pi-bro 0.25.1 → 0.27.0

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 All notable changes to pi-bro are documented here.
 
+## [0.27.0] - 2026-10-30
+
+### Highlights
+
+- `/bro remember-me` helps you write and explicitly approve personal memory entries with a short, scan-friendly statement and expandable context.
+- `about_user` lets the main Pi agent read an overview, find memories by topic, and unfold selected entries without extra model calls.
+- Memory-writing guidance preserves conditions, scope, source, exceptions, user attribution and unresolved conflicts across short and expanded views.
+
+### Added
+
+- Private Remember Me modal: `/save`, `/list`, `/expand`, `/edit`, `/delete`, `/new`, `/help`.
+- Versioned local store with stable IDs, validated entries, bounded file size, revision checks and atomic writes.
+- Focused tests and `docs/remember-me.md`.
+
+### Limits
+
+- Automatic semantic conflict detection depends on model judgment and is not exhaustive.
+- External CLI agents do not receive the main Pi `about_user` tool automatically.
+- The old `/bro preferences` file remains separate until a reviewed migration; no automatic import occurs.
+
+
+## [0.26.0] - 2026-10-20
+
+### Highlights
+
+- Run any Bro feature on **Pi itself**: a new `pi` backend drives an in-process Pi SDK session with your own Pi models and credentials. No extra CLI to install.
+- `/bro config` is now two steps: pick the backend, then its model. Esc steps back without saving.
+- Pi is the safest review option alongside Claude and Muse: Guided Review gets file-only tools and no shell.
+
+### Breaking
+
+- **pi-bro now requires Pi `>=1.3.0`** (previously `>=0.84.2`). The Pi backend is built on SDK APIs introduced after 0.84.2 — `SettingsManager.getSettings()`, `ModelRuntime.getAllModels()` and seeded `SessionManager.inMemory(cwd, { id }, entries)` (1.0.0), and the `disabledBuiltinExtensions` resource-loader option (1.1.0) — so an older host cannot load the extension at all. Update Pi before upgrading pi-bro; the five CLI backends need no other change. `pi-floor` in CI now pins 1.3.0, the oldest supported version.
+
+### Added
+
+- New `pi` backend for `explain`, `show`, `elevate`, `btw` (restricted and full), `advisor`, and Guided Review. It runs `createAgentSession` inside this process, uses your Pi model registry and configured credentials, and needs no CLI.
+- `/bro config` two-step picker: step 1 chooses the backend (Default for capability overrides, Agy, Claude, Grok, Codex, Muse, Pi), step 2 chooses that backend's model. Esc in step 2 returns to step 1 without saving; a selection only saves on a complete model pick. The Agy family list and the Pi catalog load independently, so `/bro config` works when Agy is offline.
+- Pi model choices come from your configured scoped models (`enabledModels`), falling back to every model with configured credentials. Virtual (`pi-virtual`) models are filtered out and cannot be selected.
+- A `/bro doctor` Pi section that checks the selected physical model, its auth and scope membership, the effective effort, and the curated tool set for each capability, all without a CLI spawn or a live model turn.
+
+### Changed
+
+- Guided Review accepts `pi` as a file-only backend (read/grep/find/ls, no shell) alongside Claude and Muse, and no longer treats it as a shell-capable sandbox. Its session also ignores the captured checkout's `.pi/settings.json`, `.pi/SYSTEM.md` and `.pi/APPEND_SYSTEM.md`, so a PR cannot steer settings or inject system instructions for the review. Host-untrusted workspaces get the same protection.
+- Pi `btw` keeps its side session in memory only (nothing written under `~/.pi/agent/sessions`), resumes it within the same mode and preferences, and drops it on a `/mode` switch or preferences change, matching Agy. An expired or evicted side conversation now fails loudly instead of silently restarting without its history.
+- Settings version 2 accepts `"backend": "pi"` with a `"<provider>/<id>"` model (split on the first `/` only). A malformed custom model ID is reported in the field instead of throwing out of `/bro config`.
+- Pi model choices come from your configured scoped models (`enabledModels`), falling back to every model with configured credentials. The catalog now includes models authenticated by runtime keys, so the picker offers everything a run can actually use. Virtual (`pi-virtual`) models are filtered out and cannot be selected.
+- Pi `btw` and `advisor` runs are raced against the deadline and cancellation latch, so an uncooperative provider can no longer hold the caller or start a model request after its deadline.
+- `/bro doctor` now computes and reports the effective Pi reasoning effort (`requested → effective` only when they differ) instead of claiming a clamp it never checked, and describes both BTW access modes. Scoped-model `:thinking` suffixes are honoured when the Bro effort is `default`.
+- Docs, README, and `/bro help` document the Pi backend and the two-step picker.
+
 ## [0.25.1] - 2026-10-19
 
