@vanillagreen/pi-qol 2.4.0 → 2.5.1

package/README.md

@@ -4,6 +4,15 @@ A Pi extension for session controls, prompt editing and notifications. Users can
 
 ![QOL extension settings panel](https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-qol/assets/settings-panel.png) ![Session search popup](https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-qol/assets/session-search.gif) ![/context usage breakdown](https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-qol/assets/context-usage.png)
 
+## Features
+
+- Show repository, model and context information beside the editor, with the working spinner before the project name.
+- Name and search sessions.
+- Schedule prompts and prepare handoff drafts.
+- Ask before configured shell commands run.
+- Send terminal and desktop notifications.
+- Configure summaries and compaction for long sessions.
+
 ## Install
 
 - npm: `pi install npm:@vanillagreen/pi-qol`.
@@ -16,15 +25,6 @@ source = "kendex"
 
 Requires Pi 0.86.0 or newer. Restart Pi after installation. Use `kendex update-pi --check` to preview the installation.
 
-## Features
-
-- Show repository, model and context information beside the editor, with the working spinner before the project name.
-- Name and search sessions.
-- Schedule prompts and prepare handoff drafts.
-- Ask before configured shell commands run.
-- Send terminal and desktop notifications.
-- Configure summaries and compaction for long sessions.
-
 ## How it works
 
 The extension reads your enabled features when Pi starts. It adds their editor controls, commands and event handlers. Session actions update the session or queue messages for the agent. Notifications report events through your selected channels. Compaction settings control when long conversations are summarized.
@@ -42,24 +42,29 @@ The extension reads your enabled features when Pi starts. It adds their editor c
 
 At session start, the extension deletes budget handoff files whose recorded working directory no longer exists. It also deletes files older than 5 days. Both timestamped snapshots and `latest.json` follow this rule.
 
-## Settings
+## Setup
 
 The settings editor writes project values to `.pi/settings.json`. The default user file is `~/.pi/agent/settings.json`. `PI_CODING_AGENT_DIR` changes the user directory. Package values are stored under `kendex.extensionManager.config["@vanillagreen/pi-qol"]`.
 
 Open `/extensions:settings`; settings appear under the **QOL** tab. Project settings in `.pi/settings.json` apply only after Pi marks the workspace trusted. `glyphStyle` picks `unicode` or `ascii` symbols, and `@vanillagreen/pi-tool-renderer`'s `globalGlyphStyleOverride` wins when set.
 
