one-code-extension 0.3.1 → 0.4.1

package/extensions/subagents/model-select.ts

@@ -59,6 +59,7 @@ import {
 	modelsContainedToSession,
 	modelSpec as spec,
 	pricedInput,
+	supportsImageInput,
 } from "../lib/model-policy.ts";
 import { atLeastTier, capableContainedCandidates, economicalContainedCandidates, intrinsicTier, type PromptTier } from "../lib/model-tier.ts";
 
@@ -125,6 +126,18 @@ export interface ResolveInput {
 	configuredDefault?: SubagentDefault;
 	sessionModel?: Model<Api>;
 	available: Model<Api>[];
+	/**
+	 * Set by a spawn path when the session model is image-capable: the subagent
+	 * inherits the parent transcript (fork) or may read an image/PDF file by path
+	 * (any run), so a text-only worker cannot serve. The automatic pick and any
+	 * alias then resolve to an image-capable same-provider model; an explicit
+	 * text-only choice is hard-blocked (a per-call `model` field, retryable) or
+	 * upgraded with a notice (a standing setting or agent-file model). The
+	 * `/subagent` set command leaves this false — a saved default may be meant for
+	 * another (text) session, and is gated at spawn instead. See
+	 * `docs/decisions/model-policy.md`.
+	 */
+	requireImageInput?: boolean;
 }
 
 export interface SubagentModelResolution {
@@ -136,6 +149,13 @@ export interface SubagentModelResolution {
 	 * the tool call with the menu, so the model that chose the string can retry.
 	 */
 	unresolved?: string;
+	/**
+	 * The reason for `unresolved`, when it is not the plain "no such model" case —
+	 * currently only a per-call text-only model refused on an image-capable
+	 * session. The caller shows this in place of its default "unknown model" line
+	 * so the fix is named. Undefined for an ordinary unavailable model.
+	 */
+	unresolvedReason?: string;
 	/** One-line warnings the parent should surface (fallbacks, provider crossings). */
 	notices: string[];
 }
@@ -200,8 +220,13 @@ function resolveAlias(
 	contained: Model<Api>[],
 	available: Model<Api>[],
 	sessionModel: Model<Api> | undefined,
+	requireImageInput = false,
 ): AliasResolution | undefined {
-	const matches = contained.filter((model) => model.id.toLowerCase().includes(alias));
+	// An alias asks for a *class*, so an image-capable session resolves it to an
+	// image-capable model of that class rather than erroring — the alias is
+	// auto-upgraded, never hard-blocked (unlike an explicit text-only id).
+	const imageOk = (model: Model<Api>) => !requireImageInput || supportsImageInput(model);
+	const matches = contained.filter((model) => model.id.toLowerCase().includes(alias) && imageOk(model));
 	if (matches.length > 0) {
 		const undated = matches.filter((model) => !isSnapshotDatedId(model.id));
 		const pool = undated.length > 0 ? undated : matches;
@@ -209,11 +234,12 @@ function resolveAlias(
 	}
 	if (!sessionModel) return undefined;
 	const tier = ALIAS_TIER[alias];
+	// The session model carries the caller's own modality, so frontier is always safe.
 	if (tier === "frontier") return { model: sessionModel, how: "tier" };
 	// Name-class only, deliberately: an explicit alias asks for a *class* of model,
 	// so a measured pass (which lets a strong flash serve the automatic default)
 	// does not lift a lean-named model into "sonnet" here.
-	const byTier = economicalContainedCandidates(available, sessionModel, contained).find((model) => atLeastTier(intrinsicTier(model), tier));
+	const byTier = economicalContainedCandidates(available, sessionModel, contained, requireImageInput).find((model) => atLeastTier(intrinsicTier(model), tier));
 	return byTier ? { model: byTier, how: "tier" } : undefined;
 }
 
