@vanillagreen/pi-qol 2.3.4 → 2.5.0

package/README.md

@@ -4,6 +4,15 @@ A Pi extension for session controls, prompt editing and notifications. Users can
 
 ![QOL extension settings panel](https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-qol/assets/settings-panel.png) ![Session search popup](https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-qol/assets/session-search.gif) ![/context usage breakdown](https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-qol/assets/context-usage.png)
 
+## Features
+
+- Show repository, model and context information beside the editor, with the working spinner before the project name.
+- Name and search sessions.
+- Schedule prompts and prepare handoff drafts.
+- Ask before configured shell commands run.
+- Send terminal and desktop notifications.
+- Configure summaries and compaction for long sessions.
+
 ## Install
 
 - npm: `pi install npm:@vanillagreen/pi-qol`.
@@ -16,15 +25,6 @@ source = "kendex"
 
 Requires Pi 0.86.0 or newer. Restart Pi after installation. Use `kendex update-pi --check` to preview the installation.
 
-## Features
-
-- Show repository, model and context information beside the editor, with the working spinner before the project name.
-- Name and search sessions.
-- Schedule prompts and prepare handoff drafts.
-- Ask before configured shell commands run.
-- Send terminal and desktop notifications.
-- Configure summaries and compaction for long sessions.
-
 ## How it works
 
 The extension reads your enabled features when Pi starts. It adds their editor controls, commands and event handlers. Session actions update the session or queue messages for the agent. Notifications report events through your selected channels. Compaction settings control when long conversations are summarized.
@@ -42,24 +42,29 @@ The extension reads your enabled features when Pi starts. It adds their editor c
 
 At session start, the extension deletes budget handoff files whose recorded working directory no longer exists. It also deletes files older than 5 days. Both timestamped snapshots and `latest.json` follow this rule.
 
-## Settings
+## Setup
 
 The settings editor writes project values to `.pi/settings.json`. The default user file is `~/.pi/agent/settings.json`. `PI_CODING_AGENT_DIR` changes the user directory. Package values are stored under `kendex.extensionManager.config["@vanillagreen/pi-qol"]`.
 
 Open `/extensions:settings`; settings appear under the **QOL** tab. Project settings in `.pi/settings.json` apply only after Pi marks the workspace trusted. `glyphStyle` picks `unicode` or `ascii` symbols, and `@vanillagreen/pi-tool-renderer`'s `globalGlyphStyleOverride` wins when set.
 
