gentle-pi 4.1.0 → 4.2.0

package/extensions/gentle-ai.ts

@@ -1,5 +1,5 @@
 import { appendSystemPromptOnce } from "../lib/append-system-prompt.ts";
-import { recognizeDestructiveCommands } from "../lib/destructive-command-guard.ts";
+import { dataArgumentRanges, recognizeDestructiveCommands } from "../lib/destructive-command-guard.ts";
 import { SHELL_COMMAND_TOOLS } from "../lib/background-jobs.ts";
 import { blockChildDestructiveCommand } from "./child-safety.ts";
 import { allowedEditSurfaces as hasTaskScopedAllowedEditSurfaces, bindSessionRepositoryPreparation, captureBoundSessionRepositoryAuthority, isHomeOrBroadUserDirectory, prepareBoundSessionRepository, rejectUnscopedBoundedWriterDispatch, safeBootstrapDirectory, sourcePathWithinProject } from "../lib/bounded-writer-admission.ts";
@@ -1098,9 +1098,11 @@ function homeRootedRepository(cwd: string): string | undefined {
  * `NativeReviewModeStatus`) that the `/gentle:review-mode` command also
  * calls. Never throws and never hangs past `signal`'s deadline when one is
  * given: an absent binary, a timed-out/aborted process, or a native CLI
- * failure all resolve to `undefined`. `ctx` is optional and used only for a
- * one-shot (per process) UI notice when the read is swallowed, so a
- * sustained native outage is observable beyond the rendered "unknown" line.
+ * failure all resolve to `undefined` unless an earlier read for the same cwd
+ * succeeded, in which case that last known status is kept (gentle-shell#1029:
+ * the rendered line sits in the cached prompt prefix). `ctx` is optional and
+ * used only for a one-shot (per process) UI notice when the read is
+ * swallowed, so a sustained native outage is observable beyond the prompt.
  */
 async function resolveRddModeStatus(
 	nativeReviewCli: Pick<NativeReviewCli, "reviewMode"> | null | undefined,
@@ -1112,13 +1114,19 @@ async function resolveRddModeStatus(
 	const nowMs = now();
 	const cached = rddStatusMemo.get(cwd);
 	if (cached !== undefined && cached.expiresAt > nowMs) return cached.status;
-	const status = await readRddModeStatusOnce(nativeReviewCli, cwd, signal);
+	// gentle-shell#1029: the rendered line is part of the cached system-prompt
+	// prefix. A re-read that fails or times out keeps the last successfully
+	// read status instead of flipping the prompt to "unknown" and back, which
+	// would invalidate the provider's prefix cache for the whole conversation.
+	// Only a status the native reader actually reports replaces a known one.
+	const read = await readRddModeStatusOnce(nativeReviewCli, cwd, signal);
+	const status = read ?? cached?.status;
 	rddStatusMemo.set(cwd, { status, expiresAt: nowMs + RDD_STATUS_MEMO_TTL_MS });
-	if (status === undefined && !rddStatusUnavailableWarned) {
+	if (read === undefined && !rddStatusUnavailableWarned) {
 		rddStatusUnavailableWarned = true;
 		if (ctx?.hasUI) {
 			ctx.ui.notify(
-				"Gentle AI: receipt-driven-development status is unavailable (native review CLI absent, timed out, or failed). The parent prompt renders \"unknown\" until this recovers; this notice will not repeat this session.",
+				"Gentle AI: receipt-driven-development status is unavailable (native review CLI absent, timed out, or failed). The parent prompt keeps the last known status, or renders \"unknown\" when none was read; this notice will not repeat this session.",
 				"warning",
 			);
 		}
@@ -1306,6 +1314,14 @@ ${personaPrompt}
 
 ${languageBoundary}
 
+## Authorized work continuity
+
+An authorized outcome includes its necessary in-scope implementation, documentation and verification steps. Continue those steps without asking the human to approve each transition. Never end a turn merely announcing an immediately executable authorized next step; execute it instead. A progress update is not a request for permission.
+
+Stop only for an unresolved consequential scope/product decision, required explicit consent, a denied action, unavailable required proof, or the human's explicit stop. Do not infer permission for publishing, destructive actions, unrelated scope or native consent from this continuity rule. Report a concrete blocker and the exact decision needed rather than requesting a generic "continue".
+
+For background work, launch the bounded action and end the turn when no independent in-scope work remains. Retain its identity and resume the already-authorized continuation automatically on its completion event; do not ask the human to say "continue", poll, or claim completion while checks remain pending.
+
 Default workflow: Organic Driven Development (MANDATORY)
 Organic Driven Development (ODD) is the predefined workflow of this orchestrator. Every request enters it, without the user asking for a workflow, a plan, or task tracking. Never describe this workflow only when asked about it: run it. Run these steps in this order on every request:
 1. **Authorize.** Investigation, explanation, review, comparison, and proposal-only requests stay read-only: no writer, apply, or implementation artifacts. Ambiguous or conditional change intent (unclear whether a change is authorized at all) gets one clarification; stop and wait. A user saying they may stop you or resume later asks for notes and separate commits, not a stop.
@@ -1333,7 +1349,9 @@ ${getOrchestratorPrompt(cwd, activeTools, rddStatusLine, hostMode)}`;
 
