@vanillagreen/pi-claude-bridge 1.4.1 → 1.6.0

package/README.md

@@ -3,13 +3,13 @@
 ![Claude bridge demo response](https://raw.githubusercontent.com/vanillagreencom/vstack/main/pi-extensions/pi-claude-bridge/assets/bridge-demo.png)
 ![Claude Bridge settings panel](https://raw.githubusercontent.com/vanillagreencom/vstack/main/pi-extensions/pi-claude-bridge/assets/settings-panel.png)
 
-Run Claude Code as a Pi provider. Adds `claude-bridge/*` models to `/model` and routes Pi turns through the Claude Agent SDK while keeping Pi's tools and TUI.
+Run Claude Code as a Pi provider. Adds `claude-bridge/*` models to `/model` while keeping Pi's tools and TUI.
 
-Forked from [`elidickinson/pi-claude-bridge`](https://github.com/elidickinson/pi-claude-bridge). The provider, MCP bridge, session sync, and SDK plumbing come from upstream; this fork removes the AskClaude tool and adds opt-in forwarding for Pi prompt context.
+Forked from [`elidickinson/pi-claude-bridge`](https://github.com/elidickinson/pi-claude-bridge). This fork removes the AskClaude tool and adds opt-in forwarding for Pi prompt context.
 
 ## Highlights
 
-- `claude-bridge/claude-opus-4-8`, Opus 4-7, Sonnet, and Haiku in `/model`.
+- `claude-bridge/claude-fable-5`, Sonnet 5, Opus 4.8, Opus 4.7, Sonnet 4.6, and Haiku in `/model`.
 - Pi tool calls run on Pi; Claude Code handles reasoning.
 - Tool-use turns block until Pi-delivered tool results reach Claude Code, including persistent subagent panes.
 - Session continuity across normal turns, `/compact`, tree navigation, and abort recovery.
@@ -45,6 +45,8 @@ Extra Pi context is off by default. Enable per item in the extension manager whe
 
 Open `/extensions:settings`; settings appear under the **Claude Bridge** tab.
 
+Project settings in `.pi/settings.json` apply only after Pi marks the workspace trusted; before trust, vstack Pi extensions read user/global settings only.
+
 ### General
 
 | Setting | What it does |
@@ -90,22 +92,26 @@ Pi does not have a native `max` thinking level; it exposes up to `xhigh`, and ea
 
 Keys may be bare model IDs (`claude-opus-4-8`), `claude-bridge/<id>`, or `*` for all bridge models. Values are `low`, `medium`, `high`, `xhigh`, or `max`.
 
+### Fable 5 caveat
+
+The bridge registers `claude-bridge/claude-fable-5`, `claude-bridge/claude-sonnet-5`, and `claude-bridge/claude-opus-4-8` even when Pi's Anthropic model registry has not shipped those entries yet. For Fable 5, the bridge asks Claude Code to use Opus 4.8 as the availability fallback and preserves Claude Code's content-safety fallback events so Pi labels rerouted turns as Opus 4.8. Content-safety fallback still depends on Claude Code's own Fable 5 support; use Claude Code 2.1.170 or newer, and set `ANTHROPIC_DEFAULT_FABLE_MODEL` / `ANTHROPIC_DEFAULT_OPUS_MODEL` yourself when routing provider-specific model IDs through Bedrock, Vertex, or Foundry.
+
 ## Extra usage and rate limits
 
 Claude Code's `/extra-usage` local command works through the Claude Agent SDK. In Pi, use `/claude-bridge:extra` to run that flow from claude-bridge. Persist automatic launch on extra-usage errors with **Allow extra usage helper** in `/extensions:settings`.
 
