little-coder 1.0.3 → 1.1.0

package/.pi/extensions/llama-cpp-provider/config.test.ts

@@ -0,0 +1,161 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { applyEnvOverrides, loadProviders, mergeProviders, resolveOverridePath, type ProviderEntry } from "./config.ts";
+
+const sampleProvider = (baseUrl: string, modelId: string): ProviderEntry => ({
+  api: "openai-completions",
+  baseUrl,
+  apiKey: "SAMPLE_KEY",
+  models: [
+    {
+      id: modelId,
+      name: modelId,
+      reasoning: true,
+      input: ["text"],
+      contextWindow: 32768,
+      maxTokens: 4096,
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    },
+  ],
+});
+
+describe("resolveOverridePath", () => {
+  it("prefers LITTLE_CODER_MODELS_FILE", () => {
+    expect(resolveOverridePath({ LITTLE_CODER_MODELS_FILE: "/explicit.json", HOME: "/h" })).toBe("/explicit.json");
+  });
+  it("falls back to XDG_CONFIG_HOME", () => {
+    expect(resolveOverridePath({ XDG_CONFIG_HOME: "/xdg", HOME: "/h" })).toBe("/xdg/little-coder/models.json");
+  });
+  it("falls back to HOME/.config", () => {
+    expect(resolveOverridePath({ HOME: "/h" })).toBe("/h/.config/little-coder/models.json");
+  });
+  it("returns undefined when neither is set", () => {
+    expect(resolveOverridePath({})).toBeUndefined();
+  });
+});
+
+describe("mergeProviders", () => {
+  it("returns the package default unchanged when there's no override", () => {
+    const pkg = { llamacpp: sampleProvider("http://a/v1", "m1") };
+    expect(mergeProviders(pkg, undefined)).toEqual(pkg);
+  });
+  it("user provider replaces same-key package provider", () => {
+    const pkg = { llamacpp: sampleProvider("http://a/v1", "pkg-model") };
+    const user = { llamacpp: sampleProvider("http://b/v1", "user-model") };
+    const merged = mergeProviders(pkg, user);
+    expect(merged.llamacpp.baseUrl).toBe("http://b/v1");
+    expect(merged.llamacpp.models[0].id).toBe("user-model");
+  });
+  it("user provider not in package is added", () => {
+    const pkg = { llamacpp: sampleProvider("http://a/v1", "m1") };
+    const user = { custom: sampleProvider("http://c/v1", "c1") };
+    const merged = mergeProviders(pkg, user);
+    expect(Object.keys(merged).sort()).toEqual(["custom", "llamacpp"]);
+  });
+  it("package providers without an override are kept as-is", () => {
+    const pkg = {
+      llamacpp: sampleProvider("http://a/v1", "m1"),
+      ollama: sampleProvider("http://o/v1", "m2"),
+    };
+    const user = { llamacpp: sampleProvider("http://b/v1", "m1b") };
+    const merged = mergeProviders(pkg, user);
+    expect(merged.ollama.baseUrl).toBe("http://o/v1");
+  });
+});
+
+describe("applyEnvOverrides", () => {
+  it("LLAMACPP_BASE_URL overrides llamacpp baseUrl", () => {
+    const providers = { llamacpp: sampleProvider("http://file/v1", "m1") };
+    const out = applyEnvOverrides(providers, { LLAMACPP_BASE_URL: "http://env/v1" });
+    expect(out.llamacpp.baseUrl).toBe("http://env/v1");
+  });
+  it("OLLAMA_BASE_URL overrides ollama baseUrl", () => {
+    const providers = { ollama: sampleProvider("http://file/v1", "m2") };
+    const out = applyEnvOverrides(providers, { OLLAMA_BASE_URL: "http://env/v1" });
+    expect(out.ollama.baseUrl).toBe("http://env/v1");
+  });