 // Matches `git [global-flags] push` — tolerates flags like -C /repo or --work-tree=/tmp
 // between `git` and the subcommand. Short flags may be followed by a separate value token.
-const GIT_GLOBAL_FLAGS_SRC = String.raw`(?:\s+--?\S+(?:\s+[^-\s]\S*)?)* `;
+// gentle-shell#2172: `\s+` rather than a literal space, so a tab-separated
+// `git\tpush` is guarded like any other spelling.
+const GIT_GLOBAL_FLAGS_SRC = String.raw`(?:\s+--?\S+(?:\s+[^-\s]\S*)?)*\s+`;
 const GIT_PUSH_RE = new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}(push)\b`);
 
 const DENIED_BASH_PATTERNS: RegExp[] = [
@@ -1399,7 +1417,7 @@ interface LoadGuardrailsOptions {
 
 const GUARDED_KEY_PATTERNS: Record<GuardedCommandKey, RegExp> = {
 	gitPush: GIT_PUSH_RE,
-	gitRebase: /\bgit\s+(rebase)\b/,
+	gitRebase: new RegExp(String.raw`\bgit${GIT_GLOBAL_FLAGS_SRC}(rebase)\b`),
 	gitBranchDeleteForce: /\bgit\s+(branch)\s+(?:-[a-zA-Z]*D[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|--delete\b[^\r\n;&|]*--force\b|--force\b[^\r\n;&|]*--delete\b)/,
 	npmPublish: /\bnpm\s+(publish)\b/,
 	piRemove: /\bpi\s+(remove)\b/,
@@ -1441,12 +1459,15 @@ function collectGuardedMatches(
 	config: RuntimeGuardrailsConfig,
 ): GuardMatch[] {
 	const matches: GuardMatch[] = [];
+	const dataRanges = dataArgumentRanges(command);
 	for (const [key, pattern] of Object.entries(GUARDED_KEY_PATTERNS) as [
 		GuardedCommandKey,
 		RegExp,
 	][]) {
 		const globalPattern = new RegExp(pattern.source, `${pattern.flags}g`);
 		for (const match of command.matchAll(globalPattern)) {
+			// gentle-shell#2174: text inside a data command's argument is not an operation.
+			if (inDataArgument(dataRanges, match.index)) continue;
 			const action = config.autonomousMode
 				? (config.guardedCommands[key] ?? AUTONOMOUS_DEFAULT_ACTIONS[key])
 				: "confirm";
@@ -1460,6 +1481,10 @@ function collectGuardedMatches(
 	return matches.sort((left, right) => left.triggerIndex - right.triggerIndex);
 }
 
+function inDataArgument(ranges: ReadonlyArray<readonly [number, number]>, index: number): boolean {
+	return ranges.some(([start, end]) => index >= start && index < end);
+}
+
 function evaluateGuardedCommand(
 	command: string,
 	config: RuntimeGuardrailsConfig,
@@ -1470,8 +1495,10 @@ function evaluateGuardedCommand(
 	if (hardDeny) return { action: "block", triggerIndex: hardDeny.triggerIndex, matches };
 
 	// Hard denies override every configured action across the complete command.
+	const dataRanges = dataArgumentRanges(command);
 	for (const pattern of DENIED_BASH_PATTERNS) {
-		const denied = pattern.exec(command);
+		const denied = [...command.matchAll(new RegExp(pattern.source, `${pattern.flags.replace("g", "")}g`))]
+			.find((candidate) => !inDataArgument(dataRanges, candidate.index));
 		if (!denied) continue;
 		const matchedAction = matches.find((match) =>
 			match.triggerIndex >= denied.index && match.triggerIndex < denied.index + denied[0].length,
@@ -1817,14 +1844,60 @@ function createHerdrConfirmationLifecycle(events: ExtensionAPI["events"]): Herdr
 	};
 }
 
