 `/mf-plan-settings` writes these two fields for you, but editing the file by hand works equally well — the overlay reads its current values back. An unrecognized `thinking:` value is ignored rather than passed to the subprocess.
 
+**First run.** Until the setup overlay has been saved once, `/mf-plan` opens it — set up agents and rosters before planning — instead of the plan prompt. Only interactive TUI sessions are gated; headless plan mode is unaffected.
+
 #### Agent rosters
 
 The MoA roles (proposers, synthesizer, implementer, verifier) are no longer assigned one-by-one in `/mf-plan-settings`. Instead the overlay's **agent rosters** row manages named rosters — reusable sets that assign a model + thinking level to every MoA role at once (2–5 proposers plus the three required roles; a roster must be complete to save). Each run, the picker's **Load Roster** row applies a roster to every slot wholesale — a 2-proposer roster also clears stale picks from slots 3–5 — and slots whose model is no longer callable are skipped with a warning while the rest load normally.
@@ -311,12 +320,17 @@ The **max verification repairs** row in `/mf-plan-settings` controls how many au
 
 The default is **2**. Set **0** to disable automatic repair offers — verification still runs, but gaps go straight to an exhaustion notification. When repairs are exhausted or disabled, MoA Fusion writes `.pi/mf-plan/<slug>__verification-handoff.md` with each criterion's pass/fail status, the full frozen criteria checklist, gaps, and failing project checks so you can continue the fix/verification loop manually (for example via `/mf-plan-implement`). The exhaustion notification includes the handoff file path.
 
-**First run.** Until the setup overlay has been saved once, `/mf-plan` opens it — set up agents and rosters before planning — instead of the plan prompt. Only interactive TUI sessions are gated; headless plan mode is unaffected.
+#### Minimal fan-out header
 
-**Agentic provider bridges.** Some pi providers are not plain chat-completion APIs but bridges to full coding agents with their *own* local edit/shell tools (e.g. pi-cursor-bridge, whose models run Cursor agents in the repo cwd). Pi's tool allowlist cannot restrain those agent-side tools, so plan mode adds two more layers:
+The **minimal fan-out header** row in `/mf-plan-settings` hides the phase/model band and makes the active phase name shimmer. Press Space on the row to turn it on or off. The option applies to the plan, resumed-implementation, opinion, and debate tables. On truecolor themes, the sweep covers the phase name alone — the `── ` prefix and the trailing rule stay flat; other themes show a flat highlight on the name.
 
-- **Read-only env handshake** — every planning subprocess is spawned with `PI_CURSOR_FORCE_MODE=plan`, and the parent session sets it while plan mode is active. cursor-bridge maps this to Cursor's native read-only *plan* mode (SDK `mode: "plan"`; CLI `--mode plan` without `--force`).
-- **Mutation tripwire** — `git status --porcelain` is snapshotted before subagents launch and re-checked after every phase. If the working tree changed while planning agents ran, a warning lists the touched files so rogue edits are never silently absorbed.
+The setting persists in `~/.pi/agent/mf-plan/settings.json`:
+
+```json
+{ "minimalFanoutHeader": false }
+```
+
+The default is **off**. A missing or non-boolean value also means off. Each row still shows its model in the MODEL cell. A resumed implementation table has no Plan or Synthesize rows, so it does not show those model names. The setting is read once when a run starts, so edits apply to the next run, not one already in progress.
 
 ### Parallel execution
 
@@ -356,6 +370,7 @@ src/
 ├── activityMeter.ts         # Dependency-free output-rate meter
 ├── shared/
 │   ├── modelRefs.ts         # Model refs, thinking levels, display labels
+│   ├── controlChars.ts      # Control-character stripping for argv and display
 │   └── functionKeys.ts      # F-key press matching (incl. Kitty encoding)
 ├── config/
 │   ├── settings.ts          # Persistent MoA settings
@@ -373,6 +388,7 @@ src/
 │   ├── activityTracking.ts  # Streaming output/activity assembly
 │   ├── results.ts           # Runner result classification/output helpers
 │   ├── cancelRun.ts         # Per-agent cancellation bookkeeping
+│   ├── piCapabilities.ts    # Flag-support probes for the spawned pi executable
 │   └── mutationTripwire.ts  # Working-tree mutation detection
 ├── opinion/
 │   ├── runOpinion.ts        # Interactive opinion command orchestration
@@ -396,11 +412,13 @@ src/
 │   ├── planFile.ts          # Slugs, plan files, proposal staging
 │   ├── instructions.ts      # Injected 5-phase plan-mode instructions
 │   ├── askUserQuestion.ts   # rpiv questionnaire detection and blocked-state tracking
+│   ├── contextEdits.ts      # Plan-mode context omission and verification-pending helpers
 │   └── tools/
 │       ├── shared.ts
 │       ├── enterPlanMode.ts # Interactive entry flow, ESC listener, agent tool
 │       ├── writePlan.ts
 │       ├── exitPlanMode.ts
+│       ├── structuredResults.ts # Structured result schemas for plan-mode tools
 │       └── mfPlanSubagent.ts
 ├── moa/
 │   ├── orchestration.ts     # Outer phase sequencer and run cleanup
@@ -418,6 +436,7 @@ src/
 │   ├── conflictContract.ts  # Conflict-surfacing task-text contract
 │   ├── contextContract.ts   # Context-subsection (auditable reasoning) contract
 │   ├── planInfo.ts          # Persisted MoA metadata validation
+│   ├── panelDependence.ts   # Proposer model-dependence and diversity summaries
 │   ├── verdicts.ts
 │   └── planlessRetry.ts
 └── ui/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@underactive/pi-topping-moa-fusion",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Pi extension implementing /mf-plan — Claude Code-style 5-phase plan mode with a Mixture-of-Agents proposer/synthesizer pipeline.",
   "keywords": [
     "pi-package",
@@ -50,10 +50,10 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "1.0.3",
-    "@earendil-works/pi-ai": "1.0.3",
-    "@earendil-works/pi-coding-agent": "1.0.3",
-    "@earendil-works/pi-tui": "1.0.3",
+    "@earendil-works/pi-agent-core": "1.1.0",
+    "@earendil-works/pi-ai": "1.1.0",
+    "@earendil-works/pi-coding-agent": "1.1.0",
+    "@earendil-works/pi-tui": "1.1.0",
     "@types/node": "^24.0.0",
     "typebox": "^1.3.3",
     "typescript": "^5.8.0"

package/src/config/planName.ts

@@ -22,7 +22,7 @@ export interface PlanNameOptions {
 	signal?: AbortSignal;
 }
 
-/** Call the active model to summarize a plan prompt into a 4-word slug. */
+/** Summarize a plan prompt into a 4-word slug with the cheap/fast model (the active model when none is set), or return a random phrase when summary names are off. */
 export async function summarizePlanPromptName(ctx: ExtensionContext, prompt: string, options?: PlanNameOptions): Promise<string> {
 	const fallback = () => slugifyPlanName(prompt);
 

package/src/config/settings.ts

@@ -73,6 +73,8 @@ export interface MoaConfig {
 	autoResolveConflicts: boolean;
 	/** Use LLM-summarized plan names (true) or random adjective-adjective-noun phrases (false). */
 	useSummaryName: boolean;
+	/** Hide the phase/model band above the MoA table and shimmer the active phase name instead. Defaults to false. */
+	minimalFanoutHeader: boolean;
 	/**
 	 * Whether the user has been through the setup overlay at least once. Gates the
 	 * first `/mf-plan` into setup. Kept here rather than inferred from the agent
@@ -99,6 +101,7 @@ function emptyConfig(): MoaConfig {
 		rosters: [],
 		autoResolveConflicts: false,
 		useSummaryName: true,
+		minimalFanoutHeader: false,
 		agentDefaultsConfigured: false,
 	};
 }
@@ -147,10 +150,12 @@ function parseSettingsFile(path: string): MoaConfig {
 			? parsed.useSummaryName
 			: true;
 