+  it("does not alter providers without a known env knob", () => {
+    const providers = { custom: sampleProvider("http://file/v1", "m") };
+    const out = applyEnvOverrides(providers, { LLAMACPP_BASE_URL: "http://env/v1" });
+    expect(out.custom.baseUrl).toBe("http://file/v1");
+  });
+});
+
+describe("loadProviders (filesystem)", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "lc-providers-"));
+  });
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("loads the package default when present", () => {
+    writeFileSync(
+      join(dir, "models.json"),
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://a/v1", "m1") } }),
+    );
+    const result = loadProviders(dir, {});
+    expect(Object.keys(result.providers)).toEqual(["llamacpp"]);
+    expect(result.sources[0]).toMatchObject({ status: "ok" });
+  });
+
+  it("merges a user override file when LITTLE_CODER_MODELS_FILE points at one", () => {
+    writeFileSync(
+      join(dir, "models.json"),
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://a/v1", "pkg") } }),
+    );
+    const userPath = join(dir, "user-models.json");
+    writeFileSync(
+      userPath,
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://b/v1", "user") } }),
+    );
+    const result = loadProviders(dir, { LITTLE_CODER_MODELS_FILE: userPath });
+    expect(result.providers.llamacpp.baseUrl).toBe("http://b/v1");
+    expect(result.providers.llamacpp.models[0].id).toBe("user");
+  });
+
+  it("reports invalid JSON in the package default and returns empty providers", () => {
+    writeFileSync(join(dir, "models.json"), "{ this is not json");
+    const result = loadProviders(dir, {});
+    expect(result.providers).toEqual({});
+    expect(result.sources[0].status).toBe("invalid");
+  });
+
+  it("reports a missing user override without failing the load", () => {
+    writeFileSync(
+      join(dir, "models.json"),
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://a/v1", "m1") } }),
+    );
+    const missing = join(dir, "no-such-dir", "models.json");
+    const result = loadProviders(dir, { LITTLE_CODER_MODELS_FILE: missing });
+    expect(result.providers.llamacpp.baseUrl).toBe("http://a/v1");
+    expect(result.sources.find((s) => s.path === missing)?.status).toBe("missing");
+  });
+
+  it("env var still overrides baseUrl after merge", () => {
+    writeFileSync(
+      join(dir, "models.json"),
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://file/v1", "m") } }),
+    );
+    const result = loadProviders(dir, { LLAMACPP_BASE_URL: "http://env/v1" });
+    expect(result.providers.llamacpp.baseUrl).toBe("http://env/v1");
+  });
+
+  it("XDG_CONFIG_HOME overrides applied when no LITTLE_CODER_MODELS_FILE set", () => {
+    writeFileSync(
+      join(dir, "models.json"),
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://a/v1", "pkg") } }),
+    );
+    const xdg = join(dir, "xdg");
+    mkdirSync(join(xdg, "little-coder"), { recursive: true });
+    writeFileSync(
+      join(xdg, "little-coder", "models.json"),
+      JSON.stringify({ providers: { llamacpp: sampleProvider("http://x/v1", "via-xdg") } }),
+    );
+    const result = loadProviders(dir, { XDG_CONFIG_HOME: xdg });
+    expect(result.providers.llamacpp.models[0].id).toBe("via-xdg");
+  });
+});