 ### Highlights

package/README.md

@@ -49,6 +49,7 @@ For a first success, type this in Pi after setting up a backend:
 | `/bro` | Explains the agent's latest completed reply (requires one) |
 | `/bro btw What is a race condition?` | Asks a private side question |
 | `/bro show` | Draws the current session's recent conversation, if any |
+| `/bro grill-me Should agents talk freely to each other?` | Questions your assumptions privately, one at a time |
 | `/bro elevate Improve how we search company documents` | Find expert gaps before giving Pi a task |
 
 File and webpage examples need your own real path or URL; see [how to explain them](docs/features/explain.md#explain-a-document). For a step-by-step first run, see [Getting started](docs/getting-started.md).
@@ -60,8 +61,10 @@ File and webpage examples need your own real path or URL; see [how to explain th
 | `/bro`, `/bro text`, `/bro file`, `/bro url` | **[Explain](docs/features/explain.md).** A plain-language version of the agent's last reply, pasted text, a PDF/DOCX/Markdown file, or a public webpage. Three modes: `brief`, `balanced`, `faithful`. |
 | `/bro show` | **[Show](docs/features/show.md#bro-show).** The last few turns drawn as a shape (call tree, file tree, diff, pseudocode, a sequence diagram, or an HTML layout) instead of prose. |
 | `/bro elevate` or **Ctrl+Shift+E** | **[Elevate](docs/elevate.md).** Discover missing expert considerations, select useful improvements, and rewrite your task without submitting it. Shares BTW backend settings. |
+| `/bro remember-me [thought]` | **[Remember Me](docs/remember-me.md).** Privately clarify and approve short personal memories with unfoldable background. Agents can call `about_user` to read summaries and expand IDs. |
+| `/bro grill-me` | **[Grill Me](docs/grill-me.md) (experimental).** A private, opinionated decision interview: light, balanced or exhaustive; one question per round; `/consolidate` drafts a brief without ending the interview; `/insert-last-message` explicitly returns the latest reply to the editor. Uses BTW model settings; read-only restrictions vary by backend. |
 | `/bro btw` | **[Side questions](docs/features/btw.md#bro-btw-side-conversation).** A separate conversation seeded with recent context, so you can ask without interrupting the agent. ⚠️ [Full-permission mode](#what-leaves-your-machine) can edit files. |
-| `/bro guided-review <PR>` | **[Guided Review](docs/guided-review.md).** An explanation and quality assessment of a GitHub PR, with ranked findings, source evidence and private questions. Claude or Muse is recommended for untrusted PRs. |
+| `/bro guided-review <PR>` | **[Guided Review](docs/guided-review.md).** An explanation and quality assessment of a GitHub PR, with ranked findings, source evidence and private questions. Claude, Muse, or Pi is recommended for untrusted PRs. |
 | `bro_advisor` tool | **[Second opinion](docs/features/advisor.md#bro-advisor).** A tool your agent can call mid-task; a fresh backend process reviews the session snapshot, can inspect the workspace when needed, and returns advice to the agent. ⚠️ [Runs with permissions bypassed](#what-leaves-your-machine). |
 | `/bro config`, `/bro preferences` | **[Settings](docs/reference/settings.md#settings) and [preferences](docs/user-guide.md#preferences).** Pick the backend, model and effort per feature, and tell Bro how you like answers. |
 
@@ -72,11 +75,10 @@ Guided Review has its own [guide](docs/guided-review.md).
 