@@ -233,6 +259,17 @@ export function resolveSubagentModel(input: ResolveInput): SubagentModelResoluti
 	// A per-call `model` that did not resolve — deferred, not errored (see the
 	// "per-call request" paragraph in the module doc above).
 	let callFailed: string | undefined;
+	let callFailedReason: string | undefined;
+
+	// The modality gate: when the caller marks the session image-capable, a
+	// text-only worker cannot receive the images/PDFs the session may feed it. An
+	// EXPLICIT text-only id is refused here (a per-call `model` field is
+	// hard-blocked so the model retries; a standing setting or agent-file model is
+	// upgraded with a notice). Aliases and the automatic pick are steered to an
+	// image-capable model upstream instead, never refused. `requireImageInput`
+	// already reflects `supportsImageInput(sessionModel)` — the caller computed it.
+	const requireImageInput = input.requireImageInput ?? false;
+	const modalityMismatch = (model: Model<Api>) => requireImageInput && !supportsImageInput(model);
 
 	// The `subagentModel` setting is stale when it was stamped for a different
 	// provider than this session (or never stamped — a hand-edited setting): the
@@ -252,7 +289,7 @@ export function resolveSubagentModel(input: ResolveInput): SubagentModelResoluti
 
 		const alias = wanted.toLowerCase();
 		if (alias in ALIAS_TIER) {
-			const resolved = resolveAlias(alias, contained, available, sessionModel);
+			const resolved = resolveAlias(alias, contained, available, sessionModel, requireImageInput);
 			if (resolved?.how === "name") return { model: resolved.model, source: entry.source, notices };
 			// SCOPE the claim. "No sonnet model exists" is false at machine level
 			// whenever Anthropic is also authenticated, and a model relaying it tells
@@ -281,6 +318,28 @@ export function resolveSubagentModel(input: ResolveInput): SubagentModelResoluti
 
 		const resolved = findConfigured(available, wanted);
 		if (resolved) {
+			if (modalityMismatch(resolved)) {
+				// An explicit text-only id on an image-capable session. A per-call
+				// `model` field is hard-blocked (deferred like an unavailable model,
+				// so the chain may still land on the agent/default, else the caller
+				// shows the menu and the model retries with an image-capable one). A
+				// standing setting or agent-file model is upgraded silently to the
+				// automatic same-provider image-capable pick with a notice, because
+				// the user configured it once and it should not break a fork.
+				if (entry.source === "call") {
+					callFailed = wanted;
+					callFailedReason =
+						`Requested subagent model ${spec(resolved)} is text-only, but this session works with images or PDFs a subagent may need to read ` +
+						"(the inherited transcript, or a file it opens). Pick an image-capable model.";
+					notices.push(callFailedReason);
+				} else {
+					notices.push(
+						`${spec(resolved)} (from ${entry.knob}) is text-only, but this session works with images or PDFs a subagent may need to read; ` +
+							"an image-capable same-provider model runs this subagent instead.",
+					);
+				}
+				continue;
+			}
 			if (sessionModel && crossesProvider(resolved, sessionModel)) {
 				// An `.claude/agents` model is a Claude Code convention; on a
 				// non-Claude session it does not get to move a subagent (which
@@ -334,7 +393,7 @@ export function resolveSubagentModel(input: ResolveInput): SubagentModelResoluti
 	// Per-call model failed and nothing downstream resolved: surface it so the
 	// caller shows the menu and the model retries, rather than silently dropping
 	// to the automatic/session pick for a model the main model named.
-	if (callFailed) return { source: "call", unresolved: callFailed, notices };
+	if (callFailed) return { source: "call", unresolved: callFailed, unresolvedReason: callFailedReason, notices };
 
 	// Automatic selection is a cost optimisation, so it needs price evidence:
 	// with the session price unknown there is no demonstrable saving, and picking
@@ -355,7 +414,7 @@ export function resolveSubagentModel(input: ResolveInput): SubagentModelResoluti
 		// With an Artificial Analysis snapshot (lib/capability-index.ts) the floor
 		// is measured — coding index ≥ min(session, Sonnet 5), no tolerance —
 		// and passers rank by price; unscored candidates are judged by name-class tier.
-		const cheaper = capableContainedCandidates(available, sessionModel, "subagent", { strict: true, contained })[0];
+		const cheaper = capableContainedCandidates(available, sessionModel, "subagent", { strict: true, contained, requireImageInput })[0];
 		if (cheaper) return { model: cheaper, source: "automatic", notices };
 	}
 