-/** Conservative waiver surface: one plain push in the current repository, no shell/wrapper or destination-changing options. */
-function isOrdinaryYoloPush(command: string, evaluation: GuardEvaluation): boolean {
-	if (evaluation.action !== "confirm" || evaluation.dataLoss || evaluation.matches.length !== 1 || evaluation.key !== "gitPush") return false;
-	return /^git\s+push(?:\s+(?:-u|--set-upstream|[A-Za-z0-9_][A-Za-z0-9_./-]*))*\s*$/.test(command);
+// gentle-shell#2172: YOLO waives reversible delivery, not only one bare push.
+// A guarded segment is judged from its trigger word (`push`/`rebase`) to the
+// next command separator; a plain token or allow-listed option list is the
+// whole eligible grammar, so quotes, wrappers and unknown options fall back
+// to the ordinary confirmation. Everything that deletes or rewrites a remote
+// ref, publishes, or runs arbitrary commands is deliberately absent:
+// `--delete`/`-d`, `:dst` and `+src` refspecs, `--mirror`, `--prune`,
+// `--all`, every force spelling, `--receive-pack`/`--exec`, `--repo`, `-o`.
+const YOLO_WAIVABLE_KEYS: ReadonlySet<GuardedCommandKey> = new Set(["gitPush", "gitRebase"]);
+const YOLO_SEGMENT_END_RE = /&&|\|\||;|\||\n|\r/;
+// Text between the segment start and the `push`/`rebase` word: optional
+// variable assignments, `env`/`command` prefixes and the `git` word with at
+// most a `-C <path>`. Other global options (`-c key=value`, `--exec-path`,
+// `--git-dir`) can run or redirect code, so they keep the confirmation.
+const YOLO_GIT_PREFIX_RE = /^\s*(?:[A-Za-z_][A-Za-z0-9_]*=[^\s'"`$]*\s+|env\s+(?:-i\s+)?|command\s+)*git(?:\s+-C\s+[^\s'"`$;&|]+)?\s+$/;
+const YOLO_PUSH_SEGMENT_RE = /^push(?:\s+(?:-u|--set-upstream|-q|--quiet|-v|--verbose|--tags|--follow-tags|--no-verify|--porcelain|[A-Za-z0-9_][A-Za-z0-9_./-]*(?::[A-Za-z0-9_][A-Za-z0-9_./-]*)?))*\s*$/;
+const YOLO_REBASE_SEGMENT_RE = /^rebase(?:\s+(?:--onto\s+[A-Za-z0-9_][A-Za-z0-9_./~^-]*|--continue|--abort|--skip|--autostash|--no-autostash|[A-Za-z0-9_][A-Za-z0-9_./~^-]*))*\s*$/;
+
+function yoloGuardedSegment(command: string, triggerIndex: number): string {
+	const rest = command.slice(triggerIndex);
+	const end = rest.search(YOLO_SEGMENT_END_RE);
+	return end < 0 ? rest : rest.slice(0, end);
+}
+
+function yoloSegmentPrefix(command: string, triggerIndex: number): string {
+	const head = command.slice(0, triggerIndex);
+	const separators = [...head.matchAll(new RegExp(YOLO_SEGMENT_END_RE.source, "g"))];
+	const last = separators.at(-1);
+	return last === undefined ? head : head.slice(last.index + last[0].length);
+}
+
+/** Every guarded match and every recognized Git side effect must be a reversible push or non-interactive rebase. */
+function isReversibleYoloCommand(command: string, evaluation: GuardEvaluation): boolean {
+	if (evaluation.action !== "confirm" || evaluation.dataLoss || evaluation.matches.length === 0) return false;
+	for (const match of evaluation.matches) {
+		if (!YOLO_WAIVABLE_KEYS.has(match.key)) return false;
+		if (!YOLO_GIT_PREFIX_RE.test(yoloSegmentPrefix(command, match.triggerIndex))) return false;
+		const segment = yoloGuardedSegment(command, match.triggerIndex);
+		if (!(match.key === "gitPush" ? YOLO_PUSH_SEGMENT_RE : YOLO_REBASE_SEGMENT_RE).test(segment)) return false;
+	}
+	// The data-loss recognizer leaves non-hard Git effects (reset, stash drop,
+	// restore, checkout --) to the primary policy; under YOLO only a rebase that
+	// a guarded match already vetted may remain.
+	const rebaseTriggers = new Set(evaluation.matches.filter((match) => match.key === "gitRebase").map((match) => match.triggerIndex));
+	for (const effect of recognizeDestructiveCommands(command)) {
+		if (effect.hardDeny || effect.kind !== "git") return false;
+		const rebase = /^git(?:\s+(?:-C|-c|--git-dir|--work-tree|--namespace)\s+\S+|\s+-\S+)*\s+(rebase)\b/.exec(command.slice(effect.triggerIndex));
+		if (rebase === null || !rebaseTriggers.has(effect.triggerIndex + rebase.index + rebase[0].lastIndexOf("rebase"))) return false;
+	}
+	return true;
 }
 
