one-code-extension 0.1.0

package/extensions/lib/model-policy.ts

@@ -0,0 +1,436 @@
+import type { Api, Model } from "@earendil-works/pi-ai";
+
+/** The two automatic model-selection jobs have different capability floors. */
+export type ModelRole = "classifier" | "subagent";
+
+export interface RoleProfile {
+	/** Vetted, small-but-capable models. Price alone never adds to this list. */
+	classifier: readonly string[];
+	/** Economical models suitable for delegated coding/reasoning work. */
+	subagent: readonly string[];
+}
+
+/**
+ * Short family lists, not catalogs. Broad gateways apply these to their live
+ * authenticated catalog after containment; they never get an OpenRouter-sized
+ * hardcoded list. Reviewed against official provider docs on 2026-08-06.
+ */
+export const ROLE_PROFILES: Readonly<Record<string, RoleProfile>> = {
+	anthropic: {
+		classifier: ["claude-haiku-4-5", "claude-sonnet-5", "claude-sonnet-4-6"],
+		subagent: ["claude-sonnet-5", "claude-haiku-4-5", "claude-sonnet-4-6"],
+	},
+	openai: {
+		classifier: ["gpt-5.6-luna", "gpt-5.4-mini", "gpt-5-mini", "gpt-4.1-mini", "gpt-4o-mini"],
+		subagent: ["gpt-5.6-luna", "gpt-5.4-mini", "gpt-5.3-codex-spark", "gpt-5.6-terra"],
+	},
+	google: {
+		classifier: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3-flash-preview", "gemini-2.5-flash"],
+		subagent: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3-flash-preview", "gemini-2.5-flash"],
+	},
+	xai: {
+		classifier: ["grok-4.3", "grok-4.5"],
+		subagent: ["grok-build-0.1", "grok-4.3", "grok-4.5"],
+	},
+	mistral: {
+		classifier: ["mistral-small-2603", "mistral-small-latest", "mistral-medium-3.5"],
+		subagent: ["mistral-small-2603", "mistral-medium-3.5", "codestral-latest"],
+	},
+	deepseek: {
+		classifier: ["deepseek-v4-flash", "deepseek-v4-pro"],
+		subagent: ["deepseek-v4-flash", "deepseek-v4-pro"],
+	},
+	zai: {
+		classifier: ["glm-5-turbo", "glm-4.7", "glm-5.2", "glm-4.5-air", "glm-4-flash"],
+		subagent: ["glm-5-turbo", "glm-4.7", "glm-5.2", "glm-4.5-air"],
+	},
+	moonshot: {
+		classifier: ["kimi-k2.6", "kimi-k2.5"],
+		subagent: ["kimi-k2.7-code", "kimi-k2.6", "kimi-k3"],
+	},
+	minimax: {
+		classifier: ["MiniMax-M2.7", "MiniMax-M3"],
+		subagent: ["MiniMax-M2.7", "MiniMax-M3"],
+	},
+	xiaomi: {
+		classifier: ["mimo-v2.5", "mimo-v2-pro"],
+		subagent: ["mimo-v2.5", "mimo-v2.5-pro", "mimo-v2-pro"],
+	},
+	"ant-ling": {
+		// The current pi catalog predates Ling 3.0. Flash remains opt-in: it has
+		// not been calibrated as the approval boundary.