+		const minimalFanoutHeader = parsed.minimalFanoutHeader === true;
+
 		const agentDefaultsConfigured = parsed.agentDefaultsConfigured === true;
 		const rosters = parseRosters(parsed.rosters);
 
-		return { mode, proposers, opinionModels, debateModels, debateRounds, maxConcurrentAgents, maxVerificationRepairs, synthesizer, implementer, verifier, cheap, thinkingOverrides, rosters, autoResolveConflicts, useSummaryName, agentDefaultsConfigured };
+		return { mode, proposers, opinionModels, debateModels, debateRounds, maxConcurrentAgents, maxVerificationRepairs, synthesizer, implementer, verifier, cheap, thinkingOverrides, rosters, autoResolveConflicts, useSummaryName, minimalFanoutHeader, agentDefaultsConfigured };
 	} catch (err) {
 		console.error("mf-plan: failed to parse settings, using defaults:", err);
 		return emptyConfig();

package/src/debate/debateContract.ts

@@ -1,4 +1,5 @@
 import { buildRetryCorrection } from "../moa/planlessRetry.ts";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 
 export const DEBATE_TASK_PREAMBLE =
 	"You are a read-only DEBATER in a multi-round debate between several models. Your output is shown verbatim to the user and reaches your peer debaters — there is no judge, and no agent will merge or verify anything — so argue to convince your peers. You may keep or change your stance in any round. Do not implement anything, edit files, or run commands, builds, or tests; read-only tools are expected and never a blocker. You are running headless: resolve open questions with stated assumptions rather than asking the user or waiting. The required output sections (including the `## Position` argument and the `## Stance` declaration with its `**Stance:**` value) are spelled out in the agent instructions.";
@@ -38,7 +39,7 @@ export function debaterLabel(index: number): string {
 const MAX_PRIOR_CHARS = 16_000;
 
 function quotePrior(text: string): string {
-	const trimmed = text.trim();
+	const trimmed = stripControlCharacters(text).trim();
 	const prior = trimmed.length > MAX_PRIOR_CHARS
 		? `${trimmed.slice(0, MAX_PRIOR_CHARS)}\n[prior position truncated]`
 		: trimmed;

package/src/debate/runDebate.ts

@@ -93,6 +93,7 @@ export async function runInteractiveDebate(
 					title: "MoA Debate",
 					phaseLabels: { Plan: "Debate" },
 					fanoutWorkingText: "round 1 · forming positions",
+					minimalFanoutHeader: settings.minimalFanoutHeader,
 				},
 				slug,
 			);

package/src/moa/modelRuntime.ts

@@ -8,8 +8,27 @@ import { loadMoaConfig, saveMoaConfig } from "../config/settings.ts";
 import type { UsageStats } from "../runtime/results.ts";
 import { modelRefLabel, type ModelRef, type ThinkingLevel } from "../shared/modelRefs.ts";
 
+/**
+ * pi's internal `api` id for extension-registered virtual models (the autorouter's
+ * `litellm-auto/*`). pi does not export the constant, so mirror the value the
+ * autorouter extension pins in its own catalog.ts.
+ */
+const VIRTUAL_MODEL_API = "pi-virtual";
+
+/**
+ * Whether routing this model in a child subprocess requires loading the extension that
+ * registered its provider. True for native extension providers (claude-bridge) — surfaced by
+ * getRegisteredProviderIds() — and for virtual models registered via registerVirtualModel
+ * (litellm-auto/*). A virtual model's provider never reaches getRegisteredProviderIds():
+ * registerVirtualModel keeps it in a separate virtual-model map, so a child spawned with a plain
+ * --no-extensions cannot resolve `litellm-auto/auto` and dies with "Model not found". External
+ * extensions can register virtual models too, so this keys off pi's virtual-model api id rather
+ * than a hardcoded provider name.
+ */
 export function modelUsesExtensionRegisteredProvider(ctx: ExtensionContext, ref: ModelRef): boolean {
-	return ctx.modelRegistry.getRegisteredProviderIds().includes(ref.provider);
+	if (ctx.modelRegistry.getRegisteredProviderIds().includes(ref.provider)) return true;
+	// Only an extension can register a virtual (api === "pi-virtual") model, so one mandates loadExtensions in the child.
+	return ctx.modelRegistry.find(ref.provider, ref.id)?.api === VIRTUAL_MODEL_API;
 }
 
 export function cursorBridgeExtensionPath(): string | undefined {
@@ -44,8 +63,15 @@ export function resolveContextWindow(ctx: ExtensionContext, ref: ModelRef): numb
 	return ctx.modelRegistry.find(ref.provider, ref.id)?.contextWindow;
 }
 
-/** Calculate cumulative cost from the registry rates and the runner's token totals. */
+/**
+ * Cost for a role's usage. Prefers the per-response costs the child reported
+ * (already summed in `usage.cost`), because each response is priced at its own
+ * tier. Falls back to the registry rates over cumulative token totals only
+ * when the child reported no cost; for tiered models that fallback prices the
+ * summed tokens as one request and can overstate the cost.
+ */
 export function resolveModelCost(ctx: ExtensionContext, ref: ModelRef, usage: UsageStats): number | undefined {
+	if (typeof usage.cost === "number" && Number.isFinite(usage.cost) && usage.cost > 0) return usage.cost;
 	const model = ctx.modelRegistry.find(ref.provider, ref.id);
 	if (!model) return undefined;
 	const cost = calculateCost(model, {

package/src/moa/orchestration.ts

@@ -31,6 +31,7 @@ export async function runMoaOrchestration(
 			session.closeOverlay?.();
 			runContext.observeSession?.closeOverlay?.();
 		},
+		minimalFanoutHeader: loadMoaConfig().minimalFanoutHeader,
 	}, host.getPlanRepoSlug());
 	host.setRunningProgressWidget(widget);
 	widget.setPhaseModels({

package/src/moa/planlessRetry.ts

@@ -4,7 +4,7 @@ import { stripControlCharacters } from "../shared/controlChars.ts";
  * Recovery for planning agents that exit cleanly without delivering a plan.
  *
  * Bridged agentic providers can override the moa-proposer/moa-synthesizer
- * prompt with their own interactive harness, producing two planless shapes:
+ * prompt with their own interactive harness, producing three planless shapes:
  *
  * - Question stops: Cursor's plan mode researches and then stops to ask the
  *   user a clarifying question before writing the plan. In a headless
@@ -18,8 +18,8 @@ import { stripControlCharacters } from "../shared/controlChars.ts";
  *   prompt never sees the required output sections, explores interactively,
  *   and exits with questions or prose instead of a plan.
  *
- * These helpers detect both shapes so the orchestrator can re-run the agent
- * once with an explicit instruction to answer its own questions / emit the
+ * These helpers detect all three shapes so the orchestrator can re-run the
+ * agent once with an explicit instruction to answer its own questions / emit the
  * plan, and carry the read-only planning contract inside the task text —
  * the only channel guaranteed to survive a bridge's prompt override.
  */