-/** Preserve explicitly configured confirmations even when legacy env/autonomy resolution ignores them. */
-function yoloPushConfiguredRestriction(cwd: string, options: LoadGuardrailsOptions = {}): GuardAction | undefined {
+/** Preserve explicitly configured confirmations for the waivable keys present, even when legacy env/autonomy resolution ignores them. */
+function yoloConfiguredRestriction(cwd: string, keys: readonly GuardedCommandKey[], options: LoadGuardrailsOptions = {}): GuardAction | undefined {
 	let restriction: GuardAction | undefined;
 	for (const path of [join(options.gentlePiConfigHome ?? gentleAiConfigHome(), "runtime-guardrails.json"), join(cwd, ".pi", "gentle-ai", "runtime-guardrails.json")]) {
 		try {
@@ -1834,9 +1907,11 @@ function yoloPushConfiguredRestriction(cwd: string, options: LoadGuardrailsOptio
 				restriction ??= "confirm";
 				continue;
 			}
-			const action = isRecord(parsed.guardedCommands) ? parsed.guardedCommands.gitPush : undefined;
-			if (action === "block") return "block";
-			if (action !== undefined && action !== "allow") restriction = "confirm";
+			for (const key of keys) {
+				const action = isRecord(parsed.guardedCommands) ? parsed.guardedCommands[key] : undefined;
+				if (action === "block") return "block";
+				if (action !== undefined && action !== "allow") restriction = "confirm";
+			}
 		} catch { restriction ??= "confirm"; }
 	}
 	return restriction;
@@ -1855,8 +1930,9 @@ async function confirmCommand(
 	// Configuration provenance is distinct from legacy autonomy resolution, which
 	// can ignore confirmations when an environment override is present. Activation
 	// cannot waive a restriction from either user or project configuration layer.
-	const configuredRestriction = yoloActive && evaluation.matches.some((match) => match.key === "gitPush")
-		? yoloPushConfiguredRestriction(ctx.cwd) : undefined;
+	const waivableKeys = evaluation.matches.map((match) => match.key).filter((key) => YOLO_WAIVABLE_KEYS.has(key));
+	const configuredRestriction = yoloActive && waivableKeys.length > 0
+		? yoloConfiguredRestriction(ctx.cwd, waivableKeys) : undefined;
 	const classification = evaluation.action === "block" || configuredRestriction === "block"
 		? "block" : configuredRestriction ?? evaluation.action;
 
@@ -1892,7 +1968,7 @@ async function confirmCommand(
 	}
 
 	// Full T1 evaluation has already run. YOLO never changes persistent autonomy.
-	if (yoloActive && configuredRestriction === undefined && isOrdinaryYoloPush(command, evaluation)) return undefined;
+	if (yoloActive && configuredRestriction === undefined && isReversibleYoloCommand(command, evaluation)) return undefined;
 
 	// classification === "confirm"
 	if (!ctx.hasUI) {
@@ -9384,8 +9460,8 @@ export const __testing = {
 	guardedCommandPreview,
 	guardedCommandTitle,
 	loadRuntimeGuardrailsConfig,
-	isOrdinaryYoloPush,
-	yoloPushConfiguredRestriction,
+	isReversibleYoloCommand,
+	yoloConfiguredRestriction,
 	buildGentlePrompt,
 	nativeStatusUnsupported,
 	nativeStartRejection,
@@ -9487,6 +9563,9 @@ function createGentleAiExtensionForTesting(
 		cancel: () => classifier?.cancel(),
 	}, { configHome: gentlePiConfigHome(permissionEnvironment) });
 	const auto = autoPermissions;
+	pi.on("tool_result", (event, ctx) => {
+		if (permissionEnvironment.GENTLE_PI_AGENTS_CHILD !== "1") auto.toolResult(event, ctx);
+	});
 	pi.on("input", (event, ctx) => {
 		if (permissionEnvironment.GENTLE_PI_AGENTS_CHILD !== "1") auto.input(event, ctx);
 		return { action: "continue" };
@@ -10051,7 +10130,8 @@ function createGentleAiExtensionForTesting(
 		// this branch, so no line is resolved or computed for them.
 		// resolveRddStatusLine never throws and never hangs past
 		// RDD_STATUS_TIMEOUT_MS: an absent/timed-out/aborted/failing native
-		// binary renders the fail-closed "unknown" line instead.
+		// binary keeps the last known line for this cwd, or renders the
+		// fail-closed "unknown" line when none was ever read (gentle-shell#1029).
 		const rddStatusSignal = AbortSignal.timeout(RDD_STATUS_TIMEOUT_MS);
 		// A startup read still in flight fills the memo: wait for it within the
 		// same deadline instead of spawning the same STATUS a second time.