@@ -399,6 +458,12 @@ export interface MenuOptions {
 	defaultSource?: SubagentModelSource;
 	/** How many cheaper-option lines to include. */
 	maxCheaper?: number;
+	/**
+	 * When true (an image-capable session), text-only models are omitted from the
+	 * menu — they would only be rejected again on retry (`modalityMismatch`). The
+	 * caller passes `supportsImageInput(sessionModel)`.
+	 */
+	requireImageInput?: boolean;
 	/**
 	 * The configured default and which knob set it, so the reminder can tell the
 	 * main model when the user has *manually* pinned the subagent model via the
@@ -418,11 +483,14 @@ const price = (model: Model<Api>): string => {
  * entries dropped, dated duplicates collapsed, capped — useful, not complete,
  * which is safe because resolution accepts unlisted models too.
  */
-export function subagentModelMenu({ available, sessionModel, defaultModel, defaultSource, maxCheaper = 3 }: MenuOptions): string[] {
+export function subagentModelMenu({ available, sessionModel, defaultModel, defaultSource, maxCheaper = 3, requireImageInput = false }: MenuOptions): string[] {
 	const lines: string[] = [];
 	const listed = new Set<string>();
+	// On an image-capable session a text-only model is rejected on retry
+	// (`modalityMismatch`), so it never belongs in a retry menu.
+	const imageOk = (model: Model<Api>) => !requireImageInput || supportsImageInput(model);
 	const add = (model: Model<Api>, label: string) => {
-		if (listed.has(spec(model))) return;
+		if (listed.has(spec(model)) || !imageOk(model)) return;
 		listed.add(spec(model));
 		lines.push(`- ${spec(model)}${price(model)} — ${label}`);
 	};

package/extensions/system-prompt/environment.ts

@@ -23,6 +23,19 @@ export interface EnvironmentInfo {
 	memoryDir: string;
 }
 
+/**
+ * The `Shell:` value Claude Code prints: the basename of `SHELL`, else of
+ * `COMSPEC` (Windows, where `SHELL` is unset outside Git Bash), with a `.exe`
+ * suffix stripped and either path separator honoured — `cmd`, not `cmd.exe`.
+ */
+export function shellName(env: NodeJS.ProcessEnv = process.env): string {
+	const raw = env.SHELL || env.COMSPEC;
+	if (!raw) return "unknown";
+	const base = raw.split(/[\\/]/).pop() ?? "";
+	if (!base) return "unknown";
+	return base.toLowerCase().endsWith(".exe") ? base.slice(0, -4) : base;
+}
+
 export function collectEnvironment(cwd: string, modelLine: string): EnvironmentInfo {
 	const gitRoot = findGitRoot(cwd);
 	return {
@@ -30,7 +43,7 @@ export function collectEnvironment(cwd: string, modelLine: string): EnvironmentI
 		isGitRepo: gitRoot !== undefined,
 		platform: process.platform,
 		osVersion: `${os.type()} ${os.release()}`,
-		shell: process.env.SHELL ? (process.env.SHELL.split("/").pop() ?? "unknown") : "unknown",
+		shell: shellName(),
 		modelLine,
 		memoryDir: projectMemoryDir(cwd, os.homedir()),
 	};

package/extensions/system-reminder/index.ts

@@ -12,6 +12,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import {
 	appendReminderBlocks,
 	injectReminders,
+	openingUserAnchor,
 	REMINDER_CHANNEL,
 	ReminderQueue,
 	type ReminderPayload,
@@ -44,6 +45,7 @@ export default function systemReminderExtension(pi: ExtensionAPI) {
 				suffix: payload.suffix,
 				raw: payload.raw,
 				since: payload.since,
+				once: payload.once,
 			});
 		}
 	});
@@ -75,6 +77,13 @@ export default function systemReminderExtension(pi: ExtensionAPI) {
 			const anchor = tailAnchor(event.messages);
 			if (anchor) reminderQueue.pin(anchor);
 		}
+		// A local-command breadcrumb rides the prompt that opens a request, before
+		// the user's text (Claude Code's placement), and stays there. Mid-turn —
+		// the request ends in a tool result — it waits for the next prompt.
+		if (reminderQueue.hasPending("user-prepend")) {
+			const anchor = openingUserAnchor(event.messages);
+			if (anchor) reminderQueue.pin(anchor, "user-prepend");
+		}
 		const reminders = reminderQueue.drain(event.messages);
 		return { messages: injectReminders(event.messages, reminders) };
 	});

