bermudis-pi-goodies 0.27.7 → 0.27.9

package/README.md

@@ -8,7 +8,7 @@ extensions. One entry point, thirteen independent features.
 | `copy-with-model`   | `/copy-with-model`            | Copy last assistant message to the clipboard in a code fence tagged with the model name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `copy-trajectory`   | `/copy-trajectory [thinking]` | Copy the whole conversation (user + assistant text, tool calls stripped) to the clipboard; `thinking` also includes assistant thinking blocks.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `name-with-ai`      | `/name-with-ai [name]`        | Generate a short session name from the first user message (or set one manually).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `prefer-tools`      | hook (no command)             | Blocks legacy tools: `rm` → `trash <path>` (and `trash-rm`/`trash-empty`, which delete permanently), bare `python`/`pip`/`pytest`/`mypy` → `uv`. On `glm-5.*` models it also blocks bash `rg` (they invent ripgrep flags) — the built-in grep tool still works.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `prefer-tools`      | hook (no command)             | Blocks legacy tools: `rm` → `trash <path>` (and `trash-rm`/`trash-empty`, which delete permanently), `python`/`pip`/`pytest`/`mypy` are not blocked (removed 2026-10-24 — steering to `uv` is AGENTS.md's job, not the hook's). Bash `rg` is allowed, except the replace flag: `-r` (including clusters like `-rn`) is blocked because it is `--replace` and silently replaces matched text — use `--replace` explicitly if you mean it. The built-in grep tool still works.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `keep-model-on-new` | hook (no command)             | Keep the active model when `/new` starts a fresh session instead of reverting to pi's saved default model.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `model-thinking`    | `/model-thinking`             | Per-model default thinking levels: save the current level as this model's default and get it back on every switch to that model, instead of pi's global default.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `clean-tui`         | tool overrides (no command)   | Collapse built-in tool output for a cleaner TUI: back-to-back same-tool calls share one block (e.g. `read ×2`) until a boundary — visible text (assistant prose or a typed user message) or a thinking block (even an empty one, as OpenAI emits between tool calls) — so reasoning-per-call models render one block per call. Images stay visible without expanding, expand a row with ctrl+o to see the full command and results/diffs. Long bash commands get an AI-generated summary once you pick a model with `/goodies summary-model <provider/model>` (see "Smart summaries" below) — expanding a row swaps the summary back out for the raw command. While enabled, also flips `@bermudi/pi-codex`'s `apply_patch`/`web_search` into the same burst style. Long thinking runs can show a live plain-English line above the editor (`/goodies thinking-summaries on`) instead of a static `Thinking...` — see "Smart summaries". |
@@ -25,7 +25,7 @@ extensions. One entry point, thirteen independent features.
 First install, pinned to a published version:
 
 ```bash
-pi install npm:bermudis-pi-goodies@0.27.7
+pi install npm:bermudis-pi-goodies@0.27.9
 ```
 
 Picking up a new release on an existing install (`pi install` is not the
@@ -42,8 +42,13 @@ the balance footer). State persists to `~/.pi/agent/goodies.json`.
 While enabled, the tool overrides carry the built-ins' full definitions —
 schema, execution, and system-prompt contributions (`promptSnippet`,
 `promptGuidelines`) — so the model sees exactly what vanilla pi would show it;
-the extension is purely presentational. Every feature toggle, clean-tui
-included, takes effect on the next `/reload` or new session.
+the extension is purely presentational. They re-register with
+`defaultActive: false`: registering a tool name in pi activates it by
+default, which used to force `find`/`grep`/`ls` (pi's bash-less fallback
+trio) into every session — registration is now strictly a renderer swap and
+the active tool set stays exactly what vanilla pi would pick. Every feature
+toggle, clean-tui included, takes effect on the next `/reload` or new
+session.
 Kilo's provider and its balance footer are bundled here.
 
 ## Smart summaries for long bash commands

package/clean-tui.ts

@@ -1383,6 +1383,19 @@ export default function cleanTui(pi: ExtensionAPI): void {
     const definition = {
       ...native, // retain promptSnippet/Guidelines, schema, execution mode, preparation and all future metadata
       ...burst,
+      // Renderer override ONLY — registration must never touch activation.
+      // pi activates any direct-exposure tool on registration unless
+      // defaultActive is false (agent-session _isActivatedOnRegistration),
+      // so re-registering the built-in names here used to force-activate
+      // find/grep/ls — pi keeps them for bash-less read-only sessions — in
+      // every session, and symmetrically would force bash into one. With
+      // defaultActive: false the definitions sit in the registry with their
+      // burst renderers for whenever the tool IS active: already-active
+      // tools stay active through re-registration (the refresh seeds the
+      // next active set from the previous one), inactive ones stay inactive
+      // until pi's own gating (base defaults, --tools/defaultTools, /tools,
+      // setActiveTools) names them.
+      defaultActive: false,
       async execute(
         toolCallId: string,
         params: never,