package/.pi/extensions/llama-cpp-provider/config.ts

@@ -0,0 +1,145 @@
+// Pure config-loading logic for the providers extension. Kept separate from
+// the pi wiring in index.ts so it can be unit-tested without a pi runtime.
+//
+// Schema (all required unless noted):
+//   {
+//     "providers": {
+//       "<name>": {
+//         "api": "openai-completions",
+//         "baseUrl": "http://...",
+//         "apiKey": "ENV_VAR_NAME",
+//         "models": [ { id, name, reasoning, input, contextWindow, maxTokens, cost }, ... ]
+//       }, ...
+//     }
+//   }
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface ProviderModelEntry {
+  id: string;
+  name: string;
+  reasoning: boolean;
+  input: ("text" | "image")[];
+  contextWindow: number;
+  maxTokens: number;
+  cost: { input: number; output: number; cacheRead: number; cacheWrite: number };
+}
+
+export interface ProviderEntry {
+  api: string;
+  baseUrl: string;
+  apiKey: string;
+  models: ProviderModelEntry[];
+}
+
+export interface ModelsFile {
+  providers: Record<string, ProviderEntry>;
+}
+
+export interface LoadResult {
+  providers: Record<string, ProviderEntry>;
+  /** Files that were attempted, in resolution order. Useful for diagnostics. */
+  sources: { path: string; status: "ok" | "missing" | "invalid"; error?: string }[];
+}
+
+/** Provider env knob: if set, overrides the provider's baseUrl. Legacy compat
+ *  for the two providers we shipped before the data-driven refactor. */
+const LEGACY_BASE_URL_ENV: Record<string, string> = {
+  llamacpp: "LLAMACPP_BASE_URL",
+  ollama: "OLLAMA_BASE_URL",
+};
+
+/** Resolution order for the user-override file. First existing path wins. */
+export function resolveOverridePath(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  if (env.LITTLE_CODER_MODELS_FILE) return env.LITTLE_CODER_MODELS_FILE;
+  const xdg = env.XDG_CONFIG_HOME;
+  if (xdg) return join(xdg, "little-coder", "models.json");
+  if (env.HOME) return join(env.HOME, ".config", "little-coder", "models.json");
+  return undefined;
+}
+
+function parseModelsFile(raw: string): ModelsFile {
+  const parsed = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || !parsed.providers || typeof parsed.providers !== "object") {
+    throw new Error("expected top-level { providers: { ... } }");
+  }
+  return parsed as ModelsFile;
+}
+
+function readIfPresent(path: string): { kind: "ok"; data: ModelsFile } | { kind: "missing" } | { kind: "invalid"; error: string } {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const raw = readFileSync(path, "utf-8");
+    return { kind: "ok", data: parseModelsFile(raw) };
+  } catch (err) {
+    return { kind: "invalid", error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+export function applyEnvOverrides(providers: Record<string, ProviderEntry>, env: NodeJS.ProcessEnv = process.env): Record<string, ProviderEntry> {
+  const out: Record<string, ProviderEntry> = {};
+  for (const [name, entry] of Object.entries(providers)) {
+    const envVar = LEGACY_BASE_URL_ENV[name];
+    if (envVar && env[envVar]) {
+      out[name] = { ...entry, baseUrl: env[envVar]! };
+    } else {
+      out[name] = entry;
+    }
+  }
+  return out;
+}
+
+/**
+ * Merge: user file's providers fully replace package providers with the same
+ * key. Providers only in the user file are added. Providers only in the
+ * package default are kept. (We deliberately avoid deep per-model merging —
+ * the user redeclares the whole provider entry if they want to change it,
+ * which is far less surprising than "your override silently inherited fields
+ * from a future package release.")
+ */
+export function mergeProviders(
+  pkgDefault: Record<string, ProviderEntry>,
+  userOverride: Record<string, ProviderEntry> | undefined,
+): Record<string, ProviderEntry> {
+  if (!userOverride) return { ...pkgDefault };
+  return { ...pkgDefault, ...userOverride };
+}
+
+/**
+ * Load the package default models.json + (optionally) the user override file,
+ * apply env-var baseUrl overrides for the legacy providers, and return the
+ * merged provider map plus diagnostics for each source.
+ */
+export function loadProviders(pkgRoot: string, env: NodeJS.ProcessEnv = process.env): LoadResult {
+  const sources: LoadResult["sources"] = [];
+  const defaultPath = join(pkgRoot, "models.json");
+  const defaultRead = readIfPresent(defaultPath);
+  let pkgDefault: Record<string, ProviderEntry> = {};
+  if (defaultRead.kind === "ok") {
+    pkgDefault = defaultRead.data.providers;
+    sources.push({ path: defaultPath, status: "ok" });
+  } else if (defaultRead.kind === "missing") {
+    sources.push({ path: defaultPath, status: "missing" });
+  } else {
+    sources.push({ path: defaultPath, status: "invalid", error: defaultRead.error });
+  }
+
+  const overridePath = resolveOverridePath(env);
+  let userOverride: Record<string, ProviderEntry> | undefined;
+  if (overridePath) {
+    const userRead = readIfPresent(overridePath);
+    if (userRead.kind === "ok") {
+      userOverride = userRead.data.providers;
+      sources.push({ path: overridePath, status: "ok" });
+    } else if (userRead.kind === "missing") {
+      sources.push({ path: overridePath, status: "missing" });
+    } else {
+      sources.push({ path: overridePath, status: "invalid", error: userRead.error });
+    }
+  }
+
+  const merged = mergeProviders(pkgDefault, userOverride);
+  const withEnv = applyEnvOverrides(merged, env);
+  return { providers: withEnv, sources };
+}

package/.pi/extensions/llama-cpp-provider/index.ts

@@ -1,58 +1,44 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { loadProviders } from "./config.ts";
 