package/extensions/tasks/index.ts

@@ -22,6 +22,7 @@ import { DEFER_CHANNEL } from "../lib/deferred.ts";
 import { ccToolRenderers, linesComponent, safeThemeBold, safeThemePaint, strike } from "../lib/tui-render.ts";
 import { REMINDER_CHANNEL } from "../lib/reminders.ts";
 import { formatTaskDetails, formatTaskLine, formatTaskList, formatTaskWidget, nudgeMessage, type TaskSnapshot, TaskStore } from "./store.ts";
+import { registerLocalCommand } from "../lib/local-command.ts";
 
 interface TaskDetails {
 	taskSnapshot: TaskSnapshot;
@@ -174,7 +175,7 @@ export default function tasksExtension(pi: ExtensionAPI) {
 		pi.events.emit(DEFER_CHANNEL, { name, keywords: ["task", "todo", "plan", "progress", "dependencies", "tracking"] });
 	}
 
-	pi.registerCommand("tasks", {
+	registerLocalCommand(pi, "tasks", {
 		description: "Show the structured task list; 'hide'/'show' toggles the widget",
 		handler: async (args, ctx) => {
 			const arg = args?.trim().toLowerCase();

package/extensions/tool-search/index.ts

@@ -17,7 +17,9 @@
  * Provider-native deferral (Anthropic `defer_loading`, OpenAI `tool_search_call`)
  * is only a cache optimization on top; without it, loading a tool mid-session
  * grows the tools array and invalidates the prompt cache from the tools block
- * down — an accepted tradeoff (findings §7).
+ * down — an accepted tradeoff (findings §7). On Anthropic tool-reference models
+ * this extension keeps the tools array byte-stable itself (the
+ * before_provider_request hook below), since pi 0.86 no longer does.
  *
  * Load order matters: this extension must come BEFORE any extension that defers
  * a tool, because those emit their defer request while extensions are loading
@@ -36,9 +38,10 @@ import {
 	resultText,
 	searchTools,
 	selectedNames,
+	stabilizeDeferredTools,
 	supportsToolReferences,
 	toolNotFoundName,
-	withDeferredToolDefinitions,
+	toolSearchLoads,
 } from "../lib/deferred.ts";
 import { looksLikeAnthropicRequest } from "../lib/anthropic-payload.ts";
 import { MCP_TOOLS_CHANNEL, type McpToolsPayload } from "../lib/mcp-share.ts";
@@ -47,6 +50,7 @@ import { sessionAlive } from "../lib/session-lifecycle.ts";
 import { ccToolRenderers } from "../lib/tui-render.ts";
 import { normalizeToolName } from "../permissions/matcher.ts";
 import { applyAnnouncement, planAnnouncement } from "./announce.ts";
+import { registerLocalCommand } from "../lib/local-command.ts";
 
 /** Coalesces the burst of per-tool defers one server emits into one listing update. */
 const ANNOUNCE_DEBOUNCE_MS = 100;
@@ -137,27 +141,41 @@ export default function toolSearchExtension(pi: ExtensionAPI) {
 		requestSent = true;
 	});
 
+	// Every tool_search load of this session (call id → names), seeded from the
+	// transcript at session_start and extended by each load: the wire hook needs
+	// it to reference a loaded tool from the result that loaded it.
+	let loads = new Map<string, string[]>();
+	// The loads a resumed session's transcript already holds (empty after
+	// /clear). The transcript tells the model those tools are callable, and
+	// Claude Code keeps a ToolSearch-loaded tool callable across a resume (its
+	// tool_reference blocks stay in the history), so deferring them again would
+	// send the model into a "Tool <name> not found" round trip. pi restores them
+	// as active from the transcript before session_start; deferAll and the
+	// late-defer handler leave those alone. A load made during this session
+	// activates the tool directly and never needs this set.
+	let loadedBefore = new Set<string>();
+
 	// On models that take client-side tool references (first-party Claude >= 4.5,
-	// not Haiku) every deferred tool rides every Anthropic request as a
-	// `defer_loading: true` definition from request 1, so `tools` never changes
-	// when tool_search loads one. Anthropic keeps deferred definitions out of the
-	// cached prefix, but adding one mid-session still re-cached the whole message
-	// history (lib/deferred.ts withDeferredToolDefinitions has the measurement);
-	// unloaded deferred definitions cost no input tokens, so this is free.
+	// not Haiku) the `tools` array is held byte-identical to request 1's: every
+	// deferred tool rides every Anthropic request as a `defer_loading: true`
+	// definition, and a tool that tool_search loaded — which pi 0.86 promotes into
+	// the eager list, re-caching everything from the tools block down — is
+	// demoted back to deferred and loaded through `tool_reference` blocks in the
+	// tool_search result that activated it (lib/deferred.ts stabilizeDeferredTools
+	// has the rules; docs/decisions/caching.md the measurements).
 	pi.on("before_provider_request", (event, ctx) => {
 		if (!supportsToolReferences(ctx.model as { provider?: string; id?: string } | undefined)) return undefined;
 		if (!looksLikeAnthropicRequest(event.payload)) return undefined;
-		return withDeferredToolDefinitions(event.payload as Record<string, unknown>, pi.getAllTools(), (name) =>
-			deferredRegistry.has(name),
-		);
+		return stabilizeDeferredTools(event.payload as Record<string, unknown>, pi.getAllTools(), (name) => deferredRegistry.has(name), loads);
 	});
 