 - `enabled`: package toggle for everything below.
+- `gatewayPrivacy.enabled`: require zero data retention and no prompt training for main-agent and QOL model requests through OpenRouter and Vercel AI Gateway. Covers QOL compaction, branch summaries, imported-session summaries, handoff and session naming. Keeps other routing options and overrides weaker privacy values. Pi's built-in compaction and branch summaries cannot carry these fields, so on a gateway session model QOL writes them in place of Pi's, whatever `compaction.customEnabled` and `compaction.branchSummaryEnabled` say, and a failed or refused summary cancels the compaction or tree move instead of falling back to Pi's. Custom remote compaction endpoints keep their own privacy policy.
 - Statusline and editor: `statusline.enabled`, `statusline.showProvider`, `statusline.showAccount`, `replaceFooter`, `compactPrompt`, `showSessionNameTitle`, `showSessionNameWindow`, `inputBottomPaddingLines`, `gitRefreshTimeoutMs`, `showDirtyMarker`, `newlineOnShiftEnter`, `newlineFallbackKey`, `pendingQueue.asciiGreen`, `showImageChips`, `showAttachmentCountInStatus`.
 - Commands: `enableSessionNameCommand`, `enableHandoffCommand`, `enableScheduleCommand`, `enableContextCommand`, `handoffReviewPrompt`.
-- Session naming: `sessionAutoRename.*` (model, fallback model, deterministic fallback, prefix, prompt, limits, notify, debug). `sessionAutoRename.maxTokens` also counts the naming model's reasoning tokens: with `gpt-5.4-mini` naming 40 issue-sized first messages, 22 got a title at 96 and 29 at 128, the default. `sessionAutoRename.maxNameChars` stays 80 because no title in those runs was longer than 36 characters, so 70 and 80 give the same names.
+- Session naming: `sessionAutoRename.*` (model, fallback model, deterministic fallback, prefix, prompt, limits, notify, debug). `sessionAutoRename.maxTokens` includes the naming model's reasoning tokens. The naming request asks for the lowest reasoning effort the model accepts, and turns reasoning off where the model allows it. `sessionAutoRename.maxNameChars` limits the title length.
 - Session search: `sessionSearch.*` (shortcut, result and row limits, snippets, overlay width, cache TTL, summary model and limits).
 - Rate limits: `rateLimitAutoResume.*`.
 - Permission gate: `permissionGate.enabled`, `permissionGate.commands` (comma-separated literal fragments or `/regex/flags`), `permissionGate.previewLines`, `permissionGate.previewChars`.
 - Notifications: `notification.*` (triggers, channels, tmux options, protocol, cooldown, title and body).
-- Compaction and budget guard: `compaction.*` (custom summaries, model, profile, remote endpoint, branch summaries, idle trigger, budget guard thresholds, chunk input cap, handoff artifact, transcript-risk budget). `compaction.maxTokens` stays 8192, the cap on the budget-guard, custom and branch summaries. The fleet value considered was 10192, but no comparison was possible: the fleet's settings, Pi's `compaction.enabled` false with `compaction.customEnabled` and `compaction.branchSummaryEnabled` off, run none of these summaries.
+- Compaction and budget guard: `compaction.*` (custom summaries, model, profile, remote endpoint, branch summaries, idle trigger, budget guard thresholds, chunk input cap, handoff artifact, transcript-risk budget). `compaction.maxTokens` caps budget-guard, custom and branch summaries.
   - Pi's own `compaction.enabled` (the top-level `compaction` object in the same settings files, not a QOL key) turns off every automatic compaction: when it is `false`, neither the budget guard nor the idle trigger starts one, and `/qol` reports both as disabled by that key. A manual `/compact` still runs. While it is `true` or absent, both keep the defaults and thresholds above: the budget guard on at `compaction.budgetPercent` 85, the idle trigger off until `compaction.idleEnabled` is set.
-- Thinking: `thinkingLabel.text`, `thinkingTimer.enabled`, `workingIndicator.mode`. `workingIndicator.mode` defaults to `static`, a dot with no animation timer; `animated` restores Pi's spinner. In a scripted 100-second streaming session on Pi 1.0.1, `animated` drew 2050 and 2080 frames with 4.9 s of CPU, and `static` 867 and 873 frames with 3.2 to 3.4 s. `thinkingTimer.enabled` stays on because turning it off in the same session changed neither the frames (2056 and 2066) nor the CPU (4.8 to 4.9 s).
+- Thinking: `thinkingLabel.text`, `thinkingTimer.enabled`, `workingIndicator.mode`. `workingIndicator.mode` defaults to `static`, a dot with no animation timer; `animated` restores Pi's spinner. `thinkingTimer.enabled` controls the thinking duration display.
 
 **Show model provider** displays a readable provider name before the model, such as `Copilot / GPT 6 Astra`. It is on by default; changes apply on the next render without reloading. Disabling the QOL statusline leaves Pi's standalone working indicator in place.
 