package/src/moa/verdicts.ts

@@ -12,7 +12,6 @@
  */
 
 import { parseConflicts } from "./conflicts.ts";
-import { buildRetryCorrection } from "./planlessRetry.ts";
 
 const VERDICTS_SECTION_RE = /^##\s*Proposer Verdicts\s*$/m;
 const VERDICT_BULLET_RE = /^[-*]\s+\*\*(Proposer \d+):?\*\*:?\s*(.+)$/gm;
@@ -75,7 +74,3 @@ export function missingVerdictSlots(verdictsMarkdown: string | null, labels: str
 export function buildVerdictRetryHeader(missing: string[]): string {
 	return `IMPORTANT: Your previous output (quoted below) is rejected because it does not prove you evaluated every proposal: no verdict was found for ${missing.join(", ")}. Re-read those proposals from your input now and re-emit the COMPLETE plan including a \`## Proposer Verdicts\` section with one \`- **Proposer N:** adopted | partial | rejected — reason\` bullet for every proposal you received. Do not drop or alter the rest of the plan beyond what re-evaluating those proposals requires.`;
 }
-
-export function buildVerdictRetryTask(originalTask: string, previousOutput: string, missing: string[]): string {
-	return [originalTask, "", "---", "", buildRetryCorrection(buildVerdictRetryHeader(missing), previousOutput)].join("\n");
-}

package/src/moa/verification.ts

@@ -35,6 +35,7 @@ import { CancelRun, type CancelSession } from "../runtime/cancelRun.ts";
 import { formatMutationWarning, MutationTripwire } from "../runtime/mutationTripwire.ts";
 import { getFinalOutput, getResultOutput, isFailedResult, type SingleResult } from "../runtime/results.ts";
 import { runSingleAgent } from "../runtime/runner.ts";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 import { modelRefLabel, TRIGGER_TURN } from "../shared/modelRefs.ts";
 import { activityLoopCount } from "../ui/agentStatus.ts";
 import { showVerificationFindings } from "../ui/verificationFindingsOverlay.ts";
@@ -170,26 +171,30 @@ export function buildVerifierTask(input: {
 	criteria?: VerificationCriterion[];
 }): string {
 	const { plan, implementerReport, diff, scriptResults, criteria } = input;
-	const reportSection = implementerReport && implementerReport.trim()
-		? implementerReport.trim()
-		: "(The implementer produced no final summary message.)";
+	const safePlan = stripControlCharacters(plan);
+	const safeCriteria = criteria?.map((criterion) => ({
+		id: stripControlCharacters(criterion.id),
+		text: stripControlCharacters(criterion.text),
+	}));
+	const report = implementerReport ? stripControlCharacters(implementerReport).trim() : "";
+	const reportSection = report || "(The implementer produced no final summary message.)";
 	const diffSection = diff && diff.trim()
 		? diff.trim()
 		: "(No git diff available — not a git repository, or no changes detected.)";
-	const outputContract = criteria?.length
-		? `## Required output format\n\nEmit exactly these sections at the end of your reply:\n\n## Criteria Verdicts\n${criteria.map((criterion) => `- **${criterion.id}:** pass | fail | cannot-verify — <evidence: file:line or what is missing>`).join("\n")}\n(one bullet per supplied criterion; no IDs skipped)\n\n## Deviations\n- <anything implemented differently> (or "None.")\n\n## Verification Result\n**Verdict:** complete | partial | incomplete | cannot-verify\n**Summary:** <one paragraph>\n\n### Gaps\n- <unmet criterion> — <evidence>\n\nUse complete only when every criterion is pass and every provided check passed. Prefer cannot-verify over a guessed pass.`
+	const outputContract = safeCriteria?.length
+		? `## Required output format\n\nEmit exactly these sections at the end of your reply:\n\n## Criteria Verdicts\n${safeCriteria.map((criterion) => `- **${criterion.id}:** pass | fail | cannot-verify — <evidence: file:line or what is missing>`).join("\n")}\n(one bullet per supplied criterion; no IDs skipped)\n\n## Deviations\n- <anything implemented differently> (or "None.")\n\n## Verification Result\n**Verdict:** complete | partial | incomplete | cannot-verify\n**Summary:** <one paragraph>\n\n### Gaps\n- <unmet criterion> — <evidence>\n\nUse complete only when every criterion is pass and every provided check passed. Prefer cannot-verify over a guessed pass.`
 		: VERIFIER_OUTPUT_CONTRACT;
 	const gateSection = scriptResults.length > 0
 		? scriptResults
-			.map((r) => `- ${r.command} → ${r.status.toUpperCase()} (exit ${r.exitCode})\n\`\`\`\n${r.relevantOutput}\n\`\`\``)
+			.map((r) => `- ${r.command} → ${r.status.toUpperCase()} (exit ${r.exitCode})\n\`\`\`\n${stripControlCharacters(r.relevantOutput)}\n\`\`\``)
 			.join("\n\n")
 		: "(No check/lint/test scripts were discovered in package.json.)";
 
 	return [
 		VERIFIER_TASK_PREAMBLE,
 		"---",
-		`## Approved plan (source of truth)\nVerify the working tree against every step of this plan:\n\n${plan}`,
-		criteria?.length ? `## Verification criteria (authoritative pass/fail checklist)\n${criteria.map((criterion) => `- **${criterion.id}:** ${criterion.text}`).join("\n")}\n\nWhen criteria are supplied, emit ## Criteria Verdicts with one \`- **C<n>:** pass | fail | cannot-verify — evidence\` bullet for every criterion and no skipped ids, then ## Deviations and the required ## Verification Result. Use complete only when every criterion is pass; use cannot-verify rather than guessing.` : "",
+		`## Approved plan (source of truth)\nVerify the working tree against every step of this plan:\n\n${safePlan}`,
+		safeCriteria?.length ? `## Verification criteria (authoritative pass/fail checklist)\n${safeCriteria.map((criterion) => `- **${criterion.id}:** ${criterion.text}`).join("\n")}\n\nWhen criteria are supplied, emit ## Criteria Verdicts with one \`- **C<n>:** pass | fail | cannot-verify — evidence\` bullet for every criterion and no skipped ids, then ## Deviations and the required ## Verification Result. Use complete only when every criterion is pass; use cannot-verify rather than guessing.` : "",
 		"---",
 		`## Implementer's self-report (UNTRUSTED CLAIM — not evidence)\n${reportSection}`,
 		"---",