-const LLAMACPP_BASE_URL = process.env.LLAMACPP_BASE_URL || "http://127.0.0.1:8888/v1";
-const OLLAMA_BASE_URL = process.env.OLLAMA_BASE_URL || "http://127.0.0.1:11434/v1";
+// Data-driven provider registration. Reads:
+//   1. <pkgRoot>/models.json                       (shipped default)
+//   2. $LITTLE_CODER_MODELS_FILE (if set), else
+//      $XDG_CONFIG_HOME/little-coder/models.json, else
+//      $HOME/.config/little-coder/models.json     (user override; per-provider replace)
+//   3. LLAMACPP_BASE_URL / OLLAMA_BASE_URL env    (per-provider baseUrl override)
+//
+// Issue #13: previously the model list was hardcoded here and models.json was
+// only documentation, which made any user edit a no-op until they forked.
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgRoot = resolve(here, "..", "..", "..");
 
 export default function (pi: ExtensionAPI) {
-  pi.registerProvider("llamacpp", {
-    baseUrl: LLAMACPP_BASE_URL,
-    apiKey: "LLAMACPP_API_KEY",
-    api: "openai-completions",
-    models: [
-      {
-        id: "qwen3.6-27b",
-        name: "Qwen3.6-27B (dense, local llama.cpp)",
-        reasoning: true,
-        input: ["text"],
-        contextWindow: 32768,
-        maxTokens: 4096,
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-      },
-      {
-        id: "qwen3.6-35b-a3b",
-        name: "Qwen3.6-35B-A3B (MoE, local llama.cpp)",
-        reasoning: true,
-        input: ["text"],
-        contextWindow: 32768,
-        maxTokens: 4096,
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-      },
-      {
-        id: "qwen3.5-9b",
-        name: "Qwen3.5-9B (local llama.cpp)",
-        reasoning: true,
-        input: ["text"],
-        contextWindow: 32768,
-        maxTokens: 4096,
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-      },
-    ],
-  });
+  const result = loadProviders(pkgRoot);
+
+  for (const src of result.sources) {
+    if (src.status === "invalid") {
+      console.error(`[llama-cpp-provider] ignoring ${src.path}: ${src.error}`);
+    }
+  }
+
+  const providerCount = Object.keys(result.providers).length;
+  if (providerCount === 0) {
+    console.error(
+      `[llama-cpp-provider] no providers loaded — checked: ${result.sources.map((s) => `${s.path} [${s.status}]`).join(", ")}`,
+    );
+    return;
+  }
 
-  pi.registerProvider("ollama", {
-    baseUrl: OLLAMA_BASE_URL,
-    apiKey: "OLLAMA_API_KEY",
-    api: "openai-completions",
-    models: [
-      {
-        id: "qwen3.5",
-        name: "Qwen3.5 (ollama)",
-        reasoning: true,
-        input: ["text"],
-        contextWindow: 32768,
-        maxTokens: 4096,
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-      },
-    ],
-  });
+  for (const [name, entry] of Object.entries(result.providers)) {
+    pi.registerProvider(name, {
+      baseUrl: entry.baseUrl,
+      apiKey: entry.apiKey,
+      api: entry.api,
+      models: entry.models,
+    });
+  }
 }

package/.pi/extensions/permission-gate/index.ts

@@ -5,8 +5,13 @@ import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
 // "accept-all" mode all commands pass (benchmark runs set this explicitly).
 // Write/Edit confirmations are deferred to the TUI's own prompt; we simply
 // add an extra guardrail on bash here to match little-coder's behavior.
+//
+// Per-deployment customization (issue #15):
+//   LITTLE_CODER_PERMISSION_MODE=auto|accept-all|manual
+//   LITTLE_CODER_BASH_ALLOW="cmd1,cmd2 sub,..."  extra allow-prefixes,
+//                                                merged with the built-in list.
 