 - `enabled`: package toggle for everything below.
+- `gatewayPrivacy.enabled`: require zero data retention and no prompt training for main-agent and QOL model requests through OpenRouter and Vercel AI Gateway. Covers QOL compaction, branch summaries, imported-session summaries, handoff and session naming. Keeps other routing options and overrides weaker privacy values. Pi's built-in compaction and branch summaries cannot carry these fields, so on a gateway session model QOL writes them in place of Pi's, whatever `compaction.customEnabled` and `compaction.branchSummaryEnabled` say, and a failed or refused summary cancels the compaction or tree move instead of falling back to Pi's. Custom remote compaction endpoints keep their own privacy policy.
 - Statusline and editor: `statusline.enabled`, `statusline.showProvider`, `statusline.showAccount`, `replaceFooter`, `compactPrompt`, `showSessionNameTitle`, `showSessionNameWindow`, `inputBottomPaddingLines`, `gitRefreshTimeoutMs`, `showDirtyMarker`, `newlineOnShiftEnter`, `newlineFallbackKey`, `pendingQueue.asciiGreen`, `showImageChips`, `showAttachmentCountInStatus`.
 - Commands: `enableSessionNameCommand`, `enableHandoffCommand`, `enableScheduleCommand`, `enableContextCommand`, `handoffReviewPrompt`.
-- Session naming: `sessionAutoRename.*` (model, fallback model, deterministic fallback, prefix, prompt, limits, notify, debug).
+- Session naming: `sessionAutoRename.*` (model, fallback model, deterministic fallback, prefix, prompt, limits, notify, debug). `sessionAutoRename.maxTokens` includes the naming model's reasoning tokens. `sessionAutoRename.maxNameChars` limits the title length.
 - Session search: `sessionSearch.*` (shortcut, result and row limits, snippets, overlay width, cache TTL, summary model and limits).
 - Rate limits: `rateLimitAutoResume.*`.
 - Permission gate: `permissionGate.enabled`, `permissionGate.commands` (comma-separated literal fragments or `/regex/flags`), `permissionGate.previewLines`, `permissionGate.previewChars`.
 - Notifications: `notification.*` (triggers, channels, tmux options, protocol, cooldown, title and body).
-- Compaction and budget guard: `compaction.*` (custom summaries, model, profile, remote endpoint, branch summaries, idle trigger, budget guard thresholds, chunk input cap, handoff artifact, transcript-risk budget).
+- Compaction and budget guard: `compaction.*` (custom summaries, model, profile, remote endpoint, branch summaries, idle trigger, budget guard thresholds, chunk input cap, handoff artifact, transcript-risk budget). `compaction.maxTokens` caps budget-guard, custom and branch summaries.
   - Pi's own `compaction.enabled` (the top-level `compaction` object in the same settings files, not a QOL key) turns off every automatic compaction: when it is `false`, neither the budget guard nor the idle trigger starts one, and `/qol` reports both as disabled by that key. A manual `/compact` still runs. While it is `true` or absent, both keep the defaults and thresholds above: the budget guard on at `compaction.budgetPercent` 85, the idle trigger off until `compaction.idleEnabled` is set.
-- Thinking: `thinkingLabel.text`, `thinkingTimer.enabled`, `workingIndicator.mode` (`static` if the animated indicator flashes).
+- Thinking: `thinkingLabel.text`, `thinkingTimer.enabled`, `workingIndicator.mode`. `workingIndicator.mode` defaults to `static`, a dot with no animation timer; `animated` restores Pi's spinner. `thinkingTimer.enabled` controls the thinking duration display.
 
 **Show model provider** displays a readable provider name before the model, such as `Copilot / GPT 6 Astra`. It is on by default; changes apply on the next render without reloading. Disabling the QOL statusline leaves Pi's standalone working indicator in place.
 
 Maintainer notes are in [DEVELOPMENT.md](DEVELOPMENT.md).
+
+## Licence
+
+[MIT](https://github.com/vanillagreencom/kendex/blob/main/LICENSE)

package/extensions/qol/compaction.ts

@@ -29,12 +29,16 @@ import {
 } from "./compaction-handoff.js";
 import { piCompactionEnabled, settingBoolean, settingNumber, settingString } from "./settings.js";
 import { stringifyError } from "./util.js";
+import { gatewayPrivacyBlocksNativeSummary, gatewayPrivacyOnPayload } from "./gateway-privacy.js";
 
 export type QolSummaryProfile = "concise" | "balanced" | "exhaustive";
 export type QolSummaryPurpose = "compaction" | "branch-summary" | "session-search";
 
-export function compactionNotify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info"): void {
-	if (ctx.hasUI && settingBoolean("compaction.notify", true, ctx.cwd)) ctx.ui.notify(message, level);
+export function compactionNotify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info", required = false): void {
+	if (ctx.hasUI && (required || settingBoolean("compaction.notify", true, ctx.cwd))) ctx.ui.notify(message, level);
+	// Print, JSON and RPC callers read stderr for diagnostics. A cancelled
+	// protected summary has no Pi error event to carry its provider failure.
+	if (!ctx.hasUI && required) console.error(JSON.stringify({ source: "pi-qol", level, message }));
 }
 