package/src/moa/verificationCriteria.ts

@@ -4,6 +4,7 @@ import type { AgentConfig } from "../agents/discovery.ts";
 import { CancelRun, type CancelSession } from "../runtime/cancelRun.ts";
 import { getFinalOutput, isFailedResult } from "../runtime/results.ts";
 import { runSingleAgent } from "../runtime/runner.ts";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 import { modelRefLabel, type ModelRef, type ThinkingLevel } from "../shared/modelRefs.ts";
 import { activityLoopCount } from "../ui/agentStatus.ts";
 import type { ObserveSession } from "../ui/observeOverlay.ts";
@@ -26,7 +27,7 @@ export function buildCriteriaTask(plan: string): string {
 	return [
 		CRITERIA_TASK_PREAMBLE,
 		"---",
-		`## Approved plan (frozen)\n${plan}`,
+		`## Approved plan (frozen)\n${stripControlCharacters(plan)}`,
 		"---",
 		`Your output must contain exactly one ${VERIFICATION_CRITERIA_HEADING} section and no prose outside it. Emit 3–${MAX_VERIFICATION_CRITERIA} bullets in this exact form:\n- **C<n>:** <observable binary condition> — <how to check: file, symbol, grep, expected state>\n\nEvery criterion must be checkable by reading the repository only; do not require execution. Cover at least one criterion per plan step in plan order, every named file or call site, and implied regression/scope constraints (such as preserving an existing export or avoiding unrelated files). Never reference proposer labels or model names.`,
 	].join("\n\n");

package/src/opinion/runOpinion.ts

@@ -99,6 +99,7 @@ export async function runInteractiveOpinion(
 					title: "MoA Opinion",
 					phaseLabels: { Plan: "Opinion" },
 					fanoutWorkingText: "analyzing & answering",
+					minimalFanoutHeader: settings.minimalFanoutHeader,
 				},
 				slug,
 			);

package/src/planning/planMode.ts

@@ -147,6 +147,10 @@ export function createPlanModeController(pi: ExtensionAPI) {
 	let implementationContextTokens: number | undefined;
 	let implementationTurns = 0;
 	let implementationToolCalls = 0;
+	// Older pi hosts have no before-settle boundary; enforce its veto only after
+	// this host has exposed the boundary.
+	let settleBoundarySeen = false;
+	let verificationPermittedAtSettle = false;
 	let providerEnvBeforePlanMode: Record<string, string | undefined> | undefined;
 	const persistence = new PlanModeStatePersistence(pi);
 	// Tracks whether rpiv's ask_user_question (or whichever extension registers
@@ -181,6 +185,7 @@ export function createPlanModeController(pi: ExtensionAPI) {
 		implementationContextTokens = undefined;
 		implementationTurns = 0;
 		implementationToolCalls = 0;
+		verificationPermittedAtSettle = false;
 	};
 	const resetImplementationState = (): void => {
 		implementationPending = false;
@@ -471,7 +476,9 @@ export function createPlanModeController(pi: ExtensionAPI) {
 			// adopted widget, so this only fires when none exists; single-model
 			// exit_plan_mode passes no ctx and has no MoA info, so it is skipped.
 			if (!activeProgressWidget && ctx && activeRunMoaInfo && implementationHandoff?.model) {
-				const widget = new MoaProgressWidget(ctx, (ref) => resolveContextWindow(ctx, ref), {}, planRepoSlug);
+				const widget = new MoaProgressWidget(ctx, (ref) => resolveContextWindow(ctx, ref), {
+					minimalFanoutHeader: loadMoaConfig().minimalFanoutHeader,
+				}, planRepoSlug);
 				widget.setPhaseModels({
 					Plan: activeRunMoaInfo.proposers,
 					Synthesize: activeRunMoaInfo.synthesizer,
@@ -570,8 +577,8 @@ export function createPlanModeController(pi: ExtensionAPI) {
 				// lets the meter reset rather than metering the correction as output.
 				const output = implementationOutputTracker?.snapshot();
 				if (output && activeProgressWidget) activeProgressWidget.updateRoleOutput("Implement", output.tokens, output.revision);
+				implementationUsage ??= { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0, cost: 0, turns: 0, toolCalls: 0 };
 				if (msg.usage) {
-					implementationUsage ??= { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0, cost: 0, turns: 0, toolCalls: 0 };
 					implementationUsage.input += nonnegative(msg.usage.input);
 					implementationUsage.output += nonnegative(msg.usage.output);
 					implementationUsage.cacheRead += nonnegative(msg.usage.cacheRead);
@@ -589,7 +596,7 @@ export function createPlanModeController(pi: ExtensionAPI) {
 						implementationContextTokens,
 						implementationTurns,
 						implementationToolCalls,
-						resolveModelCost(ctx, implementationHandoff.model, implementationUsage ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0, cost: 0, turns: 0, toolCalls: 0 }),
+						resolveModelCost(ctx, implementationHandoff.model, implementationUsage),
 					);
 				}
 				implementationPartial.clear();
@@ -601,7 +608,25 @@ export function createPlanModeController(pi: ExtensionAPI) {
 			}
 		},
 		onAgentBeforeSettle: (event: AgentBeforeSettleEvent, ctx: ExtensionContext) => {
+			settleBoundarySeen = true;
+			verificationPermittedAtSettle = false;
 			try {
+				const stopReason = lastImplementationStopReason;
+				// KEEP IN LOCKSTEP with onAgentSettled's verification branch below.
+				// exit_plan_mode marks implementation pending before the follow-up has
+				// run, so implementationTurns distinguishes that planning boundary.
+				const verificationWillDispatch = implementationPending
+					&& implementationTurns > 0
+					&& event.context.pendingMessages.length === 0
+					&& event.outcome !== "aborted"
+					&& event.outcome !== "error"
+					&& !implementationTurnFailed(stopReason)
+					&& stopReason !== "aborted"
+					&& stopReason !== "toolUse"
+					&& implementationHandoff !== undefined
+					&& (implementationHandoff.verifier ?? loadMoaConfig().verifier) !== undefined;
+				verificationPermittedAtSettle = verificationWillDispatch;
+
 				const branch = readBranchEntries(ctx);
 				const persistedOmissions = new Set(
 					branch
@@ -625,19 +650,6 @@ export function createPlanModeController(pi: ExtensionAPI) {
 					drafts.push(...collectOmissionDrafts(branch, isVerificationPendingEntry, omittedEntryIds));
 				}
 