-const SAFE_PREFIXES: readonly string[] = [
+const BUILTIN_SAFE_PREFIXES: readonly string[] = [
   "ls", "cat", "head", "tail", "wc", "pwd", "echo", "printf", "date",
   "which", "type", "env", "printenv", "uname", "whoami", "id",
   "git log", "git status", "git diff", "git show", "git branch",
@@ -18,9 +23,25 @@ const SAFE_PREFIXES: readonly string[] = [
   "curl -I", "curl --head",
 ];
 
-export function isSafeBash(command: string): boolean {
+// Trailing whitespace is meaningful — it acts as a word boundary in startsWith
+// matching ("find " refuses "findbug"). We only strip leading whitespace so
+// callers retain control over that boundary.
+export function parseExtraPrefixes(raw: string | undefined): string[] {
+  if (!raw) return [];
+  return raw
+    .split(",")
+    .map((s) => s.trimStart())
+    .map((s) => (s.length > 0 && s !== " ".repeat(s.length) ? s : ""))
+    .filter((s) => s.length > 0);
+}
+
+export function getSafePrefixes(): string[] {
+  return [...BUILTIN_SAFE_PREFIXES, ...parseExtraPrefixes(process.env.LITTLE_CODER_BASH_ALLOW)];
+}
+
+export function isSafeBash(command: string, prefixes: readonly string[] = getSafePrefixes()): boolean {
   const c = command.trim();
-  return SAFE_PREFIXES.some((p) => c.startsWith(p));
+  return prefixes.some((p) => c.startsWith(p));
 }
 
 function getPermissionMode(): "auto" | "accept-all" | "manual" {

package/.pi/extensions/permission-gate/permission.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { isSafeBash } from "./index.ts";
+import { isSafeBash, parseExtraPrefixes, getSafePrefixes } from "./index.ts";
 
 describe("isSafeBash", () => {
   it("allows whitelisted read-only commands", () => {
@@ -23,4 +23,45 @@ describe("isSafeBash", () => {
     expect(isSafeBash("git push origin main")).toBe(false);
     expect(isSafeBash("git commit -m x")).toBe(false);
   });
+  it("respects an explicit prefix list (LITTLE_CODER_BASH_ALLOW shape)", () => {
+    const extra = ["make ", "docker compose ps"];
+    expect(isSafeBash("make test", extra)).toBe(true);
+    expect(isSafeBash("docker compose ps", extra)).toBe(true);
+    expect(isSafeBash("docker compose down", extra)).toBe(false);
+  });
+});
+
+describe("parseExtraPrefixes", () => {
+  it("returns empty for undefined / empty / whitespace", () => {
+    expect(parseExtraPrefixes(undefined)).toEqual([]);
+    expect(parseExtraPrefixes("")).toEqual([]);
+    expect(parseExtraPrefixes("   ")).toEqual([]);
+  });
+  it("splits on comma and trims leading whitespace, preserving trailing space as word boundary", () => {
+    expect(parseExtraPrefixes("make , docker compose ps,  bun run")).toEqual([
+      "make ",
+      "docker compose ps",
+      "bun run",
+    ]);
+  });
+  it("drops empty / whitespace-only segments", () => {
+    expect(parseExtraPrefixes("a,,b,")).toEqual(["a", "b"]);
+    expect(parseExtraPrefixes("a,   ,b")).toEqual(["a", "b"]);
+  });
+});
+
+describe("getSafePrefixes", () => {
+  it("merges builtins with LITTLE_CODER_BASH_ALLOW from the env", () => {
+    const prev = process.env.LITTLE_CODER_BASH_ALLOW;
+    process.env.LITTLE_CODER_BASH_ALLOW = "make ,docker compose ps";
+    try {
+      const all = getSafePrefixes();
+      expect(all).toContain("ls"); // builtin still present
+      expect(all).toContain("make ");
+      expect(all).toContain("docker compose ps");
+    } finally {
+      if (prev === undefined) delete process.env.LITTLE_CODER_BASH_ALLOW;
+      else process.env.LITTLE_CODER_BASH_ALLOW = prev;
+    }
+  });
 });

package/.pi/extensions/quality-monitor/index.ts

@@ -2,9 +2,9 @@ import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
 import { assessResponse, buildCorrectionMessage, type ToolCall } from "./quality.ts";
 