package/index.ts

@@ -6,7 +6,7 @@
  *   - copy-with-model  /copy-with-model  copy last reply tagged with the model
  *   - copy-trajectory  /copy-trajectory  copy the whole conversation (text only) to the clipboard
  *   - name-with-ai     /name-with-ai     generate a session name via the model
- *   - prefer-tools     hook              block legacy tools (trash/uv; blocks rg on glm-5.*)
+ *   - prefer-tools     hook              block legacy tools (trash; blocks rg's -r replace flag)
  *   - keep-model       hook              preserve the active model across /new
  *   - model-thinking   /model-thinking   per-model default thinking levels, applied on switch
  *   - clean-tui        tool overrides    collapse built-in tool output; keep a one-line call header, hide results/diffs until expanded

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bermudis-pi-goodies",
-  "version": "0.27.7",
+  "version": "0.27.9",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/bermudi/agent-extensions.git",

package/prefer-tools.ts

@@ -13,12 +13,17 @@
  *   rm                  -> trash <path>   (moves to the trash can; recoverable)
  *   trash-rm            -> blocked       (permanently deletes from the trash can)
  *   trash-empty         -> blocked       (permanently empties the trash can)
- *   python/pip/pytest/  -> uv
- *     mypy
  *
- * Model-conditional: on glm-5.* models, `rg` is also blocked — they invent
- * ripgrep flags. The built-in grep tool (structured args, no raw flags) and
- * bash `grep -rn` still work.
+ * python/pip/pytest/mypy are deliberately NOT blocked (removed 2026-10-24):
+ * steering those is AGENTS.md's job ("uv always"), not the hook's — telling
+ * "inline" python apart from script-file python would need a bash-semantics
+ * matrix, and the uv block fired mostly as friction after the fact.
+ *
+ * `rg` is allowed, but its replace flag is not: `-r` is ripgrep's
+ * `--replace`, so `rg -rn` silently replaces matches with "n" instead of
+ * showing line numbers. Any short-option cluster containing `r` is blocked;
+ * spell out `--replace` if you actually mean it. The built-in grep tool
+ * (structured args, no raw flags) and bash `grep -rn` still work.
  */
 import {
   isToolCallEventType,
@@ -41,32 +46,16 @@ const RULES: Rule[] = [
     reason:
       "trash-rm and trash-empty are blocked — they delete permanently from the trash can. Use `trash <path>` to move files to the trash (recoverable).",
   },
-  {
-    names: ["python", "python3", "pip", "pip3", "pytest", "mypy"],
-    reason:
-      "bare python/pip/pytest/mypy are blocked — use `uv` (e.g. `uv run python`, `uv add`, `uv pip install <pkg>`, `uv run pytest`/`mypy`)",
-  },
 ];
 
 /**
- * glm-5.* model ids hallucinate ripgrep flags; bash `rg` is blocked for them.
- * Matches "glm-5" as a family token: not preceded by an alphanumeric (so
- * Meta's xglm-564M doesn't match) and not followed by a digit (so glm-50,
- * glm-500 don't match). glm-5, glm-5.5, glm-5-turbo, glm-5:free,
- * provider-prefixed "kilo/glm-5" all match. glm-4.x is unaffected.
+ * `rg -r` is ripgrep's `--replace`, not "recursive": it replaces matched text
+ * in the output, so `rg -rn` replaces with "n" and shows no line numbers
+ * (machine lore: it once spawned a phantom `[ln]` log tag). Block the short
+ * flag in any cluster, but allow the explicit long form as the escape hatch.
  */
-export function isRipgrepBlockedModel(modelId: string | undefined): boolean {
-  return (
-    typeof modelId === "string" && /(^|[^a-z0-9])glm-5(?![0-9])/i.test(modelId)
-  );
-}
-
-/** Extra rule appended when the active model is glm-5.*. */
-export const RG_RULE: Rule = {
-  names: ["rg"],
-  reason:
-    'rg is blocked for this model — it invents ripgrep flags. Use `grep -rn "pattern" path` instead (or pi\'s built-in grep tool).',
-};
+export const RG_REPLACE_REASON =
+  '`rg -r` is `--replace` — it silently replaces matched text in the output (`rg -rn` replaces with "n" instead of showing line numbers). If you really mean it, use `--replace` explicitly.';
 