 Maintainer notes are in [DEVELOPMENT.md](DEVELOPMENT.md).
+
+## Licence
+
+[MIT](https://github.com/vanillagreencom/kendex/blob/main/LICENSE)

package/extensions/qol/compaction.ts

@@ -29,12 +29,16 @@ import {
 } from "./compaction-handoff.js";
 import { piCompactionEnabled, settingBoolean, settingNumber, settingString } from "./settings.js";
 import { stringifyError } from "./util.js";
+import { gatewayPrivacyBlocksNativeSummary, gatewayPrivacyOnPayload } from "./gateway-privacy.js";
 
 export type QolSummaryProfile = "concise" | "balanced" | "exhaustive";
 export type QolSummaryPurpose = "compaction" | "branch-summary" | "session-search";
 
-export function compactionNotify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info"): void {
-	if (ctx.hasUI && settingBoolean("compaction.notify", true, ctx.cwd)) ctx.ui.notify(message, level);
+export function compactionNotify(ctx: ExtensionContext, message: string, level: "info" | "warning" | "error" = "info", required = false): void {
+	if (ctx.hasUI && (required || settingBoolean("compaction.notify", true, ctx.cwd))) ctx.ui.notify(message, level);
+	// Print, JSON and RPC callers read stderr for diagnostics. A cancelled
+	// protected summary has no Pi error event to carry its provider failure.
+	if (!ctx.hasUI && required) console.error(JSON.stringify({ source: "pi-qol", level, message }));
 }
 
 export function compactionProfile(cwd: string): QolSummaryProfile {
@@ -174,7 +178,7 @@ async function singleShotSummary(ctx: ExtensionContext, request: SummarizeReques
 		() => complete(
 			model,
 			{ messages: [message], systemPrompt: QOL_COMPACTION_SYSTEM_PROMPT },
-			{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, maxTokens: options.maxTokens, signal: options.signal },
+			{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, maxTokens: options.maxTokens, signal: options.signal, onPayload: gatewayPrivacyOnPayload(ctx) },
 		),
 		options.signal,
 		{
@@ -261,16 +265,19 @@ export function writeBudgetHandoffArtifact(ctx: ExtensionContext, handoff: QolBu
 
 export async function handleQolCompaction(event: any, ctx: ExtensionContext): Promise<any> {
 	const isBudgetGuard = isBudgetGuardCompaction(event?.customInstructions);
-	// Budget-guard-triggered compactions force the QOL bounded summarizer even
-	// when compaction.customEnabled is off. The handoff writer still honors its
-	// independent compaction.handoffArtifactEnabled toggle.
-	if (!isBudgetGuard && !settingBoolean("compaction.customEnabled", false, ctx.cwd)) return undefined;
+	const nativeBlocked = gatewayPrivacyBlocksNativeSummary(ctx);
+	const customEnabled = settingBoolean("compaction.customEnabled", false, ctx.cwd);
+	// Budget-guard-triggered and privacy-covered compactions force the QOL
+	// summarizer even when compaction.customEnabled is off. The handoff writer
+	// still honors its independent compaction.handoffArtifactEnabled toggle.
+	if (!isBudgetGuard && !nativeBlocked && !customEnabled) return undefined;
 	const preparation = event.preparation ?? {};
 	const messages = [...(preparation.messagesToSummarize ?? []), ...(preparation.turnPrefixMessages ?? [])];
 	if (messages.length === 0) return undefined;
 	const tokensBefore = typeof preparation.tokensBefore === "number" ? preparation.tokensBefore : 0;
-	const handoff = buildBudgetHandoff(ctx, { preparation, reason: event.customInstructions ?? "session_before_compact" });
-	const handoffResult = writeBudgetHandoffArtifact(ctx, handoff);
+	const handoffResult: HandoffWriteResult = isBudgetGuard || customEnabled
+		? writeBudgetHandoffArtifact(ctx, buildBudgetHandoff(ctx, { preparation, reason: event.customInstructions ?? "session_before_compact" }))
+		: {};
 	const sourceLabel = isBudgetGuard ? "pi-qol budget-guard" : "pi-qol";
 	compactionNotify(ctx, `QOL compaction: summarizing ${messages.length} message(s), ${tokensBefore.toLocaleString()} token(s)${isBudgetGuard ? " (budget guard)" : ""}.`, "info");
 	try {
@@ -308,8 +315,8 @@ export async function handleQolCompaction(event: any, ctx: ExtensionContext): Pr
 		};
 	} catch (error) {
 		if (event.signal?.aborted) return undefined;
-		compactionNotify(ctx, `QOL compaction failed: ${stringifyError(error)}`, "error");
-		return settingBoolean("compaction.fallbackToDefault", true, ctx.cwd) ? undefined : { cancel: true };
+		compactionNotify(ctx, `QOL compaction failed: ${stringifyError(error)}`, "error", nativeBlocked);
+		return !nativeBlocked && settingBoolean("compaction.fallbackToDefault", true, ctx.cwd) ? undefined : { cancel: true };
 	}
 }
 