 ## Requirements
 
-- Pi `>=0.84.2` (tested on 0.84.2 and 1.2) and Node.js `>=22.19.0`.
+- Pi `>=1.3.0` and Node.js `>=22.19.0`.
 - macOS or Linux. Windows is untested; there, cancelling stops only the
   backend's direct process, not anything it started.
-- At least one backend CLI on your `PATH`, signed in once from your terminal.
-  You only need the one you use:
+- At least one backend on your `PATH`, signed in once from your terminal, **or the built-in Pi backend**. You only need the one you use:
 
 | Backend | CLI | Notes |
 | --- | --- | --- |
@@ -85,9 +87,10 @@ Guided Review has its own [guide](docs/guided-review.md).
 | [Grok Build](https://docs.x.ai/build/overview) | `grok` | Guided Review uses its read-only sandbox (shell-enabled). |
 | [Codex CLI](https://github.com/openai/codex) | `codex` | Guided Review uses its read-only sandbox (shell-enabled). |
 | [Muse Code](https://dev.meta.ai/docs/muse-code) | `muse` | Works for every feature; strict file-only inspection for Guided Review. |
+| **Pi** (in-process) | none | Runs a Pi SDK session inside this process using your Pi models and credentials. No extra install. Restricted features get no tools; Guided Review is file-only; the advisor and full-access BTW get workspace tools. |
 
 - Guided Review also needs Git and an authenticated [`gh`](https://cli.github.com/).
-  Claude or Muse is recommended for untrusted PRs (strict file-only inspection); Codex, Grok and Agy run with shell available under their sandbox, with an advisory.
+  Claude, Muse, or Pi is recommended for untrusted PRs (strict file-only inspection); Codex, Grok and Agy run with shell available under their sandbox, with an advisory.
 - [PiG](docs/pig-compatibility.md) support is experimental.
 
 ## What leaves your machine
@@ -101,21 +104,25 @@ which may keep it under their own policies. Paths below are under
 | Explain | The agent's last reply, your pasted text, or text extracted from your file or webpage, plus your preferences | Nothing; the last result stays in memory |
 | Show | User and assistant text from recent turns (no tool calls, tool results, reasoning or images), plus your preferences | Diagram pages in `pi-bro-<uid>/` in your system temp folder |
 | Side questions | Your questions and up to the last 8 turns of conversation text, plus your preferences | Nothing; the thread stays in memory |
+| Grill Me | Topic, interview turns, up to the last 8 main-session text turns and preferences; any workspace files the selected inspector reads | Nothing; interview and brief are in memory |
 | Elevate | Your objective, selected findings, all current-branch user/assistant text; Full also includes tool-call arguments and text results, and preferences | Nothing; the workflow stays in memory |
 | Guided Review | The PR description and diff, the files the backend reads, your questions, plus your preferences | Reviews and captured source in `bro-reviews/`, with no automatic cleanup |
 | Advisor | The agent's system instructions, tool list and whole conversation, including tool calls and results (reasoning and images omitted), plus your steering | Steering in `bro-advisor.md` and the session file |
 
 `/bro url` also connects straight to the website, which sees your IP address.
-Bro runs each CLI as you, with your environment. It never reads or copies Pi's
-provider credentials, but the CLI signs in its own way, which can include API
-keys set in your environment. Nothing Bro produces enters Pi's conversation
-unless you insert it, except advisor answers, which return to the agent as
-tool results.
+Bro runs each CLI as you, with your environment. It never reads or copies an
+external CLI's provider credentials, but a CLI signs in its own way, which can
+include API keys set in your environment. The built-in **Pi** backend is the
+exception: it runs in-process, so it reads your Pi `auth.json` and reuses your
+Pi provider credentials for the model you select. Nothing Bro produces enters
+Pi's conversation unless you insert it, except advisor answers, which return to
+the agent as tool results.
 
