pi-better-harness 0.12.2 → 0.13.0

package/README.md

@@ -60,6 +60,27 @@ Sandbox state is human-only: `/sandbox`, `/sandbox on`, `/sandbox off`,
 commands with no tool equivalent. `/sandbox off` and `/sandbox default off`
 need interactive confirmation. Full policy: [pi-better-sandbox](https://github.com/1aboveio/pi-better-harness/tree/main/packages/pi-better-sandbox#readme).
 
+## Minimal Tool Output
+
+The bundled harness also provides `/tool-output minimal`, `/tool-output normal`,
+and `/tool-output` (toggle). Minimal mode hides every collapsed result body,
+including built-in, extension, and MCP text/images, without changing execution,
+sandboxing, or agent-facing payloads. Tool headers and error coloring remain;
+Ctrl+O reveals results, and fullscreen Pi versions with clickable tool rows
+also support clicking headers.
+
+Normal mode is the default. The preference is saved in the current session,
+including resume/reload. This is a version-sensitive internal TUI adapter,
+tested with Pi 0.82.1 and 0.99.1; incompatible APIs produce a warning and leave
+ordinary output enabled. Print/RPC output and exported transcripts are unchanged.
+
+The standalone-package installer does not install this bundled extension.
+Load the bundled harness or run it directly from a checkout:
+
+```sh
+pi -e ./packages/pi-better-harness/extensions/minimal-output/index.ts
+```
+
 ## When To Use
 
 Use the installer when you want every core extension with standalone package identities. Install an individual package instead when you only need the sandbox, subagents, shell task supervision, synchronous SSH, goal tracking, or plans.

