pi-better-harness 0.12.3 → 0.13.0

package/README.md

@@ -60,6 +60,27 @@ Sandbox state is human-only: `/sandbox`, `/sandbox on`, `/sandbox off`,
 commands with no tool equivalent. `/sandbox off` and `/sandbox default off`
 need interactive confirmation. Full policy: [pi-better-sandbox](https://github.com/1aboveio/pi-better-harness/tree/main/packages/pi-better-sandbox#readme).
 
+## Minimal Tool Output
+
+The bundled harness also provides `/tool-output minimal`, `/tool-output normal`,
+and `/tool-output` (toggle). Minimal mode hides every collapsed result body,
+including built-in, extension, and MCP text/images, without changing execution,
+sandboxing, or agent-facing payloads. Tool headers and error coloring remain;
+Ctrl+O reveals results, and fullscreen Pi versions with clickable tool rows
+also support clicking headers.
+
+Normal mode is the default. The preference is saved in the current session,
+including resume/reload. This is a version-sensitive internal TUI adapter,
+tested with Pi 0.82.1 and 0.99.1; incompatible APIs produce a warning and leave
+ordinary output enabled. Print/RPC output and exported transcripts are unchanged.
+
+The standalone-package installer does not install this bundled extension.
+Load the bundled harness or run it directly from a checkout:
+
+```sh
+pi -e ./packages/pi-better-harness/extensions/minimal-output/index.ts
+```
+
 ## When To Use
 
 Use the installer when you want every core extension with standalone package identities. Install an individual package instead when you only need the sandbox, subagents, shell task supervision, synchronous SSH, goal tracking, or plans.

package/extensions/minimal-output/hook.ts

@@ -0,0 +1,149 @@
+import { readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+interface ToolComponent {
+  expanded: boolean;
+  showImages: boolean;
+  resultRendererComponent?: unknown;
+  ui: { requestRender(): void };
+  invalidate(): void;
+  setExpanded(expanded: boolean): void;
+}
+
+type Method = (this: ToolComponent, ...args: unknown[]) => unknown;
+interface ToolPrototype {
+  updateDisplay: Method;
+  getResultRenderer: Method;
+  getTextOutput: Method;
+  setExpanded: Method;
+  invalidate: Method;
+  [HOOK]?: HookState;
+}
+interface HookState {
+  enabled: boolean;
+  owners: number;
+  redraw(collapse?: boolean): void;
+  restore(): void;
+}
+export interface MinimalOutputHook {
+  setEnabled(enabled: boolean): void;
+  dispose(): void;
+}
+
+const HOOK = Symbol.for("pi-better-harness.minimal-output-hook");
+const emptyResult = () => ({ render: () => [] as string[], invalidate() {} });
+
+/** Resolve the running host's SDK, not a second SDK bundled beside the extension. */
+export async function loadToolPrototype(): Promise<ToolPrototype> {
+  let require = createRequire(import.meta.url);
+  if (process.argv[1]) {
+    try {
+      const hostRequire = createRequire(realpathSync(process.argv[1]));
+      sdkEntry(hostRequire);
+      require = hostRequire;
+    } catch { /* SDK embedding or a test runner: use the extension's SDK. */ }
+  }
+  const entry = sdkEntry(require);
+  const path = join(dirname(entry), "modes/interactive/components/tool-execution.js");
+  const module = await import(pathToFileURL(path).href);
+  return module.ToolExecutionComponent.prototype;
+}
+
+// Pi's ESM-only export cannot be resolved with require.resolve on older SDKs.
+function sdkEntry(require: ReturnType<typeof createRequire>): string {
+  for (const directory of require.resolve.paths("@earendil-works/pi-coding-agent") ?? []) {
+    const root = join(directory, "@earendil-works/pi-coding-agent");
+    try {
+      const metadata = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+      const entry = metadata.exports?.["."]?.import ?? metadata.main;
+      if (metadata.name === "@earendil-works/pi-coding-agent" && typeof entry === "string") return join(root, entry);
+    } catch { /* Continue through Node's module search paths. */ }
+  }
+  throw new Error("Could not locate the running Pi SDK. Normal output remains enabled.");
+}
+
+/** Internal TUI adapter: no tools are replaced and no result content is changed. */
+export function installMinimalOutputHook(prototype: ToolPrototype): MinimalOutputHook {
+  for (const name of ["updateDisplay", "getResultRenderer", "getTextOutput", "setExpanded", "invalidate"] as const) {
+    if (typeof prototype[name] !== "function") {
+      throw new Error(`Pi's tool display API is incompatible: missing ${name}. Normal output remains enabled.`);
+    }
+  }
+  let state = prototype[HOOK];
+  if (!state) {
+    const originals = {
+      updateDisplay: prototype.updateDisplay,
+      getResultRenderer: prototype.getResultRenderer,
+      getTextOutput: prototype.getTextOutput,
+    };
+    const seen = new WeakSet<ToolComponent>();
+    const components = new Set<WeakRef<ToolComponent>>();
+    state = {
+      enabled: false,
+      owners: 0,
+      redraw(collapse = false) {
+        for (const reference of components) {
+          const component = reference.deref();
+          if (!component) { components.delete(reference); continue; }
+          if (collapse) component.setExpanded(false);
+          else component.invalidate();
+          component.ui.requestRender();
+        }
+      },
+      restore() {
+        for (const name of Object.keys(originals) as Array<keyof typeof originals>) {
+          // Do not remove another extension's subsequently installed wrapper.