 const COMMAND_PREFIX_KEYWORDS = new Set([
   "if",
@@ -86,8 +75,8 @@ const WORD_STOP = " \t\n\r|&;<>()\"'`$";
  * `NAME=value` (or `NAME+=value`) in command position is an env-var
  * assignment, never the command itself — bash runs the word *after* it.
  * Without this check the lexer treated `FOO=bar` as the command, found no
- * rule match, demoted command position, and `rm`/`python` sailed through as
- * a mere argument (`FOO=bar rm x`, `PYTHONDONTWRITEBYTECODE=1 python x.py`).
+ * rule match, demoted command position, and `rm` sailed through as
+ * a mere argument (`FOO=bar rm x`).
  * The name must be a portable shell identifier, matching bash's own rule —
  * `1=2 x` is not an assignment in bash either (it is a command name, so the
  * real command never runs). readWord stops at `$`/quotes, so `FOO="a b"` and
@@ -97,19 +86,34 @@ function isAssignmentWord(word: string): boolean {
   return /^[A-Za-z_][A-Za-z0-9_]*\+?=/.test(word);
 }
 
-function matchCommand(
-  name: string,
-  rules: readonly Rule[],
-): string | undefined {
-  const base = name.includes("/")
-    ? name.slice(name.lastIndexOf("/") + 1)
-    : name;
-  for (const rule of rules) {
+function commandBase(name: string): string {
+  return name.includes("/") ? name.slice(name.lastIndexOf("/") + 1) : name;
+}
+
+function matchCommand(name: string): string | undefined {
+  const base = commandBase(name);
+  for (const rule of RULES) {
     if (rule.names.includes(base)) return rule.reason;
   }
   return undefined;
 }
 
+/**
+ * Match a command word, plus the one argument-sensitive rule: an `rg`
+ * invocation that uses the replace flag. `argStart` is the offset just past
+ * the command word, where its arguments begin.
+ */
+function matchCommandAt(
+  command: string,
+  word: string,
+  argStart: number,
+): string | undefined {
+  if (commandBase(word) === "rg" && rgUsesReplaceFlag(command, argStart)) {
+    return RG_REPLACE_REASON;
+  }
+  return matchCommand(word);
+}
+
 function readWord(s: string, i: number): { word: string; next: number } {
   // Build the word char by char so backslash escapes strip the backslash:
   // `\rm` → `rm`, `foo\ bar` → `foo bar`. The old slice-based version kept
@@ -253,7 +257,6 @@ function scanExecutedSubs(
   s: string,
   start: number,
   end: number,
-  rules: readonly Rule[],
   mode: "plain" | "double",
 ): string | undefined {
   let i = start;
@@ -273,7 +276,7 @@ function scanExecutedSubs(
       if (c === '"') {
         const stop = readQuote(s, i, '"', true);
         const innerEnd = s[stop - 1] === '"' ? stop - 1 : stop;
-        const reason = scanExecutedSubs(s, i + 1, innerEnd, rules, "double");
+        const reason = scanExecutedSubs(s, i + 1, innerEnd, "double");
         if (reason) return reason;
         i = stop;
         continue;
@@ -293,7 +296,7 @@ function scanExecutedSubs(
     if (c === "`") {
       const stop = readQuote(s, i, "`", true);
       const innerEnd = s[stop - 1] === "`" ? stop - 1 : stop;
-      const reason = detectLegacyTool(s.slice(i + 1, innerEnd), rules);
+      const reason = detectLegacyTool(s.slice(i + 1, innerEnd));
       if (reason) return reason;
       i = stop;
       continue;
@@ -306,7 +309,7 @@ function scanExecutedSubs(
       const stop = skipBalancedParens(s, i, 3);
       const innerEnd =
         s[stop - 1] === ")" && s[stop - 2] === ")" ? stop - 2 : stop;
-      const reason = scanExecutedSubs(s, i + 3, innerEnd, rules, mode);
+      const reason = scanExecutedSubs(s, i + 3, innerEnd, mode);
       if (reason) return reason;
       i = stop;
       continue;
@@ -314,7 +317,7 @@ function scanExecutedSubs(
     if (c === "$" && s.startsWith("$(", i)) {
       const stop = skipBalancedParens(s, i, 2);
       const innerEnd = s[stop - 1] === ")" ? stop - 1 : stop;
-      const reason = detectLegacyTool(s.slice(i + 2, innerEnd), rules);
+      const reason = detectLegacyTool(s.slice(i + 2, innerEnd));
       if (reason) return reason;
       i = stop;
       continue;
@@ -327,7 +330,7 @@ function scanExecutedSubs(
       // substitution runs (`"${X:-'$(rm)'}"` executes).
       const stop = skipBalancedBraces(s, i);
       const innerEnd = s[stop - 1] === "}" ? stop - 1 : stop;
-      const reason = scanExecutedSubs(s, i + 2, innerEnd, rules, mode);
+      const reason = scanExecutedSubs(s, i + 2, innerEnd, mode);
       if (reason) return reason;
       i = stop;
       continue;
@@ -340,7 +343,6 @@ function scanExecutedSubs(
 function readDollar(
   s: string,
   i: number,
-  rules: readonly Rule[],
 ): { next: number; reason?: string } | null {
   if (i >= s.length || s[i] !== "$") return null;
 