package/extensions/minimal-output/hook.ts

@@ -0,0 +1,149 @@
+import { readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+interface ToolComponent {
+  expanded: boolean;
+  showImages: boolean;
+  resultRendererComponent?: unknown;
+  ui: { requestRender(): void };
+  invalidate(): void;
+  setExpanded(expanded: boolean): void;
+}
+
+type Method = (this: ToolComponent, ...args: unknown[]) => unknown;
+interface ToolPrototype {
+  updateDisplay: Method;
+  getResultRenderer: Method;
+  getTextOutput: Method;
+  setExpanded: Method;
+  invalidate: Method;
+  [HOOK]?: HookState;
+}
+interface HookState {
+  enabled: boolean;
+  owners: number;
+  redraw(collapse?: boolean): void;
+  restore(): void;
+}
+export interface MinimalOutputHook {
+  setEnabled(enabled: boolean): void;
+  dispose(): void;
+}
+
+const HOOK = Symbol.for("pi-better-harness.minimal-output-hook");
+const emptyResult = () => ({ render: () => [] as string[], invalidate() {} });
+
+/** Resolve the running host's SDK, not a second SDK bundled beside the extension. */
+export async function loadToolPrototype(): Promise<ToolPrototype> {
+  let require = createRequire(import.meta.url);
+  if (process.argv[1]) {
+    try {
+      const hostRequire = createRequire(realpathSync(process.argv[1]));
+      sdkEntry(hostRequire);
+      require = hostRequire;
+    } catch { /* SDK embedding or a test runner: use the extension's SDK. */ }
+  }
+  const entry = sdkEntry(require);
+  const path = join(dirname(entry), "modes/interactive/components/tool-execution.js");
+  const module = await import(pathToFileURL(path).href);
+  return module.ToolExecutionComponent.prototype;
+}
+
+// Pi's ESM-only export cannot be resolved with require.resolve on older SDKs.
+function sdkEntry(require: ReturnType<typeof createRequire>): string {
+  for (const directory of require.resolve.paths("@earendil-works/pi-coding-agent") ?? []) {
+    const root = join(directory, "@earendil-works/pi-coding-agent");
+    try {
+      const metadata = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+      const entry = metadata.exports?.["."]?.import ?? metadata.main;
+      if (metadata.name === "@earendil-works/pi-coding-agent" && typeof entry === "string") return join(root, entry);
+    } catch { /* Continue through Node's module search paths. */ }
+  }
+  throw new Error("Could not locate the running Pi SDK. Normal output remains enabled.");
+}
+
+/** Internal TUI adapter: no tools are replaced and no result content is changed. */
+export function installMinimalOutputHook(prototype: ToolPrototype): MinimalOutputHook {
+  for (const name of ["updateDisplay", "getResultRenderer", "getTextOutput", "setExpanded", "invalidate"] as const) {
+    if (typeof prototype[name] !== "function") {
+      throw new Error(`Pi's tool display API is incompatible: missing ${name}. Normal output remains enabled.`);
+    }
+  }
+  let state = prototype[HOOK];
+  if (!state) {
+    const originals = {
+      updateDisplay: prototype.updateDisplay,
+      getResultRenderer: prototype.getResultRenderer,
+      getTextOutput: prototype.getTextOutput,
+    };
+    const seen = new WeakSet<ToolComponent>();
+    const components = new Set<WeakRef<ToolComponent>>();
+    state = {
+      enabled: false,
+      owners: 0,
+      redraw(collapse = false) {
+        for (const reference of components) {
+          const component = reference.deref();
+          if (!component) { components.delete(reference); continue; }
+          if (collapse) component.setExpanded(false);
+          else component.invalidate();
+          component.ui.requestRender();
+        }
+      },
+      restore() {
+        for (const name of Object.keys(originals) as Array<keyof typeof originals>) {
+          // Do not remove another extension's subsequently installed wrapper.
+          if (prototype[name] === wrappers[name]) prototype[name] = originals[name];
+        }
+        delete prototype[HOOK];
+        components.clear();
+      },
+    };
+    const current = state;
+    const wrappers = {
+      updateDisplay(this: ToolComponent, ...args: unknown[]) {
+        if (!seen.has(this)) { seen.add(this); components.add(new WeakRef(this)); }
+        if (!current.enabled || this.expanded) return originals.updateDisplay.apply(this, args);
+        const showImages = this.showImages;
+        const lastRenderer = this.resultRendererComponent;
+        this.showImages = false;
+        try {
+          return originals.updateDisplay.apply(this, args);
+        } finally {
+          this.showImages = showImages;
+          // Expanded mode must get the original renderer's previous component, not our empty one.
+          this.resultRendererComponent = lastRenderer;
+        }
+      },
+      getResultRenderer(this: ToolComponent, ...args: unknown[]) {
+        return current.enabled && !this.expanded ? emptyResult : originals.getResultRenderer.apply(this, args);
+      },
+      getTextOutput(this: ToolComponent, ...args: unknown[]) {
+        return current.enabled && !this.expanded ? "" : originals.getTextOutput.apply(this, args);
+      },
+    };
+    Object.assign(prototype, wrappers);
+    prototype[HOOK] = state;
+  }
+  const current = state;
+  current.owners += 1;
+  let disposed = false;
+  return {
+    setEnabled(enabled) {
+      if (disposed) return;
+      current.enabled = enabled;
+      current.redraw(enabled);
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      current.owners -= 1;
+      if (current.owners > 0) return;
+      current.enabled = false;
+      current.redraw();
+      current.restore();
+    },
+  };
+}