@@ -322,7 +329,8 @@ function summarizeEntryForBranch(entry: any): string[] {
 }
 
 export async function handleQolBranchSummary(event: any, ctx: ExtensionContext): Promise<any> {
-	if (!settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd)) return undefined;
+	const nativeBlocked = gatewayPrivacyBlocksNativeSummary(ctx);
+	if (!nativeBlocked && !settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd)) return undefined;
 	const preparation = event.preparation ?? {};
 	if (preparation.userWantsSummary !== true) return undefined;
 	const entries = Array.isArray(preparation.entriesToSummarize) ? preparation.entriesToSummarize : [];
@@ -345,8 +353,8 @@ export async function handleQolBranchSummary(event: any, ctx: ExtensionContext):
 		};
 	} catch (error) {
 		if (event.signal?.aborted) return undefined;
-		compactionNotify(ctx, `QOL branch summary failed: ${stringifyError(error)}`, "error");
-		return undefined;
+		compactionNotify(ctx, `QOL branch summary failed: ${stringifyError(error)}`, "error", nativeBlocked);
+		return nativeBlocked ? { cancel: true } : undefined;
 	}
 }
 

package/extensions/qol/gateway-privacy.ts

@@ -0,0 +1,59 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { recordProjectTrust } from "./package-config.js";
+import { settingBoolean } from "./settings.js";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function gatewayPrivacyCovers(model: { provider: string } | undefined, cwd: string): boolean {
+	const provider = model?.provider;
+	return (provider === "openrouter" || provider === "vercel-ai-gateway") && settingBoolean("gatewayPrivacy.enabled", false, cwd);
+}
+
+/** Pi sends its own compaction and branch summaries to the session model with
+ * no payload callback, so for a covered model QOL writes the summary and never
+ * falls back to Pi's. */
+export function gatewayPrivacyBlocksNativeSummary(ctx: ExtensionContext): boolean {
+	recordProjectTrust(ctx);
+	return gatewayPrivacyCovers(ctx.model, ctx.cwd);
+}
+
+export function gatewayPrivacyOnPayload(ctx: ExtensionContext): (payload: unknown, model: { provider: string } | undefined) => unknown {
+	const cwd = ctx.cwd;
+	recordProjectTrust(ctx);
+	return (payload, model) => {
+		if (!gatewayPrivacyCovers(model, cwd)) return undefined;
+		const body = payload;
+		if (!isRecord(body)) return undefined;
+
+		// These request filters are opt-in package policy. Caller routing keys
+		// remain, but weaker privacy values must not disable an enabled filter.
+		if (model?.provider === "openrouter") {
+			return {
+				...body,
+				provider: {
+					...(isRecord(body.provider) ? body.provider : {}),
+					zdr: true,
+					data_collection: "deny",
+				},
+			};
+		}
+		const options = isRecord(body.providerOptions) ? body.providerOptions : {};
+		return {
+			...body,
+			providerOptions: {
+				...options,
+				gateway: {
+					...(isRecord(options.gateway) ? options.gateway : {}),
+					zeroDataRetention: true,
+					disallowPromptTraining: true,
+				},
+			},
+		};
+	};
+}
+
+export function registerGatewayPrivacy(pi: ExtensionAPI): void {
+	pi.on("before_provider_request", (event, ctx) => gatewayPrivacyOnPayload(ctx)(event.payload, ctx.model));
+}