 export function compactionProfile(cwd: string): QolSummaryProfile {
@@ -174,7 +178,7 @@ async function singleShotSummary(ctx: ExtensionContext, request: SummarizeReques
 		() => complete(
 			model,
 			{ messages: [message], systemPrompt: QOL_COMPACTION_SYSTEM_PROMPT },
-			{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, maxTokens: options.maxTokens, signal: options.signal },
+			{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, maxTokens: options.maxTokens, signal: options.signal, onPayload: gatewayPrivacyOnPayload(ctx) },
 		),
 		options.signal,
 		{
@@ -261,16 +265,19 @@ export function writeBudgetHandoffArtifact(ctx: ExtensionContext, handoff: QolBu
 
 export async function handleQolCompaction(event: any, ctx: ExtensionContext): Promise<any> {
 	const isBudgetGuard = isBudgetGuardCompaction(event?.customInstructions);
-	// Budget-guard-triggered compactions force the QOL bounded summarizer even
-	// when compaction.customEnabled is off. The handoff writer still honors its
-	// independent compaction.handoffArtifactEnabled toggle.
-	if (!isBudgetGuard && !settingBoolean("compaction.customEnabled", false, ctx.cwd)) return undefined;
+	const nativeBlocked = gatewayPrivacyBlocksNativeSummary(ctx);
+	const customEnabled = settingBoolean("compaction.customEnabled", false, ctx.cwd);
+	// Budget-guard-triggered and privacy-covered compactions force the QOL
+	// summarizer even when compaction.customEnabled is off. The handoff writer
+	// still honors its independent compaction.handoffArtifactEnabled toggle.
+	if (!isBudgetGuard && !nativeBlocked && !customEnabled) return undefined;
 	const preparation = event.preparation ?? {};
 	const messages = [...(preparation.messagesToSummarize ?? []), ...(preparation.turnPrefixMessages ?? [])];
 	if (messages.length === 0) return undefined;
 	const tokensBefore = typeof preparation.tokensBefore === "number" ? preparation.tokensBefore : 0;
-	const handoff = buildBudgetHandoff(ctx, { preparation, reason: event.customInstructions ?? "session_before_compact" });
-	const handoffResult = writeBudgetHandoffArtifact(ctx, handoff);
+	const handoffResult: HandoffWriteResult = isBudgetGuard || customEnabled
+		? writeBudgetHandoffArtifact(ctx, buildBudgetHandoff(ctx, { preparation, reason: event.customInstructions ?? "session_before_compact" }))
+		: {};
 	const sourceLabel = isBudgetGuard ? "pi-qol budget-guard" : "pi-qol";
 	compactionNotify(ctx, `QOL compaction: summarizing ${messages.length} message(s), ${tokensBefore.toLocaleString()} token(s)${isBudgetGuard ? " (budget guard)" : ""}.`, "info");
 	try {
@@ -308,8 +315,8 @@ export async function handleQolCompaction(event: any, ctx: ExtensionContext): Pr
 		};
 	} catch (error) {
 		if (event.signal?.aborted) return undefined;
-		compactionNotify(ctx, `QOL compaction failed: ${stringifyError(error)}`, "error");
-		return settingBoolean("compaction.fallbackToDefault", true, ctx.cwd) ? undefined : { cancel: true };
+		compactionNotify(ctx, `QOL compaction failed: ${stringifyError(error)}`, "error", nativeBlocked);
+		return !nativeBlocked && settingBoolean("compaction.fallbackToDefault", true, ctx.cwd) ? undefined : { cancel: true };
 	}
 }
 
@@ -322,7 +329,8 @@ function summarizeEntryForBranch(entry: any): string[] {
 }
 
 export async function handleQolBranchSummary(event: any, ctx: ExtensionContext): Promise<any> {
-	if (!settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd)) return undefined;
+	const nativeBlocked = gatewayPrivacyBlocksNativeSummary(ctx);
+	if (!nativeBlocked && !settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd)) return undefined;
 	const preparation = event.preparation ?? {};
 	if (preparation.userWantsSummary !== true) return undefined;
 	const entries = Array.isArray(preparation.entriesToSummarize) ? preparation.entriesToSummarize : [];
@@ -345,8 +353,8 @@ export async function handleQolBranchSummary(event: any, ctx: ExtensionContext):
 		};
 	} catch (error) {
 		if (event.signal?.aborted) return undefined;
-		compactionNotify(ctx, `QOL branch summary failed: ${stringifyError(error)}`, "error");
-		return undefined;
+		compactionNotify(ctx, `QOL branch summary failed: ${stringifyError(error)}`, "error", nativeBlocked);
+		return nativeBlocked ? { cancel: true } : undefined;
 	}
 }
 