package/extensions/gentle-shell.ts

@@ -6,8 +6,7 @@ import { existsSync, realpathSync, statSync } from "node:fs";
 import { lstat, readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { profilesFilePath, profileRoleEntries, readProfilesFileResult } from "../lib/agent-profiles.ts";
-import { readSessionProfileBinding } from "../lib/session-profile-binding.ts";
-import { resolveProfilePin } from "../lib/agent-profile-pin.ts";
+import { resolveSessionProfile, sessionProfileLabel, sessionProfileModelProfiles } from "../lib/session-profile-freeze.ts";
 import * as os from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { buildShellHeaderModel, renderShellBar, renderShellBelowInputFloat, renderShellBottomOnlyBar, renderShellHeaderChrome, renderShellSidebarBar, keepNativeWorkingRow, shellEnabled, shellHeaderUsageHit, shellJobsCount, type ShellBarModel, type ShellBarTheme } from "../lib/shell-bar.ts";
@@ -208,23 +207,18 @@ export function createActiveProfileReader(env: NodeJS.ProcessEnv = process.env):
 	const reader = (() => bound ? effective : global()) as ActiveProfileReader;
 	reader.refresh = () => {
 		if (!bound) return false;
-		// gentle-shell#1064 slice 1: a parent-session profile binding outranks
-		// both the pin layers and the global active profile, with the same
-		// "name (scope)" spelling the pin uses. The shared precedence rule lives
-		// in one place: session → p (local pin) → P (repo declaration) → global.
-		const session = sessionId === undefined ? undefined : readSessionProfileBinding(sessionId);
-		if (session !== undefined) {
-			const next = `${session.name} (session)`;
-			const changed = next !== effective;
-			effective = next;
-			return changed;
-		}
-		const pin = identity && cwd ? resolveProfilePin({
+		// gentle-shell#1064: the status shows the profile launches use, through
+		// the same single rule (explicit Enter binding → profile frozen at
+		// startup → live p → P → G only in follow mode), with the existing
+		// spelling: "name (session)", "name (local)", "name (repo)", or the bare
+		// global name.
+		const next = cwd === undefined ? global() : sessionProfileLabel(resolveSessionProfile({
+			sessionId,
 			cwd,
 			configHome: bundledGentlePiConfigHome(env) ?? env.GENTLE_PI_CONFIG_HOME ?? join(os.homedir(), ".pi", "gentle-ai"),
-			resolveWorktree: () => identity!,
-		}) : undefined;
-		const next = pin ? `${pin.profile} (${pin.source})` : global();
+			resolveWorktree: () => identity,
+			env,
+		}));
 		const changed = next !== effective;
 		effective = next;
 		return changed;
@@ -1578,19 +1572,20 @@ export default function gentleShell(pi: ExtensionAPI, env: NodeJS.ProcessEnv = p
 	// store and the profile reader cannot drift onto two different stores.
 	const usageConfigHome = gentlePiConfigHome(env);
 	const usageFetchTimeout = usageFetchTimeoutMs(env);
-	// The subagent routing in force for this session: a session binding first
-	// (gentle-shell#1064 slice 1), then a repository pin, then the global active
-	// profile. Only the profile's own role entries count; the reserved
-	// orchestrator key is not a route.
+	// The subagent routing in force for this session, through the same single
+	// rule launches use (gentle-shell#1064): explicit Enter binding, then the
+	// profile frozen at startup, then the live p → P → G only in follow mode.
+	// Only the profile's own role entries count; the reserved orchestrator key
+	// is not a route.
 	const activeRoutingModels = (ctx: ExtensionContext): Array<string | undefined> => {
-		const session = readSessionProfileBinding(ctx.sessionManager?.getSessionId?.())?.modelProfiles;
-		if (session) return [...profileRoleEntries(session).map(([, entry]) => entry.model)];
-		const pin = resolveProfilePin({ cwd: ctx.cwd, configHome: usageConfigHome, resolveWorktree: deps.resolveWorktree });
-		const config = pin ? pin.modelProfiles : undefined;
-		if (config) return [...profileRoleEntries(config).map(([, entry]) => entry.model)];
-		const store = readProfilesFileResult(profilesFilePath(usageConfigHome));
-		const active = store.status === "valid" && store.file.active !== undefined ? store.file.profiles[store.file.active] : undefined;
-		return active ? profileRoleEntries(active).map(([, entry]) => entry.model) : [];
+		const config = sessionProfileModelProfiles(resolveSessionProfile({
+			sessionId: ctx.sessionManager?.getSessionId?.(),
+			cwd: ctx.cwd,
+			configHome: usageConfigHome,
+			resolveWorktree: deps.resolveWorktree,
+			env,
+		}));
+		return config ? profileRoleEntries(config).map(([, entry]) => entry.model) : [];
 	};
 	// A bare model id names a provider only when exactly one provider in the
 	// registry carries that id; anything else stays untargeted rather than guessed.
@@ -2261,7 +2256,7 @@ export default function gentleShell(pi: ExtensionAPI, env: NodeJS.ProcessEnv = p
 			});
 			for (const mode of ["normal", "auto", "yolo"] as const) rows.push({
 				category,
-				label: () => `Session permissions: ${mode.toUpperCase()}${permissionDisplay === mode ? " (current)" : ""}`,
+				label: () => `Session permissions: ${mode.toUpperCase()}${mode === "auto" ? " (beta)" : ""}${permissionDisplay === mode ? " (current)" : ""}`,
 				preview: () => ({ title: "Permissions · current session", sample: mode === "auto"
 					? "independent session-model action checks · extra inference cost · hard safety and native consent remain"
 					: mode === "yolo" ? "ordinary scoped delivery permission · destructive confirmations remain" : "normal checks · overrides an elevated global default" }),
@@ -2273,7 +2268,7 @@ export default function gentleShell(pi: ExtensionAPI, env: NodeJS.ProcessEnv = p
 			});
 			for (const mode of ["normal", "auto", "yolo"] as const) rows.push({
 				category,
-				label: () => `Default permissions: ${mode.toUpperCase()}${permissionDefault === mode ? " (saved)" : ""}`,
+				label: () => `Default permissions: ${mode.toUpperCase()}${mode === "auto" ? " (beta)" : ""}${permissionDefault === mode ? " (saved)" : ""}`,
 				preview: () => ({ title: "Permissions · user-global default", sample: `New primary sessions start in ${mode.toUpperCase()}; current session stays unchanged. ${mode === "auto" ? "Additional classifier inference uses the session model; usage is separate." : "Independent safety and consent remain."}` }),
 				action: async () => {
 					if (closed) return;

