one-code-extension 0.4.1 → 0.6.0

package/extensions/init/prompt.ts

@@ -1,40 +1,33 @@
 /**
- * The `/init` prompt — adapted from Claude Code's `/init`, kept provider-neutral
- * (One Code writes a CLAUDE.md that any Claude Code-compatible agent reads) and
- * self-contained (no dependency on CC-internal skills like `update-config`).
+ * The `/init` prompt: Claude Code's classic one, the prompt it sends by
+ * default, submitted verbatim as a user turn by extensions/init/index.ts.
  *
- * Submitted verbatim as a user turn by extensions/init/index.ts; the model does
- * the work with the normal tool set (subagent survey, ask_user_question, write).
+ * Three adaptations. The CLAUDE.md it writes is read by every Claude
+ * Code-compatible agent, One Code included, so the opening sentence and the
+ * file's header name AI coding agents rather than one product (the header is
+ * the one One Code's /init has always written). And the rules to fold in
+ * include an AGENTS.md: One Code reads a directory's AGENTS.md only when that
+ * directory has no CLAUDE.md, so once /init writes one, anything left in
+ * AGENTS.md alone would stop reaching the model.
  */
-export const INIT_PROMPT = `Analyze this codebase and set up a concise CLAUDE.md at the repository root, to be loaded into every future session working here. Keep it minimal — every line must earn its place: include only what an agent would get wrong or waste time rediscovering without it.
-
-## 1. Survey the codebase
-Launch an Explore subagent (or read directly if the repo is small) to gather:
-- Build, test, and lint commands — especially non-standard scripts, flags, or how to run a *single* test.
-- Languages, frameworks, package manager, and whether this is a monorepo/multi-module or single project.
-- High-level architecture that requires reading several files to grasp (the "big picture", not a file listing).
-- Non-obvious gotchas, required env vars, or workflow quirks.
-- Existing AI-tool config to fold in: an existing CLAUDE.md, AGENTS.md, .cursor/rules or .cursorrules, .github/copilot-instructions.md, .windsurfrules, .clinerules — and the important parts of README.md.
-
-## 2. Fill the gaps
-Use ask_user_question only for things the code cannot answer — branch/PR conventions, required setup, testing quirks, communication preferences. Skip anything already obvious from manifests or the README. Do not mark options as "recommended": this is how their team works, not best practices.
-
-## 3. Write CLAUDE.md
-Prefix the file with:
+export const INIT_PROMPT = `Please analyze this codebase and create a CLAUDE.md file, which will be given to future AI coding agents (Claude Code and compatible tools) to operate in this repository.
+
+What to add:
+1. Commands that will be commonly used, such as how to build, lint, and run tests. Include the necessary commands to develop in this codebase, such as how to run a single test.
+2. High-level code architecture and structure so that future instances can be productive more quickly. Focus on the "big picture" architecture that requires reading multiple files to understand.
+
+Usage notes:
+- If there's already a CLAUDE.md, suggest improvements to it.
+- When you make the initial CLAUDE.md, do not repeat yourself and do not include obvious instructions like "Provide helpful error messages to users", "Write unit tests for all new utilities", "Never include sensitive information (API keys, tokens) in code or commits".
+- Avoid listing every component or file structure that can be easily discovered.
+- Don't include generic development practices.
+- If there are Cursor rules (in .cursor/rules/ or .cursorrules), Copilot rules (in .github/copilot-instructions.md) or an AGENTS.md, make sure to include the important parts.
+- If there is a README.md, make sure to include the important parts.
+- Do not make up information such as "Common Development Tasks", "Tips for Development", "Support and Documentation" unless this is expressly included in other files that you read.
+- Be sure to prefix the file with the following text:
 