-When Claude Code emits rate-limit reset metadata, the bridge shows one red ASCII `[rate-limit]` Pi warning with the reset timestamp including timezone context, deduplicates repeated Claude Code error lines, and suppresses the SDK's follow-up `Claude Code returned an error result: ...` wrapper when the bridge already emitted the terminal error. The bridge also emits `vstack:rate-limit` on Pi's extension event bus so `pi-qol` can opt into reset-time auto-resume.
+When Claude Code reports a rate-limit reset time, the bridge shows one clear `[rate-limit]` warning with timezone context and avoids repeating the same error line. If `pi-qol` is installed, it can use the reset time to resume later.
 
 Allowed-warning rate-limit events are filtered before user notification. The bridge normalizes unambiguous numeric utilization (`0 < value < 1` as fractional, `1 < value <= 100` as percent), suppresses low or unit-ambiguous values such as exact `1`, and only shows a neutral warning at 80%+ instead of claiming an unverified `% used` value. Check Claude Code `/usage` for exact allowed-warning utilization.
 
-If Claude Code accepts a turn but produces no assistant/tool output, the bridge treats that stream-idle stall as a retryable overload/rate-limit failure: it closes the stalled Claude Code subprocess, emits a normal assistant error with a backoff hint, and lets Flightdeck or `pi-agents-tmux` reuse their existing rate-limit retry ladder. Tune the first-output timeout with `CLAUDE_BRIDGE_STREAM_IDLE_TIMEOUT` (bare numbers are seconds; suffixes `ms`, `s`, and `m` are accepted). Default: `90s`; set `0` to disable.
+If Claude Code accepts a turn but produces no visible output, the bridge returns a retryable assistant error with a backoff hint instead of leaving Pi stuck waiting. Tune the first-output timeout with `CLAUDE_BRIDGE_STREAM_IDLE_TIMEOUT` (bare numbers are seconds; suffixes `ms`, `s`, and `m` are accepted). Default: `90s`; set `0` to disable.
 
 ## Debugging
 
 Set `CLAUDE_BRIDGE_DEBUG=1` to write bridge logs to `~/.pi/agent/claude-bridge.log` and per-query Claude Code CLI logs under `~/.pi/agent/cc-cli-logs/`.
 
-If a Claude Code SDK stream yields a completed assistant tool-use message before a `message_stop` stream event, the bridge treats that assistant message as the tool-turn boundary. Pi executes the tool calls immediately and Claude Code's MCP handlers stay blocked until the matching Pi tool results are delivered, preventing empty inline tool results or one-render-cycle-late result batches in subagent panes.
+Tool-result integrity problems are surfaced even when debug logging is off. Pi shows an error notification and writes a diagnostic file to `~/.pi/agent/claude-bridge-diag.log` so lost or mismatched tool output is visible.
 
-Tool-result integrity failures are surfaced even when debug logging is off. If the bridge has to repair missing Claude Code `tool_use` / Pi `toolResult` pairs with `[no tool result recorded]`, Pi shows an error notification and writes a JSON diagnostic to `~/.pi/agent/claude-bridge-diag.log` with counts, affected tool names, and sampled tool-call IDs so the lost output is visible. Tool results whose IDs were never registered in the active assistant tool-use turn are refused instead of being queued against another pending call, and any remaining MCP handlers receive an internal-error result so the turn cannot report false success. If a query tears down while parallel tool results are still queued or unresolved, the bridge writes the same kind of diagnostic, marks the Claude session for rebuild, and re-imports delivered results from Pi history on the next turn instead of silently resuming a corrupted session.
+Startup failures include the resolved Claude executable and working directory, which makes missing binaries and wrong launch directories easier to fix.
 