package/extensions/gentle-todo.ts

@@ -16,6 +16,7 @@ import {
 	TODO_TOOL_NAME,
 	todoCardTone,
 	todoPromptBlock,
+	todoStateMessage,
 	todoSummary,
 	type TodoParams,
 	type TodoState,
@@ -24,10 +25,12 @@ import {
 // Gentle Todo: the task list the model keeps while it works, drawn as a
 // Gentle Shell card above the editor. Three things keep it current that a
 // static tool description cannot: `write` replaces the whole list in one
-// call, each run's system prompt carries the open tasks and the rules, and
-// a list that goes untouched while tasks stay open is marked stale for both
-// the human and the model. Long runs also receive one request-local reminder
-// after several tool-use turns, without waking the agent or changing tasks.
+// call, each run's system prompt carries a byte-stable rules block while the
+// open tasks reach the model as a request-local trailing message (so list
+// changes never invalidate the cached prompt prefix, gentle-shell#1662), and
+// a list that goes untouched while tasks stay open is marked stale for the
+// human. Long runs also receive one request-local reminder after several
+// tool-use turns, without waking the agent or changing tasks.
 
 const WIDGET_KEY = "gentle-todo";
 const STATUS_ENUM = ["pending", "in_progress", "blocked", "done", "dropped"];
@@ -281,7 +284,9 @@ export default function gentleTodo(pi: ExtensionAPI, env: NodeJS.ProcessEnv = pr
 		});
 	}
 
-	for (const [key, lines] of [["ctrl+shift+up", -3], ["ctrl+shift+down", 3]] as const) {
+	// Pi binds ctrl+shift+up/down to prompt navigation (tui.altScreen.*Prompt) and
+	// alt+up/down to dequeue and model reordering; alt+shift+up/down are free.
+	for (const [key, lines] of [["alt+shift+up", -3], ["alt+shift+down", 3]] as const) {
 		pi.registerShortcut(key, {
 			description: `Scroll the Todo list ${lines < 0 ? "up" : "down"}`,
 			handler: async (ctx) => session(ctx).scrollTodo?.(lines),
@@ -315,11 +320,10 @@ export default function gentleTodo(pi: ExtensionAPI, env: NodeJS.ProcessEnv = pr
 			current.clearOnNextTurn = false;
 			show(current);
 		}
-		const block = todoPromptBlock(current.state, staleTurns(current.state, current.turn));
-		if (!block) return undefined;
 		// gentle-shell#1485: pi-claude-bridge drops a handler-returned
-		// systemPrompt, so the open-tasks block goes through appendSystemPrompt.
-		appendSystemPromptOnce(event.systemPromptOptions, block);
+		// systemPrompt, so the rules block goes through appendSystemPrompt. It is
+		// the same bytes on every turn, list or no list (gentle-shell#1662).
+		appendSystemPromptOnce(event.systemPromptOptions, todoPromptBlock());
 		return undefined;
 	});
 