-				const stopReason = lastImplementationStopReason;
-				// KEEP IN LOCKSTEP with onAgentSettled's verification branch below.
-				// exit_plan_mode marks implementation pending before the follow-up has
-				// run, so implementationTurns distinguishes that planning boundary.
-				const verificationWillDispatch = implementationPending
-					&& implementationTurns > 0
-					&& event.context.pendingMessages.length === 0
-					&& event.outcome !== "aborted"
-					&& event.outcome !== "error"
-					&& !implementationTurnFailed(stopReason)
-					&& stopReason !== "aborted"
-					&& implementationHandoff !== undefined
-					&& (implementationHandoff.verifier ?? loadMoaConfig().verifier) !== undefined;
 				if (verificationWillDispatch) {
 					drafts.push({
 						type: "custom_message",
@@ -657,10 +669,15 @@ export function createPlanModeController(pi: ExtensionAPI) {
 				return undefined;
 			}
 		},
-		onAgentSettled: (_event: AgentSettledEvent, ctx: ExtensionContext) => {
+		onAgentSettled: (event: AgentSettledEvent, ctx: ExtensionContext) => {
 			updateStatus(ctx);
+			const verificationPermitted = verificationPermittedAtSettle;
+			verificationPermittedAtSettle = false;
 			if (!implementationPending) return;
 			implementationPending = false;
+			// pi >= 1.1 reports a cancel that never produced an aborted assistant
+			// message (e.g. cancelled mid-tool); older pi omits the field.
+			const runAborted = event.aborted === true;
 			const stopReason = lastImplementationStopReason;
 			const report = lastImplementationReport;
 			lastImplementationStopReason = undefined;
@@ -669,9 +686,9 @@ export function createPlanModeController(pi: ExtensionAPI) {
 			// Settle the Implement row before any retry/verify routing. Aborted
 			// runs stop the table outright (no verification follows).
 			if (activeProgressWidget) {
-				if (implementationTurnFailed(stopReason)) {
+				if (implementationTurnFailed(stopReason) && !runAborted) {
 					activeProgressWidget.settleRoleRow("Implement", "error");
-				} else if (stopReason === "aborted") {
+				} else if (stopReason === "aborted" || runAborted) {
 					activeProgressWidget.settleRoleRow("Implement", "cancelled");
 					stopActiveProgressWidget();
 				} else {
@@ -694,15 +711,15 @@ export function createPlanModeController(pi: ExtensionAPI) {
 					// ctx is stale (replaced/reloaded); nothing left to notify against.
 				}
 			};
-			if (implementationTurnFailed(stopReason) && implementationHandoff) {
+			if (implementationTurnFailed(stopReason) && implementationHandoff && !runAborted) {
 				void runImplementationRetryFlow(ctx, moaRunHost, implementationHandoff)
 					.catch(reportFlowFailure("Implementation retry"));
 				return;
 			}
-			// A user-cancelled implementation must NOT be verified. implementationTurnFailed
-			// returns false for "aborted" (so the retry flow above is skipped), so this
-			// explicit guard is required before the verification branch.
-			if (stopReason === "aborted") return;
+			// Older hosts omit the settled aborted flag for mid-tool cancellation, leaving
+			// toolUse as the last stop reason.
+			if (stopReason === "aborted" || stopReason === "toolUse" || runAborted) return;
+			if (settleBoundarySeen && !verificationPermitted) return;
 			if (!implementationHandoff) return;
 			// KEEP IN LOCKSTEP with verificationWillDispatch in onAgentBeforeSettle.
 			const verifier = implementationHandoff.verifier ?? loadMoaConfig().verifier;

package/src/planning/tools/mfPlanSubagent.ts

@@ -144,8 +144,9 @@ export function registerMfPlanSubagentTool(pi: ExtensionAPI, host: MfPlanSubagen
 			const overrideFor = (agentName: string) => (agentName === "mf-plan" ? planOverride : undefined);
 
 			// An agent whose effective model belongs to an extension-registered
-			// provider (claude-bridge, cursor-bridge) cannot resolve in a child that
-			// spawns with --no-extensions. Same opt-in the MoA fan-out already does;
+			// provider (claude-bridge, cursor-bridge) or is an extension-registered virtual model
+			// (litellm-auto/*) cannot resolve in a child that spawns with --no-extensions.
+			// Same opt-in the MoA fan-out already does;
 			// built-in and bare ids fall through to no extension loading.
 			const agentExtensionOptions = (agentName: string): { loadExtensions?: boolean; extensionPath?: string } => {
 				const model = overrideFor(agentName)?.model ?? agents.find((agent) => agent.name === agentName)?.model;

package/src/runtime/piCapabilities.ts

@@ -0,0 +1,72 @@
+/**
+ * Capability probing for the pi executable a child process will actually run.
+ * The local `@earendil-works/pi-coding-agent` VERSION export describes the
+ * package this extension was built against, not the host (or `pi` on PATH)
+ * that `getPiInvocation()` spawns, so flag support is probed on the executable.
+ */
+
+import { execFile } from "node:child_process";
+
+export interface PiInvocation {
+	command: string;
+	args: string[];
+}
+
+/** `--no-mcp` first ships in pi 1.0.4; 1.0.3 rejects it as an unknown option. */
+const NO_MCP_MIN_VERSION = [1, 0, 4] as const;
+const VERSION_PROBE_TIMEOUT_MS = 10_000;
+
+export function parsePiVersion(output: string): [number, number, number] | undefined {
+	const match = /(\d+)\.(\d+)\.(\d+)/.exec(output);
+	if (!match) return undefined;
+	return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+export function versionAtLeast(version: readonly number[], minimum: readonly number[]): boolean {
+	for (let i = 0; i < minimum.length; i++) {
+		const diff = (version[i] ?? 0) - minimum[i];
+		if (diff !== 0) return diff > 0;
+	}
+	return true;
+}
+
+export function versionSupportsNoMcp(output: string): boolean {
+	const version = parsePiVersion(output);
+	return version !== undefined && versionAtLeast(version, NO_MCP_MIN_VERSION);
+}
+
+const noMcpSupport = new Map<string, Promise<boolean>>();
+
+function probeVersion(invocation: PiInvocation): Promise<string> {
+	return new Promise((resolve) => {
+		try {
+			execFile(
+				invocation.command,
+				[...invocation.args, "--version"],
+				{ timeout: VERSION_PROBE_TIMEOUT_MS, windowsHide: true, encoding: "utf-8" },
+				(error, stdout, stderr) => resolve(error ? "" : `${stdout}\n${stderr}`),
+			);
+		} catch {
+			resolve("");
+		}
+	});
+}
+
+/**
+ * Whether the executable behind `invocation` accepts `--no-mcp`. An executable
+ * whose version cannot be determined is treated as unsupported, because an
+ * unknown flag would make the child exit instead of run. Only determined
+ * results are cached per executable for the life of the process.
+ */
+export function piSupportsNoMcp(invocation: PiInvocation): Promise<boolean> {
+	const key = JSON.stringify([invocation.command, invocation.args]);
+	let cached = noMcpSupport.get(key);
+	if (!cached) {
+		cached = probeVersion(invocation).then((output) => {
+			if (parsePiVersion(output) === undefined) noMcpSupport.delete(key);
+			return versionSupportsNoMcp(output);
+		});
+		noMcpSupport.set(key, cached);
+	}
+	return cached;
+}

package/src/runtime/runner.ts

@@ -14,6 +14,7 @@ import type { AgentConfig } from "../agents/discovery.ts";
 import { normalizeMaxConcurrentAgents } from "../config/settings.ts";
 import type { ThinkingLevel } from "../shared/modelRefs.ts";
 import { OutputActivityTracker, PartialAssistantAssembler, formatToolActivity } from "./activityTracking.ts";
+import { piSupportsNoMcp, type PiInvocation } from "./piCapabilities.ts";
 import { escalateKill, mapWithConcurrencyLimit, trackedProcesses } from "./processPool.ts";
 import { getFinalOutput, type SingleResult } from "./results.ts";
 import {
@@ -70,7 +71,7 @@ export function getReadOnlyAgentTools(configuredTools?: string[]): string[] {
 	return configuredTools.filter((tool) => READ_ONLY_AGENT_TOOL_SET.has(tool));
 }
 