 \`\`\`
 # CLAUDE.md
 
 This file gives guidance to AI coding agents (Claude Code and compatible tools) working in this repository.
-\`\`\`
-
-Include: build/test/lint commands an agent can't guess; code-style rules that DIFFER from language defaults; testing instructions and quirks; repo etiquette (branch naming, PR/commit conventions); required env vars or setup; non-obvious gotchas and architectural decisions; the important parts of any existing AI-tool config.
-
-Exclude: file-by-file structure or component lists (discoverable by reading); standard language conventions; generic advice ("write clean code", "handle errors"); long references or API docs (link them with \`@path/to/file\` import syntax instead of inlining); anything that changes frequently (reference the source with \`@path\`).
-
-Be specific — "Use 2-space indentation in TypeScript" beats "format code properly." Do not repeat yourself and do not invent sections like "Common Development Tasks" — only include what you actually found.
-
-If a CLAUDE.md already exists: read it, propose concrete improvements as diffs, and explain each. Do NOT silently overwrite. For projects with distinct subdirectories (monorepos), mention that per-directory CLAUDE.md files are loaded automatically when working in those directories, and offer to create them.
-
-## 4. Recap
-Summarize which file(s) you wrote and the key points in each. Remind the user this is a starting point to review and tweak, and that they can run \`/init\` again anytime to re-scan.`;
+\`\`\``;

package/extensions/interrupted/index.ts

@@ -11,11 +11,13 @@
  * InterruptedByUser component. The paired turn-duration line suppresses itself
  * on the same signal, so an interrupted turn shows this note in place of the
  * "Cooked for …" line — CC's behaviour (its turn-duration render is gated on
- * `!aborted`).
+ * `!aborted`). A send now (ctrl+x ctrl+s, the send-now extension) aborts the
+ * turn too, but gets no note: the user has already said what to do instead.
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { wasInterrupted } from "../lib/interrupt.ts";
+import { SEND_NOW_CHANNEL } from "../lib/send-now-channel.ts";
 import { linesComponent, safeThemePaint } from "../lib/tui-render.ts";
 import { INTERRUPTED_TEXT } from "./line.ts";
 
@@ -27,7 +29,17 @@ export default function interruptedExtension(pi: ExtensionAPI) {
 		return linesComponent(() => [paint("dim", INTERRUPTED_TEXT)]);
 	});
 
+	// Send now aborts the turn to deliver the queued messages: the user has
+	// already said what to do instead, so that abort gets no note.
+	let sendingNow = false;
+	pi.events.on(SEND_NOW_CHANNEL, () => {
+		sendingNow = true;
+	});
+
 	pi.on("agent_end", (event, ctx) => {
+		const skip = sendingNow;
+		sendingNow = false;
+		if (skip) return;
 		if (!ctx.hasUI) return;
 		if (!wasInterrupted(event.messages, ctx.signal?.aborted)) return;
 		pi.appendEntry(ENTRY_TYPE);

package/extensions/kept-thinking/index.ts

@@ -0,0 +1,27 @@
+/**
+ * kept-thinking extension — removes thinking from the turns a compaction keeps,
+ * on APIs that check a thinking block's signature against the conversation
+ * before it (`compaction/kept-thinking.ts` says why and which turns).
+ *
+ * The boundary comes from the session branch, not from the request's messages:
+ * system-reminder rewrites the compaction summary message into a plain user
+ * message, so a strip keyed on it found nothing (seen live on Opus 5.5: every
+ * request after the compaction was a 400). It is the first `context` hook in
+ * the package manifest, before every extension that captures the request's
+ * messages for a side call (skill, background, subagents, recap, btw,
+ * compaction), so each capture carries the stripped history the session sent.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { signsThinking, withoutKeptThinking } from "../compaction/kept-thinking.ts";
+import { latestCompaction } from "../lib/compaction-boundary.ts";
+
+export default function keptThinkingExtension(pi: ExtensionAPI) {
+	pi.on("context", (event, ctx) => {
+		const api = ctx.model?.api;
+		// Only a signing API pays for the branch walk.
+		if (!signsThinking(api)) return undefined;
+		const messages = withoutKeptThinking(event.messages, api, latestCompaction(ctx.sessionManager.getBranch())?.time);
+		return messages ? { messages } : undefined;
+	});
+}