 // Port of local/quality.py. Hooks turn_end, inspects the assistant message
-// + previous turn's tool calls, and — if we detect a failure mode — queues
-// a correction user message via session.followUp() so the model gets a
-// chance to recover on its next turn.
+// + previous turn's tool calls, and — if we detect a failure mode — sends
+// a correction user message with deliverAs:"steer" so the model gets it
+// immediately on its next turn rather than waiting for the next user input.
 
 // Session-scoped state. Pi reuses extensions across turns within a session;
 // a fresh extension instance is loaded per session via the session lifecycle.
@@ -62,9 +62,12 @@ export default function (pi: ExtensionAPI) {
 
     const correction = buildCorrectionMessage(verdict.reason);
     ctx.ui.notify(
-      `quality-monitor: ${verdict.reason} → queued correction`,
+      `quality-monitor: ${verdict.reason} → injecting correction`,
       "warning",
     );
-    pi.sendUserMessage(correction, { deliverAs: "followUp" });
+    // "steer" delivers the correction promptly to the in-flight loop. The
+    // prior "followUp" mode parked the message until the *next* user input,
+    // by which point it was no longer relevant (issue #16).
+    pi.sendUserMessage(correction, { deliverAs: "steer" });
   });
 }

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to little-coder are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and little-coder's public interface (CLI, providers, tools, skills) follows semver starting at `v0.0.1` post-rename.
 
+## [v1.1.0] — 2026-05-03
+
+Issue-cleanup release. Three small features and one bug fix, driven by GitHub issues #12 / #13 / #15 / #16.
+
+### Added
+- **`models.json` is now the canonical provider registration.** ([#13](https://github.com/itayinbarr/little-coder/issues/13))
+  Previously `.pi/extensions/llama-cpp-provider/index.ts` hardcoded the model list and `models.json` was decorative; editing it had no effect. Now the extension loads providers and models from `models.json` at startup and registers them dynamically. **User override file** (first match wins): `$LITTLE_CODER_MODELS_FILE` → `$XDG_CONFIG_HOME/little-coder/models.json` → `~/.config/little-coder/models.json`. Per-provider replace semantics — your override fully replaces a same-keyed provider in the shipped file. Diagnostics for missing/invalid sources surface via `console.error`. The legacy `LLAMACPP_BASE_URL` / `OLLAMA_BASE_URL` env vars still beat both files for those two providers. New unit-test module `.pi/extensions/llama-cpp-provider/config.test.ts` covers merge, env override, and resolution-order semantics. README has a new **Configuring models** section.
+- **`LITTLE_CODER_BASH_ALLOW` env var** ([#15](https://github.com/itayinbarr/little-coder/issues/15)) — comma-separated extra prefixes merged with the built-in `permission-gate` whitelist, so deployments can allow extra bash commands without forking. Trailing whitespace is meaningful (acts as a word boundary, matching the built-in convention). README has a new **Permissions** section that also documents the existing `LITTLE_CODER_PERMISSION_MODE=accept-all` escape hatch (which was undocumented before).
+- **`bun add -g little-coder` install path documented** ([#12](https://github.com/itayinbarr/little-coder/issues/12)). Node ≥ 20.6 is still required at runtime because of the launcher shebang; users who want a fully node-less setup get a one-line shebang-swap recipe.
+- `qwen3.6-27b` re-added to `models.json` so the data-driven extension preserves the four-model lineup (`llamacpp/qwen3.6-27b`, `llamacpp/qwen3.6-35b-a3b`, `llamacpp/qwen3.5-9b`, `ollama/qwen3.5`) that `.pi/settings.json` profiles already reference.
+
+### Fixed
+- **Empty-response correction is no longer parked until the next user input.** ([#16](https://github.com/itayinbarr/little-coder/issues/16))
+  `quality-monitor` was sending its correction message via `pi.sendUserMessage(..., { deliverAs: "followUp" })`, which queued the message until the user typed something — by which point "your previous response was empty" had nothing to steer. Switched to `deliverAs: "steer"` so the correction injects into the in-flight loop. Same fix applies to the other quality-monitor reasons (`unknown_tool`, `repeated_tool_call`, `malformed_args`, `empty_tool_name`); they all benefit from prompt delivery for the same reason. The `thinking-budget` extension's deliberate use of `followUp` (post-abort retry; see commit `50becc3`) is unchanged.
+
+### Changed
+- README architecture diagram: `llama-cpp-provider/` is now described as "data-driven provider registration from models.json (+ user override file)"; `models.json` is now described as "canonical provider registration", reflecting the actual load path.
+
+### Notes for upgraders
+- No CLI flag, settings.json, or skill-pack breaks. Existing `.pi/settings.json` `model_profiles` keys (`llamacpp/qwen3.6-27b`, `llamacpp/qwen3.6-35b-a3b`, `llamacpp/qwen3.5-9b`, `ollama/qwen3.5`) all still match.
+- If you'd been editing the installed package's `models.json` manually, those edits will keep working — but they're erased on the next `npm install -g little-coder@latest`. Move them to `~/.config/little-coder/models.json` to make them survive upgrades.
+
+---
+
 ## [v1.0.3] — 2026-04-28
 