@@ -335,14 +339,20 @@ export default function gentleTodo(pi: ExtensionAPI, env: NodeJS.ProcessEnv = pr
 
 	pi.on("context", (event, ctx) => {
 		const current = session(ctx);
-		if (current.reminded || current.toolTurnsSinceWrite < REMIND_AFTER_TOOL_TURNS) return undefined;
-		if (!current.state.tasks.some((task) => task.status === "pending" || task.status === "in_progress")) return undefined;
-		current.reminded = true;
 		// Context transforms are request-local: no transcript entry, UI
-		// notification, continuation or provider-specific wake is needed.
-		return {
-			messages: [...event.messages, { role: "custom" as const, customType: "gentle-todo-reminder", content: TODO_REMINDER, display: false, timestamp: Date.now() }],
-		};
+		// notification, continuation or provider-specific wake is needed. The
+		// current list trails the transcript (gentle-shell#1662), then the
+		// one-shot reminder when it is due.
+		const trailing: Array<{ role: "custom"; customType: string; content: string; display: false; timestamp: number }> = [];
+		const state = todoStateMessage(current.state);
+		if (state !== undefined) trailing.push({ role: "custom", customType: "gentle-todo-state", content: state, display: false, timestamp: Date.now() });
+		const actionable = current.state.tasks.some((task) => task.status === "pending" || task.status === "in_progress");
+		if (!current.reminded && current.toolTurnsSinceWrite >= REMIND_AFTER_TOOL_TURNS && actionable) {
+			current.reminded = true;
+			trailing.push({ role: "custom", customType: "gentle-todo-reminder", content: TODO_REMINDER, display: false, timestamp: Date.now() });
+		}
+		if (trailing.length === 0) return undefined;
+		return { messages: [...event.messages, ...trailing] };
 	});
 