-Before starting Claude Code, the bridge preflights the resolved executable and working directory. Failures include the underlying `code`, `errno`, `syscall`, `path`, `cwd`, and detected executable file type so spawn issues point at the real failing path instead of the Claude Agent SDK's generic native-binary message. If Node still emits a spawn error after preflight, the bridge wraps that error with the same context before handing it back to the SDK.
+Contributor-facing stream, tool-result, and startup diagnostics are documented in [`DEVELOPMENT.md`](./DEVELOPMENT.md).

package/bundle/index.js

@@ -22237,9 +22237,51 @@ function convertPiMessages(messages, customToolNameToSdk) {
 }
 
 // src/models.ts
-var MODEL_IDS_IN_ORDER = ["claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"];
+var FABLE_MODEL_ID = "claude-fable-5";
+var FABLE_FALLBACK_MODEL_ID = "claude-opus-4-8";
+var SONNET_5_MODEL_ID = "claude-sonnet-5";
+function fallbackModelForPrimaryModel(modelId) {
+  return modelId === FABLE_MODEL_ID ? FABLE_FALLBACK_MODEL_ID : void 0;
+}
+var MODEL_IDS_IN_ORDER = [
+  FABLE_MODEL_ID,
+  FABLE_FALLBACK_MODEL_ID,
+  "claude-opus-4-7",
+  "claude-opus-4-6",
+  SONNET_5_MODEL_ID,
+  "claude-sonnet-4-6",
+  "claude-haiku-4-5"
+];
+var FALLBACK_MODELS = {
+  [FABLE_MODEL_ID]: {
+    id: FABLE_MODEL_ID,
+    name: "Claude Fable 5",
+    reasoning: true,
+    thinkingLevelMap: { xhigh: "xhigh" },
+    input: ["text", "image"],
+    contextWindow: 1e6,
+    maxTokens: 128e3
+  },
+  [FABLE_FALLBACK_MODEL_ID]: {
+    id: FABLE_FALLBACK_MODEL_ID,
+    name: "Claude Opus 4.8",
+    reasoning: true,
+    thinkingLevelMap: { xhigh: "xhigh" },
+    input: ["text", "image"],
+    contextWindow: 1e6,
+    maxTokens: 128e3
+  },
+  [SONNET_5_MODEL_ID]: {
+    id: SONNET_5_MODEL_ID,
+    name: "Claude Sonnet 5",
+    reasoning: true,
+    input: ["text", "image"],
+    contextWindow: 1e6,
+    maxTokens: 128e3
+  }
+};
 function buildModels(piAiModels) {
-  return MODEL_IDS_IN_ORDER.map((id) => piAiModels.find((m4) => m4.id === id)).filter((m4) => m4 != null).map(({ id, name, reasoning, input, contextWindow, maxTokens, thinkingLevelMap }) => ({
+  return MODEL_IDS_IN_ORDER.map((id) => piAiModels.find((m4) => m4.id === id) ?? FALLBACK_MODELS[id]).filter((m4) => m4 != null).map(({ id, name, reasoning, input, contextWindow, maxTokens, thinkingLevelMap }) => ({
     id,
     name,
     reasoning,
@@ -22638,8 +22680,34 @@ function projectSettingsPath(cwd) {
     current = parent;
   }
 }
+var PROJECT_TRUST_SYMBOL = /* @__PURE__ */ Symbol.for("vstack.pi.project-trust");
+function projectTrustRegistry() {
+  const host = globalThis;
+  const existing = host[PROJECT_TRUST_SYMBOL];
+  if (existing) return existing;
+  const created = {};
+  host[PROJECT_TRUST_SYMBOL] = created;
+  return created;
+}
+function recordProjectTrust(ctx2) {
+  if (!ctx2.cwd) return;
+  let trusted = true;
+  try {
+    trusted = ctx2.isProjectTrusted?.() === true;
+  } catch {
+    trusted = false;
+  }
+  const registry2 = projectTrustRegistry();
+  if (!registry2.projectSettings) registry2.projectSettings = /* @__PURE__ */ new Map();
+  registry2.projectSettings.set(projectSettingsPath(ctx2.cwd), trusted);
+}
+function projectSettingsTrusted(settingsPath) {
+  return projectTrustRegistry().projectSettings?.get(settingsPath) === true;
+}
 function settingsPaths(cwd) {
-  return [join2(piUserDir(), "settings.json"), projectSettingsPath(cwd)];
+  const user = join2(piUserDir(), "settings.json");
+  const project = projectSettingsPath(cwd);
+  return projectSettingsTrusted(project) ? [user, project] : [user];
 }
 function tryParseJson(path) {
   if (!existsSync3(path)) return {};
@@ -22747,7 +22815,9 @@ function managerToConfig(raw) {
 }
 function loadConfig(cwd) {
   const global2 = tryParseJson(join2(piUserDir(), "claude-bridge.json"));
-  const project = tryParseJson(join2(cwd, ".pi", "claude-bridge.json"));
+  const projectSettings = projectSettingsPath(cwd);
+  const trustedProject = projectSettingsTrusted(projectSettings);
+  const project = trustedProject ? tryParseJson(join2(dirname2(projectSettings), "claude-bridge.json")) : {};
   const manager = managerToConfig(readManagerConfig(cwd));
   const provider = normalizeProviderConfig({ ...global2.provider, ...project.provider, ...manager.provider });
   return {
@@ -38549,6 +38619,13 @@ function finalizeCurrentStream(stopReason) {
   ctx().currentPiStream.end();
   ctx().currentPiStream = null;
 }
+function updateTurnOutputModel(modelId) {
+  const c2 = ctx();
+  if (typeof modelId !== "string" || !modelId || !c2.turnOutput) return;
+  if (c2.turnOutput.model === modelId) return;
+  debug(`provider: active Claude model changed ${c2.turnOutput.model} -> ${modelId}`);