package/extensions/minimal-output/index.ts

@@ -0,0 +1,85 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { installMinimalOutputHook, loadToolPrototype, type MinimalOutputHook } from "./hook.ts";
+
+const ENTRY = "pi-better-harness-tool-output";
+
+export default function minimalOutputExtension(pi: ExtensionAPI): void {
+  let hook: MinimalOutputHook | undefined;
+  let enabled = false;
+
+  function status(ctx: ExtensionContext): void {
+    ctx.ui.setStatus(ENTRY, enabled ? "tools: minimal" : undefined);
+  }
+
+  function collapseTools(ctx: ExtensionContext): void {
+    // setToolsExpanded is a no-op when already false; force a redraw of restored transcript rows.
+    if (!ctx.ui.getToolsExpanded()) ctx.ui.setToolsExpanded(true);
+    ctx.ui.setToolsExpanded(false);
+  }
+
+  async function ensureHook(ctx: ExtensionContext): Promise<boolean> {
+    if (ctx.mode !== "tui") {
+      ctx.ui.notify("Minimal tool output is available only in Pi's interactive TUI.", "warning");
+      return false;
+    }
+    if (hook) return true;
+    try {
+      hook = installMinimalOutputHook(await loadToolPrototype());
+      return true;
+    } catch (error) {
+      ctx.ui.notify(`Minimal tool output is unavailable: ${error instanceof Error ? error.message : String(error)}`, "warning");
+      return false;
+    }
+  }
+
+  pi.on("session_start", async (_event, ctx) => {
+    if (ctx.mode !== "tui") return;
+    enabled = false;
+    for (const entry of ctx.sessionManager.getBranch()) {
+      if (entry.type === "custom" && entry.customType === ENTRY) {
+        const data = entry.data as { enabled?: unknown } | undefined;
+        if (typeof data?.enabled === "boolean") enabled = data.enabled;
+      }
+    }
+    // Observe transcript components from startup, so the toggle also redraws existing rows.
+    if (await ensureHook(ctx)) {
+      if (enabled) collapseTools(ctx);
+      hook!.setEnabled(enabled);
+    } else enabled = false;
+    status(ctx);
+  });
+
+  pi.on("session_shutdown", () => {
+    hook?.dispose();
+    hook = undefined;
+    enabled = false;
+  });
+
+  pi.registerCommand("tool-output", {
+    description: "Tool output: minimal | normal (no argument toggles). Display only; agent results are unchanged.",
+    getArgumentCompletions: (argumentPrefix) => {
+      const prefix = argumentPrefix.trimStart().toLowerCase();
+      const matches = [
+        { value: "minimal", label: "minimal", description: "Hide collapsed tool result bodies" },
+        { value: "normal", label: "normal", description: "Restore ordinary tool output" },
+      ].filter((option) => option.value.startsWith(prefix));
+      return matches.length > 0 ? matches : null;
+    },
+    handler: async (args, ctx) => {
+      const mode = args.trim().toLowerCase();
+      if (mode && mode !== "minimal" && mode !== "normal") {
+        ctx.ui.notify("Usage: /tool-output [minimal|normal]", "warning");
+        return;
+      }
+      if (!await ensureHook(ctx)) return;
+      enabled = mode ? mode === "minimal" : !enabled;
+      if (enabled) collapseTools(ctx);
+      hook!.setEnabled(enabled);
+      pi.appendEntry(ENTRY, { version: 1, enabled });
+      status(ctx);
+      ctx.ui.notify(enabled
+        ? "Minimal tool output on. Click a tool in fullscreen mode or use Ctrl+O to reveal results."
+        : "Normal tool output restored.", "info");
+    },
+  });
+}

package/node_modules/pi-better-background-tasks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-background-tasks",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Pi extension for durable background shell tasks, watchers, logs, and status inspection.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-background-tasks/src/shared-sandbox-core.ts

@@ -228,10 +228,7 @@ const CREDENTIAL_LOCATIONS = [
     ".docker/config.json", ".npmrc", ".netrc", ".git-credentials", ".pi/agent/auth.json",
 ] as const;
 
-/**
- * Credential stores added by the broad-write profile. They are never readable
- * or writable there, whatever the Stored credentials row says.
- */
+/** Credential stores added to the Stored credentials row by the broad-write profile. */
 const BROAD_CREDENTIAL_LOCATIONS = [
     "Library/Keychains", ".claude/.credentials.json", ".claude.json", ".gnupg",
     ".codex/auth.json", ".cargo/credentials.toml", ".cargo/credentials", ".pgpass", ".config/rclone",
@@ -386,10 +383,7 @@ function compile(
     return {
         writableRoot, denyWrite, home: policy.home,
         ...(policy.permissions && {
-            // The broad-write profile's credential deny list is not optional.
-            permissions: broadMode
-                ? { ...policy.permissions, storedCredentials: "off" as const }
-                : { ...policy.permissions },
+            permissions: { ...policy.permissions },
             credentialPaths: broadMode ? broadCredentialPaths(policy.home, seams) : credentialFilePaths(policy.home, seams),
             compatibilityWrite,
             runtimeWrite,
@@ -598,7 +592,7 @@ export function evaluateReadAccess(
     const permissions = policy.permissions;
     if (!permissions) return { allowed: true, path };
     if (policy.broad) {
-        const denied = isCredential(path, policy) ||
+        const denied = (isCredential(path, policy) && permissions.storedCredentials === "off") ||
             (permissions.projectFiles === "off" && contains(policy.writableRoot, path));
         return denied ? { allowed: false, path, reason: "read-denied" } : { allowed: true, path };
     }
@@ -652,7 +646,8 @@ function evaluateBroadWrite(
     for (const denied of [...policy.denyWrite, ...broad.codePaths]) {
         if (contains(denied, path)) return { allowed: false, path, reason: "write-denied", deniedBy: denied };
     }
-    if (isCredential(path, policy)) return { allowed: false, path, reason: "permission-denied" };
+    if (isCredential(path, policy)) return canWrite(policy.permissions!.storedCredentials)
+        ? { allowed: true, path } : { allowed: false, path, reason: "permission-denied" };
     if (policy.runtimeWrite?.some((root) => contains(root, path))) return { allowed: true, path };
     if (contains(policy.writableRoot, path)) {
         return canWrite(policy.permissions!.projectFiles)
@@ -808,7 +803,8 @@ export function resetRecoverySnapshotClock(): void {
 }
 