package/extensions/qol/constants.ts

@@ -92,7 +92,7 @@ export const DEFAULT_AUTO_RENAME_MODEL = "openai-codex/gpt-5.4-mini";
 export const DEFAULT_AUTO_RENAME_FALLBACK_MODEL = "current";
 export const DEFAULT_AUTO_RENAME_INPUT_CHARS = 2000;
 export const DEFAULT_AUTO_RENAME_NAME_CHARS = 80;
-export const DEFAULT_AUTO_RENAME_MAX_TOKENS = 96;
+export const DEFAULT_AUTO_RENAME_MAX_TOKENS = 128;
 export const DEFAULT_AUTO_RENAME_TIMEOUT_MS = 12_000;
 export const DEFAULT_INPUT_BOTTOM_PADDING_LINES = 0;
 

package/extensions/qol/gateway-privacy.ts

@@ -0,0 +1,59 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { recordProjectTrust } from "./package-config.js";
+import { settingBoolean } from "./settings.js";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function gatewayPrivacyCovers(model: { provider: string } | undefined, cwd: string): boolean {
+	const provider = model?.provider;
+	return (provider === "openrouter" || provider === "vercel-ai-gateway") && settingBoolean("gatewayPrivacy.enabled", false, cwd);
+}
+
+/** Pi sends its own compaction and branch summaries to the session model with
+ * no payload callback, so for a covered model QOL writes the summary and never
+ * falls back to Pi's. */
+export function gatewayPrivacyBlocksNativeSummary(ctx: ExtensionContext): boolean {
+	recordProjectTrust(ctx);
+	return gatewayPrivacyCovers(ctx.model, ctx.cwd);
+}
+
+export function gatewayPrivacyOnPayload(ctx: ExtensionContext): (payload: unknown, model: { provider: string } | undefined) => unknown {
+	const cwd = ctx.cwd;
+	recordProjectTrust(ctx);
+	return (payload, model) => {
+		if (!gatewayPrivacyCovers(model, cwd)) return undefined;
+		const body = payload;
+		if (!isRecord(body)) return undefined;
+
+		// These request filters are opt-in package policy. Caller routing keys
+		// remain, but weaker privacy values must not disable an enabled filter.
+		if (model?.provider === "openrouter") {
+			return {
+				...body,
+				provider: {
+					...(isRecord(body.provider) ? body.provider : {}),
+					zdr: true,
+					data_collection: "deny",
+				},
+			};
+		}
+		const options = isRecord(body.providerOptions) ? body.providerOptions : {};
+		return {
+			...body,
+			providerOptions: {
+				...options,
+				gateway: {
+					...(isRecord(options.gateway) ? options.gateway : {}),
+					zeroDataRetention: true,
+					disallowPromptTraining: true,
+				},
+			},
+		};
+	};
+}
+
+export function registerGatewayPrivacy(pi: ExtensionAPI): void {
+	pi.on("before_provider_request", (event, ctx) => gatewayPrivacyOnPayload(ctx)(event.payload, ctx.model));
+}

package/extensions/qol/handoff.ts

@@ -6,6 +6,7 @@ import { acquirekendexModalLock } from "./bridges.js";
 import { serializeMessagesForSummary } from "./compaction.js";
 import { HANDOFF_SYSTEM_PROMPT } from "./constants.js";
 import { settingBoolean } from "./settings.js";
+import { gatewayPrivacyOnPayload } from "./gateway-privacy.js";
 