 ### Changed

package/README.md

@@ -26,8 +26,16 @@ Or with npm directly:
 npm install -g little-coder
 ```
 
+Or with [bun](https://bun.sh):
+
+```bash
+bun add -g little-coder
+```
+
 That's the whole install. No clone, no `npm install` in a workspace, no PATH fiddling. `little-coder` is now on your PATH and works from any directory.
 
+> **Note for `bun add -g` users.** The launcher (`bin/little-coder.mjs`) is a Node.js script with `#!/usr/bin/env node` at the top, so Node ≥ 20.6 still has to be on your PATH for the binary to start — bun is fine for installing/updating the package, but the runtime is Node. If you want a fully node-less setup, replace the shebang in `$(bun pm bin -g)/little-coder` with `#!/usr/bin/env bun`.
+
 ## Run
 
 ```bash
@@ -93,6 +101,76 @@ All small-model-specific extensions auto-disable for large/cloud models so they
 
 ---
 
+## Configuring models
+
+The shipped model list lives in **`models.json`** at the package root. The `llama-cpp-provider` extension reads it at startup and registers each provider via pi's `registerProvider()`. Editing this file in your global install **does** take effect — but it's overwritten on `npm install -g little-coder@latest`, so for anything you want to keep, use a user override file instead.
+
+User override resolution (first match wins):
+
+1. `$LITTLE_CODER_MODELS_FILE` — explicit path, useful for ad-hoc tests.
+2. `$XDG_CONFIG_HOME/little-coder/models.json`
+3. `~/.config/little-coder/models.json`
+
+Merge semantics: each top-level provider key in your override file **fully replaces** the same key in the shipped `models.json`. Providers only in your file are added; providers only in the shipped file are kept. (We don't deep-merge per-model fields — you redeclare the whole provider entry, which avoids "your override silently inherited new fields from a future package release" surprises.)
+
+Example — switch the llama.cpp port and bump `qwen3.6-35b-a3b` to a 150K context, leave ollama untouched:
+
+```json
+{
+  "providers": {
+    "llamacpp": {
+      "api": "openai-completions",
+      "baseUrl": "http://127.0.0.1:1234/v1",
+      "apiKey": "LLAMACPP_API_KEY",
+      "models": [
+        {
+          "id": "qwen3.6-35b-a3b",
+          "name": "Qwen3.6-35B-A3B (local llama.cpp, 150K)",
+          "reasoning": true,
+          "input": ["text"],
+          "contextWindow": 150000,
+          "maxTokens": 4096,
+          "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 }
+        }
+      ]
+    }
+  }
+}
+```
+
+Then verify with `little-coder --list-models` — you should see your overridden entry.
+
+`LLAMACPP_BASE_URL` and `OLLAMA_BASE_URL` env vars still beat both files for those two providers (legacy compat).
+
+`.pi/settings.json` is a separate concern: it controls per-model **profiles** (context_limit, thinking_budget, temperature, benchmark_overrides) referenced by the `<provider>/<id>` key. Profiles don't register or describe models — they only tune how little-coder runs against models that are already registered.
+
+---
+
+## Permissions
+
+little-coder gates `Bash` tool calls against a built-in safe-prefix whitelist (`ls`, `cat`, `git log/status/diff`, `find`, `grep`, etc.) before pi's own confirmation flow ever sees them.
+
+Two env vars control the gate:
+
+| Env var | Values | Effect |
+|---|---|---|
+| `LITTLE_CODER_PERMISSION_MODE` | `auto` *(default)* / `accept-all` / `manual` | `auto`: block any bash command not on the whitelist. `accept-all`: skip the gate entirely, every bash call passes (the benchmark runner sets this). `manual`: same as `auto` but with a different rejection message. |
+| `LITTLE_CODER_BASH_ALLOW` | comma-separated prefixes | Extra allow-prefixes merged with the built-in list. **Trailing whitespace is meaningful**: `"make "` allows `make test` but not `makefoo`; `"make"` allows both. |
+
+Examples:
+
+```bash
+# Add 'make' (with word-boundary) and 'docker compose ps' on top of the defaults
+export LITTLE_CODER_BASH_ALLOW="make ,docker compose ps"
+
+# Skip the gate entirely (use this only inside controlled environments)
+export LITTLE_CODER_PERMISSION_MODE=accept-all
+```
+
+Write/Edit confirmations are pi's responsibility; little-coder doesn't intercept those.
+
+---
+
 ## Paper / benchmark results
 