 function broadProtectedPaths(policy: CompiledSandboxWritePolicy, broad: CompiledBroadWrite): string[] {
-    return [...policy.denyWrite, ...(policy.credentialPaths ?? []), ...broad.codePaths,
+    return [...policy.denyWrite,
+        ...(policy.permissions?.storedCredentials === "read-write" ? [] : policy.credentialPaths ?? []), ...broad.codePaths,
         ...(!canWrite(policy.permissions?.projectFiles) ? [policy.writableRoot] : [])];
 }
 
@@ -927,7 +923,7 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[.]worktrees/."))`,
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[^/]+-worktrees/."))`,
     );
-    // The fixed deny list overrides every grant above. A rule naming
+    // Write-denied controls and credentials override every broad grant above. A rule naming
     // `file-write-unlink` outranks a `file-write*` wildcard whatever their
     // order (verified on the real kernel), so each protected path also gets an
     // explicit unlink denial; otherwise the removal grants above would reopen it.
@@ -936,8 +932,8 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
     if (!canWrite(permissions.projectFiles)) denyWrite(project);
     for (const path of broad.codePaths) denyWrite(path);
     for (const path of policy.credentialPaths ?? []) {
-        rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
-        denyWrite(path);
+        if (permissions.storedCredentials === "off") rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
+        if (permissions.storedCredentials !== "read-write") denyWrite(path);
     }
     for (const path of policy.denyWrite) denyWrite(path);
     // Renaming an ancestor would move a protected subtree to an unprotected path,
@@ -1350,9 +1346,11 @@ function maskSources(profilePath: string): { directory: string; file: string } {
  * the root is read-only; temp, the workspace, hidden home entries and worktree
  * folders are writable (removal included); ordinary top-level home folders and
  * home itself stay read-only, so sibling repositories cannot even be edited in
- * place there. Credentials are masked by empty mode-000 mounts; code that runs
- * later and caller-denied paths are read-only binds. Every writable bind and
- * protected leaf is a mount point, which Linux refuses to rename. A protected
+ * place there. Off credentials are masked by empty mode-000 mounts, Read
+ * credentials are read-only binds, and Read / write credentials follow the
+ * surrounding broad-write rules. Code that runs later and caller-denied paths
+ * are read-only binds. Every writable bind and protected leaf is a mount point,
+ * which Linux refuses to rename. A protected
  * symlink inside a writable directory (a stow link in `~/.config`) makes that
  * directory read-only with each existing entry bound writable again, so only
  * new top-level entries there are refused.
@@ -1373,14 +1371,15 @@ function buildLinuxBroadCommand(
         throw new Error("Linux bubblewrap cannot separate removal from writing for Project files; use Write & delete or Read.");
     }
     const credentials = policy.credentialPaths ?? [];
+    const protectedCredentials = permissions.storedCredentials === "read-write" ? [] : credentials;
     const writeDenied = [...broad.codePaths, ...policy.denyWrite];
     if (permissions.projectFiles === "read-write" &&
-        [...credentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
+        [...protectedCredentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
         throw new Error("Linux bubblewrap cannot make a project writable inside a protected directory.");
     }
     const list = seams.listDirectory ?? systemListDirectory;
     const exists = (path: string) => (seams.pathExists ?? existsSync)(path);
-    const protectedPaths = [...credentials, ...writeDenied];
+    const protectedPaths = [...protectedCredentials, ...writeDenied];
     const insideProtected = (path: string) => protectedPaths.some((guard) => contains(guard, path));
 