package/extensions/ledger/index.ts

@@ -0,0 +1,46 @@
+/**
+ * ledger extension, the request side of the record-once design
+ * (working-docs/features/lifecycle-grid-hunt/design.md sections 2 and 5): the
+ * request is a pure function of the branch. Every request is recorded on the
+ * branch as it went on the wire (`ledger/wire.ts`, the payload side), and the
+ * next request inside the same epoch takes every byte above its append point
+ * from that record instead of from a rebuild.
+ *
+ * Its `context` hook runs right after kept-thinking, before anything injects:
+ *
+ * - it folds the branch (lib/ledger/fold.ts, through the shared memo in
+ *   lib/ledger/fold-memo.ts) and decides whether this request
+ *   opens an epoch (lib/ledger/plan.ts planRequest);
+ * - inside an epoch it cuts the messages the last request covered, so pi and
+ *   every later `context` hook see only the tail, and the payload side puts
+ *   the recorded list in front of what pi renders for it;
+ * - it publishes the plan on LEDGER_PLAN_CHANNEL for the renderer
+ *   (system-reminder) and the payload side.
+ *
+ * Resume, `/reload`, `/fork` and `/tree` need no restore code: each folds a
+ * different branch. pi keeps a `/tree` move only in memory, so `session_tree`
+ * appends a `one-code:branch` record, which makes the selected leaf the one a
+ * reopened file resumes on.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { sessionIdentity } from "../lib/anthropic-auth.ts";
+import { foldSession } from "../lib/ledger/fold-memo.ts";
+import { LEDGER_PLAN_CHANNEL, planRequest } from "../lib/ledger/plan.ts";
+import { makeRecord, RECORD } from "../lib/ledger/records.ts";
+import { extensionVersion } from "../lib/package-version.ts";
+
+export default function ledgerExtension(pi: ExtensionAPI) {
+	const by = extensionVersion();
+
+	pi.on("session_tree", (event) => {
+		pi.appendEntry(RECORD.branch, makeRecord("branch", by, { fromLeafId: event.oldLeafId ?? "" }));
+	});
+
+	pi.on("context", (event, ctx) => {
+		const fold = foldSession(ctx.sessionManager, sessionIdentity(pi, ctx.model));
+		const { plan, tailStart } = planRequest(fold, event.messages as Array<{ role: string; timestamp?: number }>);
+		pi.events.emit(LEDGER_PLAN_CHANNEL, plan);
+		return tailStart > 0 ? { messages: event.messages.slice(tailStart) } : undefined;
+	});
+}