+          if (prototype[name] === wrappers[name]) prototype[name] = originals[name];
+        }
+        delete prototype[HOOK];
+        components.clear();
+      },
+    };
+    const current = state;
+    const wrappers = {
+      updateDisplay(this: ToolComponent, ...args: unknown[]) {
+        if (!seen.has(this)) { seen.add(this); components.add(new WeakRef(this)); }
+        if (!current.enabled || this.expanded) return originals.updateDisplay.apply(this, args);
+        const showImages = this.showImages;
+        const lastRenderer = this.resultRendererComponent;
+        this.showImages = false;
+        try {
+          return originals.updateDisplay.apply(this, args);
+        } finally {
+          this.showImages = showImages;
+          // Expanded mode must get the original renderer's previous component, not our empty one.
+          this.resultRendererComponent = lastRenderer;
+        }
+      },
+      getResultRenderer(this: ToolComponent, ...args: unknown[]) {
+        return current.enabled && !this.expanded ? emptyResult : originals.getResultRenderer.apply(this, args);
+      },
+      getTextOutput(this: ToolComponent, ...args: unknown[]) {
+        return current.enabled && !this.expanded ? "" : originals.getTextOutput.apply(this, args);
+      },
+    };
+    Object.assign(prototype, wrappers);
+    prototype[HOOK] = state;
+  }
+  const current = state;
+  current.owners += 1;
+  let disposed = false;
+  return {
+    setEnabled(enabled) {
+      if (disposed) return;
+      current.enabled = enabled;
+      current.redraw(enabled);
+    },
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      current.owners -= 1;
+      if (current.owners > 0) return;
+      current.enabled = false;
+      current.redraw();
+      current.restore();
+    },
+  };
+}

package/extensions/minimal-output/index.ts

@@ -0,0 +1,85 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { installMinimalOutputHook, loadToolPrototype, type MinimalOutputHook } from "./hook.ts";
+
+const ENTRY = "pi-better-harness-tool-output";
+
+export default function minimalOutputExtension(pi: ExtensionAPI): void {
+  let hook: MinimalOutputHook | undefined;
+  let enabled = false;
+
+  function status(ctx: ExtensionContext): void {
+    ctx.ui.setStatus(ENTRY, enabled ? "tools: minimal" : undefined);
+  }
+
+  function collapseTools(ctx: ExtensionContext): void {
+    // setToolsExpanded is a no-op when already false; force a redraw of restored transcript rows.
+    if (!ctx.ui.getToolsExpanded()) ctx.ui.setToolsExpanded(true);
+    ctx.ui.setToolsExpanded(false);
+  }
+
+  async function ensureHook(ctx: ExtensionContext): Promise<boolean> {
+    if (ctx.mode !== "tui") {
+      ctx.ui.notify("Minimal tool output is available only in Pi's interactive TUI.", "warning");
+      return false;
+    }
+    if (hook) return true;
+    try {
+      hook = installMinimalOutputHook(await loadToolPrototype());
+      return true;
+    } catch (error) {
+      ctx.ui.notify(`Minimal tool output is unavailable: ${error instanceof Error ? error.message : String(error)}`, "warning");
+      return false;
+    }
+  }
+
+  pi.on("session_start", async (_event, ctx) => {
+    if (ctx.mode !== "tui") return;
+    enabled = false;
+    for (const entry of ctx.sessionManager.getBranch()) {
+      if (entry.type === "custom" && entry.customType === ENTRY) {
+        const data = entry.data as { enabled?: unknown } | undefined;
+        if (typeof data?.enabled === "boolean") enabled = data.enabled;
+      }
+    }
+    // Observe transcript components from startup, so the toggle also redraws existing rows.
+    if (await ensureHook(ctx)) {
+      if (enabled) collapseTools(ctx);
+      hook!.setEnabled(enabled);
+    } else enabled = false;
+    status(ctx);
+  });
+
+  pi.on("session_shutdown", () => {
+    hook?.dispose();
+    hook = undefined;
+    enabled = false;
+  });
+
+  pi.registerCommand("tool-output", {
+    description: "Tool output: minimal | normal (no argument toggles). Display only; agent results are unchanged.",
+    getArgumentCompletions: (argumentPrefix) => {
+      const prefix = argumentPrefix.trimStart().toLowerCase();
+      const matches = [
+        { value: "minimal", label: "minimal", description: "Hide collapsed tool result bodies" },
+        { value: "normal", label: "normal", description: "Restore ordinary tool output" },
+      ].filter((option) => option.value.startsWith(prefix));
+      return matches.length > 0 ? matches : null;
+    },
+    handler: async (args, ctx) => {
+      const mode = args.trim().toLowerCase();
+      if (mode && mode !== "minimal" && mode !== "normal") {
+        ctx.ui.notify("Usage: /tool-output [minimal|normal]", "warning");
+        return;
+      }
+      if (!await ensureHook(ctx)) return;
+      enabled = mode ? mode === "minimal" : !enabled;
+      if (enabled) collapseTools(ctx);
+      hook!.setEnabled(enabled);
+      pi.appendEntry(ENTRY, { version: 1, enabled });
+      status(ctx);
+      ctx.ui.notify(enabled
+        ? "Minimal tool output on. Click a tool in fullscreen mode or use Ctrl+O to reveal results."