+  c2.turnOutput.model = modelId;
+}
 function processStreamEvent(message, customToolNameToPi, model) {
   const c2 = ctx();
   if (!c2.currentPiStream || !c2.turnOutput) return;
@@ -38560,6 +38637,7 @@ function processStreamEvent(message, customToolNameToPi, model) {
   }
   if (event?.type === "message_start") {
     c2.resetToolTracking();
+    updateTurnOutputModel(event.message?.model);
     if (event.message?.usage) updateUsage(c2.turnOutput, event.message.usage, model);
     return;
   }
@@ -38698,6 +38776,7 @@ function processAssistantMessage(message, model, customToolNameToPi) {
   const c2 = ctx();
   const assistantMsg = message.message;
   if (!assistantMsg?.content) return;
+  updateTurnOutputModel(assistantMsg.model);
   if (c2.turnSawStreamEvent) {
     if (appendMissingToolUsesFromAssistant(assistantMsg, model, customToolNameToPi)) {
       c2.turnSawToolCall = true;
@@ -38744,6 +38823,8 @@ function processAssistantMessage(message, model, customToolNameToPi) {
       const toolBlock = c2.turnBlocks[idx];
       c2.currentPiStream?.push({ type: "toolcall_start", contentIndex: idx, partial: c2.turnOutput });
       c2.currentPiStream?.push({ type: "toolcall_end", contentIndex: idx, toolCall: toolBlock, partial: c2.turnOutput });
+    } else if (block.type === "fallback") {
+      updateTurnOutputModel(block.to?.model);
     } else {
       debug("processAssistantMessage: unhandled block type", block.type);
     }
@@ -38795,6 +38876,14 @@ async function consumeQuery(sdkQuery, customToolNameToPi, model, cwd, bridgeConf
       case "system":
         if (message.subtype === "init" && message.session_id) {
           capturedSessionId = message.session_id;
+        } else if (message.subtype === "model_refusal_fallback") {
+          const originalModel = message.original_model;
+          const fallbackModel = message.fallback_model;
+          updateTurnOutputModel(fallbackModel);
+          debug("consumeQuery: model_refusal_fallback", JSON.stringify({ originalModel, fallbackModel }));
+          if (originalModel === FABLE_MODEL_ID && fallbackModel === FABLE_FALLBACK_MODEL_ID) {
+            safeNotify("Claude bridge switched Fable 5 to Opus 4.8 after Claude Code safety fallback.", "info");
+          }
         }
         break;
       case "user":
@@ -38949,16 +39038,19 @@ function streamClaudeAgentSdk(model, context, options) {
   const { sessionId: resumeSessionId } = syncSharedSession(context.messages, cwd, customToolNameToSdk, model.id);
   const requestedEffort = options?.reasoning ? model.thinkingLevelMap?.[options.reasoning] ?? REASONING_TO_EFFORT[options.reasoning] : void 0;
   const effort = resolveConfiguredEffort(model.id, requestedEffort, providerSettings);
-  const extraArgs = { model: model.id };
+  const extraArgs = {};
   if (strictMcpConfigEnabled) extraArgs["strict-mcp-config"] = null;
   if (effort) extraArgs["thinking-display"] = "summarized";
+  const fallbackModel = fallbackModelForPrimaryModel(model.id);
   const childEnv = { ...process.env, ENABLE_CLAUDEAI_MCP_SERVERS: "0", DISABLE_AUTO_COMPACT: "1" };
   const queryOptions = {
     cwd,
+    model: model.id,
     env: childEnv,
     ...CLAUDE_BRIDGE_TOOL_ISOLATION,
     permissionMode: "bypassPermissions",
     includePartialMessages: true,
+    ...fallbackModel ? { fallbackModel } : {},
     ...providerSettings.fastMode ? { settings: { fastMode: true } } : {},
     systemPrompt: {
       type: "preset",
@@ -38978,6 +39070,7 @@ function streamClaudeAgentSdk(model, context, options) {
     "provider: fresh query",
     `model=${model.id} msgs=${context.messages.length} tools=${mcpTools.length}`,
     `resume=${resumeSessionId?.slice(0, 8) ?? "none"} effort=${effort ?? "default"}`,
+    `fallback=${fallbackModel ?? "none"}`,
     `appendSys=${appendSystemPrompt} promptCtx=${promptContextAppend.labels.join(",") || "none"} strictMcp=${strictMcpConfigEnabled} fastMode=${providerSettings.fastMode === true}`,
     `claudeExec=${claudeExecutablePreflight ? `${claudeExecutablePreflight.fileType}:${claudeExecutablePreflight.path}` : "sdk-default"}`,
     `prompt=${promptText.slice(0, 60)}${promptBlocks ? " [+images]" : ""}`
@@ -39238,6 +39331,7 @@ function index_default(pi) {
     }
   };
   pi.on("session_start", (event, ctx2) => {
+    recordProjectTrust(ctx2);
     piUI = ctx2.ui;
     if (event.reason === "new" || event.reason === "resume" || event.reason === "fork") {
       clearSession(`session_start:${event.reason}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-claude-bridge",
-  "version": "1.4.1",
+  "version": "1.6.0",
   "description": "Pi provider bridge that runs Claude Code through the Claude Agent SDK, with opt-in forwarding for Pi prompt context.",
   "type": "module",
   "keywords": [