package/extensions/qol/handoff.ts

@@ -6,6 +6,7 @@ import { acquirekendexModalLock } from "./bridges.js";
 import { serializeMessagesForSummary } from "./compaction.js";
 import { HANDOFF_SYSTEM_PROMPT } from "./constants.js";
 import { settingBoolean } from "./settings.js";
+import { gatewayPrivacyOnPayload } from "./gateway-privacy.js";
 
 function errorMessage(error: unknown): string {
 	const message = error instanceof Error ? error.message : String(error);
@@ -66,7 +67,7 @@ export async function runHandoff(args: string, ctx: ExtensionCommandContext): Pr
 				const response = await complete(
 					ctx.model!,
 					{ systemPrompt: HANDOFF_SYSTEM_PROMPT, messages: [userMessage] },
-					{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, signal: loader.signal },
+					{ apiKey: auth.apiKey, env: auth.env, headers: auth.headers, signal: loader.signal, onPayload: gatewayPrivacyOnPayload(ctx) },
 				);
 
 				if (response.stopReason === "aborted") return null;

package/extensions/qol/pi-ai-compat.ts

@@ -18,11 +18,27 @@ type RetryAssistantCall = (
 	},
 ) => Promise<any>;
 
-export async function complete(model: unknown, context: unknown, options?: unknown, deps: PiAiCompatDeps = {}): Promise<any> {
-	const rootComplete = (deps.root ?? piAi as any).complete;
-	if (typeof rootComplete === "function") return await rootComplete(model, context, options);
+async function dispatchCompletion(name: "complete" | "completeSimple", model: unknown, context: unknown, options: unknown, deps: PiAiCompatDeps): Promise<any> {
+	const rootFunction = (deps.root ?? piAi as any)[name];
+	if (typeof rootFunction === "function") return await rootFunction(model, context, options);
 	const compat = deps.loadCompat ? await deps.loadCompat() : await dynamicImport("@earendil-works/pi-ai/compat") as any;
-	return await compat.complete(model, context, options);
+	return await compat[name](model, context, options);
+}
+
+export async function complete(model: unknown, context: unknown, options?: unknown, deps: PiAiCompatDeps = {}): Promise<any> {
+	return await dispatchCompletion("complete", model, context, options, deps);
+}
+
+export async function completeSimple(model: unknown, context: unknown, options?: unknown, deps: PiAiCompatDeps = {}): Promise<any> {
+	return await dispatchCompletion("completeSimple", model, context, options, deps);
+}
+
+// The lowest reasoning level the model accepts, as `SimpleStreamOptions.reasoning`
+// takes it. Simple options express "off" by leaving the level out, so a model that
+// can turn reasoning off gets undefined. Levels come from pi-ai's model catalog.
+export function lowestReasoningLevel(model: unknown, deps: { root?: any } = {}): string | undefined {
+	const [lowest] = (deps.root ?? piAi as any).getSupportedThinkingLevels(model) as string[];
+	return lowest === "off" ? undefined : lowest;
 }
 
 export async function retryAssistantCallCompat(

package/extensions/qol/session-rename.ts

@@ -1,5 +1,6 @@
 import type { Message } from "@earendil-works/pi-ai";
-import { complete } from "./pi-ai-compat.js";
+import { completeSimple, lowestReasoningLevel } from "./pi-ai-compat.js";
+import { gatewayPrivacyOnPayload } from "./gateway-privacy.js";
 import type { ExtensionContext, SessionEntry } from "@earendil-works/pi-coding-agent";
 import { textFromContent } from "./agent-end.js";
 import { oneLine } from "./ansi.js";
@@ -247,6 +248,21 @@ export function headerRecord(headers: unknown): Record<string, string | null> |
 	return entries.length > 0 ? Object.fromEntries(entries) : undefined;
 }
 