-	/** Deactivate every deferred-registry tool and announce the loadable set. */
+
+	/** Deactivate every deferred-registry tool the transcript has not loaded, and announce the loadable set. */
 	const deferAll = () => {
 		const deferred = new Set(deferredRegistry.names);
 		if (deferred.size === 0) return;
 		const active = pi.getActiveTools();
-		const next = active.filter((name) => !deferred.has(name));
+		const next = active.filter((name) => !deferred.has(name) || loadedBefore.has(name));
 		if (next.length !== active.length) pi.setActiveTools(next);
 		announce();
 	};
@@ -167,11 +185,11 @@ export default function toolSearchExtension(pi: ExtensionAPI) {
 		deferredRegistry.add(request);
 		// A defer arriving after the session_start pass (MCP servers connect
 		// asynchronously and register their tools then) would otherwise leave the
-		// tool eager AND unlisted in the reminder. Deactivate it and refresh the
-		// keyed reminder.
+		// tool eager AND unlisted in the reminder. Deactivate it (unless the
+		// transcript loaded it) and refresh the keyed reminder.
 		if (sessionStarted && request?.name) {
 			const active = pi.getActiveTools();
-			if (active.includes(request.name)) {
+			if (active.includes(request.name) && !loadedBefore.has(request.name)) {
 				pi.setActiveTools(active.filter((name) => name !== request.name));
 			}
 			// The tool is searchable (keyword search reads the registry) from now;
@@ -180,12 +198,14 @@ export default function toolSearchExtension(pi: ExtensionAPI) {
 		}
 	});
 
-	pi.on("session_start", () => {
+	pi.on("session_start", (_event, ctx) => {
 		sessionStarted = true;
 		// A pending debounce belongs to the previous session's listing (RPC's
 		// new_session emits session_start twice, findings §3); deferAll below
 		// announces the fresh one.
 		clearAnnounce();
+		loads = toolSearchLoads(ctx?.sessionManager?.getBranch?.() ?? []);
+		loadedBefore = new Set([...loads.values()].flat());
 		// A new session (/clear, or a resume in a new process) has no cached prefix
 		// yet: its first request gets a freshly written listing.
 		requestSent = false;
@@ -229,7 +249,7 @@ export default function toolSearchExtension(pi: ExtensionAPI) {
 				Type.Integer({ minimum: 1, maximum: 20, description: "Maximum tools to load (default 5)" }),
 			),
 		}),
-		async execute(_toolCallId, params) {
+		async execute(toolCallId, params) {
 			const available = searchableTools();
 			const matches = searchTools(params.query, available, params.max_results ?? 5);
 
@@ -261,6 +281,7 @@ export default function toolSearchExtension(pi: ExtensionAPI) {
 			const added = matches.map((m) => m.name).filter((name) => !active.includes(name));
 			if (added.length > 0) {
 				pi.setActiveTools([...new Set([...active, ...added])]);
+				loads.set(toolCallId, added);
 			}
 
 			const loaded = matches.map((m) => m.name);
@@ -279,9 +300,9 @@ export default function toolSearchExtension(pi: ExtensionAPI) {
 		},
 	});
 