package/src/config.ts

@@ -76,8 +76,43 @@ function projectSettingsPath(cwd: string): string {
 	}
 }
 
+const PROJECT_TRUST_SYMBOL = Symbol.for("vstack.pi.project-trust");
+
+interface ProjectTrustRegistry {
+	projectSettings?: Map<string, boolean>;
+}
+
+function projectTrustRegistry(): ProjectTrustRegistry {
+	const host = globalThis as unknown as Record<PropertyKey, ProjectTrustRegistry | undefined>;
+	const existing = host[PROJECT_TRUST_SYMBOL];
+	if (existing) return existing;
+	const created: ProjectTrustRegistry = {};
+	host[PROJECT_TRUST_SYMBOL] = created;
+	return created;
+}
+
+export function recordProjectTrust(ctx: { cwd?: string; isProjectTrusted?: () => boolean }): void {
+	if (!ctx.cwd) return;
+	let trusted = true;
+	try {
+		trusted = ctx.isProjectTrusted?.() === true;
+	} catch {
+		trusted = false;
+	}
+	const registry = projectTrustRegistry();
+	if (!registry.projectSettings) registry.projectSettings = new Map();
+	registry.projectSettings.set(projectSettingsPath(ctx.cwd), trusted);
+}
+
+function projectSettingsTrusted(settingsPath: string): boolean {
+	return projectTrustRegistry().projectSettings?.get(settingsPath) === true;
+}
+
+
 function settingsPaths(cwd: string): string[] {
-	return [join(piUserDir(), "settings.json"), projectSettingsPath(cwd)];
+	const user = join(piUserDir(), "settings.json");
+	const project = projectSettingsPath(cwd);
+	return projectSettingsTrusted(project) ? [user, project] : [user];
 }
 