package/extensions/ledger/wire.ts

@@ -0,0 +1,154 @@
+/**
+ * ledger-wire extension, the payload side of the ledger (extensions/ledger/index.ts
+ * has the request side and the design). Its `before_provider_request` hook
+ * runs after every hook that shapes the tail (system-reminder's layout,
+ * tool-search, context-management) and before cache-marks:
+ *
+ * 1. Inside an epoch it splices: the base request's recorded list, then pi's
+ *    rendering of the tail, under the recorded system prompt and tools, with
+ *    tools added mid-epoch appended (lib/ledger/wire.ts spliceRequest).
+ * 2. It settles the layout (lib/ledger/layout.ts: no system message stranded
+ *    before a user message) and validates the request (lib/ledger/validate.ts): no reference to an
+ *    undeclared tool, no system message stranded before a user message. A
+ *    problem is a bug; it is dropped and reported, so it costs one block,
+ *    never a 400. ONE_CODE_LEDGER_STRICT=1 sends it unrepaired instead, for
+ *    the live probes to see.
+ * 3. It records the request as a delta against the fold's base (the request
+ *    the fold rebuilds it on), with the pending items it carried and what its
+ *    new blocks told the model, and publishes it (LEDGER_SENT_CHANNEL) for
+ *    the side calls that replay it (compaction's summarizer, btw, recap,
+ *    forks).
+ *
+ * A pi cache warm never records or publishes: it is not a request the model
+ * answers. pi sends it through the same hooks with the warm cap, under the
+ * plan of the request it warms, in a provider call of its own, so it resends
+ * that request as it went out (with the warm's cap), or after a `/reload` (no
+ * plan here: pi's context is the tail the old instance cut) the branch's last
+ * request. Every other payload follows a context pass: pi's retry runs one
+ * too, and a second payload in the call a request went out in is pi-ai's
+ * strict-tools fallback, a real re-send. The cap alone cannot tell them
+ * apart: pi-ai clamps a request's cap to the window's room, down to 1.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { sessionIdentity } from "../lib/anthropic-auth.ts";
+import { notifyOrPrint } from "../lib/headless-output.ts";
+import { foldSession } from "../lib/ledger/fold-memo.ts";
+import { LEDGER_PLAN_CHANNEL, LEDGER_SENT_CHANNEL, type LedgerSent, type RequestPlan } from "../lib/ledger/plan.ts";
+import { makeRecord, RECORD, type ToldFact } from "../lib/ledger/records.ts";
+import { deliveredAfterRepair, repairRequest, validateRequest } from "../lib/ledger/validate.ts";
+import { settlePayload } from "../lib/ledger/layout.ts";
+import { appendPoint, encodeRequest, hasWarmCap, listKey, type RecordedRequest, recordedBody, recordedRequest, samePrefix, spliceRequest, type WirePayload, withBranchToolOrder, withRequestFields } from "../lib/ledger/wire.ts";
+import { type AffinityModel, affinityHeaders } from "../lib/request-replay.ts";
+import { extensionVersion } from "../lib/package-version.ts";
+
+export default function ledgerWireExtension(pi: ExtensionAPI) {
+	const by = extensionVersion();
+	/** The plan of the last `context` pass; a warm re-runs only this hook and reuses it. */
+	let plan: RequestPlan | undefined;
+	/**
+	 * The provider call the hook runs in: pi resolves a call's headers once
+	 * (`prepareRequest`), before its first payload, so `before_provider_headers`
+	 * opens each call, a warm's included.
+	 */
+	let call = 0;
+	/** The call a request under `plan` went out in: a payload with the warm cap in a later call is a warm, in the same call pi-ai's re-send. */
+	let sentIn: number | undefined;
+	/** What this hook recorded under `plan`: the request, and the hashes it stored, so a re-send stores only new bodies. */
+	let recorded: { request: RecordedRequest; hashes: Set<string> } | undefined;
+	/** The last session request this instance sent, as it left this hook: what a warm resends. */
+	let lastSent: WirePayload | undefined;
+	/** Problems already reported this session, so a recurring bug is one notice. */
+	const reported = new Set<string>();
+
+	pi.events.on(LEDGER_PLAN_CHANNEL, (data) => {
+		plan = data as RequestPlan;
+		sentIn = undefined;
+		recorded = undefined;
+	});
+	pi.on("session_start", () => {
+		plan = undefined;
+		sentIn = undefined;
+		recorded = undefined;
+		lastSent = undefined;
+		reported.clear();
+	});
+
+	/** The session the plan's request is routed for: the one that opened the epoch, recorded with its base. */
+	const routingOf = (current: RequestPlan | undefined, own: string) => (current && !current.epoch ? (current.base?.routing ?? own) : own);
+