@@ -354,14 +356,14 @@ function readDollar(
     const innerEnd = s[end - 1] === ")" && s[end - 2] === ")" ? end - 2 : end;
     return {
       next: end,
-      reason: scanExecutedSubs(s, i + 3, innerEnd, rules, "plain"),
+      reason: scanExecutedSubs(s, i + 3, innerEnd, "plain"),
     };
   }
   if (s.startsWith("(", i + 1)) {
     const end = skipBalancedParens(s, i, 2);
     const closeParen = end > 0 && s[end - 1] === ")" ? 1 : 0;
     const inner = s.slice(i + 2, end - closeParen);
-    const reason = detectLegacyTool(inner, rules);
+    const reason = detectLegacyTool(inner);
     return { next: end, reason };
   }
   if (s.startsWith("{", i + 1)) {
@@ -370,7 +372,7 @@ function readDollar(
     const innerEnd = s[end - 1] === "}" ? end - 1 : end;
     return {
       next: end,
-      reason: scanExecutedSubs(s, i + 2, innerEnd, rules, "plain"),
+      reason: scanExecutedSubs(s, i + 2, innerEnd, "plain"),
     };
   }
   if (i + 1 < s.length && /[0-9?@*#\-!$]/.test(s[i + 1])) {
@@ -447,10 +449,7 @@ function readHeredocDelimiter(
  * backslash suppresses expansion (`\$(rm)` is literal). Returns the matched
  * rule's reason if a blocked tool is found, undefined otherwise.
  */
-function scanHeredocLineForCommandSubs(
-  line: string,
-  rules: readonly Rule[],
-): string | undefined {
+function scanHeredocLineForCommandSubs(line: string): string | undefined {
   let i = 0;
   while (i < line.length) {
     const c = line[i];
@@ -461,7 +460,7 @@ function scanHeredocLineForCommandSubs(
     if (line.startsWith("$(", i)) {
       const end = skipBalancedParens(line, i, 2);
       const inner = line.slice(i + 2, end - 1);
-      const reason = detectLegacyTool(inner, rules);
+      const reason = detectLegacyTool(inner);
       if (reason) return reason;
       i = end;
       continue;
@@ -469,7 +468,7 @@ function scanHeredocLineForCommandSubs(
     if (c === "`") {
       const end = readQuote(line, i, "`", true);
       const inner = line.slice(i + 1, end - 1);
-      const reason = detectLegacyTool(inner, rules);
+      const reason = detectLegacyTool(inner);
       if (reason) return reason;
       i = end;
       continue;
@@ -485,7 +484,6 @@ function skipHeredocBody(
   delimiter: string,
   indented: boolean,
   quoted: boolean,
-  rules: readonly Rule[],
 ): { next: number; reason?: string } {
   let pos = i;
   while (pos <= s.length) {
@@ -499,7 +497,7 @@ function skipHeredocBody(
     // In unquoted heredocs, command substitutions execute — scan for
     // blocked tools inside $(...) and backticks.
     if (!quoted) {
-      const reason = scanHeredocLineForCommandSubs(line, rules);
+      const reason = scanHeredocLineForCommandSubs(line);
       if (reason) return { next: end, reason };
     }
     if (nl === -1) break;
@@ -530,11 +528,157 @@ const SUDO_OPTS_WITH_ARG = new Set([
   "--user",
 ]);
 