 function errorMessage(error: unknown): string {
 	const message = error instanceof Error ? error.message : String(error);
@@ -66,7 +67,7 @@ export async function runHandoff(args: string, ctx: ExtensionCommandContext): Pr
 				const response = await complete(
 					ctx.model!,
 					{ systemPrompt: HANDOFF_SYSTEM_PROMPT, messages: [userMessage] },
-					{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, signal: loader.signal },
+					{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, signal: loader.signal, onPayload: gatewayPrivacyOnPayload(ctx) },
 				);
 
 				if (response.stopReason === "aborted") return null;

package/extensions/qol/session-rename.ts

@@ -1,5 +1,6 @@
 import type { Message } from "@earendil-works/pi-ai";
 import { complete } from "./pi-ai-compat.js";
+import { gatewayPrivacyOnPayload } from "./gateway-privacy.js";
 import type { ExtensionContext, SessionEntry } from "@earendil-works/pi-coding-agent";
 import { textFromContent } from "./agent-end.js";
 import { oneLine } from "./ansi.js";
@@ -331,7 +332,7 @@ export async function generateAutoRenameName(query: string, ctx: ExtensionContex
 				const response = await complete(
 					resolved.model,
 					{ messages: [message], systemPrompt: AUTO_RENAME_SYSTEM_PROMPT },
-					{ apiKey: resolved.apiKey, env: resolved.env, headers: resolved.headers, maxTokens, signal: controller.signal },
+					{ apiKey: resolved.apiKey, env: resolved.env, headers: resolved.headers, maxTokens, signal: controller.signal, onPayload: gatewayPrivacyOnPayload(ctx) },
 				);
 				if (response.stopReason === "error") {
 					autoRenameDebug(ctx, `${resolved.label} failed: ${response.errorMessage ?? "unknown error"}`, "warning");