+		classifier: ["Ling-2.6-1T", "Ring-2.6-1T"],
+		subagent: ["Ling-2.6-1T", "Ring-2.6-1T", "Ling-2.6-flash"],
+	},
+	meta: {
+		classifier: ["llama-3.3-70b", "llama-4-scout"],
+		subagent: ["llama-4-scout", "llama-3.3-70b"],
+	},
+	amazon: {
+		classifier: ["nova-2-lite", "nova-lite"],
+		subagent: ["nova-2-lite", "nova-lite", "nova-pro"],
+	},
+	"host:nvidia": {
+		classifier: ["nvidia/nvidia-nemotron-nano-9b-v2", "openai/gpt-oss-20b", "meta/llama-3.3-70b-instruct"],
+		subagent: ["poolside/laguna-xs-2.1", "nvidia/nemotron-3-super-120b-a12b", "openai/gpt-oss-20b"],
+	},
+	"host:groq": {
+		classifier: ["openai/gpt-oss-20b", "llama-3.3-70b-versatile"],
+		subagent: ["openai/gpt-oss-20b", "openai/gpt-oss-120b", "llama-3.3-70b-versatile"],
+	},
+	"host:cerebras": {
+		classifier: ["gpt-oss-120b", "zai-glm-4.7"],
+		subagent: ["gpt-oss-120b", "zai-glm-4.7"],
+	},
+	"host:fireworks": {
+		classifier: ["accounts/fireworks/models/deepseek-v4-flash", "accounts/fireworks/models/gpt-oss-20b"],
+		subagent: ["accounts/fireworks/models/kimi-k2p7-code", "accounts/fireworks/models/gpt-oss-20b"],
+	},
+	"host:together": {
+		classifier: ["Qwen/Qwen3.5-9B", "openai/gpt-oss-20b"],
+		subagent: ["openai/gpt-oss-20b", "moonshotai/Kimi-K2.7-Code", "Qwen/Qwen3.5-9B"],
+	},
+	"host:baseten": {
+		classifier: ["openai/gpt-oss-120b", "deepseek-ai/DeepSeek-V4-Flash"],
+		subagent: ["openai/gpt-oss-120b", "zai-org/GLM-5.2", "moonshotai/Kimi-K2.7-Code"],
+	},
+	"host:cloudflare-workers": {
+		classifier: ["@cf/openai/gpt-oss-20b", "@cf/zai-org/glm-4.7-flash"],
+		subagent: ["@cf/moonshotai/kimi-k2.7-code", "@cf/openai/gpt-oss-20b"],
+	},
+	"host:qwen-plan": {
+		classifier: ["qwen3.6-flash", "deepseek-v4-flash", "qwen3.6-plus"],
+		subagent: ["kimi-k2.7-code", "deepseek-v4-flash", "qwen3.7-plus", "qwen3.6-plus"],
+	},
+	"host:kimi-coding": {
+		classifier: ["kimi-for-coding", "k3"],
+		subagent: ["kimi-for-coding", "k3"],
+	},
+};
+
+export type ProviderPolicyKind = "direct" | "hosted" | "gateway" | "opaque";
+
+export interface ProviderPolicy {
+	kind: ProviderPolicyKind;
+	/** Fixed profile for direct vendors and stable hosted catalogs. */
+	profile?: string;
+	/** Whether a price-ranked subagent may follow the vetted profile. */
+	dynamicSubagents: boolean;
+}
+
+const direct = (profile: string): ProviderPolicy => ({ kind: "direct", profile, dynamicSubagents: true });
+const hosted = (profile?: string): ProviderPolicy => ({ kind: "hosted", profile, dynamicSubagents: true });
+const gateway = (): ProviderPolicy => ({ kind: "gateway", dynamicSubagents: true });
+const opaque = (): ProviderPolicy => ({ kind: "opaque", dynamicSubagents: false });
+
+/**
+ * Every built-in language-model provider in pi 0.84.0. Unknown/custom providers
+ * get the opaque policy below, so a pi upgrade fails safe rather than widening
+ * automatic routing.