 > [!WARNING]
 > These run the backend in your workspace with its permission checks bypassed:
 > - **Advisor:** it can read, edit and run commands. "Advise, don't edit" is
 >   only an instruction.
+> - **Grill Me `/access full`:** explicitly opts into unrestricted workspace permissions. The no-edits prompt is not an access control.
 > - **BTW full-permission mode** (turned on with `/mode` inside BTW): it is
 >   meant to edit files and run commands.
 > - **Grok:** its sandbox is off except during Guided Review, which uses the
@@ -135,7 +142,7 @@ and [Privacy and safety](docs/reference/data-and-permissions.md#privacy-and-safe
 - No fallback: if the chosen backend, model or effort fails, Bro shows that
   backend's error instead of switching. → Run `/bro doctor`.
 - Elevate runs fresh restricted calls through the BTW model setting. Restricted does not always mean sandboxed; see [access and retention](docs/reference/data-and-permissions.md). The shortcut may not work in all terminals: use `/bro elevate` instead.
-- BTW threads and the last explanation live in memory only and clear on
+- BTW and Grill Me threads and the last explanation live in memory only and clear on
   reload or restart.
 - Guided Review runs in local interactive Pi only and does not post to
   GitHub.

package/docs/README.md

@@ -13,6 +13,8 @@ Start with what you want to do. The [README](../README.md) explains the product,
 - [Explain a local file](features/explain.md#explain-a-document) or [webpage](features/explain.md#explain-a-webpage).
 - [Visualize a conversation](features/show.md#bro-show) — Show diagrams.
 - [Ask a private side question](features/btw.md#bro-btw-side-conversation) — BTW.
+- [Remember personal context for agents](remember-me.md) — approved short memories, expandable background and the read-only `about_user` tool.
+- [Get grilled on a decision](grill-me.md) — one question at a time in a private modal, then copy a decision brief.
 - [Improve a request before sending it](elevate.md) — Elevate: discover expert gaps, choose improvements, rewrite the task.
 - [Investigate a PR](guided-review.md) — Guided Review.
 - [Get an agent's second opinion](features/advisor.md#bro-advisor) — Advisor; review its permissions first.

package/docs/getting-started.md

@@ -4,7 +4,7 @@ Pi-bro helps you understand agent replies, ask side questions, and review work w
 