-function getPiInvocation(args: string[]): { command: string; args: string[] } {
+function getPiInvocation(args: string[]): PiInvocation {
 	const currentScript = process.argv[1];
 	const isBunVirtualScript = currentScript?.startsWith("/$bunfs/root/");
 	if (currentScript && !isBunVirtualScript && fs.existsSync(currentScript)) {
@@ -90,7 +91,8 @@ export interface RunSingleAgentOptions {
 	/**
 	 * Load all configured pi extensions in the child process. Retained as a
 	 * fallback for extension-registered providers whose entry point cannot be
-	 * isolated explicitly.
+	 * isolated explicitly. Such a child also gets --no-mcp when the spawned pi
+	 * supports it, because loading all extensions keeps pi's built-in MCP.
 	 */
 	loadExtensions?: boolean;
 	/**
@@ -118,6 +120,11 @@ export interface RunSingleAgentOptions {
 	resolveOnAbort?: boolean;
 	/** Abort grace period; exposed for focused process-boundary tests. */
 	killTimeoutMs?: number;
+	/**
+	 * Replaces the discovered pi executable (the child args are appended).
+	 * Exposed for focused process-boundary tests.
+	 */
+	piInvocation?: PiInvocation;
 }
 
 export async function runSingleAgent(
@@ -184,8 +191,7 @@ export async function runSingleAgent(
 	}
 
 	// argv entries are C strings: a NUL makes spawn throw before execve.
-	// Follow-up (out of scope): pass the task via temp file or stdin instead of
-	// argv, which would also remove the E2BIG class of failures.
+	// Passing the task via a temp file or stdin instead of argv would remove this failure and the E2BIG class with it.
 	if (task.includes("\0")) {
 		const message = "Task contains a NUL byte and cannot be passed as a process argument";
 		currentResult.exitCode = 1;
@@ -217,11 +223,24 @@ export async function runSingleAgent(
 			args.push("--append-system-prompt", tmpPromptPath);
 		}
 
+		// An all-extension child keeps pi's built-in MCP, whose codemode and
+		// tool_search tools can reach write-capable MCP servers regardless of the
+		// read-only --tools allowlist (pi >= 1.0.4 keeps MCP tools registered under
+		// a plain allowlist). Disable it, but only when the executable this child
+		// will run knows the flag. The default and isolated paths already pass
+		// --no-extensions, which excludes built-in MCP.
+		if (options.loadExtensions && !options.extensionPath) {
+			const probe = options.piInvocation ?? getPiInvocation([]);
+			if (await piSupportsNoMcp(probe)) args.push("--no-mcp");
+		}
+
 		args.push(`Task: ${task}`);
 		let wasAborted = false;
 
 		const exitCode = await new Promise<number>((resolve) => {
-			const invocation = getPiInvocation(args);
+			const invocation = options.piInvocation
+				? { command: options.piInvocation.command, args: [...options.piInvocation.args, ...args] }
+				: getPiInvocation(args);
 
 			const appendDiagnostics = (diagnostics: string) => {
 				currentResult.stderr = (currentResult.stderr + diagnostics).slice(-MAX_DIAGNOSTIC_CHARS);
@@ -371,9 +390,14 @@ export async function runSingleAgent(
 
 			proc.stdout.on("data", (data) => {
 				resetIdleTimer();
-				buffer += data.toString();
-				const lines = buffer.split("\n");
-				buffer = (lines.pop() || "").slice(-MAX_DIAGNOSTIC_CHARS);
+				const chunk = data.toString();
+				const newline = chunk.lastIndexOf("\n");
+				if (newline === -1) {
+					buffer += chunk;
+					return;
+				}
+				const lines = (buffer + chunk.slice(0, newline)).split("\n");
+				buffer = chunk.slice(newline + 1);
 				for (const line of lines) processLine(line);
 			});
 

package/src/ui/conflictOverlay.ts

@@ -257,7 +257,8 @@ class ConflictReviewComponent implements Component {
 			const isAnswered = this.answers.has(conflict.id);
 			const box = isAnswered ? "■" : "□";
 			const color = isAnswered ? "success" : "muted";
-			const lbl = truncateToWidth(conflict.label, maxTabLabelLen, "…", false);
+			const maxLen = isActive ? 30 : maxTabLabelLen;
+			const lbl = truncateToWidth(conflict.label, maxLen, "…", false);
 			const text = ` ${box} ${lbl} `;
 			tabParts.push(isActive ? th.bg("selectedBg", th.fg("text", text)) : th.fg(color, text));
 		}

package/src/ui/menu.ts

@@ -16,6 +16,8 @@ export interface ToggleMenuItem {
 	id: string;
 	label: string;
 	value: boolean;
+	/** Dimmed helper text wrapped under the row. */
+	description?: string;
 	onChange?: (value: boolean) => void;
 }
 
@@ -386,21 +388,24 @@ export class MenuComponent implements Component {
 		}
 		let flatIndex = 0;
 		const itemLineIndices: number[] = [];
+		const itemBlockEndLineIndices: number[] = [];
 		for (const section of this.sections) {
 			lines.push(renderMenuSectionDivider(theme, innerWidth, section.title));
 			const [from, to] = this.itemWindow(section, flatIndex);
 			if (from > 0) lines.push(renderMenuContentRow(theme, innerWidth, theme.fg("dim", `    ↑ ${from} more`)));
 			for (const [index, item] of section.items.entries()) {
 				// The cursor indexes every item, so rows hidden by the window still advance it.
-				const selected = flatIndex++ === this.cursor;
+				const itemIndex = flatIndex++;
+				const selected = itemIndex === this.cursor;
 				if (index < from || index >= to) continue;
-				itemLineIndices[flatIndex - 1] = lines.length;
+				itemLineIndices[itemIndex] = lines.length;
 				lines.push(this.renderItemRow(item, selected, innerWidth));
 				const descriptionRows = this.renderDescriptionRows(item, innerWidth);
 				lines.push(...descriptionRows);
 				if (descriptionRows.length > 0 && index < to - 1) {
 					lines.push(renderMenuContentRow(theme, innerWidth, ""));
 				}
+				itemBlockEndLineIndices[itemIndex] = lines.length - 1;
 			}
 			const below = section.items.length - to;
 			if (below > 0) lines.push(renderMenuContentRow(theme, innerWidth, theme.fg("dim", `    ↓ ${below} more`)));
@@ -429,8 +434,9 @@ export class MenuComponent implements Component {
 			const middle = lines.slice(1, footerStart);
 			const middleHeight = Math.max(0, this.viewport - top.length - footer.length);
 			const selectedMiddleLine = Math.max(0, (itemLineIndices[this.cursor] ?? 1) - 1);
+			const selectedBlockEndLine = Math.max(0, (itemBlockEndLineIndices[this.cursor] ?? itemLineIndices[this.cursor] ?? 1) - 1);
 			if (selectedMiddleLine < this.scrollOffset) this.scrollOffset = selectedMiddleLine;
-			if (selectedMiddleLine >= this.scrollOffset + middleHeight) this.scrollOffset = selectedMiddleLine - middleHeight + 1;
+			if (selectedBlockEndLine >= this.scrollOffset + middleHeight) this.scrollOffset = selectedBlockEndLine - middleHeight + 1;
 			this.scrollOffset = Math.max(0, Math.min(this.scrollOffset, Math.max(0, middle.length - middleHeight)));
 			visibleLines = [...top, ...middle.slice(this.scrollOffset, this.scrollOffset + middleHeight), ...footer];
 		}
@@ -448,9 +454,9 @@ export class MenuComponent implements Component {
 		return [from, from + cap];
 	}
 