+	// A /fork's first request extends its parent's record, and the parent's cache
+	// lives on the host the parent's session id routed to: a gateway such as
+	// OpenRouter picks it by the session-affinity headers, which pi-ai builds
+	// from the fork's own id (R3-M22). Not on Codex, where pi-ai sets its
+	// session-id header after every hook (findings §75). With no plan in this
+	// instance (a warm after a /reload) the call resends the branch's last
+	// request, so it goes where that request was routed.
+	pi.on("before_provider_headers", (event, ctx) => {
+		call++;
+		const own = ctx.sessionManager.getSessionId();
+		const identity = plan ? undefined : sessionIdentity(pi, ctx.model);
+		const routing = plan ? routingOf(plan, own) : ((identity && foldSession(ctx.sessionManager, identity).lastRequest?.routing) ?? own);
+		if (routing === own) return;
+		Object.assign(event.headers, affinityHeaders(ctx.model as AffinityModel | undefined, routing));
+	});
+
+	pi.on("before_provider_request", (event, ctx) => {
+		const model = ctx.model;
+		const identity = sessionIdentity(pi, model);
+		if (!model || !identity) return undefined;
+		const api = model.api;
+		const live = event.payload as WirePayload;
+		const current = plan;
+
+		// A cache warm: the request it warms, as sent, under the warm's cap. A
+		// payload in the call the request went out in is pi-ai sending it again.
+		if ((!current || (sentIn !== undefined && sentIn !== call)) && hasWarmCap(live)) {
+			if (lastSent) return withRequestFields(lastSent, live);
+			const base = foldSession(ctx.sessionManager, identity).lastRequest;
+			return base ? recordedBody(base, live, api) : undefined;
+		}
+		// No context pass in this instance and not a warm: leave pi's request alone.
+		if (!current) return undefined;
+
+		let payload = live;
+		const base = current.epoch ? undefined : current.base;
+		const end = base ? appendPoint(base.list, api) : 0;
+		if (base) payload = spliceRequest(base, payload, api);
+		// An epoch renders pi's tools again, in the order the branch first declared them.
+		else payload = withBranchToolOrder(payload, current.fold.toolOrder, api);
+		const spliced = payload;
+		// The final layout pass: no system message stranded before a user message (lib/ledger/layout.ts).
+		payload = settlePayload(payload, api, listKey(api), end);
+		let delivered: { consumed: string[]; facts: ToldFact[] } = { consumed: current.consumed, facts: current.carried.flatMap((block) => block.facts) };
+
+		const problems = validateRequest(payload, api);
+		if (problems.length > 0) {
+			const fresh = problems.map((problem) => JSON.stringify(problem)).filter((key) => !reported.has(key));
+			for (const key of fresh) reported.add(key);
+			if (fresh.length > 0) notifyOrPrint(ctx, `One Code: the request had ${problems.length} problem(s) the ledger ${process.env.ONE_CODE_LEDGER_STRICT === "1" ? "left in place" : "removed"}: ${fresh.join(", ")}`, "warning");
+			if (process.env.ONE_CODE_LEDGER_STRICT !== "1") {
+				payload = repairRequest(payload, api, problems);
+				delivered = deliveredAfterRepair(payload, api, delivered, current.fold.pending, new Set(current.base?.hashes ?? []), current.carried);
+			}
+		}
+
+		// The recorded prefix is known, unless the layout pass or a repair moved its elements.
+		const request = recordedRequest(payload, identity, base && samePrefix(spliced, payload, listKey(api), end) ? { base, end } : undefined);
+		lastSent = payload;
+		sentIn = call;
+		// The same request again under this plan (pi-ai re-sending an identical body) records nothing new.
+		if (recorded && encodeRequest(recorded.request, request, { has: () => true }) === undefined) return payload === live ? undefined : payload;
+		const known = { has: (hash: string) => current.fold.knownHashes.has(hash) || recorded?.hashes.has(hash) === true };
+		const delta = encodeRequest(current.fold.lastRequest, request, known);
+		if (delta) {
+			if (current.epoch) pi.appendEntry(RECORD.epoch, makeRecord("epoch", by, { cause: current.cause ?? "first" }));
+			const routing = routingOf(current, ctx.sessionManager.getSessionId());
+			pi.appendEntry(RECORD.request, makeRecord("request", by, { ...delta, covers: current.covers, consumed: delivered.consumed, routing }));
+			if (delivered.facts.length > 0) pi.appendEntry(RECORD.told, makeRecord("told", by, { facts: delivered.facts }));
+			recorded = { request, hashes: new Set([...(recorded?.hashes ?? []), ...Object.keys(delta.blobs)]) };
+			pi.events.emit(LEDGER_SENT_CHANNEL, { payload, model, sessionId: ctx.sessionManager.getSessionId(), plan: current } satisfies LedgerSent);
+		}
+		return payload === live ? undefined : payload;
+	});
+}