-	pi.registerCommand("tools-deferred", {
+	registerLocalCommand(pi, "tools-deferred", {
 		description: "Show which tools are deferred (loadable via tool_search)",
-		handler: async (_args, ctx) => {
+		handler: async (args, ctx) => {
 			const available = searchableTools();
 			const activeSet = new Set(pi.getActiveTools());
 			const lines = available.map((t) => `${activeSet.has(t.name) ? "loaded " : "deferred"} ${t.name}`);

package/extensions/workflow/agent-session.ts

@@ -21,7 +21,7 @@ import type { Api, Model } from "@earendil-works/pi-ai";
 import { Type } from "typebox";
 import { whenAborted } from "../lib/abort.ts";
 import { createSharedModelRuntime, finalAssistantText, openChildSession } from "../lib/agent-loader.ts";
-import { modelSpec as modelSpecOf } from "../lib/model-policy.ts";
+import { modelSpec as modelSpecOf, supportsImageInput } from "../lib/model-policy.ts";
 import { isModelUnavailableError } from "../auto-mode/model-select.ts";
 import { agentPromptIdentity, PrefixWarmGate, prefixWarmKey } from "../lib/prefix-warm-gate.ts";
 import type { PermissionBridge } from "../permissions/subagent-gate.ts";
@@ -145,22 +145,24 @@ export function resolveWorkflowAgentModel(input: WorkflowModelInput): {
 		configuredDefault: input.configuredDefault,
 		sessionModel: input.sessionModel,
 		available: input.available,
+		requireImageInput: supportsImageInput(input.sessionModel),
 	});
 	if (resolution.unresolved) {
 		const fallback = resolveSubagentModel({
 			configuredDefault: input.configuredDefault,
 			sessionModel: input.sessionModel,
 			available: input.available,
+			requireImageInput: supportsImageInput(input.sessionModel),
 		});
 		const menu = subagentModelMenu({
 			available: input.available,
 			sessionModel: input.sessionModel,
 			defaultModel: fallback.model,
 			defaultSource: fallback.source,
+			requireImageInput: supportsImageInput(input.sessionModel),
 		});
-		throw new WorkflowScriptError(
-			`agent() model "${resolution.unresolved}" is not available.\n${menu.join("\n")}\nAny exact provider/model-id also resolves.`,
-		);
+		const reason = resolution.unresolvedReason ?? `agent() model "${resolution.unresolved}" is not available.`;
+		throw new WorkflowScriptError(`${reason}\n${menu.join("\n")}\nAny exact provider/model-id also resolves.`);
 	}
 	const gate = expensiveModelGate(resolution, input.sessionModel, input.opts.allowExpensive);
 	if (gate) {

package/extensions/workflow/index.ts

@@ -26,7 +26,7 @@ import { Type } from "typebox";
 import { recordUsage } from "../lib/usage-bus.ts";
 import { MODEL_UNUSABLE_CHANNEL, type ModelUnusableEvent } from "../lib/model-unusable.ts";
 import { whenAborted } from "../lib/abort.ts";
-import { createTaskNotifier, oneShotNote, sessionOutlivesTurn } from "../lib/notifications.ts";
+import { createTaskNotifier, oneShotNote, sessionOutlivesTurn, taskNotification, taskStatusOf, workflowSummary } from "../lib/notifications.ts";
 import { REMINDER_CHANNEL } from "../lib/reminders.ts";
 import { ULTRACODE_MODE_CHANNEL } from "../effort/slider.ts";
 import { PERMISSION_STATUS_CHANNEL } from "../permissions/modes.ts";
@@ -54,6 +54,7 @@ import {
 	type ViewerRunSnapshot,
 } from "./viewer.ts";
 import { WorkflowWidget } from "./widget.ts";
+import { registerLocalCommand } from "../lib/local-command.ts";
 
 /**
  * Claude Code's own arming reminder, verbatim in intent: the keyword is a
@@ -231,11 +232,32 @@ export default function workflowExtension(pi: ExtensionAPI) {
 		}
 	};
 