+        : "Normal tool output restored.", "info");
+    },
+  });
+}

package/node_modules/pi-better-sandbox/README.md

@@ -28,11 +28,10 @@ Network access                    -                On
     Guarded (follows the file rules)
     [x] apply_patch  harness adapter
     Trusted (runs outside the file rules)
-    [x] web_fetch    @juicesharp/rpiv-web-tools · needs Network On
-    [x] web_search   @juicesharp/rpiv-web-tools · needs Network On
-    [ ] <other installed tool>  <its package>
+    > [x] @juicesharp/rpiv-web-tools  2/2
+    > [ ] <other installed package>  0/1
 
-↑↓ Select row   ←→ Select column   Space Change
+↑↓ Select row   ←→ Select column / expand / collapse   Enter Fold   Space Change
 Save as defaults
 ```
 
@@ -44,10 +43,22 @@ Save as defaults
   full before any file changes.
 - **Trusted** tools are the other tools your Pi has loaded, listed with their
   package. A ticked one is loaded into the subagent and runs in its Pi process,
-  **outside the file rules**. Ticking one needs a second Space. It is admitted
+  **outside the file rules**. One Space toggles it immediately. It is admitted
   only from the package you ticked. Known network tool names are refused while
   Network access is Off: `web_fetch`, `web_search`, `firecrawl_scrape`, `firecrawl_extract`, `mcp`, `mcpScript`, `remote_bash`, and any `mcp__*` name. That is a name list, not a network sandbox.
 
+Trusted tools use two levels: a package/provider group, then its individual tools.
+Non-MCP tools are grouped by exact owning package; `mcp__<provider>__...` tools
+are grouped by provider and owning package together. Groups start collapsed.
+`>` means collapsed and `v` means expanded. Their checkbox shows `[x]` when
+all children are selected, `[-]` when some are selected, and `[ ]` when none
+are; the count is selected/total. Right expands a group. Left collapses a group,
+or moves from a child to its parent and collapses it. Enter folds the selected
+group. Space on a group selects all children when none or only some are selected,
+or deselects them all when all are selected. Every toggle applies on one Space;
+saving looser defaults still needs a second Enter. Only individual tool
+entries are saved, never a package/provider wildcard or the open/closed state.
+
 Defaults: `apply_patch`, `web_fetch`, and `web_search` on; everything else off.
 See [ADR 0009](../../docs/adr/0009-guarded-and-trusted-subagent-tools.md).
 
@@ -109,9 +120,11 @@ repository's `.git/hooks` or `.git/config` (`core.hooksPath`, `core.fsmonitor`,
 `~/.gitconfig`, `~/.config/git`, and `~/.git-templates` themselves stay protected. Add your own paths to the deny list with `/sandbox deny add <path>`. Under
 Write, those paths are also protected from removal and renaming.
 
-A looser value (a higher level, a capability switched on, or a sandbox switched
-off) takes effect only on a second Space, and saving looser defaults needs a
-second Enter. Each prompt lists what would loosen. No model
+Space applies every change immediately, including higher permission levels,
+capabilities switched on, and a sandbox switched off. Saving looser defaults
+still needs a second Enter, with a prompt listing what would loosen. The focused
+row has a full-width background and bold text; the selected Main/Subagents cell
+also uses inverse styling. No model
 tool can change these settings. Other rows toggle Off/On. Detail cells under an
 Off sandbox display a dimmed `-` and cannot be changed; their values return when
 the sandbox is enabled again.