 ## 1. Install
 
-You need **Pi**, Node.js 22.19.0 or later, and one supported backend CLI already installed and signed in (Agy, Claude, Grok, Codex, or Muse). See [requirements](../README.md#requirements).
+You need **Pi**, Node.js 22.19.0 or later, and one supported backend already installed and signed in (Agy, Claude, Grok, Codex, or Muse) — or the built-in **Pi** backend, which uses your Pi session's own models and needs no extra CLI. See [requirements](../README.md#requirements).
 
 ```sh
 pi install npm:pi-bro
@@ -44,4 +44,4 @@ See the [docs home](README.md) for detailed workflows.
 
 ## Data and access before you use Bro at work
 
-Bro sends your selected text and some context to the backend CLI and model provider you configure. BTW and the advisor have different access rules; some modes can read or change local files. Read [What leaves your machine](../README.md#what-leaves-your-machine) and the [backend access matrix](reference/data-and-permissions.md#backends-access-and-retention) before using private data. A model prompt saying 'do not access' is not a security boundary.
+Bro sends your selected text and some context to the backend CLI and model provider you configure. BTW and the advisor have different access rules; some modes can read or change local files. The Pi backend runs in-process but still sends the prompt to whichever Pi model provider you select. Read [What leaves your machine](../README.md#what-leaves-your-machine) and the [backend access matrix](reference/data-and-permissions.md#backends-access-and-retention) before using private data. A model prompt saying 'do not access' is not a security boundary.

package/docs/grill-me.md

@@ -0,0 +1,63 @@
+# Grill Me (experimental)
+
+[Docs home](README.md) · [Commands](reference/commands.md) · [Safety](reference/data-and-permissions.md)
+
+`/bro grill-me` opens an independent decision interview in Bro's modal, without adding turns to Pi's main conversation.
+
+```text
+/bro grill-me Should child agents communicate freely?
+/bro grill-me
+```
+
+With a topic, start a new interview. Without one, reopen the current interview or enter a topic inside the modal. A proposal prompts scrutiny; an open question prompts discovery. Bro offers reasoned pushback, then one question with lettered choices, including an open-ended alternative. Answer with a letter or your own words. Questions request a horizontal divider, a distinct **Question** heading, and exactly one **(Recommended)** option with a short reason. Recommendations are provisional; model adherence is not guaranteed.
+
+## How Bro works with you
+
+Grill Me is a **context-rich thinking partner**, not a review pipeline. It can help you discover a position from an open question or test a proposal you already have. If you propose a solution before explaining the problem, Bro looks for the goal and constraints that matter; when those are already clear, it uses them rather than repeating an intake checklist.
+
+Bro contributes options and reasons, asks about the most consequential choice still open, and may inspect relevant workspace material when its backend permits it. It should check available facts rather than guessing, ask *you* about preferences and trade-offs, and explain meaningful uncertainty. Good arguments can persuade Bro; it should not invent objections to prolong the interview.
+
+As the discussion develops, Bro treats your **agreed choices and reasons** differently from untested assumptions and Bro's own suggestions. You can correct or change a constraint in normal conversation. Bro should carry that change forward and avoid reopening settled ground without a reason.
+
+`/consolidate` captures the current position for a handoff, at whatever level of detail the topic warrants: goals, key constraints, endorsed decisions and why, material trade-offs, unresolved questions, and a next step. It does not promote Bro's recommendations into decisions you never made. You can consolidate early, then continue and consolidate again.
+
+This takes inspiration from the context-rich **Elephant** in Google's [Elephant–Goldfish Model](https://github.com/google/elephant-goldfish-model). Grill Me does **not** dispatch Goldfish reviewers, require a design document, or impose review/approval stages. It remains one dialogue in Bro's modal.
+
+## Controls
+
+| Command inside the modal | Effect |
+| --- | --- |
+| `/consolidate` | Generate a current decision brief. Does not end the interview or insert anything. |
+| `/insert-last-message` | Insert the latest completed Bro reply, including a consolidated brief, into an empty Pi editor **without sending**. No model call. |