+	/** The tool call that started each background run — the notification's `<tool-use-id>`. */
+	const startedBy = new Map<string, string>();
 	const deliverResult = (runId: string) => {
+		// One delivery per run, so the id is spent here even when the run has
+		// already gone from the manager or was delivered another way.
+		const toolUseId = startedBy.get(runId);
+		startedBy.delete(runId);
 		const handle = manager.get(runId);
 		if (!handle || deliveredRuns.has(runId)) return;
 		deliveredRuns.add(runId);
-		notifyTask("one-code:workflow-result", buildRunReport(handle), { runId: handle.runId, name: handle.meta.name, status: handle.status });
+		// CC's kind=workflow task notification; the run report (result or the
+		// failure and how to resume) is its `<result>`. Summary literal: see
+		// workflowSummary — unverified against CC.
+		const status = taskStatusOf(handle.status);
+		notifyTask(
+			"one-code:workflow-result",
+			taskNotification({
+				kind: "workflow",
+				taskId: handle.runId,
+				toolUseId,
+				status,
+				summary: workflowSummary(handle.meta.name, status, status === "completed" ? undefined : handle.errorMessage),
+				result: buildRunReport(handle),
+			}),
+			{ runId: handle.runId, name: handle.meta.name, status: handle.status },
+		);
 	};
 
 	pi.registerMessageRenderer("one-code:workflow-result", (message, { expanded }, theme) =>
@@ -260,7 +282,7 @@ export default function workflowExtension(pi: ExtensionAPI) {
 		description: WORKFLOW_TOOL_DESCRIPTION,
 		promptSnippet: "Run a script that orchestrates many subagents (opt-in ultracode mode)",
 		parameters: WorkflowParams,
-		async execute(_toolCallId, params, signal, onUpdate, ctx) {
+		async execute(toolCallId, params, signal, onUpdate, ctx) {
 			lastCtx = ctx;
 			const sessionDir = ctx.sessionManager.getSessionDir();
 
@@ -345,6 +367,7 @@ export default function workflowExtension(pi: ExtensionAPI) {
 					};
 				}
 
+				startedBy.set(handle.runId, toolCallId);
 				void handle.finished.then(() => deliverResult(handle.runId));
 				return {
 					content: [
@@ -353,7 +376,7 @@ export default function workflowExtension(pi: ExtensionAPI) {
 							text:
 								`Workflow **${handle.meta.name}** ${handle.resumed ? "resumed" : "started"} in the background.\n` +
 								`runId: ${handle.runId}\nscript: ${handle.scriptPath}\n` +
-								"The result will arrive as a follow-up message when the run finishes. " +
+								"The result will arrive as a task notification when the run finishes. " +
 								"You know nothing about its outcome until then — do not predict it. " +
 								"The user can watch with /workflows and stop with /workflows stop.",
 						},
@@ -370,7 +393,7 @@ export default function workflowExtension(pi: ExtensionAPI) {
 		},
 	});
 
-	pi.registerCommand("workflows", {
+	registerLocalCommand(pi, "workflows", {
 		description: "Open the workflow viewer; list, stop, or inspect runs",
 		getArgumentCompletions: (prefix) => {
 			const items = ["stop ", "log ", "list"].filter((c) => c.startsWith(prefix));

package/extensions/worktree/guards.ts

@@ -26,7 +26,8 @@
  */
 
 import { homedir } from "node:os";
-import { isWithin, toAbsolute } from "../auto-mode/paths.ts";
+import { isAbsolute } from "node:path";
+import { isWithin, toAbsoluteBash } from "../auto-mode/paths.ts";
 import { gitSubcommand, leadTokens, parseCommand, resolvePayload, type Token } from "../auto-mode/shell-analysis.ts";
 
 export interface WorktreeGuardContext {
@@ -124,8 +125,8 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 			else if (hasExpansion(target) || target === "-") dir = undefined;
 			// An absolute (or ~) destination re-anchors the tracked directory
 			// even when it was unknown — later git commands become checkable again.
-			else if (target.startsWith("/") || target === "~" || target.startsWith("~/")) dir = toAbsolute("/", target, homedir());
-			else if (dir !== undefined) dir = toAbsolute(dir, target, homedir());
+			else if (isAbsolute(target) || target === "~" || target.startsWith("~/")) dir = toAbsoluteBash("/", target, homedir());
+			else if (dir !== undefined) dir = toAbsoluteBash(dir, target, homedir());
 			return undefined;
 		}
 		if (rawLead === "pushd" || rawLead === "popd") {
@@ -179,7 +180,7 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 						`Use literal paths inside ${worktreePath} instead.`,
 					);
 				}
-				const resolved = toAbsolute(effective, raw, homedir());
+				const resolved = toAbsoluteBash(effective, raw, homedir());
 				if (value === "-C") effective = resolved;
 				else extraTargets.push(resolved);
 				i += inlined ? 1 : 2;