 export function tryParseJson(path: string): Partial<Config> {
@@ -202,7 +237,9 @@ function managerToConfig(raw: SettingsRecord): Partial<Config> {
 
 export function loadConfig(cwd: string): Config {
 	const global = tryParseJson(join(piUserDir(), "claude-bridge.json"));
-	const project = tryParseJson(join(cwd, ".pi", "claude-bridge.json"));
+	const projectSettings = projectSettingsPath(cwd);
+	const trustedProject = projectSettingsTrusted(projectSettings);
+	const project = trustedProject ? tryParseJson(join(dirname(projectSettings), "claude-bridge.json")) : {};
 	const manager = managerToConfig(readManagerConfig(cwd));
 	const provider = normalizeProviderConfig({ ...global.provider, ...project.provider, ...manager.provider });
 	return {

package/src/index.ts

@@ -11,13 +11,13 @@ import { resolve as pathResolve } from "path";
 import { homedir } from "os";
 import { delimiter, dirname, join } from "path";
 import { PROVIDER_ID, messageContentToText, convertPiMessages } from "./convert.js";
-import { buildModels } from "./models.js";
+import { FABLE_FALLBACK_MODEL_ID, FABLE_MODEL_ID, buildModels, fallbackModelForPrimaryModel } from "./models.js";
 import { MCP_SERVER_NAME, MCP_TOOL_PREFIX, extractSkillsBlock } from "./skills.js";
 import { verifyWrittenSession as _verifyWrittenSession } from "./session-verify.js";
 import { extractAllToolResults as _extractAllToolResults, type McpResult } from "./extract-tool-results.js";
 import { QueryContext, ctx, stackDepth, pushContext, popContext } from "./query-state.js";
 import { findUnpairedToolUses, summarizeMissingToolNames, type MissingToolResult } from "./tool-pairing-audit.js";
-import { loadConfig, normalizeEffortLevel, type Config } from "./config.js";
+import { loadConfig, normalizeEffortLevel, recordProjectTrust, type Config } from "./config.js";
 import { extractAgentsAppend } from "./agents-md.js";
 import { buildPromptContextAppend } from "./prompt-context.js";
 import { jsonSchemaToZodShape } from "./typebox-to-zod.js";
@@ -1401,6 +1401,14 @@ function finalizeCurrentStream(stopReason?: string): void {
 	ctx().currentPiStream = null;
 }
 
+function updateTurnOutputModel(modelId: unknown): void {
+	const c = ctx();
+	if (typeof modelId !== "string" || !modelId || !c.turnOutput) return;
+	if (c.turnOutput.model === modelId) return;
+	debug(`provider: active Claude model changed ${c.turnOutput.model} -> ${modelId}`);
+	c.turnOutput.model = modelId;
+}
+
 /** Maps Anthropic stream events to pi stream events (text, thinking, toolcall).
  *  On message_stop with tool_use: ends currentPiStream so pi can execute the tool. */
 export function processStreamEvent(
@@ -1419,6 +1427,7 @@ export function processStreamEvent(
 