+ */
+export const BUILTIN_PROVIDER_POLICIES: Readonly<Record<string, ProviderPolicy>> = {
+	"amazon-bedrock": hosted(),
+	"ant-ling": direct("ant-ling"),
+	anthropic: direct("anthropic"),
+	google: direct("google"),
+	"google-vertex": direct("google"),
+	openai: direct("openai"),
+	"azure-openai-responses": direct("openai"),
+	"openai-codex": direct("openai"),
+	radius: opaque(),
+	nvidia: hosted("host:nvidia"),
+	deepseek: direct("deepseek"),
+	"github-copilot": hosted(),
+	xai: direct("xai"),
+	groq: hosted("host:groq"),
+	cerebras: hosted("host:cerebras"),
+	openrouter: gateway(),
+	"vercel-ai-gateway": gateway(),
+	zai: direct("zai"),
+	"zai-coding-cn": direct("zai"),
+	mistral: direct("mistral"),
+	minimax: direct("minimax"),
+	"minimax-cn": direct("minimax"),
+	moonshotai: direct("moonshot"),
+	"moonshotai-cn": direct("moonshot"),
+	huggingface: opaque(),
+	fireworks: hosted("host:fireworks"),
+	together: hosted("host:together"),
+	baseten: hosted("host:baseten"),
+	opencode: opaque(),
+	"opencode-go": opaque(),
+	"kimi-coding": direct("host:kimi-coding"),
+	"cloudflare-workers-ai": hosted("host:cloudflare-workers"),
+	"cloudflare-ai-gateway": gateway(),
+	"qwen-token-plan": hosted("host:qwen-plan"),
+	"qwen-token-plan-cn": hosted("host:qwen-plan"),
+	xiaomi: direct("xiaomi"),
+	"xiaomi-token-plan-cn": direct("xiaomi"),
+	"xiaomi-token-plan-ams": direct("xiaomi"),
+	"xiaomi-token-plan-sgp": direct("xiaomi"),
+};
+
+const VENDOR_ALIASES: Readonly<Record<string, string>> = {
+	anthropic: "anthropic",
+	openai: "openai",
+	google: "google",
+	xai: "xai",
+	"x-ai": "xai",
+	mistral: "mistral",
+	mistralai: "mistral",
+	deepseek: "deepseek",
+	zai: "zai",
+	"z-ai": "zai",
+	qwen: "host:qwen-plan",
+	alibaba: "host:qwen-plan",
+	moonshotai: "moonshot",
+	minimax: "minimax",
+	minimaxai: "minimax",
+	xiaomi: "xiaomi",
+	meta: "meta",
+	"meta-llama": "meta",
+	amazon: "amazon",
+};
+
+export interface ModelIdentity {
+	/** Models may be switched automatically only when this key stays equal. */
+	containment: string;
+	/** Role profile to apply to normalizedId, when identity is reliable. */
+	profile?: string;
+	normalizedId: string;
+	confidence: "exact" | "family" | "opaque";
+}
+
+const providerPolicy = (provider: string): ProviderPolicy => BUILTIN_PROVIDER_POLICIES[provider] ?? opaque();
+
+function canonicalVendor(value: string): string | undefined {
+	return VENDOR_ALIASES[value.toLowerCase()];
+}
+
+function prefixedIdentity(model: Model<Api>, prefix: string): ModelIdentity {
+	const raw = model.id.startsWith("~") ? model.id.slice(1) : model.id;
+	const slash = raw.indexOf("/");
+	if (slash <= 0) {
+		return { containment: `${model.provider}:opaque:${model.id}`, normalizedId: model.id, confidence: "opaque" };
+	}
+	const route = raw.slice(0, slash).toLowerCase();
+	const normalizedId = raw.slice(slash + 1);
+	return {
+		containment: `${model.provider}:${prefix}:${route}`,
+		profile: canonicalVendor(route),
+		normalizedId,
+		confidence: canonicalVendor(route) ? "family" : "opaque",
+	};
+}
+
+function bareFamily(id: string): string | undefined {
+	if (/^claude-/i.test(id)) return "anthropic";
+	if (/^(gpt-|o\d(?:-|$))/i.test(id)) return "openai";
+	if (/^(gemini-|gemma-)/i.test(id)) return "google";
+	if (/^grok-/i.test(id)) return "xai";