package/extensions/lib/agent-cron.ts

@@ -0,0 +1,146 @@
+/**
+ * Cron jobs for subagents, Claude Code's way (findings §21): a subagent's
+ * `cron_create` stamps its task id on the job, `cron_list` shows it only its
+ * own jobs, `cron_delete` refuses another's, and a fire goes to that agent
+ * while it lives and is dropped once it has ended.
+ *
+ * Children never load the background extension, so the subagents extension
+ * gives each child proxy tools (`agentCronTools`) that reach the main
+ * session's store over the main session's bus: an `AgentCronRequest` on
+ * AGENT_CRON_CHANNEL, answered synchronously by the background extension. A
+ * fire for an agent's job goes the other way as an `AgentCronFire` on
+ * AGENT_CRON_FIRE_CHANNEL; the subagents extension sets `delivered` when the
+ * agent took it.
+ *
+ * Pure: no pi imports.
+ */
+
+import {
+	CRON_CREATE_DESCRIPTION,
+	CRON_CREATE_PARAMETERS,
+	CRON_DELETE_DESCRIPTION,
+	CRON_DELETE_PARAMETERS,
+	CRON_LIST_DESCRIPTION,
+	CRON_LIST_PARAMETERS,
+} from "../background/cron.ts";
+
+export const AGENT_CRON_CHANNEL = "one-code:agent-cron";
+export const AGENT_CRON_FIRE_CHANNEL = "one-code:agent-cron-fire";
+
+export type AgentCronRequest =
+	| { op: "create"; agentId: string; cwd: string; cron: string; prompt: string; recurring?: boolean; result?: AgentCronResult }
+	| { op: "list"; agentId: string; result?: AgentCronResult }
+	| { op: "delete"; agentId: string; id: string; result?: AgentCronResult };
+
+export interface AgentCronResult {
+	text: string;
+	isError?: boolean;
+	details?: Record<string, unknown>;
+}
+
+/**
+ * The conversation a fire lands in: its branch to read, and entries to
+ * append to it. A no-prompt `/loop` sentinel records there what it already
+ * sent, so the record follows that conversation (its `/tree`, its resume,
+ * its own compaction), not the session that owns the job store.
+ */
+export interface FireConversation {
+	getBranch(): readonly unknown[];
+	appendEntry(customType: string, data?: unknown): void;
+}
+
+export interface AgentCronFire {
+	agentId: string;
+	jobId: string;
+	/**
+	 * The text to send, resolved against the agent's own conversation (a
+	 * sentinel reads and records its delivery there; undefined resolves as a
+	 * conversation that was sent nothing). Call it once, for the send.
+	 */
+	text(conversation: FireConversation | undefined): string;
+	/** Set by the subagents extension when a live agent received it. */
+	delivered?: boolean;
+}
+
+/**
+ * cron_create's refusal in an agent that runs to completion (a nested spawn,
+ * or any spawn in a one-shot run): a fire reaches only a background agent,
+ * and this one ends first.
+ */
+export const BLOCKING_RUN_REFUSAL =
+	"Nothing was scheduled: this agent runs until its task is done and then ends, so a job it schedules could never fire. Do the work now, or report back so the main session can schedule it.";
+
+/** Claude Code's refusal when an agent deletes a job it does not own. */
+export function formatNotOwner(id: string): string {
+	return `Cannot delete cron job '${id}': owned by another agent`;
+}
+
+interface Emitter {
+	emit(channel: string, data: unknown): unknown;
+}
+
+/**
+ * Whether `agentId` owns a pending job in the main session's store (its
+ * `cron_list` count). The subagents extension keeps such an agent resident,
+ * since a fire reaches only a live one.
+ */
+export function agentOwnsCronJobs(events: Emitter, agentId: string): boolean {
+	const request: AgentCronRequest = { op: "list", agentId };
+	events.emit(AGENT_CRON_CHANNEL, request);
+	return ((request.result?.details?.jobCount as number | undefined) ?? 0) > 0;
+}
+
+/** Where a child's cron tools live: only a `resident` (background) run can receive a fire. */
+export interface AgentCronOwner {
+	agentId: string;
+	cwd: string;
+	resident: boolean;
+}
+
+/**
+ * The three cron tools for a child session, bound to its owner and the MAIN
+ * session's bus. Same names, schemas and descriptions as the main session's
+ * (background/index.ts). A run that is not resident keeps all three, as in
+ * Claude Code, but its cron_create refuses.
+ */
+export function agentCronTools(events: Emitter, { agentId, cwd, resident }: AgentCronOwner) {
+	const toolResult = (result: AgentCronResult) => ({
+		content: [{ type: "text" as const, text: result.text }],
+		details: result.details ?? {},
+		...(result.isError ? { isError: true } : {}),
+	});
+	const ask = (request: AgentCronRequest) => {
+		events.emit(AGENT_CRON_CHANNEL, request);
+		return toolResult(request.result ?? { text: "The session's cron store is not loaded; nothing was scheduled.", isError: true });
+	};
+	return [
+		{
+			name: "cron_create",
+			label: "Cron Create",
+			description: CRON_CREATE_DESCRIPTION,
+			parameters: CRON_CREATE_PARAMETERS,
+			async execute(_id: string, params: { cron: string; prompt: string; recurring?: boolean; durable?: boolean }) {
+				if (!resident) return toolResult({ text: BLOCKING_RUN_REFUSAL, isError: true });
+				return ask({ op: "create", agentId, cwd, cron: params.cron, prompt: params.prompt, recurring: params.recurring });
+			},
+		},
+		{
+			name: "cron_list",
+			label: "Cron List",
+			description: CRON_LIST_DESCRIPTION,
+			parameters: CRON_LIST_PARAMETERS,
+			async execute() {
+				return ask({ op: "list", agentId });
+			},
+		},
+		{
+			name: "cron_delete",
+			label: "Cron Delete",
+			description: CRON_DELETE_DESCRIPTION,
+			parameters: CRON_DELETE_PARAMETERS,
+			async execute(_id: string, params: { id: string }) {
+				return ask({ op: "delete", agentId, id: params.id });
+			},
+		},
+	];
+}