 	if (event?.type === "message_start") {
 		c.resetToolTracking();
+		updateTurnOutputModel(event.message?.model);
 		if (event.message?.usage) updateUsage(c.turnOutput, event.message.usage, model);
 		return;
 	}
@@ -1579,6 +1588,7 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	const c = ctx();
 	const assistantMsg = (message as any).message;
 	if (!assistantMsg?.content) return;
+	updateTurnOutputModel(assistantMsg.model);
 	if (c.turnSawStreamEvent) {
 		// Claude Agent SDK can yield the completed assistant message before (or
 		// instead of) a stream_event message_stop for a tool-use turn. Treat that
@@ -1630,6 +1640,8 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 			const toolBlock = c.turnBlocks[idx];
 			c.currentPiStream?.push({ type: "toolcall_start", contentIndex: idx, partial: c.turnOutput });
 			c.currentPiStream?.push({ type: "toolcall_end", contentIndex: idx, toolCall: toolBlock as any, partial: c.turnOutput });
+		} else if (block.type === "fallback") {
+			updateTurnOutputModel(block.to?.model);
 		} else {
 			debug("processAssistantMessage: unhandled block type", block.type);
 		}
@@ -1698,6 +1710,14 @@ async function consumeQuery(
 			case "system":
 				if ((message as any).subtype === "init" && (message as any).session_id) {
 					capturedSessionId = (message as any).session_id;
+				} else if ((message as any).subtype === "model_refusal_fallback") {
+					const originalModel = (message as any).original_model;
+					const fallbackModel = (message as any).fallback_model;
+					updateTurnOutputModel(fallbackModel);
+					debug("consumeQuery: model_refusal_fallback", JSON.stringify({ originalModel, fallbackModel }));
+					if (originalModel === FABLE_MODEL_ID && fallbackModel === FABLE_FALLBACK_MODEL_ID) {
+						safeNotify("Claude bridge switched Fable 5 to Opus 4.8 after Claude Code safety fallback.", "info");
+					}
 				}
 				break;
 			case "user":
@@ -1908,11 +1928,12 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 		: undefined;
 	const effort = resolveConfiguredEffort(model.id, requestedEffort, providerSettings);
 
-	const extraArgs: Record<string, string | null> = { model: model.id };
+	const extraArgs: Record<string, string | null> = {};
 	if (strictMcpConfigEnabled) extraArgs["strict-mcp-config"] = null;
 	// Opus 4.7 defaults thinking.display to "omitted" (empty thinking text in stream).
 	// Force summarized so thinking_delta events arrive. See anthropics/claude-agent-sdk-python#830.
 	if (effort) extraArgs["thinking-display"] = "summarized";
+	const fallbackModel = fallbackModelForPrimaryModel(model.id);
 
 	// Suppress claude.ai cloud MCP servers (Figma/Canva/etc. auto-discovered via OAuth
 	// when the user is logged into Anthropic). These are a separate code path from
@@ -1927,10 +1948,12 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	const childEnv = { ...process.env, ENABLE_CLAUDEAI_MCP_SERVERS: "0", DISABLE_AUTO_COMPACT: "1" };
 	const queryOptions: NonNullable<Parameters<typeof query>[0]["options"]> = {
 		cwd,
+		model: model.id,
 		env: childEnv,
 		...CLAUDE_BRIDGE_TOOL_ISOLATION,
 		permissionMode: "bypassPermissions",
 		includePartialMessages: true,
+		...(fallbackModel ? { fallbackModel } : {}),
 		...(providerSettings.fastMode ? { settings: { fastMode: true } } : {}),
 		systemPrompt: {
 			type: "preset", preset: "claude_code",
@@ -1949,6 +1972,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	debug("provider: fresh query",
 		`model=${model.id} msgs=${context.messages.length} tools=${mcpTools.length}`,
 		`resume=${resumeSessionId?.slice(0, 8) ?? "none"} effort=${effort ?? "default"}`,
+		`fallback=${fallbackModel ?? "none"}`,
 		`appendSys=${appendSystemPrompt} promptCtx=${promptContextAppend.labels.join(",") || "none"} strictMcp=${strictMcpConfigEnabled} fastMode=${providerSettings.fastMode === true}`,
 		`claudeExec=${claudeExecutablePreflight ? `${claudeExecutablePreflight.fileType}:${claudeExecutablePreflight.path}` : "sdk-default"}`,
 		`prompt=${promptText.slice(0, 60)}${promptBlocks ? " [+images]" : ""}`);
@@ -2248,6 +2272,7 @@ export default function (pi: ExtensionAPI) {
 		}
 	};
 	pi.on("session_start", (event, ctx) => {
+		recordProjectTrust(ctx);
 		piUI = ctx.ui;
 		if (event.reason === "new" || event.reason === "resume" || event.reason === "fork") {
 			clearSession(`session_start:${event.reason}`);