package/node_modules/pi-better-sandbox/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-sandbox",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Pi extension with independent Main and Subagents permission profiles, file guards, and OS sandbox enforcement.",
   "license": "MIT",
   "type": "module",

package/node_modules/pi-better-sandbox/permissions-page.ts

@@ -2,7 +2,7 @@ import type { ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
 import { Key, matchesKey, truncateToWidth, visibleWidth, type Component } from "@earendil-works/pi-tui";
 
 import { isNetworkTool, packageLabel, type DiscoveredTool } from "./shared-task-tools.ts";
-import { defaultSandboxPermissions, describeLoosening, type CredentialAccess, type FileAccess, type SandboxPermissionProfile as PermissionProfile, type SandboxPermissionSettings as PermissionSettings } from "./permissions.ts";
+import { defaultSandboxPermissions, type CredentialAccess, type FileAccess, type SandboxPermissionProfile as PermissionProfile, type SandboxPermissionSettings as PermissionSettings } from "./permissions.ts";
 export type { PermissionProfile, PermissionSettings };
 
 export interface PermissionPageHandlers {
@@ -15,9 +15,12 @@ export interface PermissionPageHandlers {
     discoverTools?(): readonly Pick<DiscoveredTool, "name" | "package">[];
 }
 
+type TrustedItem = { kind: "trusted"; name: string; package: string; loaded: boolean; group: string };
+type ToolGroup = { kind: "group"; id: string; label: string; tools: TrustedItem[] };
 type ToolItem =
     | { kind: "guarded"; name: "apply_patch" }
-    | { kind: "trusted"; name: string; package: string; loaded: boolean };
+    | TrustedItem
+    | ToolGroup;
 
 const GUARDED_HINT = "apply_patch goes through the guarded file operations: Project files and Outside project apply to it.";
 const TRUSTED_HINT = "Trusted tools run in the subagent's Pi process, outside the file rules. Tick only tools you trust.";
@@ -66,7 +69,7 @@ function cell(text: string, width: number): string {
     return cut + " ".repeat(Math.max(0, width - visibleWidth(cut)));
 }
 
-/** A flat, keyboard-driven view; handlers own the effective policy and persistence. */
+/** Keyboard-driven profiles and a foldable package/provider tool tree. */
 export function createPermissionsPage(
     theme: Theme,
     handlers: PermissionPageHandlers,
@@ -91,24 +94,41 @@ export function createPermissionsPage(
     }
     const isTicked = (item: { name: string; package: string }) =>
         !!settings?.subagentTools.trusted.some((tool) => tool.name === item.name && tool.package === item.package);
-    /** Guarded first, then discovered and ticked trusted tools, by name. */
-    function toolItems(): ToolItem[] {
-        const trusted = new Map<string, ToolItem & { kind: "trusted" }>();
-        for (const tool of discovered) trusted.set(`${tool.name}\0${tool.package}`, { kind: "trusted", name: tool.name, package: tool.package, loaded: true });
-        for (const tool of settings?.subagentTools.trusted ?? []) {
-            const key = `${tool.name}\0${tool.package}`;
-            if (!trusted.has(key)) trusted.set(key, { kind: "trusted", name: tool.name, package: tool.package, loaded: false });
+    const expanded = new Set<string>();
+    function toolGroups(): ToolGroup[] {
+        const trusted = new Map<string, TrustedItem>();
+        const add = (tool: { name: string; package: string }, loaded: boolean) => {
+            const provider = /^mcp__(.+?)__/.exec(tool.name)?.[1];
+            const group = JSON.stringify([tool.package, provider ?? ""]);
+            const key = JSON.stringify([tool.name, tool.package]);
+            if (!trusted.has(key)) trusted.set(key, { ...tool, kind: "trusted", loaded, group });
+        };
+        for (const tool of discovered) add(tool, true);
+        for (const tool of settings?.subagentTools.trusted ?? []) add(tool, false);
+        const groups = new Map<string, ToolGroup>();
+        for (const tool of trusted.values()) {
+            if (!groups.has(tool.group)) {
+                const provider = JSON.parse(tool.group)[1] as string;
+                groups.set(tool.group, { kind: "group", id: tool.group,
+                    label: provider ? `${provider} (${packageLabel(tool.package)})` : packageLabel(tool.package), tools: [] });
+            }
+            groups.get(tool.group)!.tools.push(tool);
         }
-        return [{ kind: "guarded", name: "apply_patch" },
-            ...[...trusted.values()].sort((a, b) => a.name.localeCompare(b.name) || a.package.localeCompare(b.package))];
+        for (const group of groups.values()) group.tools.sort((a, b) => a.name.localeCompare(b.name));
+        return [...groups.values()].sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
+    }
+    function toolItems(): ToolItem[] {
+        return [{ kind: "guarded", name: "apply_patch" }, ...toolGroups().flatMap((group): ToolItem[] =>
+            [group, ...(expanded.has(group.id) ? group.tools : [])])];
     }
+    const itemKey = (item: ToolItem) => item.kind === "group" ? item.id
+        : item.kind === "guarded" ? "apply_patch" : JSON.stringify([item.name, item.package]);
     let items = toolItems();
     const saveRow = () => rows.length + items.length;
     let row = 0;
     let column = 0;
     let busy = false;
     let pendingConfirmation: string | undefined;
-    let pendingChange: string | undefined;
 
     function report(error: unknown): void {
         message = errorText(error);
@@ -122,7 +142,14 @@ export function createPermissionsPage(
         if (row >= rows.length) {
             const item = items[row - rows.length]!;
             if (item.kind === "guarded") next.subagentTools.applyPatch = !next.subagentTools.applyPatch;
-            else if (isTicked(item)) {
+            else if (item.kind === "group") {
+                const all = item.tools.every(isTicked);
+                for (const tool of item.tools) {
+                    if (all) next.subagentTools.trusted = next.subagentTools.trusted.filter((entry) =>
+                        !(entry.name === tool.name && entry.package === tool.package));
+                    else if (!isTicked(tool)) next.subagentTools.trusted.push({ name: tool.name, package: tool.package });
+                }
+            } else if (isTicked(item)) {
                 next.subagentTools.trusted = next.subagentTools.trusted.filter((tool) => !(tool.name === item.name && tool.package === item.package));
             } else next.subagentTools.trusted.push({ name: item.name, package: item.package });
             return apply(next);
@@ -144,22 +171,18 @@ export function createPermissionsPage(
 
     async function apply(next: PermissionSettings): Promise<void> {
         if (!settings) return;
-        // A looser value is applied only on a second Space, like a looser Save.