+| `/depth light` | Quick, focused questioning |
+| `/depth balanced` | Default: material assumptions and trade-offs |
+| `/depth exhaustive` | Deeper alternatives, evidence and failure cases |
+| `/retry` | Retry the failed/cancelled operation, otherwise regenerate the latest reply. Never repeats insertion. |
+| `/new <topic>` | Start over after confirmation. Resets depth to balanced and access to inspection. |
+| `/access inspect` | Request inspection tools; enforcement depends on backend |
+| `/access full` | Request full permissions; requires typing `yes` after a warning |
+| `/help` | Show commands on demand; **Esc returns to the interview** |
+| Esc | Close and cancel active work; preserve completed discussion |
+
+Type `/` to see matching commands; keep typing to narrow suggestions and press **Tab** to complete the first match. Completion never submits. From help, Esc returns to the discussion; a second Esc closes the modal.
+
+For confirmation prompts, type `yes` to proceed; anything else cancels. Depth can change between replies without losing the discussion. There are no question quotas or finished/locked states. Consolidate whenever useful, inspect the brief, then explicitly insert it or continue talking. The brief includes the current position, reasons, objections, unresolved questions and next actions. Insertion never overwrites a draft or submits it.
+
+The old `/finish`, `/copy`, `/copy-all`, `/insert`, `/insert-all`, `/clear`, and entry depth flags have been removed from this experimental interface. BTW commands are unchanged.
+
+Grill Me uses the **BTW model/backend/effort** selection from `/bro config`, but has its own independent thread. The header shows depth and effective access; `/help` keeps the footer short. Full access and Agy write risks remain visible in the header even when another notice is shown.
+
+## Access, privacy and limits
+
+- Inspection uses the Guided Review backend path in your current workspace. Claude, Muse and Pi have file-only tools. Codex and Grok have read-only sandboxes with shell access. **Agy inspection can still write project files.** No-edit prompts are not security controls.
+- Full access can read, edit and execute commands. Bro instructs the model not to make changes, but cannot enforce that instruction. There is no automatic escalation.
+- Each turn makes a fresh backend call replaying the complete interview. Long interviews cost more and may exceed context limits; there is no hidden truncation or fallback.
+- The provider receives your topic, interview history, Bro preferences and up to eight recent main-session user/assistant text turns (40,000 characters). Captured context excludes tool calls/results, hidden reasoning and images. Backend tools can inspect additional workspace content.
+- Bro keeps the interview in memory, lost on reload, session change or exit. Backend/provider retention is separate; see [backend retention](reference/data-and-permissions.md#backends-access-and-retention).
+- Closing discards partial output, preserves completed replies, and restores cancelled input unless a newer draft exists. Retry preserves the previous reply until replacement succeeds. Cancellation cannot undo backend changes; descendant cleanup on Windows and abrupt host shutdown are not guaranteed.
+
+## Comparison
+
+BTW is for side questions. Elevate improves an assignment. Grill Me tests a decision through dialogue. Its advantage over a standalone questioning skill is modal isolation and explicit return to Pi, not a claim of smarter questioning.
+
+See the [evaluation record](plans/grill-me-evaluation.md). Historical live results predate the command redesign and multiple-choice guidance; they do not validate the revised experience.

package/docs/guided-review.md

@@ -6,7 +6,7 @@ The normal journey is: **open a PR → read and investigate → leave when satis
 
 ## Open a review
 
-Requirements: local Pi interactive mode, Git, authenticated GitHub CLI (`gh`), and a configured review backend (Claude or Muse is recommended for untrusted PRs). Run `gh auth status` to check GitHub authentication; `/bro doctor` checks Bro's selected backend setup and shows an advisory when the review backend uses a shell-capable sandbox, without proving GitHub access or model connectivity.
+Requirements: local Pi interactive mode, Git, authenticated GitHub CLI (`gh`), and a configured review backend (Claude, Muse, or Pi is recommended for untrusted PRs). Run `gh auth status` to check GitHub authentication; `/bro doctor` checks Bro's selected backend setup and shows an advisory when the review backend uses a shell-capable sandbox, without proving GitHub access or model connectivity.
 