package/extensions/qol/status-message.ts

@@ -12,6 +12,7 @@ import {
 import { currentEditorText } from "./editor.js";
 import { glyphs } from "./glyphs.js";
 import { attachmentLabels } from "./images.js";
+import { gatewayPrivacyBlocksNativeSummary } from "./gateway-privacy.js";
 import { permissionGateCommands } from "./permission-gate.js";
 import { autoRenameEnabled } from "./session-rename.js";
 import { sessionSearchShortcut } from "./session-search/index.js";
@@ -36,6 +37,7 @@ export function statusMessage(ctx: ExtensionContext): string {
 	const labels = attachmentLabels(currentEditorText(ctx), ctx.cwd);
 	const searchShortcut = sessionSearchShortcut(ctx.cwd);
 	const statuslineEnabled = settingBoolean("statusline.enabled", true, ctx.cwd);
+	const nativeBlocked = gatewayPrivacyBlocksNativeSummary(ctx);
 	const statuslineMode = statuslineEnabled
 		? (settingBoolean("replaceFooter", true, ctx.cwd) ? "enabled, replaces footer" : "enabled, footer preserved")
 		: "disabled";
@@ -53,10 +55,10 @@ export function statusMessage(ctx: ExtensionContext): string {
 		`Schedule command: ${settingBoolean("enableScheduleCommand", true, ctx.cwd) ? "enabled (/schedule)" : "disabled"}`,
 		`Handoff prompt review: ${settingBoolean("handoffReviewPrompt", true, ctx.cwd) ? "enabled" : "disabled"}`,
 		`Session search: ${settingBoolean("sessionSearch.enabled", true, ctx.cwd) ? `enabled (/search${searchShortcut ? `, ${searchShortcut}` : ""})` : "disabled"}`,
-		`Custom compaction: ${settingBoolean("compaction.customEnabled", false, ctx.cwd) ? `enabled (${settingString("compaction.model", DEFAULT_COMPACTION_MODEL, ctx.cwd)}, ${compactionProfile(ctx.cwd)})` : "disabled (Pi default)"}`,
+		`Custom compaction: ${settingBoolean("compaction.customEnabled", false, ctx.cwd) ? `enabled (${settingString("compaction.model", DEFAULT_COMPACTION_MODEL, ctx.cwd)}, ${compactionProfile(ctx.cwd)})` : nativeBlocked ? "enabled by gateway privacy" : "disabled (Pi default)"}`,
 		`Budget guard: ${autoCompactionStatus(autoCompactionGate("budgetGuard", ctx.cwd), () => `enabled (budgetPercent=${settingNumber("compaction.budgetPercent", DEFAULT_BUDGET_GUARD_PERCENT, ctx.cwd)}, budgetTokens=${settingNumber("compaction.budgetTokens", DEFAULT_BUDGET_GUARD_TOKENS, ctx.cwd)})`)}`,
 		`Idle compaction: ${autoCompactionStatus(autoCompactionGate("idle", ctx.cwd), () => `enabled after ${Math.max(1, Math.floor(settingNumber("compaction.idleTimeoutSeconds", DEFAULT_IDLE_COMPACTION_SECONDS, ctx.cwd)))}s idle`)}`,
-		`Branch summary override: ${settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd) ? "enabled" : "disabled"}`,
+		`Branch summary override: ${settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd) ? "enabled" : nativeBlocked ? "enabled by gateway privacy" : "disabled"}`,
 		`Notifications: ${settingBoolean("notification.enabled", true, ctx.cwd) ? `enabled (bell=${settingBoolean("notification.bell", true, ctx.cwd)}, muteBell=${settingBoolean("notification.muteBellSound", false, ctx.cwd)}, native=${settingBoolean("notification.native", true, ctx.cwd)}, tmuxClientTty=${settingBoolean("notification.tmuxNativeClientTty", true, ctx.cwd)}, tmuxMessage=${settingBoolean("notification.tmux", false, ctx.cwd)})` : "disabled"}`,
 		`Permission gate: ${settingBoolean("permissionGate.enabled", false, ctx.cwd) ? `enabled (${permissionGateCommands(ctx.cwd).join(", ") || "none configured"}; preview ${boundedSettingNumber("permissionGate.previewLines", DEFAULT_PERMISSION_GATE_PREVIEW_LINES, 4, 40, ctx.cwd)} lines/${boundedSettingNumber("permissionGate.previewChars", DEFAULT_PERMISSION_GATE_PREVIEW_CHARS, 200, 5000, ctx.cwd)} chars)` : "disabled"}`,
 		`Thinking timer: ${settingBoolean("thinkingTimer.enabled", true, ctx.cwd) ? "enabled" : "disabled"}`,

package/extensions/qol.ts

@@ -39,6 +39,7 @@ import {
 	QolEditor,
 } from "./qol/editor.js";
 import { runHandoff } from "./qol/handoff.js";
+import { registerGatewayPrivacy } from "./qol/gateway-privacy.js";
 import { imageContentsForPaths, resolveSubmittedImagePaths } from "./qol/images.js";
 import {
 	clearTmuxWindowMark,
@@ -109,6 +110,7 @@ export default function qol(pi: ExtensionAPI): void {
 	if (guard[INSTALL_SYMBOL]) return;
 	guard[INSTALL_SYMBOL] = true;
 	if (!settingBoolean("enabled", true)) return;
+	registerGatewayPrivacy(pi);
 
 	installThinkingTimerPatch();
 	const thinkingTimerStore: ThinkingTimerStore = {
@@ -226,12 +228,12 @@ export default function qol(pi: ExtensionAPI): void {
 		thinkingTimerStore.enabled = !!ctx?.hasUI && settingBoolean("thinkingTimer.enabled", true, ctx?.cwd);
 	};
 