-export function detectLegacyTool(
-  command: string,
-  extraRules: readonly Rule[] = [],
-): string | undefined {
-  const rules = extraRules.length > 0 ? [...RULES, ...extraRules] : RULES;
+/**
+ * Short rg options that consume a value: the rest of the cluster is their
+ * value, or — at cluster end — the next word is. `r` is handled separately
+ * (and blocked) before this set is consulted.
+ */
+const RG_SHORT_VALUE_OPTS = new Set([
+  "A",
+  "B",
+  "C",
+  "d",
+  "E",
+  "e",
+  "f",
+  "g",
+  "j",
+  "M",
+  "m",
+  "t",
+  "T",
+]);
+
+/**
+ * Long rg options that consume the next word as a value. Values are skipped
+ * before flag inspection, so `--field-match-separator -r` (ripgrep accepts
+ * `-r` there as literal output text) is not mistaken for the replace flag.
+ */
+const RG_LONG_VALUE_OPTS = new Set([
+  "--after-context",
+  "--before-context",
+  "--context",
+  "--encoding",
+  "--field-context-separator",
+  "--field-match-separator",
+  "--file",
+  "--glob",
+  "--iglob",
+  "--max-columns",
+  "--max-count",
+  "--max-depth",
+  "--max-filesize",
+  "--path-separator",
+  "--pre",
+  "--regexp",
+  "--replace",
+  "--sort",
+  "--sortr",
+  "--threads",
+  "--type",
+  "--type-add",
+  "--type-clear",
+  "--type-not",
+]);
+
+/**
+ * Read one shell word after an `rg` command, keeping quoted content as part
+ * of the token so `rg "-r"` and `rg '-rn'` are caught like their unquoted
+ * twins. Stops at whitespace or an unquoted operator.
+ */
+function readArgWord(s: string, i: number): { word: string; next: number } {
+  let word = "";
+  while (i < s.length) {
+    const c = s[i];
+    if (c === " " || c === "\t" || c === "\r" || c === "\n") break;
+    if (readOperator(s, i)) break;
+    if (c === "'" || c === '"') {
+      const end = readQuote(s, i, c, c === '"');
+      const innerEnd = s[end - 1] === c ? end - 1 : end;
+      word += s.slice(i + 1, innerEnd);
+      i = end;
+      continue;
+    }
+    if (c === "\\" && i + 1 < s.length) {
+      word += s[i + 1];
+      i += 2;
+      continue;
+    }
+    if (c === "$") {
+      const d = readDollar(s, i);
+      if (d) {
+        word += s.slice(i, d.next);
+        i = d.next;
+        continue;
+      }
+    }
+    word += c;
+    i++;
+  }
+  return { word, next: i };
+}
+
+/**
+ * True when the `rg` invocation starting at `start` uses the replace flag in
+ * short form, including clusters (`-rn`, `-rln`, `-nr`). The explicit
+ * `--replace` long form stays allowed. Value-taking options are skipped so a
+ * pattern/replacement that merely looks like `-r` is not a false hit.
+ */
+function rgUsesReplaceFlag(s: string, start: number): boolean {
+  let i = start;
+  let skipValue = false;
+  while (i < s.length) {
+    const c = s[i];
+    if (c === " " || c === "\t" || c === "\r") {
+      i++;
+      continue;
+    }
+    if (c === "\n") break;
+    // Unquoted `#` at the start of a word begins a shell comment: bash never
+    // passes it (or anything after it) to rg, so `rg -n foo . # avoid -rn`
+    // must not be blocked for what its comment merely mentions. Mid-word `#`
+    // (`rg foo#bar`) stays inside the word read below, matching bash.
+    if (c === "#") break;
+    const op = readOperator(s, i);
+    if (op) {
+      if (op.type !== "redirect") break;
+      // Redirections may appear among a command's arguments; consume the
+      // target (`>out`) and keep looking at the real rg options after it.
+      i = op.next;
+      while (i < s.length && (s[i] === " " || s[i] === "\t")) i++;
+      if (i < s.length) i = readArgWord(s, i).next;
+      continue;
+    }
+    const { word, next } = readArgWord(s, i);
+    if (next === i) {
+      i++;
+      continue;
+    }
+    i = next;
+    if (skipValue) {
+      skipValue = false;
+      continue;
+    }
+    if (word === "--") break;
+    if (word.startsWith("--")) {
+      if (!word.includes("=") && RG_LONG_VALUE_OPTS.has(word)) skipValue = true;
+      continue;
+    }
+    if (!word.startsWith("-") || word === "-") continue;
+    for (let k = 1; k < word.length; k++) {
+      const flag = word[k];
+      if (flag === "r") return true;
+      if (RG_SHORT_VALUE_OPTS.has(flag)) {
+        // The rest of the cluster (or the next word) is this option's value.
+        if (k === word.length - 1) skipValue = true;
+        break;
+      }
+    }
+  }
+  return false;
+}
+
+export function detectLegacyTool(command: string): string | undefined {
   let i = 0;
   let commandPos = true;
   // Set once an env-var assignment word is seen in the current simple
@@ -560,7 +704,6 @@ export function detectLegacyTool(
         heredoc.delimiter,
         heredoc.indented,
         heredoc.quoted,
-        rules,
       );
       if (result.reason) return result.reason;
       i = result.next;
@@ -671,17 +814,11 @@ export function detectLegacyTool(
       // their unquoted twin.
       if (quote === '"') {
         const innerEnd = command[end - 1] === '"' ? end - 1 : end;
-        const reason = scanExecutedSubs(
-          command,
-          i + 1,
-          innerEnd,
-          rules,
-          "double",
-        );
+        const reason = scanExecutedSubs(command, i + 1, innerEnd, "double");
         if (reason) return reason;
       } else if (quote === "`") {
         const innerEnd = command[end - 1] === "`" ? end - 1 : end;
-        const reason = detectLegacyTool(command.slice(i + 1, innerEnd), rules);
+        const reason = detectLegacyTool(command.slice(i + 1, innerEnd));
         if (reason) return reason;
       }
       i = end;
@@ -694,7 +831,7 @@ export function detectLegacyTool(
     }
 