 ```text
 /bro guided-review https://github.com/OWNER/REPO/pull/123
@@ -83,9 +83,9 @@ Use Overview → Regenerate guide only when you want a fresh explanation/assessm
 
 ## Access, privacy and storage
 
-Review never runs with full-access or bypass flags. **Claude and Muse provide strict file-only inspection** and are recommended for untrusted PRs: Claude runs with `--restricted`, Read/Grep/Glob only, `dontAsk`, safe mode and no MCP; Muse disables write, shell and web tools, foreign personal context and native session logs, without trusting repository rules. No model-run project tests, commands, Git or network tools are available on Claude or Muse.
+Review never runs with full-access or bypass flags. **Claude, Muse, and Pi provide strict file-only inspection** and are recommended for untrusted PRs: Claude runs with `--restricted`, Read/Grep/Glob only, `dontAsk`, safe mode and no MCP; Muse disables write, shell and web tools, foreign personal context and native session logs, without trusting repository rules; Pi runs in-process with `read/grep/find/ls` only, no shell, and an isolated session. No model-run project tests, commands, Git or network tools are available on Claude, Muse, or Pi.
 
-**Codex, Grok and Agy run with shell available inside their own sandbox**, and each sandbox is different: Codex and Grok apply a read-only sandbox (`codex exec --sandbox read-only --ephemeral`, `grok --sandbox read-only --permission-mode dontAsk`), while Agy's `--sandbox` only restricts terminal commands and still lets them write inside the project. All three inspect the captured checkout with a 10-minute review deadline, and **none is shell-free**. When one of these backends is selected for review, Bro shows an advisory during acquisition, in the live review workspace, and in `/bro doctor` (as a non-fatal informational note). Set the **review** override to Claude or Muse in `/bro config` for untrusted PRs; saved reviews remain readable with any backend. Unsupported/older CLI flags fail visibly; there is no bypass fallback.
+**Codex, Grok and Agy run with shell available inside their own sandbox**, and each sandbox is different: Codex and Grok apply a read-only sandbox (`codex exec --sandbox read-only --ephemeral`, `grok --sandbox read-only --permission-mode dontAsk`), while Agy's `--sandbox` only restricts terminal commands and still lets them write inside the project. All three inspect the captured checkout with a 10-minute review deadline, and **none is shell-free**. When one of these backends is selected for review, Bro shows an advisory during acquisition, in the live review workspace, and in `/bro doctor` (as a non-fatal informational note). Set the **review** override to Claude, Muse, or Pi in `/bro config` for untrusted PRs; saved reviews remain readable with any backend. Unsupported/older CLI flags fail visibly; there is no bypass fallback.
 
 Captured evidence is read from pinned Git blobs, so a shell-capable backend that writes inside the checkout cannot alter the code shown as evidence — but it can still change what it later reads, so treat very large changes with suspicion when using Agy.
 
@@ -108,7 +108,7 @@ One open writer per review is supported within a Pi process. Concurrent editing
 | Problem | What to do |
 | --- | --- |
 | GitHub unavailable when reopening | Use bare `/bro guided-review` to choose a saved review; the picker does not fetch |
-| Sandboxed shell review backend (Codex, Grok, Agy) | Advisory shown; choose Claude or Muse in `/bro config` for strict file-only inspection on untrusted PRs |
+| Sandboxed shell review backend (Codex, Grok, Agy) | Advisory shown; choose Claude, Muse, or Pi in `/bro config` for strict file-only inspection on untrusted PRs |
 | Git/gh authentication or fetch error | Read the acquisition error; check Git/`gh auth status`; retry explicitly |
 | Invalid/failed preparation | Changed files remain available; use Prepare guide to retry when ready for another call |
 | Failed regeneration | Current guide is kept; retry only if you want another call |

package/docs/reference/commands.md

@@ -35,6 +35,8 @@ text directly captures a new source the same way.
 | `/bro config` | Open settings for the shared backend/model/effort, explain mode, show turns, and per-capability (explain/show/btw/advisor/review) overrides. |
 | `/bro guided-review <PR number or URL>` | Automatically explain and assess a captured PR in local Pi, with source evidence and optional private questions. Opening the same PR restores its saved review. |
 | `/bro guided-review` | List saved reviews; `resume` is an alias. |
+| `/bro remember-me [thought]` | Start a private memory-writing conversation, browse and expand memories, and approve saves explicitly. [Guide](../remember-me.md). |
+| `/bro grill-me [topic]` | Private one-question-at-a-time decision interview. Supply a topic to start fresh; omit it to resume. `/consolidate` drafts a brief; `/insert-last-message` inserts explicitly without sending. `/help` lists modal controls. [Guide](../grill-me.md). |
 | `/bro elevate [request]` | Improve an assignment before execution. Discover up to five gaps, choose useful findings, and insert a revised request without submitting it. **Ctrl+Shift+E** can use your unsent draft. See [Elevate](../elevate.md). |
 | `/bro btw [question]` | Open a side conversation in a modal, seeded with recent main-session context. Starts conversation-only; type `/mode` inside to toggle full permission (read and edit the workspace) without losing the thread. |
 | `/bro advisor` | Quick notice of whether the executor's `bro_advisor` tool is available right now, pointing at `/bro config`, `/bro advisor-steer`, and `/bro doctor`. |

package/docs/reference/data-and-permissions.md

@@ -9,6 +9,10 @@ credentials, and does not copy credentials or rewrite backend configuration.
 Each backend and your model provider may retain sessions, logs, and request
 data under their own settings and policies.
 