+// Pi's agent path sends a request to the base URL the credential resolves, not the
+// catalog's: a Copilot enterprise token names the enterprise proxy host
+// (pi-ai auth/oauth/github-copilot.js `toAuth`, pi-coding-agent
+// core/agent-session.js `_getRequiredRequestAuth`).
+function autoRenameAuth(model: any, auth: { apiKey?: string; baseUrl?: string; env?: Record<string, string>; headers?: unknown }, source: string): AutoRenameAuth {
+	return {
+		apiKey: auth.apiKey,
+		env: auth.env,
+		headers: headerRecord(auth.headers),
+		label: modelLabel(model),
+		model: auth.baseUrl ? { ...model, baseUrl: auth.baseUrl } : model,
+		source,
+	};
+}
+
 function modelCost(model: any): number {
 	const cost = model?.cost;
 	return Number(cost?.input ?? 0) + Number(cost?.output ?? 0);
@@ -266,8 +282,7 @@ async function cheapestAvailableAutoRenameModel(ctx: ExtensionContext): Promise<
 	for (const model of models) {
 		try {
 			const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-			const headers = headerRecord(auth.headers);
-			if (auth.ok) return { apiKey: auth.apiKey, env: auth.env, headers, label: modelLabel(model), model, source: "cheapest" };
+			if (auth.ok) return autoRenameAuth(model, auth, "cheapest");
 		} catch (error) {
 			if (isStaleCtxError(error)) return undefined;
 			// Try the next available model.
@@ -286,12 +301,11 @@ async function resolveAutoRenameModel(ctx: ExtensionContext, configured: string)
 		}
 		try {
 			const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-			const headers = headerRecord(auth.headers);
 			if (!auth.ok) {
 				autoRenameDebug(ctx, `auth unavailable for ${modelLabel(model)}: ${auth.error}`, "warning");
 				return undefined;
 			}
-			return { apiKey: auth.apiKey, env: auth.env, headers, label: modelLabel(model), model, source: configured };
+			return autoRenameAuth(model, auth, configured);
 		} catch (error) {
 			if (isStaleCtxError(error)) return undefined;
 			autoRenameDebug(ctx, `auth failed for ${modelLabel(model)}: ${stringifyError(error)}`, "warning");
@@ -328,10 +342,12 @@ export async function generateAutoRenameName(query: string, ctx: ExtensionContex
 			const timeout = setTimeout(() => controller.abort(), timeoutMs);
 			timeout.unref?.();
 			try {
-				const response = await complete(
+				// A reasoning model left at its default effort can spend the whole token
+				// cap reasoning and write no title.
+				const response = await completeSimple(
 					resolved.model,
 					{ messages: [message], systemPrompt: AUTO_RENAME_SYSTEM_PROMPT },
-					{ apiKey: resolved.apiKey, env: resolved.env, headers: resolved.headers, maxTokens, signal: controller.signal },
+					{ apiKey: resolved.apiKey, env: resolved.env, headers: resolved.headers, maxTokens, reasoning: lowestReasoningLevel(resolved.model), signal: controller.signal, onPayload: gatewayPrivacyOnPayload(ctx) },
 				);
 				if (response.stopReason === "error") {
 					autoRenameDebug(ctx, `${resolved.label} failed: ${response.errorMessage ?? "unknown error"}`, "warning");