+	if (/^deepseek-/i.test(id)) return "deepseek";
+	if (/^kimi-/i.test(id)) return "moonshot";
+	if (/^minimax-/i.test(id)) return "minimax";
+	if (/^glm-/i.test(id)) return "zai";
+	if (/^qwen/i.test(id)) return "host:qwen-plan";
+	if (/^mimo-/i.test(id)) return "xiaomi";
+	if (/^llama-/i.test(id)) return "meta";
+	return undefined;
+}
+
+function bedrockIdentity(model: Model<Api>): ModelIdentity {
+	const geography = model.id.match(/^(us|eu|apac|au|global)\./i)?.[1]?.toLowerCase() ?? "in-region";
+	const raw = model.id.replace(/^(?:us|eu|apac|au|global)\./i, "");
+	const dot = raw.indexOf(".");
+	if (dot <= 0 || raw.startsWith("arn:")) {
+		return { containment: `${model.provider}:opaque:${model.id}`, normalizedId: model.id, confidence: "opaque" };
+	}
+	const vendor = raw.slice(0, dot).toLowerCase();
+	const profile = canonicalVendor(vendor);
+	return {
+		containment: `${model.provider}:geography:${geography}:family:${vendor}`,
+		profile,
+		normalizedId: raw.slice(dot + 1).replaceAll("_", "-").replace(/-v\d(?::\d+)?$/i, ""),
+		confidence: profile ? "family" : "opaque",
+	};
+}
+
+function cloudflareGatewayIdentity(model: Model<Api>): ModelIdentity {
+	if (model.id.startsWith("workers-ai/")) {
+		return {
+			containment: `${model.provider}:route:workers-ai`,
+			profile: "host:cloudflare-workers",
+			normalizedId: model.id.slice("workers-ai/".length),
+			confidence: "exact",
+		};
+	}
+	const api = String(model.api);
+	const route = api === "anthropic-messages" ? "anthropic" : api.includes("openai") ? "openai" : undefined;
+	if (!route) {
+		return { containment: `${model.provider}:opaque:${model.id}`, normalizedId: model.id, confidence: "opaque" };
+	}
+	return {
+		containment: `${model.provider}:route:${route}`,
+		profile: route,
+		normalizedId: model.id,
+		confidence: "exact",
+	};
+}
+
+/** Normalize privacy containment and model-family identity for one catalog row. */
+export function modelIdentity(model: Model<Api>): ModelIdentity {
+	const policy = providerPolicy(model.provider);
+	if (policy.kind === "opaque") {
+		return { containment: `${model.provider}:opaque:${model.id}`, normalizedId: model.id, confidence: "opaque" };
+	}
+	if (model.provider === "openrouter") return prefixedIdentity(model, "author");
+	if (model.provider === "vercel-ai-gateway") return prefixedIdentity(model, "creator");
+	if (model.provider === "cloudflare-ai-gateway") return cloudflareGatewayIdentity(model);
+	if (model.provider === "amazon-bedrock") return bedrockIdentity(model);
+	if (model.provider === "github-copilot") {
+		const profile = bareFamily(model.id);
+		return profile
+			? { containment: `${model.provider}:family:${profile}`, profile, normalizedId: model.id, confidence: "family" }
+			: { containment: `${model.provider}:opaque:${model.id}`, normalizedId: model.id, confidence: "opaque" };
+	}
+	return {
+		containment: model.provider,
+		profile: policy.profile,
+		normalizedId: model.id,
+		confidence: "exact",
+	};
+}
+
+/**
+ * Names of the known small-but-capable model families, best tier first. Too weak
+ * to *choose* by — Groq and xAI carry none of them — but strong enough to
+ * corroborate a choice price alone suggested, and to order tiers when several
+ * cheap models qualify (mini-class ahead of nano/lite-class).