-	// Pi's Loader starts no animation timer for a single-frame indicator.
-	// Keep static mode available for terminals where frequent redraws flash,
-	// whether the indicator is embedded in QOL or in Pi's standalone row.
+	// Pi's Loader starts no animation timer for a single-frame indicator, so
+	// static mode, the default, draws no frames of its own whether the
+	// indicator is embedded in QOL or in Pi's standalone row.
 	const applyWorkingIndicatorMode = (ctx: ExtensionContext): void => {
 		if (!ctx.hasUI) return;
-		const mode = settingString("workingIndicator.mode", "animated", ctx.cwd);
+		const mode = settingString("workingIndicator.mode", "static", ctx.cwd);
 		if (mode === "static") {
 			ctx.ui.setWorkingVisible(true);
 			ctx.ui.setWorkingIndicator({ frames: [ctx.ui.theme.fg("accent", "●")] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-qol",
-  "version": "2.3.4",
+  "version": "2.5.0",
   "description": "Pi quality-of-life extension: compact statusline/π prompt, reliable multiline input, styled pasted-image chips, session naming/search/context import, scheduled prompts, handoff, permission prompts, notifications, custom compaction, and a collapsed-thinking timer.",
   "license": "MIT",
   "keywords": [
@@ -33,6 +33,15 @@
           "apply": "reload",
           "requiresReload": true
         },
+        {
+          "key": "gatewayPrivacy.enabled",
+          "label": "Require gateway privacy controls",
+          "description": "Require zero data retention and no prompt training for main-agent and QOL model requests through OpenRouter and Vercel AI Gateway. Overrides weaker privacy values and keeps other routing options. On a gateway session model, QOL writes compaction and branch summaries in place of Pi's built-in ones, which cannot carry these controls, and a failed summary cancels instead of falling back to Pi's.",
+          "type": "boolean",
+          "default": false,
+          "category": "Privacy",
+          "apply": "live"
+        },
         {
           "key": "glyphStyle",
           "label": "Glyph style",
@@ -310,9 +319,9 @@
         {
           "key": "sessionAutoRename.maxTokens",
           "label": "Auto-rename output tokens",
-          "description": "Maximum output tokens requested from the naming model.",
+          "description": "Maximum output tokens requested from the naming model, reasoning tokens included.",
           "type": "number",
-          "default": 96,
+          "default": 128,
           "category": "Session Auto-Rename",
           "apply": "live"
         },
@@ -803,7 +812,7 @@
         {
           "key": "compaction.fallbackToDefault",
           "label": "Fallback to Pi default compaction",
-          "description": "If custom compaction fails, let Pi run its default compaction instead of cancelling the compaction.",
+          "description": "If custom compaction fails, let Pi run its default compaction instead of cancelling the compaction. Ignored while gatewayPrivacy.enabled covers the session model, since Pi's compaction would send the transcript without the privacy controls.",
           "type": "boolean",
           "default": true,
           "category": "Compaction",
@@ -966,13 +975,13 @@
         {
           "key": "workingIndicator.mode",
           "label": "Working indicator mode",
-          "description": "Control Pi's built-in streaming spinner. The default animated spinner ticks every 80ms; in terminals where rendered content overflows the viewport (chat scrolled past the top, /tree open, etc.) each tick can trigger a pi-tui full-screen redraw and visible flash. Use 'static' for a single non-animating dot that keeps the working indicator visible without the 80ms timer. It appears before the project name when the QOL statusline is enabled, or in Pi's working row otherwise.",
+          "description": "Control Pi's built-in streaming spinner. The default 'static' shows a single non-animating dot that keeps the working indicator visible without a timer. 'animated' restores Pi's spinner, which ticks every 80ms; in terminals where rendered content overflows the viewport (chat scrolled past the top, /tree open, etc.) each tick can trigger a pi-tui full-screen redraw and visible flash. It appears before the project name when the QOL statusline is enabled, or in Pi's working row otherwise.",
           "type": "enum",
           "enumValues": [
             "animated",
             "static"
           ],
-          "default": "animated",
+          "default": "static",
           "category": "Thinking",
           "apply": "reload",
           "requiresReload": true