-        const loosened = describeLoosening(settings, next);
-        const nextKey = JSON.stringify(next);
-        if (loosened.length && pendingChange !== nextKey) {
-            pendingChange = nextKey;
-            message = `Looser (${loosened.join("; ")}). Press Space again to apply.`;
-            isError = false;
-            requestRender();
-            return;
-        }
-        pendingChange = undefined;
         busy = true;
         try {
             await handlers.change(snapshot(next));
+            const selected = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
+            const wasSave = row === saveRow();
+            const successors = selected ? items.slice(row - rows.length + 1).map(itemKey) : [];
             settings = next;
             items = toolItems();
+            const index = selected ? items.findIndex((item) => itemKey(item) === itemKey(selected)) : -1;
+            const successor = successors.map((key) => items.findIndex((item) => itemKey(item) === key)).find((at) => at >= 0);
+            row = wasSave ? saveRow() : index >= 0 ? rows.length + index
+                : successor !== undefined ? rows.length + successor : Math.min(row, saveRow());
             message = "";
             isError = false;
             requestRender();
@@ -201,11 +224,21 @@ export function createPermissionsPage(
         }
     }
 
+    function fold(open?: boolean): void {
+        const item = row >= rows.length && row < saveRow() ? items[row - rows.length] : undefined;
+        const id = item?.kind === "group" ? item.id : item?.kind === "trusted" && open === false ? item.group : undefined;
+        if (!id) return;
+        if (open ?? !expanded.has(id)) expanded.add(id);
+        else expanded.delete(id);
+        items = toolItems();
+        row = rows.length + items.findIndex((entry) => entry.kind === "group" && entry.id === id);
+        requestRender();
+    }
+
     return {
         invalidate() {},
         handleInput(data: string) {
             if (!matchesKey(data, Key.enter)) pendingConfirmation = undefined;
-            if (!matchesKey(data, Key.space)) pendingChange = undefined;
             if (matchesKey(data, Key.escape)) {
                 close();
             } else if (matchesKey(data, Key.up)) {
@@ -215,15 +248,19 @@ export function createPermissionsPage(
                 row = Math.min(saveRow(), row + 1);
                 requestRender();
             } else if (matchesKey(data, Key.left)) {
-                column = 0;
+                if (row >= rows.length && row < saveRow()) fold(false);
+                else column = 0;
                 requestRender();
             } else if (matchesKey(data, Key.right)) {
-                column = 1;
+                if (row >= rows.length && row < saveRow()) fold(true);
+                else column = 1;
                 requestRender();
             } else if (matchesKey(data, Key.space)) {
                 void change();
             } else if (matchesKey(data, Key.enter) && row === saveRow()) {
                 void save();
+            } else if (matchesKey(data, Key.enter)) {
+                fold();
             }
         },
         render(width: number): string[] {
@@ -235,14 +272,16 @@ export function createPermissionsPage(
             const available = Math.max(0, w - prefix - labelWidth - gap);
             const mainWidth = Math.ceil(available / 2);
             const subWidth = available - mainWidth;
+            const highlight = (text: string, selected: boolean): string => selected
+                ? theme.bg("selectedBg", theme.bold(cell(text, w))) : text;
             const line = (label: string, main: string, sub: string, selected: boolean, dimMain = false, dimSub = false) => {
                 const marker = prefix ? (selected ? "> " : "  ") : "";
                 const labelPart = cell(label, labelWidth);
-                const mainPart = cell(main, mainWidth);
-                const subPart = cell(sub, subWidth);
-                return theme.fg(selected ? "accent" : "text", marker + labelPart) + " ".repeat(gap) +
-                    theme.fg(dimMain ? "dim" : selected && column === 0 ? "accent" : "text", mainPart) +
-                    theme.fg(dimSub ? "dim" : selected && column === 1 ? "accent" : "text", subPart);
+                const mainPart = theme.fg(dimMain ? "dim" : "text", cell(main, mainWidth));
+                const subPart = theme.fg(dimSub ? "dim" : "text", cell(sub, subWidth));
+                return highlight(theme.fg(selected ? "accent" : "text", marker + labelPart) + " ".repeat(gap) +
+                    (selected && column === 0 ? theme.inverse(mainPart) : mainPart) +
+                    (selected && column === 1 ? theme.inverse(subPart) : subPart), selected);
             };
             const output = [line("Sandbox permissions", "Main", "Subagents", false), ""];
             for (let i = 0; i < rows.length; i++) {
@@ -261,16 +300,25 @@ export function createPermissionsPage(
             }
             // Subagents · Tools: which extension tools a confined subagent may use.