     const writable = new Set<string>();
@@ -1498,7 +1497,10 @@ function buildLinuxBroadCommand(
             readOnly.add(path);
         }
     };
-    for (const path of credentials) guard(path, true);
+    for (const path of credentials) {
+        if (permissions.storedCredentials === "off") guard(path, true);
+        else if (permissions.storedCredentials === "read") guard(path, false);
+    }
     for (const path of writeDenied) guard(path, false);
     if (permissions.projectFiles === "read") readOnly.add(project);
 

package/node_modules/pi-better-plan/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-plan",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Structured execution plans with persistent progress for Pi.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-plan/src/index.ts

@@ -1,6 +1,6 @@
 import { StringEnum } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { Text } from "@earendil-works/pi-tui";
+import { Text, type AutocompleteItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
 import {
@@ -78,6 +78,21 @@ const LEGACY_PLAN_NAV_STATUS_KEY = "pi-better-plan-nav";
 const DELEGATION_MODE_REQUEST = "pi-better-subagents:delegation-mode-request";
 type DelegationMode = "manual" | "adaptive" | "coordinator";
 
+const PLAN_ACTIONS: readonly AutocompleteItem[] = [
+  { value: "clear", label: "clear", description: "Remove the current plan" },
+  { value: "hide", label: "hide", description: "Hide the plan widget" },
+  { value: "show", label: "show", description: "Restore automatic plan display" },
+  { value: "pin auto", label: "pin auto", description: "Use automatic plan pinning" },
+  { value: "pin on", label: "pin on", description: "Keep the plan pinned" },
+  { value: "pin off", label: "pin off", description: "Keep the plan unpinned" },
+];
+
+export function planArgumentCompletions(argumentPrefix: string): AutocompleteItem[] | null {
+  const prefix = argumentPrefix.trimStart().toLowerCase();
+  const matches = PLAN_ACTIONS.filter((action) => action.value.startsWith(prefix));
+  return matches.length > 0 ? [...matches] : null;
+}
+
 function activeDelegationMode(pi: ExtensionAPI): DelegationMode {
   const request: { mode?: string } = {};
   pi.events.emit(DELEGATION_MODE_REQUEST, request);
@@ -396,6 +411,7 @@ export default function planExtension(pi: ExtensionAPI): void {
 
   pi.registerCommand("plan", {
     description: "Inspect, show, hide, clear, or configure the current plan",
+    getArgumentCompletions: planArgumentCompletions,
     handler: async (args, ctx) => {
       const input = args.trim().toLowerCase();
       if (!input) return showFullPlan(ctx);

package/node_modules/pi-better-sandbox/README.md

@@ -20,7 +20,7 @@ Sandbox                           Off              On
 
 Project files                     -                Write & delete
 Outside project                   -                Write
-Stored credentials                -                Off (fixed)
+Stored credentials                -                Read
 Run commands & applications       -                On
 Network access                    -                On
 
@@ -28,11 +28,10 @@ Network access                    -                On
     Guarded (follows the file rules)
     [x] apply_patch  harness adapter
     Trusted (runs outside the file rules)
-    [x] web_fetch    @juicesharp/rpiv-web-tools · needs Network On
-    [x] web_search   @juicesharp/rpiv-web-tools · needs Network On
-    [ ] <other installed tool>  <its package>
+    > [x] @juicesharp/rpiv-web-tools  2/2
+    > [ ] <other installed package>  0/1
 