package/extensions/worktree/index.ts

@@ -20,6 +20,7 @@ import { Type } from "typebox";
 import { restoreLatestDetails } from "../lib/branch-restore.ts";
 import { DEFER_CHANNEL } from "../lib/deferred.ts";
 import { REMINDER_CHANNEL } from "../lib/reminders.ts";
+import { WORKTREE_CHANNEL, type WorktreeLocation } from "../lib/worktree-channel.ts";
 import { worktreeBashGuardReason } from "./guards.ts";
 import { ORIGINAL_COMMAND_CHANNEL, type OriginalCommandRecord } from "../lib/original-command.ts";
 import { rewriteToolInput, validateWorktreeName } from "./rewrite.ts";
@@ -67,6 +68,8 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 
 	const applyState = (next: WorktreeState | undefined) => {
 		state = next;
+		const location: WorktreeLocation | null = next ? { path: next.path, branch: next.branch } : null;
+		pi.events.emit(WORKTREE_CHANNEL, location);
 		if (next) {
 			pi.events.emit(REMINDER_CHANNEL, {
 				text: reminderFor(next),
@@ -145,10 +148,20 @@ export default function worktreeExtension(pi: ExtensionAPI) {
 				const known = await listWorktreePaths(ctx.cwd);
 				const target = known.find((p) => p === params.path);
 				if (!target) return fail(`${params.path} is not a worktree of this repository. Known worktrees:\n${known.join("\n")}`);
-				const next: WorktreeState = { path: target, createdByUs: false, originalCwd: ctx.cwd, sharedRoot: repoRoot };
+				// The branch is display-only here (footer, reminder): a detached HEAD
+				// leaves it unset silently, a failing git is reported in the result text.
+				let branch: string | undefined;
+				let branchNote = "";
+				try {
+					const ref = await git(["rev-parse", "--abbrev-ref", "HEAD"], target);
+					if (ref && ref !== "HEAD") branch = ref;
+				} catch (error) {
+					branchNote = ` Its branch could not be read (${(error as Error).message.split("\n")[0]}).`;
+				}
+				const next: WorktreeState = { path: target, branch, createdByUs: false, originalCwd: ctx.cwd, sharedRoot: repoRoot };
 				applyState(next);
 				return {
-					content: [{ type: "text", text: `Switched into existing worktree ${target}. All work now happens there; exit_worktree returns to ${ctx.cwd}.` }],
+					content: [{ type: "text", text: `Switched into existing worktree ${target}${branch ? ` (branch ${branch})` : ""}.${branchNote} All work now happens there; exit_worktree returns to ${ctx.cwd}.` }],
 					details: { worktreeState: next } satisfies WorktreeDetails,
 				};
 			}

package/extensions/worktree/rewrite.ts

@@ -20,6 +20,11 @@ export function shellQuote(path: string): string {
 	return `'${path.replace(/'/g, "'\\''")}'`;
 }
 
+/** PowerShell single-quoted literal: only `'` needs escaping, as `''`. */
+export function powershellQuote(path: string): string {
+	return `'${path.replace(/'/g, "''")}'`;
+}
+
 
 /**
  * Mutates `input` in place so the call runs inside the worktree. For bash,
@@ -46,6 +51,18 @@ export function rewriteToolInput(
 		}
 		return {};
 	}
+	if (toolName === "powershell") {
+		// `Set-Location -LiteralPath` takes the path verbatim (no wildcard
+		// expansion); `;` chains regardless of edition (`&&` is pwsh-7-only), and a
+		// failed Set-Location is a terminating error under -NonInteractive, so the
+		// command does not run in the wrong directory.
+		if (typeof input.command === "string") {
+			const originalCommand = input.command;
+			input.command = `Set-Location -LiteralPath ${powershellQuote(worktreePath)} -ErrorAction Stop; ${originalCommand}`;
+			return { originalCommand };
+		}
+		return {};
+	}
 	if (!PATH_TOOLS.has(toolName)) return {};
 
 	// Rewrite whichever field carries the path — `path` for pi's built-ins,