-	/** Dimmed helper text wrapped under an action/choice row. */
+	/** Dimmed helper text wrapped under an action/choice/toggle row. */
 	private renderDescriptionRows(item: MenuItem, innerWidth: number): string[] {
-		if (isToggleItem(item) || !item.description) return [];
+		if (!item.description) return [];
 		const indent = "    ";
 		return wrapWords(item.description, Math.max(0, innerWidth - indent.length - 2)).map((line) =>
 			renderMenuContentRow(this.theme, innerWidth, this.theme.fg("dim", indent + line)),

package/src/ui/moaProgressWidget.ts

@@ -7,9 +7,12 @@
  * usage and a pi-topping style generated-output activity meter per agent.
  * Rows are grouped under `── Plan / Synthesize / Implement / Verify` headings,
  * with a shimmering four-phase chevron band above the header tracing the
- * active phase. The table stays mounted across the whole run — orchestration
- * hands it to the plan-mode controller on approval, which keeps it alive
- * through in-session implementation and verification.
+ * active phase. In minimal mode, the band is hidden and only the active phase
+ * name shimmers — its rule and prefix stay flat.
+ *
+ * The table stays mounted across the whole run — orchestration hands it to the
+ * plan-mode controller on approval, which keeps it alive through in-session
+ * implementation and verification.
  *
  * Each row's MONITOR activity meter is tinted with the thinking level that row
  * runs under, using that level's native theme color (`thinkingOff` through
@@ -76,7 +79,8 @@ export interface ProposerStatus {
 	turns?: number;
 	/** Tool calls started so far. */
 	toolCalls?: number;
-	/** Cumulative model cost in USD, calculated from registry rates. */
+	/** Cumulative model cost in USD from resolveModelCost: reported per-response
+	 * costs, or registry rates when none are reported. */
 	costUsd?: number;
 	startedAt?: number;
 	/** Set once the agent settles, freezing its elapsed reading. */
@@ -209,6 +213,8 @@ export interface MoaProgressView {
 	readonly planName: string | undefined;
 	/** Whether live transcript previews are currently shown beneath active rows. */
 	readonly previewVisible: boolean;
+	/** Whether the phase/model band is hidden and the active phase name shimmers. */
+	readonly minimalFanoutHeader: boolean;
 	/** Display label for a phase without changing its internal identity. */
 	phaseLabel(phase: MoaPhase): string;
 	/** Model assigned to each phase, for the band above the table header. */
@@ -229,6 +235,8 @@ export interface MoaProgressCallbacks {
 	title?: string;
 	phaseLabels?: Partial<Record<MoaPhase, string>>;
 	fanoutWorkingText?: string;
+	/** Hide the phase/model band and shimmer the active phase heading instead. Read once at construction. */
+	minimalFanoutHeader?: boolean;
 }
 
 interface RowMeter {
@@ -252,6 +260,7 @@ export class MoaProgressWidget implements MoaProgressView {
 	private readonly callbacks: MoaProgressCallbacks;
 	readonly title: string;
 	readonly planName: string | undefined;
+	readonly minimalFanoutHeader: boolean;
 
 	private statuses: ProposerStatus[] = [];
 	private roleRows = new Map<MoaPhase, RoleRow>();
@@ -278,6 +287,7 @@ export class MoaProgressWidget implements MoaProgressView {
 		this.callbacks = callbacks;
 		this.title = callbacks.title ?? TABLE_TITLE;
 		this.planName = planName;
+		this.minimalFanoutHeader = callbacks.minimalFanoutHeader ?? false;
 	}
 
 	private get ui(): ExtensionContext["ui"] {
@@ -783,6 +793,32 @@ export class MoaProgressTableComponent implements Component {
 		return shortModelName(models);
 	}
 
+	/** Active-phase tone shared by the band and, in minimal mode, the table's phase headings. */
+	private paintPhase(lit: boolean, text: string, now: number): string {
+		const th = this.theme;
+		if (!lit) return th.fg("dim", text);
+		return th.getFgAnsi
+			? shimmerString(text, now - this.animationStartedAt, th as ShimmerTheme, "ltr", "normal", true)
+			: th.fg("text", text);
+	}
+
+	/**
+	 * Minimal-mode heading with the sweep on the phase name alone: the `── `
+	 * prefix and the trailing rule stay flat, so the shimmer marks the name
+	 * rather than washing the whole line. The name is cut to the room left by
+	 * the prefix and rule, so the line still fills the table body exactly.
+	 */
+	private phaseNameShimmer(label: string, bodyWidth: number, now: number): string {
+		const prefix = "── ";
+		const suffix = " ";
+		const name = fitVisible(label, Math.max(1, bodyWidth - visibleWidth(prefix) - visibleWidth(suffix)), {
+			truncationMark: "…",
+			padToWidth: false,
+		});
+		const fill = "─".repeat(Math.max(0, bodyWidth - visibleWidth(prefix) - visibleWidth(name) - visibleWidth(suffix)));
+		return `${this.theme.fg("dim", prefix)}${this.paintPhase(true, name, now)}${this.theme.fg("dim", suffix + fill)}`;
+	}
+
 	/**
 	 * Two centered rows — phase names, then their assigned model ids — shown
 	 * above the table header, with a two-row powerline chevron standing between
@@ -798,14 +834,7 @@ export class MoaProgressTableComponent implements Component {
 		const colWidth = Math.floor((bodyWidth - sepCount) / MOA_PHASES.length);
 		if (colWidth < PHASE_BAND_MIN_COL) return [];
 
-		const th = this.theme;
 		const active = this.view.activePhase();
-		const paint = (lit: boolean, text: string): string => {
-			if (!lit) return th.fg("dim", text);
-			return th.getFgAnsi
-				? shimmerString(text, now - this.animationStartedAt, th as ShimmerTheme, "ltr", "normal", true)
-				: th.fg("text", text);
-		};
 		// Each boundary carries a two-row powerline chevron: the "\" half on the name
 		// row stacks over the "/" half on the model row. Both rows share one column
 		// layout, so the halves land in the same terminal column and read as a
@@ -814,9 +843,9 @@ export class MoaProgressTableComponent implements Component {
 		const bandRow = (sep: string, textFor: (phase: MoaPhase) => string): string => {
 			const parts: string[] = [];
 			MOA_PHASES.forEach((phase, i) => {
-				parts.push(paint(phase === active, cell(textFor(phase), colWidth, "center")));
+				parts.push(this.paintPhase(phase === active, cell(textFor(phase), colWidth, "center"), now));
 				const next = MOA_PHASES[i + 1];
-				if (next !== undefined) parts.push(paint(phase === active || next === active, sep));
+				if (next !== undefined) parts.push(this.paintPhase(phase === active || next === active, sep, now));
 			});
 			return parts.join("");
 		};
@@ -832,7 +861,7 @@ export class MoaProgressTableComponent implements Component {
 		const border = (s: string) => th.fg("border", s);
 		const row = (s: string) => `  ${fitVisible(s, bodyWidth, { truncationMark: "…", padToWidth: true })}  `;
 		const now = Date.now();
-		const band = this.phaseModelBand(bodyWidth, now);
+		const band = this.view.minimalFanoutHeader ? [] : this.phaseModelBand(bodyWidth, now);
 		const rows = this.view.progressRows();
 		const cols = tableColumns(bodyWidth, rows.map((r) => r.label));
 		// Transcript previews stop after ACTIVITY, leaving the right-aligned stats
@@ -926,14 +955,18 @@ export class MoaProgressTableComponent implements Component {
 			}
 		}
 		let renderedPhase = false;
+		const activePhase = this.view.activePhase();
 