+ */
+const NAME_HINTS = [/haiku/i, /flash/i, /mini/i, /nano/i, /small/i, /lite/i, /instant/i, /sonnet/i];
+
+/** Index into NAME_HINTS; NAME_HINTS.length means "no known small-model name". */
+export function hintRank(model: Model<Api>): number {
+	const index = NAME_HINTS.findIndex((pattern) => pattern.test(model.id));
+	return index === -1 ? NAME_HINTS.length : index;
+}
+
+/** Whether the model's name carries one of the known small-model family words. */
+export function hasSmallModelName(model: Model<Api>): boolean {
+	return hintRank(model) < NAME_HINTS.length;
+}
+
+const UNSUITABLE_VARIANT = /:(batch|free|online|thinking)$/i;
+
+/** Automatic selection excludes endpoint variants with the wrong execution shape. */
+export function isSelectableVariant(model: Model<Api>): boolean {
+	return !UNSUITABLE_VARIANT.test(model.id);
+}
+
+/** Non-positive values are catalog sentinels/unpriced, not evidence of being free. */
+export function pricedInput(model: Model<Api>): number | undefined {
+	const input = model.cost?.input;
+	return typeof input === "number" && input > 0 ? input : undefined;
+}
+
+/** Models that automatic selection may consider without changing containment. */
+export function modelsContainedToSession(available: Model<Api>[], sessionModel: Model<Api>): Model<Api>[] {
+	const sessionIdentity = modelIdentity(sessionModel);
+	return available.filter(
+		(model) =>
+			model.provider === sessionModel.provider &&
+			isSelectableVariant(model) &&
+			modelIdentity(model).containment === sessionIdentity.containment,
+	);
+}
+
+function comparableId(value: string): string {
+	return value.toLowerCase().replaceAll(".", "-").replaceAll("_", "-");
+}
+
+function matchesPrefix(model: Model<Api>, prefix: string): boolean {
+	const id = comparableId(modelIdentity(model).normalizedId);
+	const wanted = comparableId(prefix);
+	return id === wanted || id.startsWith(wanted);
+}
+
+/** First live model matching a role's reviewed family order. */
+export function findRoleProfileModel(
+	available: Model<Api>[],
+	sessionModel: Model<Api>,
+	role: ModelRole,
+	accept: (model: Model<Api>) => boolean = () => true,
+	// A caller that already computed the containment set can pass it to avoid the
+	// O(catalog) recompute (classifierCandidates does, on a per-tool-call hot path).
+	precomputedContained?: Model<Api>[],
+): Model<Api> | undefined {
+	const identity = modelIdentity(sessionModel);
+	if (!identity.profile) return undefined;
+	const prefixes = ROLE_PROFILES[identity.profile]?.[role] ?? [];
+	const contained = precomputedContained ?? modelsContainedToSession(available, sessionModel);
+	for (const prefix of prefixes) {
+		const wanted = comparableId(prefix);
+		const exact = contained.find(
+			(model) => comparableId(modelIdentity(model).normalizedId) === wanted && accept(model),
+		);
+		if (exact) return exact;
+		const prefixed = contained.find((model) => matchesPrefix(model, prefix) && accept(model));
+		if (prefixed) return prefixed;
+	}
+	return undefined;
+}
+
+export interface EconomicalModelChoice {
+	model: Model<Api>;
+	via: "profile" | "session";
+}
+
+/**
+ * A vetted small-but-capable same-containment model within the session's
+ * price ceiling, else the session model itself. Used for low-stakes one-shot
+ * jobs over untrusted content (the web_fetch reader) — the content goes to
+ * the model, so containment applies. Not used for compaction, which runs on
+ * the session model to reuse the provider prompt cache.
+ */
+export function pickEconomicalContainedModel(
+	available: Model<Api>[],
+	sessionModel: Model<Api> | undefined,
+): EconomicalModelChoice | undefined {
+	if (!sessionModel) return undefined;
+	const sessionPrice = pricedInput(sessionModel);
+	const withinBudget = (model: Model<Api>) => {
+		if (sessionPrice === undefined) return true;
+		const price = pricedInput(model);
+		return price === undefined || price <= sessionPrice;
+	};
+	const profiled = findRoleProfileModel(available, sessionModel, "classifier", withinBudget);
+	return profiled ? { model: profiled, via: "profile" } : { model: sessionModel, via: "session" };
+}
+
+/** Whether price ranking is an acceptable subagent fallback for this session. */