             output.push("", theme.fg("text", truncateToWidth(`${prefix ? "  " : ""}Subagents · Tools`, w, "")));
-            const nameWidth = Math.min(24, Math.max(...items.map((item) => visibleWidth(item.name))), Math.max(0, w - prefix - 8));
+            const toolNames = items.flatMap((item) => item.kind === "group" ? [] : [visibleWidth(item.name)]);
+            const nameWidth = Math.min(24, Math.max(...toolNames), Math.max(0, w - prefix - 10));
             items.forEach((item, index) => {
                 if (index === 0) output.push(theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}  Guarded (follows the file rules)`, w, "")));
                 if (index === 1) output.push(theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}  Trusted (runs outside the file rules)`, w, "")));
                 const selected = row === rows.length + index;
-                const ticked = item.kind === "guarded" ? !!settings?.subagentTools.applyPatch : isTicked(item);
-                const detail = item.kind === "guarded" ? "harness adapter" : [packageLabel(item.package),
-                    ...(isNetworkTool(item.name) ? ["needs Network On"] : []), ...(item.loaded ? [] : ["not loaded"])].join(" · ");
-                const text = `${prefix ? (selected ? "> " : "  ") : ""}  [${ticked ? "x" : " "}] ${cell(item.name, nameWidth)} ${detail}`;
-                output.push(theme.fg(selected ? "accent" : settings ? "text" : "dim", truncateToWidth(text, w, "")));
+                let text: string;
+                if (item.kind === "group") {
+                    const count = item.tools.filter(isTicked).length;
+                    const tick = count === item.tools.length ? "x" : count ? "-" : " ";
+                    text = `  ${expanded.has(item.id) ? "v" : ">"} [${tick}] ${item.label} ${count}/${item.tools.length}`;
+                } else {
+                    const ticked = item.kind === "guarded" ? !!settings?.subagentTools.applyPatch : isTicked(item);
+                    const detail = item.kind === "guarded" ? "harness adapter" : [
+                        ...(isNetworkTool(item.name) ? ["needs Network On"] : []), ...(item.loaded ? [] : ["not loaded"])].join(" · ");
+                    text = `${item.kind === "guarded" ? "  " : "      "}[${ticked ? "x" : " "}] ${cell(item.name, nameWidth)} ${detail}`;
+                }
+                output.push(highlight(theme.fg(selected ? "accent" : settings ? "text" : "dim",
+                    truncateToWidth(`${prefix ? (selected ? "> " : "  ") : ""}${text}`, w, "")), selected));
             });
             if (items.length === 1) {
                 output.push(theme.fg("dim", truncateToWidth(`${prefix ? "  " : ""}  Trusted (runs outside the file rules)`, w, "")),
@@ -282,13 +330,18 @@ export function createPermissionsPage(
             const contextual = tool ? (tool.kind === "guarded" ? GUARDED_HINT : TRUSTED_HINT)
                 : selected && settings ? cellHint(selected, settings[columns[column]!]) : undefined;
             for (const hint of [
-                "↑↓ Select row · ←→ Select column · Space Change · Enter Save · Esc Back",
+                "↑↓ Select · ←→ Column/fold · Space Toggle tool/group · Enter Fold/Save · Esc Back",
                 "Changes apply to new launches. Background tasks follow their launcher.",
                 "Stored credentials: known files only; excludes OS vaults and environment tokens.",
                 "Trusted tools run outside the file rules.",
                 ...(contextual ? [contextual] : []),
             ]) output.push(theme.fg("dim", truncateToWidth(hint, w, "")));
-            if (message) output.push(theme.fg(isError ? "error" : "muted", truncateToWidth(message.replace(/[\r\n]+/g, " "), w, "")));
+            if (message) {
+                const clean = message.replace(/[\r\n]+/g, " ");
+                const confirmation = /^(.*) (Press Enter again to save\.)$/.exec(clean);
+                const messages = confirmation && visibleWidth(clean) > w ? [confirmation[1]!, confirmation[2]!] : [clean];
+                for (const text of messages) output.push(theme.fg(isError ? "error" : "muted", truncateToWidth(text, w, "")));
+            }
             return output;
         },
     };

package/node_modules/pi-better-subagents/README.md

@@ -44,14 +44,14 @@ nontrivial role-owned task, while the foreground coordinates, integrates, and
 verifies. See [usage notes](docs/usage.md#delegation-mode).
 
 `agents_catalog` shows each role's and named agent's default model and effort,
-such as `role developer "Developer" … default openai/gpt-6-sol@high`. Roles are
+such as `role developer "Developer" … default openai/gpt-6.1-sol@high`. Roles are
 listed and passed by short name (`role: "developer"`); the stored id
 `role.developer` also works, and named agents keep their full id
 (`agent: "agent.payments"`). To launch on that default, omit
 `model` and `thinking` on a role or agent spawn; name one only for a stated
 reason. When a launch's model or effort differs from the default, its launch
 line says so, for example
-`model openai/gpt-6-astra@high (role developer default openai/gpt-6-sol@high)`.
+`model openai/gpt-6-astra@high (role developer default openai/gpt-6.1-sol@high)`.
 
 ## When To Use
 

package/node_modules/pi-better-subagents/catalog-runtime.ts

@@ -256,9 +256,9 @@ export async function clarifyCatalogRequest(
  * Launch-line note for a catalog run whose effective model or effort differs
  * from the role or agent default. The wording names the cause, so a fallback
  * or a capped effort is not mistaken for a caller override:
- * - override: `model openai/gpt-6-astra@high (role developer default openai/gpt-6-sol@high)`
- * - fallback: `model xai/grok-4.7@high (role developer default openai/gpt-6-sol@high unavailable; foreground fallback)`
- * - capped effort: `model openai/gpt-6-sol@medium (role developer default openai/gpt-6-sol@high; effort capped at medium by the model)`
+ * - override: `model openai/gpt-6-astra@high (role developer default openai/gpt-6.1-sol@high)`
+ * - fallback: `model xai/grok-4.7@high (role developer default openai/gpt-6.1-sol@high unavailable; foreground fallback)`
+ * - capped effort: `model openai/gpt-6.1-sol@medium (role developer default openai/gpt-6.1-sol@high; effort capped at medium by the model)`
  * Undefined for a non-catalog run, a definition with no default, or a launch
  * that matches the default. Only the fields the definition sets are compared.