package/extensions/qol/status-message.ts

@@ -12,6 +12,7 @@ import {
 import { currentEditorText } from "./editor.js";
 import { glyphs } from "./glyphs.js";
 import { attachmentLabels } from "./images.js";
+import { gatewayPrivacyBlocksNativeSummary } from "./gateway-privacy.js";
 import { permissionGateCommands } from "./permission-gate.js";
 import { autoRenameEnabled } from "./session-rename.js";
 import { sessionSearchShortcut } from "./session-search/index.js";
@@ -36,6 +37,7 @@ export function statusMessage(ctx: ExtensionContext): string {
 	const labels = attachmentLabels(currentEditorText(ctx), ctx.cwd);
 	const searchShortcut = sessionSearchShortcut(ctx.cwd);
 	const statuslineEnabled = settingBoolean("statusline.enabled", true, ctx.cwd);
+	const nativeBlocked = gatewayPrivacyBlocksNativeSummary(ctx);
 	const statuslineMode = statuslineEnabled
 		? (settingBoolean("replaceFooter", true, ctx.cwd) ? "enabled, replaces footer" : "enabled, footer preserved")
 		: "disabled";
@@ -53,10 +55,10 @@ export function statusMessage(ctx: ExtensionContext): string {
 		`Schedule command: ${settingBoolean("enableScheduleCommand", true, ctx.cwd) ? "enabled (/schedule)" : "disabled"}`,
 		`Handoff prompt review: ${settingBoolean("handoffReviewPrompt", true, ctx.cwd) ? "enabled" : "disabled"}`,
 		`Session search: ${settingBoolean("sessionSearch.enabled", true, ctx.cwd) ? `enabled (/search${searchShortcut ? `, ${searchShortcut}` : ""})` : "disabled"}`,
-		`Custom compaction: ${settingBoolean("compaction.customEnabled", false, ctx.cwd) ? `enabled (${settingString("compaction.model", DEFAULT_COMPACTION_MODEL, ctx.cwd)}, ${compactionProfile(ctx.cwd)})` : "disabled (Pi default)"}`,
+		`Custom compaction: ${settingBoolean("compaction.customEnabled", false, ctx.cwd) ? `enabled (${settingString("compaction.model", DEFAULT_COMPACTION_MODEL, ctx.cwd)}, ${compactionProfile(ctx.cwd)})` : nativeBlocked ? "enabled by gateway privacy" : "disabled (Pi default)"}`,
 		`Budget guard: ${autoCompactionStatus(autoCompactionGate("budgetGuard", ctx.cwd), () => `enabled (budgetPercent=${settingNumber("compaction.budgetPercent", DEFAULT_BUDGET_GUARD_PERCENT, ctx.cwd)}, budgetTokens=${settingNumber("compaction.budgetTokens", DEFAULT_BUDGET_GUARD_TOKENS, ctx.cwd)})`)}`,
 		`Idle compaction: ${autoCompactionStatus(autoCompactionGate("idle", ctx.cwd), () => `enabled after ${Math.max(1, Math.floor(settingNumber("compaction.idleTimeoutSeconds", DEFAULT_IDLE_COMPACTION_SECONDS, ctx.cwd)))}s idle`)}`,
-		`Branch summary override: ${settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd) ? "enabled" : "disabled"}`,
+		`Branch summary override: ${settingBoolean("compaction.branchSummaryEnabled", false, ctx.cwd) ? "enabled" : nativeBlocked ? "enabled by gateway privacy" : "disabled"}`,
 		`Notifications: ${settingBoolean("notification.enabled", true, ctx.cwd) ? `enabled (bell=${settingBoolean("notification.bell", true, ctx.cwd)}, muteBell=${settingBoolean("notification.muteBellSound", false, ctx.cwd)}, native=${settingBoolean("notification.native", true, ctx.cwd)}, tmuxClientTty=${settingBoolean("notification.tmuxNativeClientTty", true, ctx.cwd)}, tmuxMessage=${settingBoolean("notification.tmux", false, ctx.cwd)})` : "disabled"}`,
 		`Permission gate: ${settingBoolean("permissionGate.enabled", false, ctx.cwd) ? `enabled (${permissionGateCommands(ctx.cwd).join(", ") || "none configured"}; preview ${boundedSettingNumber("permissionGate.previewLines", DEFAULT_PERMISSION_GATE_PREVIEW_LINES, 4, 40, ctx.cwd)} lines/${boundedSettingNumber("permissionGate.previewChars", DEFAULT_PERMISSION_GATE_PREVIEW_CHARS, 200, 5000, ctx.cwd)} chars)` : "disabled"}`,
 		`Thinking timer: ${settingBoolean("thinkingTimer.enabled", true, ctx.cwd) ? "enabled" : "disabled"}`,