-↑↓ Select row   ←→ Select column   Space Change
+↑↓ Select row   ←→ Select column / expand / collapse   Enter Fold   Space Change
 Save as defaults
 ```
 
@@ -44,10 +43,22 @@ Save as defaults
   full before any file changes.
 - **Trusted** tools are the other tools your Pi has loaded, listed with their
   package. A ticked one is loaded into the subagent and runs in its Pi process,
-  **outside the file rules**. Ticking one needs a second Space. It is admitted
+  **outside the file rules**. One Space toggles it immediately. It is admitted
   only from the package you ticked. Known network tool names are refused while
   Network access is Off: `web_fetch`, `web_search`, `firecrawl_scrape`, `firecrawl_extract`, `mcp`, `mcpScript`, `remote_bash`, and any `mcp__*` name. That is a name list, not a network sandbox.
 
+Trusted tools use two levels: a package/provider group, then its individual tools.
+Non-MCP tools are grouped by exact owning package; `mcp__<provider>__...` tools
+are grouped by provider and owning package together. Groups start collapsed.
+`>` means collapsed and `v` means expanded. Their checkbox shows `[x]` when
+all children are selected, `[-]` when some are selected, and `[ ]` when none
+are; the count is selected/total. Right expands a group. Left collapses a group,
+or moves from a child to its parent and collapses it. Enter folds the selected
+group. Space on a group selects all children when none or only some are selected,
+or deselects them all when all are selected. Every toggle applies on one Space;
+saving looser defaults still needs a second Enter. Only individual tool
+entries are saved, never a package/provider wildcard or the open/closed state.
+
 Defaults: `apply_patch`, `web_fetch`, and `web_search` on; everything else off.
 See [ADR 0009](../../docs/adr/0009-guarded-and-trusted-subagent-tools.md).
 
@@ -74,15 +85,14 @@ select the row.
 
 **Outside project = Write** (the Subagents default) lets tasks write across your
 home directory and temp, so tool caches just work with no per-tool setup. It
-keeps one fixed deny list that is not configurable per tool:
+retains fixed protections that are not configurable per tool:
 
-- **Credentials** are neither readable nor writable, whatever the Stored
-  credentials row says: the files listed below plus `~/Library/Keychains`,
+- **Credentials** follow the independent Stored credentials row. The default
+  `Read` setting exposes the files listed below plus `~/Library/Keychains`,
   `~/.claude/.credentials.json`, `~/.claude.json`, `~/.gnupg`,
   `~/.codex/auth.json`, `~/.cargo/credentials(.toml)`, `~/.pgpass`, and
-  `~/.config/rclone`. The table shows
-  "Off (fixed)". Tasks that need git over SSH, `gh`, or cloud CLIs need Outside
-  project = Read or Write & delete.
+  `~/.config/rclone` to confined subagents, while denying writes. Set the row to
+  Off to hide them or Read / write when a CLI must refresh credential state.
 - **Code that runs later** cannot be written, removed, or renamed: shell startup
   files (`.bashrc`, `.zshrc`, `.profile`, and the rest), `~/.config/fish`,
   `~/.gitconfig`, `~/.config/git`, `~/.config/systemd/user`,
@@ -110,9 +120,11 @@ repository's `.git/hooks` or `.git/config` (`core.hooksPath`, `core.fsmonitor`,
 `~/.gitconfig`, `~/.config/git`, and `~/.git-templates` themselves stay protected. Add your own paths to the deny list with `/sandbox deny add <path>`. Under
 Write, those paths are also protected from removal and renaming.
 
-A looser value (a higher level, a capability switched on, or a sandbox switched
-off) takes effect only on a second Space, and saving looser defaults needs a
-second Enter. Each prompt lists what would loosen. No model
+Space applies every change immediately, including higher permission levels,
+capabilities switched on, and a sandbox switched off. Saving looser defaults
+still needs a second Enter, with a prompt listing what would loosen. The focused
+row has a full-width background and bold text; the selected Main/Subagents cell
+also uses inverse styling. No model
 tool can change these settings. Other rows toggle Off/On. Detail cells under an
 Off sandbox display a dimmed `-` and cannot be changed; their values return when
 the sandbox is enabled again.
@@ -152,8 +164,8 @@ AWS, GitHub CLI, Google Cloud CLI, Azure, Kubernetes, Docker, npm, netrc, Git
 credentials, and Pi's file-based auth. These rules override ordinary file access.
 OS vault services such as Keychain and Secret Service, and tokens inherited in
 environment variables, are excluded. Read / write may be needed by a CLI that
-refreshes a token or updates its credential database. Under Outside project =
-Write, credentials are always Off (see above).
+refreshes a token or updates its credential database. This row applies
+independently of Project files and Outside project.
 
 File and shell operations use the kernel: macOS uses Seatbelt (`sandbox-exec`)
 and Linux uses Bubblewrap (`bwrap`). `read`, `write`, and `edit` keep Pi's normal

package/node_modules/pi-better-sandbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-sandbox",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Pi extension with independent Main and Subagents permission profiles, file guards, and OS sandbox enforcement.",
   "license": "MIT",
   "type": "module",