+export function allowsDynamicSubagentSelection(sessionModel: Model<Api>): boolean {
+	const policy = providerPolicy(sessionModel.provider);
+	if (!policy.dynamicSubagents) return false;
+	return modelIdentity(sessionModel).confidence !== "opaque";
+}
+
+/** Resolve an explicit provider/id, bare id, or prefix. Explicit choices are not contained. */
+export function findConfigured(available: Model<Api>[], configured: string): Model<Api> | undefined {
+	const wanted = configured.trim();
+	if (!wanted) return undefined;
+	const qualified = available.find((model) => `${model.provider}/${model.id}` === wanted);
+	if (qualified) return qualified;
+	const byId = available.find((model) => model.id === wanted);
+	if (byId) return byId;
+	const slash = wanted.indexOf("/");
+	if (slash > 0) {
+		const provider = wanted.slice(0, slash);
+		const idPrefix = wanted.slice(slash + 1);
+		const inProvider = available.filter((model) => model.provider === provider);
+		const exact = inProvider.find((model) => model.id === idPrefix);
+		if (exact) return exact;
+		const prefixed = inProvider.find((model) => model.id.startsWith(idPrefix));
+		if (prefixed) return prefixed;
+	}
+	return available.find((model) => model.id.startsWith(wanted));
+}

package/extensions/lib/model-tier.ts

@@ -0,0 +1,99 @@
+/**
+ * Which system-prompt register the active model gets. Claude Code ships a
+ * capability-tiered prompt — a terse one for frontier models, a much longer,
+ * more explicit one for smaller models (Anthropic removed 80%+ of the prompt for
+ * Claude-5-gen models with no measured loss). One Code serves every provider, so
+ * its non-frontier audience is dominated by models weaker than Haiku; a single
+ * lean prompt under-instructs them. This module maps a model to one of three
+ * registers; `extensions/system-prompt` picks the prompt text from the result.
+ *
+ * The classification obeys the repo convention against id-substring matching
+ * (see `auto-mode/model-select.ts`): the only id parsing is structural version
+ * parsing on first-party Anthropic ids (a namespace we control); for every other
+ * provider the decision rests on price + containment, with a name hint as a
+ * corroborating signal, never the lead.
+ */
+
+import type { Api, Model } from "@earendil-works/pi-ai";
+import { modelIdentity, pricedInput } from "./model-policy.ts";
+
+export type PromptTier = "frontier" | "mid" | "low";
+
+/**
+ * `CC_PROMPT_TIER=frontier|mid|low` forces a register; `auto`/unset classifies.
+ * Env only — a project must not be able to downgrade its own scaffolding, the
+ * same reasoning that keeps `autoMode` out of project settings.
+ */
+export function tierOverride(env: NodeJS.ProcessEnv = process.env): PromptTier | undefined {
+	const raw = env.CC_PROMPT_TIER?.trim().toLowerCase();
+	return raw === "frontier" || raw === "mid" || raw === "low" ? raw : undefined;
+}
+
+/**
+ * Anthropic first-party frontier gate: Opus/Fable ≥ 4.8 or Sonnet ≥ 5. Adapted
+ * from pi-ai's `defaultSupportsToolReferences` — never Haiku, and the
+ * `length < 8` guard stops a dated suffix (`claude-opus-4-8-20251101`) being read
+ * as the minor version. Version parse, not price: `claude-opus-4-1` ($15/M) costs
+ * more than `opus-4-8`/`opus-5` ($5/M), so cost ranking would misclassify it.
+ */
+function isAnthropicFrontier(model: Model<Api>): boolean {
+	if (model.provider !== "anthropic" || model.id.includes("haiku")) return false;
+	const version = model.id.match(/^claude-(opus|sonnet|fable)-(\d+)(?:-(\d+))?(?:-|$)/);
+	if (!version) return false;
+	const family = version[1];
+	const major = Number(version[2]);
+	const minor = version[3] && version[3].length < 8 ? Number(version[3]) : 0;
+	return family === "sonnet" ? major >= 5 : major > 4 || (major === 4 && minor >= 8);
+}
+
+/**
+ * Small-model name words that justify the low tier, matched as delimited tokens.
+ * Delimiting matters: a bare `/mini/` matches inside "geMINI", which would drag
+ * every Gemini model (pro included) to low. Deliberately narrower than
+ * model-policy's `NAME_HINTS`, which also counts "haiku"/"sonnet" — those are
+ * mid-class, and a gateway-proxied `…/claude-sonnet-5` reaching this branch must
+ * not be demoted to the weakest prompt on the strength of its name.