 		for (let i = 0; i < rows.length; i++) {
 			const r = rows[i];
 			const active = isActive(r.state);
 			if (r.firstOfPhase) {
 				if (renderedPhase) lines.push(row(""));
-				const heading = `── ${this.view.phaseLabel(r.phase)} `;
-				lines.push(row(dim(heading + "─".repeat(Math.max(0, bodyWidth - visibleWidth(heading))))));
+				const label = this.view.phaseLabel(r.phase);
+				const heading = `── ${label} `;
+				const rule = heading + "─".repeat(Math.max(0, bodyWidth - visibleWidth(heading)));
+				const lit = this.view.minimalFanoutHeader && r.phase === activePhase;
+				lines.push(row(lit ? this.phaseNameShimmer(label, bodyWidth, now) : dim(rule)));
 				renderedPhase = true;
 			}
 			const icon =

package/src/ui/moaSetupOverlay.ts

@@ -79,6 +79,7 @@ interface SetupDraft {
 	useSummaryName: boolean;
 	maxConcurrentAgents: number;
 	maxVerificationRepairs: number;
+	minimalFanoutHeader: boolean;
 	rosters: PlanRoster[];
 }
 
@@ -94,6 +95,7 @@ class MoaSetupComponent implements Component {
 	private useSummaryName: boolean;
 	private maxConcurrentAgents: number;
 	private maxVerificationRepairs: number;
+	private minimalFanoutHeader: boolean;
 
 	constructor(
 		private readonly tui: TUI,
@@ -111,6 +113,7 @@ class MoaSetupComponent implements Component {
 		this.useSummaryName = draft.useSummaryName;
 		this.maxConcurrentAgents = draft.maxConcurrentAgents;
 		this.maxVerificationRepairs = draft.maxVerificationRepairs;
+		this.minimalFanoutHeader = draft.minimalFanoutHeader;
 		const slotItem = (slotIndex: number): MenuItem => ({
 			id: `role-${slotIndex}`,
 			label: SLOTS[slotIndex]!.menuLabel,
@@ -158,6 +161,13 @@ class MoaSetupComponent implements Component {
 						description: "Verifier-driven repair rounds after implementation (0 disables automatic repairs).",
 						onChange: (valueIndex: number) => { this.maxVerificationRepairs = MIN_VERIFICATION_REPAIRS + valueIndex; },
 					},
+					{
+						id: "minimal-fanout-header",
+						label: "minimal fan-out header",
+						value: this.minimalFanoutHeader,
+						description: "Hide the phase band and shimmer the active phase heading instead. Applies to the next run.",
+						onChange: (value: boolean) => { this.minimalFanoutHeader = value; },
+					},
 				] },
 			],
 			buttons: [
@@ -198,6 +208,7 @@ class MoaSetupComponent implements Component {
 			useSummaryName: this.useSummaryName,
 			maxConcurrentAgents: this.maxConcurrentAgents,
 			maxVerificationRepairs: this.maxVerificationRepairs,
+			minimalFanoutHeader: this.minimalFanoutHeader,
 			rosters: [...this.draft.rosters],
 		};
 	}
@@ -331,6 +342,7 @@ export async function showMoaSetup(
 		useSummaryName: saved.useSummaryName,
 		maxConcurrentAgents: saved.maxConcurrentAgents,
 		maxVerificationRepairs: saved.maxVerificationRepairs,
+		minimalFanoutHeader: saved.minimalFanoutHeader,
 		rosters: [...saved.rosters],
 	};
 
@@ -361,6 +373,7 @@ export async function showMoaSetup(
 			draft.useSummaryName = result.draft.useSummaryName;
 			draft.maxConcurrentAgents = result.draft.maxConcurrentAgents;
 			draft.maxVerificationRepairs = result.draft.maxVerificationRepairs;
+			draft.minimalFanoutHeader = result.draft.minimalFanoutHeader;
 			draft.rosters = await showRosterManager(ctx, draft.rosters, {
 				currentThinking,
 				onChange: (rosters) => {
@@ -404,6 +417,7 @@ export async function showMoaSetup(
 		useSummaryName: finalDraft.useSummaryName,
 		maxConcurrentAgents: finalDraft.maxConcurrentAgents,
 		maxVerificationRepairs: finalDraft.maxVerificationRepairs,
+		minimalFanoutHeader: finalDraft.minimalFanoutHeader,
 		cheap: finalDraft.selections[AGENT_SLOT_COUNT],
 		rosters: finalDraft.rosters,
 		thinkingOverrides: { ...current.thinkingOverrides, ...finalDraft.thinkingOverrides },

package/src/ui/observeOverlay.ts

@@ -1,6 +1,7 @@
 import type { Message } from "@earendil-works/pi-ai";
 import { getMarkdownTheme, type ExtensionContext, type Theme } from "@earendil-works/pi-coding-agent";
-import { Key, Markdown, matchesKey, truncateToWidth, type Component, type TUI } from "@earendil-works/pi-tui";
+import { Key, Markdown, matchesKey, stripTerminalSequences, truncateToWidth, type Component, type TUI } from "@earendil-works/pi-tui";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 import { transcriptBody, truncateFromStart } from "./agentTranscript.ts";
 import { ROUNDED_SINGLE_BOX, UI_TICK_MS, createFrame, ratioViewport, safeRenderWidth } from "./chrome.ts";
 
@@ -32,7 +33,7 @@ export function formatAgentMarkdown(agent: ObserveAgentData): string {
 	const task = truncateToWidth(agent.task.replace(/\s+/g, " ").trim(), MAX_TASK_WIDTH, "…", false);
 	const header = [`## ${agent.label}`, `_${agent.model} · ${agent.state}_`, "", `**Task:** ${task}`, ""].join("\n");
 	const contentBudget = Math.max(0, MAX_RENDERED_CHARS - header.length - 1);
-	const body = transcriptBody(agent.messages, agent.partial, agent.state, contentBudget);
+	const body = stripControlCharacters(stripTerminalSequences(transcriptBody(agent.messages, agent.partial, agent.state, contentBudget)));
 	const result = `${header}${body}`;
 	return result.length <= MAX_RENDERED_CHARS ? result : truncateFromStart(result, MAX_RENDERED_CHARS);
 }

package/src/ui/verificationFindingsOverlay.ts

@@ -1,6 +1,7 @@
 import type { ExtensionContext, KeybindingsManager, Theme } from "@earendil-works/pi-coding-agent";
 import { getMarkdownTheme, keyHint } from "@earendil-works/pi-coding-agent";
-import { Key, Markdown, matchesKey, type Component, type TUI } from "@earendil-works/pi-tui";
+import { Key, Markdown, matchesKey, stripTerminalSequences, type Component, type TUI } from "@earendil-works/pi-tui";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 import { ROUNDED_SINGLE_BOX, createFrame, ratioViewport, safeRenderWidth } from "./chrome.ts";
 
 const OVERLAY_HEIGHT_RATIO = 0.9;
@@ -51,7 +52,7 @@ class VerificationFindingsOverlay implements Component {
 		this.theme = theme;
 		this.keybindings = keybindings;
 		this.done = done;
-		this.markdown = new Markdown(findingsMarkdown, 0, 0, getMarkdownTheme());
+		this.markdown = new Markdown(stripControlCharacters(stripTerminalSequences(findingsMarkdown)), 0, 0, getMarkdownTheme());
 	}
 
 	private viewportLines(): number {