  */

package/node_modules/pi-better-subagents/catalog-schema.ts

@@ -72,10 +72,10 @@ export const PARSER_LIMITS = {
  * runtime already uses. Tiers are catalog policy, not benchmark rankings.
  */
 export const APPROVED_ROLE_DEFAULTS = [
-    { id: "role.researcher", name: "Researcher", model: "openai/gpt-6-sol", effort: "medium", tier: "balanced" },
+    { id: "role.researcher", name: "Researcher", model: "openai/gpt-6.1-sol", effort: "medium", tier: "balanced" },
     { id: "role.explorer", name: "Explorer", model: "openai/gpt-6-luna", effort: "medium", tier: "efficient" },
-    { id: "role.product-manager", name: "Product Manager", model: "openai/gpt-6-sol", effort: "medium", tier: "balanced" },
-    { id: "role.developer", name: "Developer", model: "openai/gpt-6-sol", effort: "high", tier: "balanced" },
+    { id: "role.product-manager", name: "Product Manager", model: "openai/gpt-6.1-sol", effort: "medium", tier: "balanced" },
+    { id: "role.developer", name: "Developer", model: "openai/gpt-6.1-sol", effort: "high", tier: "balanced" },
     { id: "role.reviewer", name: "Reviewer", model: "openai/gpt-6-astra", effort: "medium", tier: "frontier" },
     { id: "role.architect", name: "Architect", model: "openai/gpt-6-astra", effort: "high", tier: "frontier" },
 ] as const;

package/node_modules/pi-better-subagents/docs/agent-catalog-operations.md

@@ -52,7 +52,7 @@ Codex applies the agent file's model and `model_reasoning_effort` ahead of the c
 
 `agents_catalog` accepts `list` and `inspect` only. It uses the same inspection view as `/agents show`. It has no write path. Launch remains `subagent_spawn` or the batch tool, with at most one `agent` or `role` selector. Those selectors are lifecycle's wiring, not this tool.
 
-A list line names a role by its short name (`role developer "Developer" …`), the form the `role` field takes; the inspect header, `identity.id`, and the structured `id` keep the stored id `role.developer`. Named agents show their full `agent.<slug>` id in both. Each list line and the inspect header end with the definition's default model and effort when one is set, such as `default openai/gpt-6-sol@high`: a role's own default, or a named agent's override or inherited role default. The structured view carries the same value as `defaults: { model, effort, label }`, or `null` when neither is set. A spawn that omits `model` and `thinking` uses it. When a catalog launch's model or effort differs from it, the launch line (and each batch job line) adds a note such as `model openai/gpt-6-astra@high (role developer default openai/gpt-6-sol@high)`; a named agent's note reads `agent default …`. Only the fields the definition sets are compared. The note names the cause: a fallback from an unavailable default reads `(role developer default openai/gpt-6-sol@high unavailable; foreground fallback)` (or `same-tier` / `configured-default`), and an effort the model cannot run adds `effort capped at <level> by the model`.
+A list line names a role by its short name (`role developer "Developer" …`), the form the `role` field takes; the inspect header, `identity.id`, and the structured `id` keep the stored id `role.developer`. Named agents show their full `agent.<slug>` id in both. Each list line and the inspect header end with the definition's default model and effort when one is set, such as `default openai/gpt-6.1-sol@high`: a role's own default, or a named agent's override or inherited role default. The structured view carries the same value as `defaults: { model, effort, label }`, or `null` when neither is set. A spawn that omits `model` and `thinking` uses it. When a catalog launch's model or effort differs from it, the launch line (and each batch job line) adds a note such as `model openai/gpt-6-astra@high (role developer default openai/gpt-6.1-sol@high)`; a named agent's note reads `agent default …`. Only the fields the definition sets are compared. The note names the cause: a fallback from an unavailable default reads `(role developer default openai/gpt-6.1-sol@high unavailable; foreground fallback)` (or `same-tier` / `configured-default`), and an effort the model cannot run adds `effort capped at <level> by the model`.
 
 ## Lifecycle attachment
 

package/node_modules/pi-better-subagents/docs/agent-catalog.md

@@ -16,7 +16,7 @@ id: role.developer
 name: Developer
 description: Implements a requested change in the existing system.