+ */
+const LOW_TIER_NAME_HINT = /(?:^|[-/.])(?:flash|mini|nano|small|lite|instant)(?:[-/.]|$)/i;
+
+/**
+ * A "pro"-class name marks the capable variant of a family (deepseek-v4-pro,
+ * gemini-3-pro, gpt-5-pro) — a capability-up signal that keeps a cheap or
+ * unpriced flagship in mid rather than low. Matched as a delimited token so it
+ * fires on `-pro`/`pro-` but not on `prometheus`, `improved`, or `proxy`.
+ */
+const CAPABLE_NAME_HINT = /(?:^|[-/.])pro(?:[-/.]|$)/i;
+
+/**
+ * Below this input price (USD per million tokens) a model with no other signal
+ * is treated as small. Calibrated against the live catalogs: capable flagships
+ * sit at ≥ $1/M (gpt-5 1.25, grok 1.25, gemini-pro 1.25–2), while mini/nano/flash
+ * classes sit well under $0.5. The boundary is intentionally biased toward `low`
+ * (more scaffolding never hurts a cheap model), per the "unknown → low" decision.
+ */
+const LOW_TIER_MAX_INPUT_COST = 0.5;
+
+export function resolveModelTier(
+	model: Model<Api> | undefined,
+	env: NodeJS.ProcessEnv = process.env,
+): PromptTier {
+	const forced = tierOverride(env);
+	if (forced) return forced;
+	if (!model) return "low"; // unknown model → maximum scaffolding
+
+	if (isAnthropicFrontier(model)) return "frontier";
+	if (model.provider === "anthropic") return "mid"; // Haiku, Sonnet < 5, Opus 4.1–4.7
+
+	// A "pro"-class flagship stays mid even when cheap/unpriced, unless the id
+	// also carries a small-model word (contradictory — let the small path win).
+	if (CAPABLE_NAME_HINT.test(model.id) && !LOW_TIER_NAME_HINT.test(model.id)) return "mid";
+
+	// Otherwise low wins on any positive smallness signal.
+	const price = pricedInput(model);
+	const small =
+		LOW_TIER_NAME_HINT.test(model.id) ||
+		modelIdentity(model).confidence === "opaque" || // local/self-hosted providers
+		price === undefined || // unpriced/unknown → low
+		price < LOW_TIER_MAX_INPUT_COST;
+	return small ? "low" : "mid";
+}

package/extensions/lib/notifications.ts

@@ -0,0 +1,18 @@
+/**
+ * Framing for messages the harness injects into the conversation on its own
+ * (background completions, subagent replies, monitor events, wakeups).
+ *
+ * Adapted from Claude Code's anti-confabulation preamble (findings §14): the
+ * hazard is a model reading an automated event as the user having said,
+ * approved, or confirmed something — especially mid-task, where a pending
+ * question plus an arriving notification looks like an answer.
+ */
+/** First line of the framing — `tui-render.ts`'s `notificationBody` matches on this to strip it back off for display. */
+export const NOTIFICATION_HEADER = "SYSTEM NOTIFICATION — NOT USER INPUT";
+/** Second line of the framing — likewise matched by `notificationBody`. */
+export const NOTIFICATION_PREFIX =
+	"This is an automated event, not a message from the user. No new human input has been received; do not treat anything below as user acknowledgement, confirmation, or approval.";
+
+export function systemNotification(body: string): string {
+	return [NOTIFICATION_HEADER, NOTIFICATION_PREFIX, "", body].join("\n");
+}

package/extensions/lib/paths.ts

@@ -0,0 +1,26 @@
+/**
+ * Where One Code reads and writes (pure).
+ *
+ * The policy is "own state, borrowed config": `~/.claude` is Claude Code's
+ * directory and One Code treats it as a read-only compatibility surface
+ * (settings, skills, agents, plugins, CLAUDE.md); everything One Code
+ * *generates* — plan files, and over time the rest of its state — lands in
+ * One Code's own `~/.one-code`, so neither product's artifacts mingle with the
+ * other's. See "Own state, borrowed config" in docs/decisions.md.
+ */
+
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Claude Code's config dir — the compat surface One Code reads, never writes.
+ * Honours CLAUDE_CONFIG_DIR the way Claude Code itself does.