     if (c === "$") {
-      const d = readDollar(command, i, rules);
+      const d = readDollar(command, i);
       if (d) {
         if (d.reason) return d.reason;
         i = d.next;
@@ -730,7 +867,7 @@ export function detectLegacyTool(
         continue;
       }
       // Env-var assignment prefix: skip it and stay in command position so
-      // the word after it (`rm`, `python`, …) is the one checked. Under
+      // the word after it (`rm`, …) is the one checked. Under
       // sudo it likewise keeps sudoNext armed (`sudo FOO=bar rm x`).
       if (isAssignmentWord(word) && !skipNextWord) {
         assignmentPrefix = true;
@@ -746,7 +883,7 @@ export function detectLegacyTool(
           skipNextWord = false;
           continue;
         }
-        const reason = matchCommand(word, rules);
+        const reason = matchCommandAt(command, word, i);
         if (reason) return reason;
         sudoNext = false;
       } else {
@@ -754,7 +891,7 @@ export function detectLegacyTool(
           skipNextWord = false;
           continue;
         }
-        const reason = matchCommand(word, rules);
+        const reason = matchCommandAt(command, word, i);
         if (reason) return reason;
       }
       if (!COMMAND_PREFIX_KEYWORDS.has(word)) {
@@ -769,13 +906,10 @@ export function detectLegacyTool(
 }
 
 export default function preferTools(pi: ExtensionAPI) {
-  pi.on("tool_call", async (event, ctx) => {
+  pi.on("tool_call", async (event) => {
     if (!isToolCallEventType("bash", event)) return;
 
-    // Model-conditional rule: glm-5.* gets bash `rg` blocked (live model,
-    // read per call — model switches mid-session take effect immediately).
-    const extraRules = isRipgrepBlockedModel(ctx.model?.id) ? [RG_RULE] : [];
-    const reason = detectLegacyTool(event.input.command ?? "", extraRules);
+    const reason = detectLegacyTool(event.input.command ?? "");
     if (reason) {
       return { block: true, reason };
     }

package/provider-balance.ts

@@ -1733,10 +1733,19 @@ export default function providerBalance(
         return;
       }
 
-      // Do not render a cached value while credentials are being resolved. The
-      // same provider can represent a different account after login/logout.
-      identityPending = true;
-      requestRender?.();
+      // Hide the balance while credentials are being resolved — but only when
+      // nothing is displayed yet (cold start, provider switch, post-logout).
+      // A same-account refresh keeps its last value on screen: blanking on
+      // every refresh would flicker the footer for the full duration of
+      // keychain reads and OAuth token refreshes (seconds under lock
+      // contention). If resolution reveals a different account, the
+      // displayedCacheKey mismatch below still clears it, so a foreign
+      // reading is never painted. Same principle as the post-fetch re-check
+      // below: never blank a displayed same-account value.
+      if (!balance) {
+        identityPending = true;
+        requestRender?.();
+      }
 
       // Preserve a known same-account value during routine credential refresh,
       // but clear it if identity resolution fails or reveals another account.
@@ -1831,6 +1840,14 @@ export default function providerBalance(
       );
       const observedAtMs = now();
       if (generation !== refreshGeneration) return;
+      if (nextBalance.length === 0) {
+        // An empty reading would render as an empty string — visually
+        // identical to the balance vanishing — and parseCachedBalance already
+        // refuses to serve empty entries from the cache. Treat it as a failed
+        // observation: the catch below keeps the previous display and records
+        // the failure.
+        throw new Error("provider returned no balance segments");
+      }
 
       // Login/logout does not emit model_select. Re-resolve identity before
       // committing so an account switch during the request cannot paint the
@@ -1910,7 +1927,14 @@ export default function providerBalance(
           companionTokenAfter,
         );
       }
-      // Recovery detected: clear the marker so sibling idle polls resume.
+      // Recovery detected: tell the log once, then clear the marker so
+      // sibling idle polls resume.
+      if (readBalanceFailureAt(cacheKey, now(), cacheDir) !== null) {
+        logGoodiesEvent({
+          type: "provider_balance_refresh_recovered",
+          provider: providerId,
+        });
+      }
       clearBalanceFailureMarker(cacheKey, cacheDir);
       const persisted = writeCachedBalance(
         cacheKey,
@@ -1929,12 +1953,28 @@ export default function providerBalance(
         return;
       }
       identityPending = false;
-      clearBalance();
+      // A failed fetch does not make the displayed value wrong — it stays
+      // TTL-gated at render time. Keep a same-account reading on screen
+      // instead of blanking the footer for the whole backoff window; clear
+      // only when the failure landed before any account was identified.
+      if (cacheKey === undefined || cacheKey !== displayedCacheKey) {
+        clearBalance();
+      }
       // Record the failure machine-wide so sibling sessions' idle polls back
       // off instead of stacking their own timeouts onto the same outage.
+      const firstFailureOfStreak =
+        cacheKey === undefined ||
+        readBalanceFailureAt(cacheKey, now(), cacheDir) === null;
       if (cacheKey !== undefined) {
         writeBalanceFailureMarker(cacheKey, now(), cacheDir);
       }
+      if (firstFailureOfStreak) {
+        logGoodiesEvent({
+          type: "provider_balance_refresh_failed",
+          provider: providerId,
+          message: describeError(error),
+        });
+      }
       // This is a best-effort background refresh. Writing to stdout/stderr while
       // Pi owns the terminal corrupts the TUI (the text appears in the editor),
       // so expose failures to other extensions without producing terminal output.