package/src/models.ts

@@ -2,13 +2,69 @@
 // `resolveModelId` returns the first partial match, so `opus` resolves to the first-listed opus entry.
 // Extracted from index.ts so tests can import without activating the extension.
 
-export const MODEL_IDS_IN_ORDER = ["claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"];
+export const FABLE_MODEL_ID = "claude-fable-5";
+export const FABLE_FALLBACK_MODEL_ID = "claude-opus-4-8";
+export const SONNET_5_MODEL_ID = "claude-sonnet-5";
+
+export function fallbackModelForPrimaryModel(modelId: string): string | undefined {
+	return modelId === FABLE_MODEL_ID ? FABLE_FALLBACK_MODEL_ID : undefined;
+}
+
+export const MODEL_IDS_IN_ORDER = [
+	FABLE_MODEL_ID,
+	FABLE_FALLBACK_MODEL_ID,
+	"claude-opus-4-7",
+	"claude-opus-4-6",
+	SONNET_5_MODEL_ID,
+	"claude-sonnet-4-6",
+	"claude-haiku-4-5",
+];
+
+type BridgeModelMetadata = {
+	id: string;
+	name: string;
+	reasoning: boolean;
+	thinkingLevelMap?: Record<string, string | null>;
+	input: ("text" | "image")[];
+	contextWindow: number;
+	maxTokens: number;
+};
+
+const FALLBACK_MODELS: Record<string, BridgeModelMetadata> = {
+	[FABLE_MODEL_ID]: {
+		id: FABLE_MODEL_ID,
+		name: "Claude Fable 5",
+		reasoning: true,
+		thinkingLevelMap: { xhigh: "xhigh" },
+		input: ["text", "image"],
+		contextWindow: 1000000,
+		maxTokens: 128000,
+	},
+	[FABLE_FALLBACK_MODEL_ID]: {
+		id: FABLE_FALLBACK_MODEL_ID,
+		name: "Claude Opus 4.8",
+		reasoning: true,
+		thinkingLevelMap: { xhigh: "xhigh" },
+		input: ["text", "image"],
+		contextWindow: 1000000,
+		maxTokens: 128000,
+	},
+	[SONNET_5_MODEL_ID]: {
+		id: SONNET_5_MODEL_ID,
+		name: "Claude Sonnet 5",
+		reasoning: true,
+		input: ["text", "image"],
+		contextWindow: 1000000,
+		maxTokens: 128000,
+	},
+};
 
 // Project pi-ai's model entries down to the fields pi's registerProvider expects,
-// and keep MODEL_IDS_IN_ORDER ordering. IDs missing from pi-ai are silently dropped.
+// keep MODEL_IDS_IN_ORDER ordering, and fill bridge-owned future IDs when pi-ai
+// has not shipped metadata for them yet. Unknown missing IDs are still dropped.
 export function buildModels<T extends { id: string; [key: string]: any }>(piAiModels: T[]) {
 	return MODEL_IDS_IN_ORDER
-		.map((id) => piAiModels.find((m) => m.id === id))
+		.map((id) => piAiModels.find((m) => m.id === id) ?? FALLBACK_MODELS[id])
 		.filter((m) => m != null)
 		// Forward thinkingLevelMap so per-model overrides (e.g. opus-4-7 mapping
 		// xhigh→xhigh instead of xhigh→max) are visible to the effort lookup.