 defaults:
-  model: openai/gpt-6-sol
+  model: openai/gpt-6.1-sol
   effort: high
   tier: balanced
 ---
@@ -100,10 +100,10 @@ Model availability, same-tier fallback, and nearest-effort adjustment are not de
 
 | Role | Stored id | Name | Model | Effort | Tier |
 | --- | --- | --- | --- | --- | --- |
-| `researcher` | `role.researcher` | Researcher | `openai/gpt-6-sol` | medium | balanced |
+| `researcher` | `role.researcher` | Researcher | `openai/gpt-6.1-sol` | medium | balanced |
 | `explorer` | `role.explorer` | Explorer | `openai/gpt-6-luna` | medium | efficient |
-| `product-manager` | `role.product-manager` | Product Manager | `openai/gpt-6-sol` | medium | balanced |
-| `developer` | `role.developer` | Developer | `openai/gpt-6-sol` | high | balanced |
+| `product-manager` | `role.product-manager` | Product Manager | `openai/gpt-6.1-sol` | medium | balanced |
+| `developer` | `role.developer` | Developer | `openai/gpt-6.1-sol` | high | balanced |
 | `reviewer` | `role.reviewer` | Reviewer | `openai/gpt-6-astra` | medium | frontier |
 | `architect` | `role.architect` | Architect | `openai/gpt-6-astra` | high | frontier |
 

package/node_modules/pi-better-subagents/docs/agent-model-resolution.md

@@ -10,7 +10,7 @@ Normative rules are R3, R4, R8, and the resolver half of R10. Prose parsing and
 - It does not grant tools, sandbox modes, extensions, or presets. Inspection copies the catalog `capabilities` object (`grantedByCatalog: false`).
 - It does not call a provider. Availability is one `getAvailable()` snapshot from the foreground registry. `find()` only explains that a known model is outside that set.
 - It does not retry, and it does not substitute after a child has started. `automaticRetry` and `substitutionAfterStart` are false. `startupFailure.action` is `surface-error-no-retry-no-substitution`. A later provider initialization failure is a lifecycle error.
-- It does not invent tier candidates. Built-in tiers name the approved models and have empty candidate lists. `openai/gpt-6-sol`, `openai/gpt-6-luna`, and `openai/gpt-6-astra` are not substitutes.
+- It does not invent tier candidates. Built-in tiers name the approved models and have empty candidate lists. `openai/gpt-6.1-sol`, `openai/gpt-6-luna`, and `openai/gpt-6-astra` are not substitutes.
 
 ## Precedence
 

package/node_modules/pi-better-subagents/roles/role.developer.md

@@ -5,7 +5,7 @@ id: role.developer
 name: Developer
 description: Owns implementation and focused tests; excludes architecture policy and independent review.
 defaults:
-  model: openai/gpt-6-sol
+  model: openai/gpt-6.1-sol
   effort: high
   tier: balanced
 ---

package/node_modules/pi-better-subagents/roles/role.product-manager.md

@@ -5,7 +5,7 @@ id: role.product-manager
 name: Product Manager
 description: Owns user-visible requirements and acceptance criteria; excludes technical design and implementation.
 defaults:
-  model: openai/gpt-6-sol
+  model: openai/gpt-6.1-sol
   effort: medium
   tier: balanced
 ---

package/node_modules/pi-better-subagents/roles/role.researcher.md

@@ -5,7 +5,7 @@ id: role.researcher
 name: Researcher
 description: Owns external-source evidence and factual uncertainty; excludes repo mapping and changes.
 defaults:
-  model: openai/gpt-6-sol
+  model: openai/gpt-6.1-sol
   effort: medium
   tier: balanced
 ---

package/node_modules/pi-better-subagents/tier-policy.ts

@@ -49,13 +49,13 @@ export interface NormalizedTierPolicy {
 }
 
 /**
- * Approved model membership only. `openai/gpt-6-sol`, `openai/gpt-6-luna`, and
+ * Approved model membership only. `openai/gpt-6.1-sol`, `openai/gpt-6-luna`, and
  * `openai/gpt-6-astra` are not fallbacks for each other.
  */
 export const DEFAULT_TIER_POLICY = {
     tiers: {
         efficient: { members: ["openai/gpt-6-luna"], candidates: [] },
-        balanced: { members: ["openai/gpt-6-sol"], candidates: [] },
+        balanced: { members: ["openai/gpt-6.1-sol"], candidates: [] },
         frontier: { members: ["openai/gpt-6-astra"], candidates: [] },
     },
 } as const satisfies TierPolicy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-harness",
-  "version": "0.12.3",
+  "version": "0.13.0",
   "description": "Pi extension bundle for a write sandbox, subagents, background tasks, SSH, goals, and structured plans.",
   "license": "MIT",
   "type": "module",
@@ -23,7 +23,8 @@
       "extensions/background-tasks/index.ts",
       "extensions/ssh/index.ts",
       "extensions/goal/index.ts",
-      "extensions/plan/index.ts"
+      "extensions/plan/index.ts",
+      "extensions/minimal-output/index.ts"
     ],
     "image": "https://raw.githubusercontent.com/1aboveio/pi-better-harness/main/docs/images/package-gallery/pi-better-harness.png"
   },
@@ -47,13 +48,14 @@
   ],
   "scripts": {
     "prepack": "node ../../scripts/stage-harness-dependencies.mjs",
+    "typecheck": "tsc --noEmit --allowImportingTsExtensions --module NodeNext --moduleResolution NodeNext --target ES2022 --strict --skipLibCheck --types node extensions/minimal-output/index.ts extensions/minimal-output/hook.ts",
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
     "pi-better-background-tasks": "0.6.2",
     "pi-better-goal": "0.5.0",
     "pi-better-plan": "0.5.1",
-    "pi-better-sandbox": "0.7.3",
+    "pi-better-sandbox": "0.8.0",
     "pi-better-ssh": "0.1.1",
     "pi-better-subagents": "0.9.3",
     "smol-toml": "1.9.0",