package/review.ts

@@ -54,6 +54,15 @@
  *   ctx.ui.select dialogs when ctx.mode !== "tui", the end-review loader
  *   only renders in TUI mode, and the review widget renders as string
  *   lines outside the TUI
+ * - /end-review "Return and fix findings" fast path: the review branch's
+ *   final assistant response already IS the handoff, so capture it verbatim
+ *   (getFinalReviewMessage: walk the leaf path back to the common ancestor
+ *   with the origin, the same boundary pi's summarizer would use), return
+ *   with summarize:false (no LLM call), and queue the fix follow-up with the
+ *   review embedded in the prompt (buildFastFixPrompt). Upstream f1de050
+ *   (still its tip as of 2026-10-24) pays a full branch-summary round trip
+ *   first via navigateWithSummary; "Return and summarize" keeps that flow.
+ *   If upstream grows a comparable fast path, prefer the port.
  */
 
 import type {
@@ -75,6 +84,7 @@ import {
 } from "@earendil-works/pi-tui";
 import path from "node:path";
 import { promises as fs } from "node:fs";
+import type { TextContent } from "@earendil-works/pi-ai";
 import { describeError } from "./json-file.ts";
 
 // State to track fresh session review (where we branched from).
@@ -173,6 +183,76 @@ function applyReviewSettings(ctx: ExtensionContext) {
   reviewCustomInstructions = state.customInstructions?.trim() || undefined;
 }
 
+// Fix-findings follow-up instructions shared by the fast-path prompt.
+const REVIEW_FIX_INSTRUCTIONS = `Instructions:
+1. Treat the review's findings as a checklist.
+2. Fix in priority order: P0, P1, then P2 (include P3 if quick and safe).
+3. If a finding is invalid/already fixed/not possible right now, briefly explain why and continue.
+4. Treat "Human Reviewer Callouts (Non-Blocking)" as informational only; do not convert them into fix tasks unless there is a separate explicit finding.
+5. Follow fail-fast error handling: do not add local catch/fallback recovery unless this scope is an explicit boundary that can safely translate the failure.
+6. If you add or keep a \`try/catch\`, explain the expected failure mode and either rethrow with context or return a boundary-safe error response.
+7. JSON parsing/decoding should fail loudly by default; avoid silent fallback parsing.
+8. Run relevant tests/checks for touched code where practical.
+9. End with: fixed items, deferred/skipped items (with reasons), and verification results.`;
+
+/**
+ * Build the fix-findings follow-up for the fast path: the verbatim review
+ * rides in the prompt, so no branch-summary LLM round trip is needed.
+ */
+export function buildFastFixPrompt(review: string): string {
+  return `Implement the findings in the following review. The review ran on a separate branch of this session that is no longer in context — the review text below is the complete handoff.
+
+${REVIEW_FIX_INSTRUCTIONS}
+
+<review>
+${review}
+</review>`;
+}
+
+/**
+ * Capture the review branch's final assistant response (the review itself).
+ *
+ * The review branch diverged from the main branch, so the origin entry is
+ * NOT on the leaf's path — the boundary is the common ancestor of the two
+ * paths (the same boundary pi's branch summarizer collects entries for).
+ * Returns the newest non-empty assistant text between the leaf and that
+ * boundary, or undefined when the review branch holds no completed review
+ * response (or provenance cannot be established — stale origin, disjoint
+ * paths), in which case the caller must not pretend there is a review.
+ */
+export function getFinalReviewMessage(
+  ctx: Pick<ExtensionCommandContext, "sessionManager">,
+  originId: string,
+): string | undefined {
+  const leafPath = ctx.sessionManager.getBranch(); // leaf → root
+  const originPathIds = new Set(
+    ctx.sessionManager.getBranch(originId).map((entry) => entry.id),
+  );
+  if (originPathIds.size === 0) {
+    return undefined; // unknown origin: refuse instead of grabbing main-branch text
+  }
+  // Both paths end at the root, so the first shared entry on the leaf path
+  // is the common ancestor. Review-branch entries strictly precede it.
+  const boundaryIndex = leafPath.findIndex((entry) =>
+    originPathIds.has(entry.id),
+  );
+  if (boundaryIndex === -1) {
+    return undefined; // disjoint paths (orphaned entries): provenance unprovable
+  }
+  for (let i = 0; i < boundaryIndex; i++) {
+    const entry = leafPath[i];
+    if (entry.type !== "message") continue;
+    const message = entry.message;
+    if (message.role !== "assistant") continue;
+    const text = message.content
+      .filter((part): part is TextContent => part.type === "text")
+      .map((part) => part.text)
+      .join("\n\n");
+    if (text.trim()) return text;
+  }
+  return undefined;
+}
+
 // Review target types (matching Codex's approach)
 type ReviewTarget =
   | { type: "uncommitted" }
@@ -1984,19 +2064,6 @@ These are informational callouts for humans and are not fix items by themselves.
 