package/extensions/lib/agent-loader.ts

@@ -31,6 +31,7 @@ import type { PermissionBridge } from "../permissions/subagent-gate.ts";
 import { withShortCacheRetention } from "./cache-retention.ts";
 import { hookGateFactory } from "./hook-gate.ts";
 import { permissionGateFactory } from "./permission-gate.ts";
+import { releaseSideCalls } from "./side-call-run.ts";
 import { worktreeGuardFactory } from "./worktree-isolation.ts";
 
 /** The last assistant message's text (the value an agent run returns). */
@@ -113,8 +114,9 @@ export interface AgentLoaderOptions {
  * listener). A cached loader therefore broke the second child of the same
  * agent type, every SendMessage resume, every workflow agent after the first,
  * and any sibling still running when one was disposed
- * (LIFECYCLE-REVIEW-2026-09-06 H3, measured). A build costs ~3 ms once the
- * extension modules are in jiti's cache, so there is nothing to save.
+ * (LIFECYCLE-REVIEW-2026-09-06 H3, measured). A build costs ~3 ms once pi's
+ * factory cache holds the extensions for that directory (jiti itself runs
+ * with `moduleCache: false`, findings §8), so there is nothing to save.
  */
 export async function buildAgentLoader(options: AgentLoaderOptions): Promise<DefaultResourceLoader> {
 	const loader = new DefaultResourceLoader({
@@ -126,7 +128,8 @@ export async function buildAgentLoader(options: AgentLoaderOptions): Promise<Def
 			// Order is load-bearing, mirroring the main session's extension order:
 			// hooks first (a hook's updatedInput must be what every guard judges),
 			// then the worktree git-isolation guard, then the permission gate.
-			...(options.getHookBridge ? [hookGateFactory(options.getHookBridge, { agentTypeOf: options.agentTypeOf, neverGate: options.neverGate })] : []),
+			// Permission-autoallowed orchestration tools still run the user's hooks.
+			...(options.getHookBridge ? [hookGateFactory(options.getHookBridge, { agentTypeOf: options.agentTypeOf })] : []),
 			worktreeGuardFactory(options.cwd),
 			permissionGateFactory(options.cwd, os.homedir(), options.neverGate, options.getPermissionBridge),
 			...(options.extraFactories ?? []),
@@ -181,3 +184,15 @@ export async function openChildSession(options: OpenChildSessionOptions): Promis
 	await session.bindExtensions({ onError: options.onError });
 	return session;
 }
+
+/**
+ * Dispose a child opened by openChildSession. `dispose()` never emits
+ * `session_shutdown`, so the child's side-call keys (its web_fetch reader),
+ * which that event releases in a main session, are released here
+ * (lib/side-call-run.ts).
+ */
+export function disposeChildSession(session: AgentSession): void {
+	const sessionId = session.sessionManager.getSessionId();
+	session.dispose();
+	releaseSideCalls(sessionId);
+}