 	pi.on("tool_execution_end", (event, ctx) => {

package/lib/auto-permission-answers.ts

@@ -0,0 +1,133 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { QuestionParams } from "./questionnaire/schema.ts";
+import type { AnswerRow } from "./questionnaire/questionnaire-view.ts";
+import { isInteractiveMode } from "./rpc-host.ts";
+
+type AnswerContext = Pick<ExtensionContext, "sessionManager" | "cwd" | "mode" | "hasUI">;
+export type HumanAnswer =
+	| { readonly kind: "option" | "custom"; readonly text: string; readonly selected?: readonly string[] }
+	| { readonly kind: "multi"; readonly selected: readonly string[] };
+export interface HumanAnswerReceipt {
+	readonly sessionManager: ExtensionContext["sessionManager"];
+	readonly sessionId: string;
+	readonly cwd: string;
+	readonly branchAnchor: string | null;
+	readonly toolName: "ask_user_choice" | "ask_user_question";
+	readonly toolCallId: string;
+	readonly questionIndex: number;
+	/** Untrusted referent, never an instruction or an authorization. */
+	readonly question: string;
+	/** Full original prompt context, untrusted and inseparable from its answer. */
+	readonly prompt: string;
+	/** Authenticated human response; opaque tokens and previews are excluded. */
+	readonly answer: HumanAnswer;
+}
+interface Subscription {
+	ctx: AnswerContext;
+	sessionId: string;
+	cwd: string;
+	callback: (receipt: HumanAnswerReceipt) => void;
+}
+const subscriptions = new WeakMap<object, Set<Subscription>>();
+
+/** Subscribe from a trusted host context; dispose on session shutdown/replacement. */
+export function subscribeHumanAnswers(ctx: AnswerContext, callback: (receipt: HumanAnswerReceipt) => void): () => void {
+	if (!ctx.sessionManager || !isInteractiveMode(ctx.mode, process.env) || ctx.hasUI === false) return () => {};
+	const sessionId = ctx.sessionManager.getSessionId();
+	if (!sessionId || !ctx.cwd) return () => {};
+	let listeners = subscriptions.get(ctx.sessionManager);
+	if (!listeners) subscriptions.set(ctx.sessionManager, listeners = new Set());
+	const subscription = { ctx, sessionId, cwd: ctx.cwd, callback };
+	listeners.add(subscription);
+	return () => { listeners.delete(subscription); };
+}
+
+/** Host-only capture seam. Call before mounting UI, never from tool_result. */
+function beginCapture(ctx: AnswerContext, toolName: HumanAnswerReceipt["toolName"], toolCallId: string, questions: ReadonlyArray<{ question: string; prompt: string }>, signal?: AbortSignal) {
+	const manager = ctx.sessionManager;
+	const sessionId = manager?.getSessionId();
+	const cwd = ctx.cwd;
+	const branchAnchor = manager?.getLeafId?.();
+	const listeners = manager ? subscriptions.get(manager) : undefined;
+	const eligible = [...(listeners ?? [])].filter((entry) => entry.sessionId === sessionId && entry.cwd === cwd);
+	const interactive = isInteractiveMode(ctx.mode, process.env) && ctx.hasUI !== false;
+	let finished = false;
+	return (answers: ReadonlyArray<{ questionIndex: number; answer: HumanAnswer }>) => {
+		if (finished) return;
+		finished = true;
+		if (!interactive || !isInteractiveMode(ctx.mode, process.env) || ctx.hasUI === false ||
+			!manager || !sessionId || signal?.aborted || ctx.sessionManager !== manager ||
+			manager.getSessionId() !== sessionId || ctx.cwd !== cwd || branchAnchor === undefined || manager.getLeafId() !== branchAnchor) return;
+		for (const { questionIndex, answer } of answers) {
+			const referent = questions[questionIndex];
+			if (referent === undefined) continue;
+			const { question, prompt } = referent;
+			const receipt = Object.freeze({ sessionManager: manager, sessionId, cwd, branchAnchor, toolName, toolCallId, questionIndex, question, prompt,
+				answer: Object.freeze({ ...answer, ...(answer.selected ? { selected: Object.freeze([...answer.selected]) } : {}) }) });
+			for (const entry of eligible) {
+				if (!listeners?.has(entry) || !isInteractiveMode(entry.ctx.mode, process.env) || entry.ctx.hasUI === false ||
+					entry.ctx.sessionManager !== manager || entry.ctx.cwd !== cwd ||
+					manager.getSessionId() !== sessionId || manager.getLeafId() !== branchAnchor || signal?.aborted) continue;
+				// Observers must not change the existing public tool outcome.
+				try { entry.callback(receipt); } catch { /* Isolate host observer failures. */ }
+			}
+		}
+	};
+}
+
+interface ChoicePrompt {
+	question: string;
+	options: Array<{ label: string; description?: string; value: string }>;
+	allowCustomResponse?: boolean;
+}
+export function captureChoiceAnswer(ctx: AnswerContext, toolCallId: string, params: ChoicePrompt, signal?: AbortSignal) {
+	const options = params.options.map((option) => ({ ...option }));
+	const allowCustom = params.allowCustomResponse === true;
+	const prompt = JSON.stringify({ question: params.question,
+		options: options.map(({ label, description }) => ({ label, description })), allowCustomResponse: allowCustom });
+	const publish = beginCapture(ctx, "ask_user_choice", toolCallId, [{ question: params.question, prompt }], signal);
+	return (selection: { value: string; label: string; index: number } | { customResponse: string } | undefined) => {
+		if (!selection) return;
+		if ("customResponse" in selection) {
+			if (allowCustom && typeof selection.customResponse === "string" && selection.customResponse.trim())
+				publish([{ questionIndex: 0, answer: { kind: "custom", text: selection.customResponse } }]);
+			return;
+		}
+		const option = options[selection.index - 1];
+		if (Number.isInteger(selection.index) && option && selection.label === option.label && selection.value === option.value)
+			publish([{ questionIndex: 0, answer: { kind: "option", text: option.label } }]);
+	};
+}
+
+export function captureQuestionnaireAnswers(ctx: AnswerContext, toolCallId: string, params: QuestionParams, signal?: AbortSignal) {
+	const questions = params.questions.map((question) => ({ ...question, options: question.options.map((option) => ({ ...option })) }));
+	const referents = questions.map((question) => ({ question: question.question, prompt: JSON.stringify({
+		question: question.question, header: question.header, multiSelect: question.multiSelect === true,
+		options: question.options.map(({ label, description, preview }) => ({ label, description,
+			...(ctx.mode === "tui" && preview !== undefined ? { preview } : {}) })),
+	}) }));
+	const publish = beginCapture(ctx, "ask_user_question", toolCallId, referents, signal);
+	return (rows: AnswerRow[] | undefined) => {
+		if (!rows?.length) return;
+		const seen = new Set<number>();
+		const answers: Array<{ questionIndex: number; answer: HumanAnswer }> = [];
+		for (const row of rows) {
+			const question = questions[row.questionIndex];
+			if (!Number.isInteger(row.questionIndex) || !question || seen.has(row.questionIndex) || row.question !== question.question) return;
+			seen.add(row.questionIndex);
+			const labels = question.options.map((option) => option.label);
+			const selected = row.selected;
+			if (selected && (!question.multiSelect || new Set(selected).size !== selected.length || selected.some((label) => !labels.includes(label)))) return;
+			let answer: HumanAnswer;
+			if (row.kind === "option" && typeof row.answer === "string" && labels.includes(row.answer) && !question.multiSelect && !selected)
+				answer = { kind: "option", text: row.answer };
+			else if (row.kind === "custom" && typeof row.answer === "string" && row.answer.trim())
+				answer = { kind: "custom", text: row.answer, ...(selected ? { selected } : {}) };
+			else if (row.kind === "multi" && question.multiSelect && selected && row.answer === null)
+				answer = { kind: "multi", selected };
+			else return;
+			answers.push({ questionIndex: row.questionIndex, answer });
+		}
+		publish(answers);
+	};
+}