 Preserve exact file paths, function names, and error messages where available.`;
 
-  const REVIEW_FIX_FINDINGS_PROMPT = `Use the latest review summary in this session and implement the review findings now.
-
-Instructions:
-1. Treat the summary's Findings/Fix Queue as a checklist.
-2. Fix in priority order: P0, P1, then P2 (include P3 if quick and safe).
-3. If a finding is invalid/already fixed/not possible right now, briefly explain why and continue.
-4. Treat "Human Reviewer Callouts (Non-Blocking)" as informational only; do not convert them into fix tasks unless there is a separate explicit finding.
-5. Follow fail-fast error handling: do not add local catch/fallback recovery unless this scope is an explicit boundary that can safely translate the failure.
-6. If you add or keep a \`try/catch\`, explain the expected failure mode and either rethrow with context or return a boundary-safe error response.
-7. JSON parsing/decoding should fail loudly by default; avoid silent fallback parsing.
-8. Run relevant tests/checks for touched code where practical.
-9. End with: fixed items, deferred/skipped items (with reasons), and verification results.`;
-
   type EndReviewAction = "returnOnly" | "returnAndFix" | "returnAndSummarize";
   type EndReviewActionResult = "ok" | "cancelled" | "error";
   type EndReviewActionOptions = {
@@ -2171,6 +2238,48 @@ Instructions:
       return "ok";
     }
 
+    if (action === "returnAndFix") {
+      // Fast path: the review's final assistant response already is the
+      // handoff — carry it across the branch boundary verbatim instead of
+      // paying a branch-summary LLM round trip before the fixing turn can
+      // even start. Returning is a pure tree move (summarize: false).
+      const reviewText = getFinalReviewMessage(ctx, originId);
+      if (!reviewText) {
+        ctx.ui.notify(
+          "No completed review response found on the review branch — nothing to fix. Use /end-review → Return and summarize if you still want a branch summary.",
+          "error",
+        );
+        return "error";
+      }
+
+      try {
+        const result = await ctx.navigateTree(originId, { summarize: false });
+        if (result.cancelled) {
+          ctx.ui.notify(
+            "Navigation cancelled. Use /end-review to try again.",
+            "info",
+          );
+          return "cancelled";
+        }
+      } catch (error) {
+        ctx.ui.notify(`Failed to return: ${describeError(error)}`, "error");
+        return "error";
+      }
+
+      clearReviewState(ctx);
+      pi.sendUserMessage(buildFastFixPrompt(reviewText), {
+        deliverAs: "followUp",
+      });
+      if (notifySuccess) {
+        ctx.ui.notify(
+          "Review complete! Returned and queued a follow-up to fix findings.",
+          "info",
+        );
+      }
+      return "ok";
+    }
+
+    // action === "returnAndSummarize"
     const summaryResult = await navigateWithSummary(
       ctx,
       originId,
@@ -2199,22 +2308,11 @@ Instructions:
 
     clearReviewState(ctx);
 
-    if (action === "returnAndSummarize") {
-      if (!ctx.ui.getEditorText().trim()) {
-        ctx.ui.setEditorText("Act on the review findings");
-      }
-      if (notifySuccess) {
-        ctx.ui.notify("Review complete! Returned and summarized.", "info");
-      }
-      return "ok";
+    if (!ctx.ui.getEditorText().trim()) {
+      ctx.ui.setEditorText("Act on the review findings");
     }
-
-    pi.sendUserMessage(REVIEW_FIX_FINDINGS_PROMPT, { deliverAs: "followUp" });
     if (notifySuccess) {
-      ctx.ui.notify(
-        "Review complete! Returned and queued a follow-up to fix findings.",
-        "info",
-      );
+      ctx.ui.notify("Review complete! Returned and summarized.", "info");
     }
     return "ok";
   }