package/extensions/qol/thinking-timer.ts

@@ -71,11 +71,15 @@ export function installThinkingTimerPatch(): void {
 			const labelComponents: Text[] = [];
 			for (const child of this.contentContainer.children as any[]) {
 				if (!child || typeof child !== "object") continue;
-				if (typeof child.setText !== "function") continue;
-				if (typeof child.text !== "string") continue;
+				// Pi's SDK setHiddenThinkingLabel applies one label globally, not per block.
+				// Until it supports per-block labels, depend on the private contentContainer
+				// and MouseRegion.child (verified at Pi 0.86.0 and 1.0.1).
+				const label = child.child ?? child;
+				if (typeof label.setText !== "function") continue;
+				if (typeof label.text !== "string") continue;
 				const expectedLabel = thinkingLabel(store.cwd);
-				if (!child.text.includes(expectedLabel) && !child.text.includes("Thinking...")) continue;
-				labelComponents.push(child as Text);
+				if (!label.text.includes(expectedLabel) && !label.text.includes("Thinking...")) continue;
+				labelComponents.push(label as Text);
 			}
 			if (labelComponents.length === 0) return;
 

package/extensions/qol.ts

@@ -39,6 +39,7 @@ import {
 	QolEditor,
 } from "./qol/editor.js";
 import { runHandoff } from "./qol/handoff.js";
+import { registerGatewayPrivacy } from "./qol/gateway-privacy.js";
 import { imageContentsForPaths, resolveSubmittedImagePaths } from "./qol/images.js";
 import {
 	clearTmuxWindowMark,
@@ -109,6 +110,7 @@ export default function qol(pi: ExtensionAPI): void {
 	if (guard[INSTALL_SYMBOL]) return;
 	guard[INSTALL_SYMBOL] = true;
 	if (!settingBoolean("enabled", true)) return;
+	registerGatewayPrivacy(pi);
 
 	installThinkingTimerPatch();
 	const thinkingTimerStore: ThinkingTimerStore = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-qol",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "Pi quality-of-life extension: compact statusline/π prompt, reliable multiline input, styled pasted-image chips, session naming/search/context import, scheduled prompts, handoff, permission prompts, notifications, custom compaction, and a collapsed-thinking timer.",
   "license": "MIT",
   "keywords": [
@@ -33,6 +33,15 @@
           "apply": "reload",
           "requiresReload": true
         },
+        {
+          "key": "gatewayPrivacy.enabled",
+          "label": "Require gateway privacy controls",
+          "description": "Require zero data retention and no prompt training for main-agent and QOL model requests through OpenRouter and Vercel AI Gateway. Overrides weaker privacy values and keeps other routing options. On a gateway session model, QOL writes compaction and branch summaries in place of Pi's built-in ones, which cannot carry these controls, and a failed summary cancels instead of falling back to Pi's.",
+          "type": "boolean",
+          "default": false,
+          "category": "Privacy",
+          "apply": "live"
+        },
         {
           "key": "glyphStyle",
           "label": "Glyph style",
@@ -803,7 +812,7 @@
         {
           "key": "compaction.fallbackToDefault",
           "label": "Fallback to Pi default compaction",
-          "description": "If custom compaction fails, let Pi run its default compaction instead of cancelling the compaction.",
+          "description": "If custom compaction fails, let Pi run its default compaction instead of cancelling the compaction. Ignored while gatewayPrivacy.enabled covers the session model, since Pi's compaction would send the transcript without the privacy controls.",
           "type": "boolean",
           "default": true,
           "category": "Compaction",