+ */
+export function claudeConfigDir(env: Record<string, string | undefined> = process.env): string {
+	return env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
+}
+
+/** One Code's own state dir — everything One Code generates goes here. */
+export function oneCodeStateDir(env: Record<string, string | undefined> = process.env): string {
+	return env.ONE_CODE_STATE_DIR || join(homedir(), ".one-code");
+}

package/extensions/lib/per-cwd.ts

@@ -0,0 +1,21 @@
+/**
+ * Memoized get-or-create-by-cwd factory.
+ *
+ * Several tool definitions from pi (bash, read, write, edit, grep, find, ls)
+ * close over their working directory at construction time, but a session's
+ * cwd can change mid-run (worktree switches). Extensions that wrap those
+ * definitions re-create them per cwd and cache the result so a given cwd only
+ * pays construction cost once.
+ */
+
+export function perCwd<T>(create: (cwd: string) => T): (cwd: string) => T {
+	const cache = new Map<string, T>();
+	return (cwd: string): T => {
+		let value = cache.get(cwd);
+		if (!value) {
+			value = create(cwd);
+			cache.set(cwd, value);
+		}
+		return value;
+	};
+}

package/extensions/lib/persisted-output.ts

@@ -0,0 +1,70 @@
+/**
+ * Claude Code-style persistence for oversized tool results (pure apart from
+ * the file write).
+ *
+ * pi's built-in tools already bound their own output — bash truncates to a
+ * temp file, read/grep paginate — but an extension-registered tool returns
+ * whatever it returns, and an MCP server can hand back megabytes that would
+ * land verbatim in the context window. Claude Code's answer, matched here
+ * byte-for-byte so the model recognises the convention: write the full result
+ * to `<session-dir>/tool-results/<tool-call-id>.txt` and return a
+ * `<persisted-output>` block naming the file, its size, and a short preview.
+ * The model then reads or greps the file for the parts it actually needs.
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** Claude Code persists around this size; pi's bash truncation uses 50KB too. */
+export const PERSIST_MAX_BYTES = 50 * 1024;
+export const PREVIEW_BYTES = 2 * 1024;
+
+function formatSize(bytes: number): string {
+	return bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)}KB` : `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+
+export interface PersistOptions {
+	/** Directory the `tool-results/` folder is created under (the session dir). */
+	dir: string;
+	/** File stem — the tool call id, matching Claude Code's `toolu_*.txt` naming. */
+	id: string;
+	maxBytes?: number;
+	previewBytes?: number;
+}
+
+/**
+ * Pass text through untouched while it fits; past the limit, persist it and
+ * return the block the model sees instead. A failed write degrades to the
+ * preview with the error named — never to the full text, which is exactly the
+ * context blowout this exists to prevent.
+ */
+export function persistIfLarge(text: string, options: PersistOptions): string {
+	const maxBytes = options.maxBytes ?? PERSIST_MAX_BYTES;
+	const size = Buffer.byteLength(text, "utf-8");
+	if (size <= maxBytes) return text;
+
+	const previewBytes = options.previewBytes ?? PREVIEW_BYTES;
+	// Character slice, not byte slice: close enough to the target size, and it
+	// cannot split a multibyte character.
+	const preview = text.slice(0, previewBytes);
+
+	const file = join(options.dir, "tool-results", `${options.id.replace(/[^A-Za-z0-9._-]/g, "_")}.txt`);
+	let saved: string;
+	try {
+		mkdirSync(join(options.dir, "tool-results"), { recursive: true });
+		writeFileSync(file, text);
+		saved = `Output too large (${formatSize(size)}). Full output saved to: ${file}`;
+	} catch (error) {
+		saved = `Output too large (${formatSize(size)}) and could not be saved to ${file}: ${(error as Error).message}. Only this preview survives — re-run with a narrower query if more is needed.`;
+	}
+
+	return [
+		"<persisted-output>",
+		saved,
+		"",
+		`Preview (first ${Math.round(previewBytes / 1024)}KB):`,
+		preview,
+		"...",
+		"</persisted-output>",
+	].join("\n");
+}