package/extensions/lib/agent-view.ts

@@ -0,0 +1,85 @@
+/**
+ * The agent view's shared half: while the user views an agent (the subagents
+ * panel's Enter-to-view), the editor targets that agent, as Claude Code
+ * 2.1.283's does (findings §40). A label sits on the editor's top border, the
+ * empty editor shows `Message @<label>…`, and what the user submits goes to
+ * the agent in Claude Code's mid-turn wrapper. The subagents extension owns
+ * the view and announces it over `AGENT_VIEW_CHANNEL`; the branding extension
+ * owns the editor and paints it (extensions share no module state).
+ */
+
+import { fitPainted, visibleWidth } from "./text-width.ts";
+import { cutPlainText } from "./tui-render.ts";
+
+/** `{ target }` while an agent is viewed, `{}` when the view returns to main. */
+export const AGENT_VIEW_CHANNEL = "one-code:agent-view";
+
+export interface AgentViewTarget {
+	/** The top-border label: `@<name>` for a fork, the run's description otherwise. */
+	badge: string;
+	/** The empty editor's placeholder: `Message @<name or agent type>…`. */
+	placeholder: string;
+}
+
+export interface AgentViewAnnouncement {
+	target?: AgentViewTarget;
+}
+
+/** The slice of a live run the target is built from. */
+export interface ViewedRun {
+	name: string;
+	agentType: string;
+	label: string;
+}
+
+/**
+ * The editor target for a viewed run, Claude Code's shapes: a fork shows
+ * `@what-word-is` on the border and `Message @what-word-is…`; a regular agent
+ * shows its description on the border and `Message @general-purpose…`.
+ */
+export function agentViewTarget(run: ViewedRun, fork: boolean): AgentViewTarget {
+	const handle = fork ? run.name : run.agentType;
+	return { badge: fork ? `@${run.name}` : run.label, placeholder: `Message @${handle}…` };
+}
+
+/**
+ * Claude Code's wrapper for a message the user types at an agent, idle or
+ * running (findings §40), verbatim.
+ */
+export function userMessageForAgent(text: string): string {
+	return `The user sent a new message while you were working:\n${text}\n\nThis is how Claude Code surfaces messages the user sends mid-turn — within the running turn, often alongside the next tool result, rather than as a separate conversation turn. Address the message above as you continue this turn.`;
+}
+
+const USER_MESSAGE_OPENER = "The user sent a new message while you were working:\n";
+const USER_MESSAGE_CLOSER = "\n\nThis is how Claude Code surfaces messages the user sends mid-turn";
+
+/** The user's own text inside `userMessageForAgent`'s wrapper, or undefined for any other prompt. */
+export function unwrapUserMessage(prompt: string): string | undefined {
+	if (!prompt.startsWith(USER_MESSAGE_OPENER)) return undefined;
+	const end = prompt.lastIndexOf(USER_MESSAGE_CLOSER);
+	return end < USER_MESSAGE_OPENER.length ? undefined : prompt.slice(USER_MESSAGE_OPENER.length, end);
+}
+
+/**
+ * Draw `badge` (already painted, padding included, `badgeWidth` columns) at the
+ * right end of the editor's top border, followed by one border glyph:
+ * `─── @name ─`. The rest of the border, and anything pi embeds at its left
+ * (the working status), keeps its paint. No-op when the border is too narrow.
+ */
+export function applyBorderBadge(lines: string[], badge: string, badgeWidth: number, borderGlyph: string): string[] {
+	const top = lines[0];
+	if (top === undefined) return lines;
+	const width = visibleWidth(top);
+	const tail = badgeWidth + 1;
+	if (width < tail + 4) return lines;
+	const head = fitPainted(top, width - tail).text;
+	const out = lines.slice();
+	out[0] = `${head}\x1b[0m${badge}${borderGlyph}`;
+	return out;
+}
+
+/** The label cut to fit a border of `width` columns, keeping room for the border itself. */
+export function fitBadge(label: string, width: number): string {
+	const room = Math.floor(width / 2) - 3;
+	return room <= 1 ? "" : cutPlainText(label, room);
+}