 | Release | Model | Benchmark | Result |
@@ -163,7 +241,7 @@ little-coder/
 ├── .pi/
 │   ├── settings.json               # per-model profiles + benchmark_overrides (terminal_bench, gaia)
 │   └── extensions/                 # 20 TypeScript extensions, auto-discovered by pi
-│       ├── llama-cpp-provider/     # registers llamacpp/* and ollama/* as OpenAI-compat providers
+│       ├── llama-cpp-provider/     # data-driven provider registration from models.json (+ user override file)
 │       ├── write-guard/            # Write refuses on existing files — the whitepaper invariant
 │       ├── extra-tools/            # glob, webfetch, websearch (pi ships grep/find)
 │       ├── skill-inject/           # per-turn tool-skill selection (error > recency > intent)
@@ -193,7 +271,7 @@ little-coder/
 │   ├── tb_status.sh / harbor_status.sh
 │   └── test_rpc_client.py
 ├── AGENTS.md                       # project system prompt (pi discovers it automatically)
-├── models.json                     # documented provider registration (extension is canonical)
+├── models.json                     # canonical provider registration (loaded by llama-cpp-provider; user override at $XDG_CONFIG_HOME/little-coder/models.json)
 └── docs/
     ├── benchmark-*.md              # per-benchmark narratives
     └── architecture.md             # v0.0.5-era Python architecture (historical)

package/models.json

@@ -5,9 +5,18 @@
       "baseUrl": "http://127.0.0.1:8888/v1",
       "apiKey": "LLAMACPP_API_KEY",
       "models": [
+        {
+          "id": "qwen3.6-27b",
+          "name": "Qwen3.6-27B (dense, local llama.cpp)",
+          "reasoning": true,
+          "input": ["text"],
+          "contextWindow": 32768,
+          "maxTokens": 4096,
+          "cost": { "input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0 }
+        },
         {
           "id": "qwen3.6-35b-a3b",
-          "name": "Qwen3.6-35B-A3B (local llama.cpp)",
+          "name": "Qwen3.6-35B-A3B (MoE, local llama.cpp)",
           "reasoning": true,
           "input": ["text"],
           "contextWindow": 32768,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "little-coder",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "A pi-based coding agent optimized for small local language models. Reproduces the whitepaper's scaffold-model-fit adaptations as pi extensions.",
   "homepage": "https://github.com/itayinbarr/little-coder",
   "repository": {