+The **Pi** backend is the in-process exception: it does not spawn a CLI. It runs a
+Pi SDK session inside the host process using your own Pi model registry and its
+configured credentials, so it uses the same account route as your Pi session.
+
 | | Explain / show | BTW conversation-only | BTW full permission | Advisor | Guided Review |
 | --- | --- | --- | --- | --- | --- |
 | **Agy** | Temporary directory, Agy sandbox | Temporary directory, Agy sandbox | Workspace, permissions bypassed | Fresh workspace process, permissions bypassed | Captured checkout, Agy sandbox (shell and in-project writes allowed; advisory) |
@@ -16,6 +20,7 @@ data under their own settings and policies.
 | **Grok** | Temporary directory, **prompt instruction only** | Workspace, **prompt instruction only** | Workspace, permissions bypassed | Fresh workspace process, permissions bypassed | Captured checkout, read-only sandbox (shell-enabled; advisory) |
 | **Codex** | Scratch directory, read-only sandbox, ephemeral session | Workspace, read-only sandbox | Workspace, approvals and sandbox bypassed | Fresh workspace process, approvals and sandbox bypassed | Captured checkout, read-only sandbox, ephemeral (shell-enabled; advisory) |
 | **Muse** | Scratch directory, approval/write/shell disabled, no session log | Workspace, approval/write/shell disabled | Workspace, permissions bypassed (`--yolo`) | Fresh workspace process, permissions bypassed (`--yolo`) | Captured checkout; writes/shell/web disabled, no session log |
+| **Pi** | No tools at all (isolated in-process session) | No tools at all | Workspace, read/bash/edit/write (no nested delegation or MCP) | Workspace, read/bash/edit/write (no nested delegation or MCP) | Captured checkout, read/grep/find/ls only (no shell) |
 
 - Grok always runs explain, show, btw and the advisor with its sandbox off and
   permissions bypassed; its tools, hooks, skills, plugins, and MCP may remain
@@ -41,7 +46,15 @@ data under their own settings and policies.
   including across `/mode` switches. An Agy conversation stays bound to the
   workspace it started in, so after a `/mode` switch — or whenever a thread
   has turns but no native session ID — Bro starts a fresh native session
-  seeded with the main-session context and every earlier turn.
+  seeded with the main-session context and every earlier turn. Pi keeps its side
+  session in memory only (nothing is written under `~/.pi/agent/sessions`) and,
+  like Agy, drops it on a `/mode` switch.
+- Pi runs in-process with no CLI, no extensions, no skills, no prompt templates,
+  no context files, MCP or codemode, and auto-retry and compaction disabled. Its
+  Guided Review uses read/grep/find/ls only and cannot run shell commands, and it
+  ignores the captured checkout's `.pi/settings.json` so an untrusted PR cannot
+  steer the reviewing session. In restricted explain/show/elevate/btw it has no
+  tools at all.
 - Cancellation, deadlines, and invalid output streams stop the backend's
   process group on POSIX, escalating after a five-second grace period. On
   Windows only the direct child is targeted. Detached shell work or external
@@ -53,7 +66,7 @@ data under their own settings and policies.
 When resolving backend, model, and reasoning effort:
 1. **Per-capability override**: `overrides.<capability>` (`explain`, `show`, `btw`, `advisor`, or `review`) pins that capability's complete selection.
 2. **Shared default**: otherwise the capability inherits `default` (root `model`/`effort` in older flat files).
-3. **Agy catalog normalization**: for Agy selections, Bro maps suffixed variant IDs and handles fixed-effort models.
+3. **Backend-specific normalization**: Agy selections are mapped against its installed catalog (suffixed variants, fixed-effort models); Pi selections are `<provider>/<id>` physical models resolved against your Pi registry.
 4. **Initial file creation only**: `PI_BRO_MODEL` has no effect once the settings file exists.
 
 When resolving turn count for `/bro show`:
@@ -80,7 +93,8 @@ When shaping an answer, each part has one owner:
   seeded main-session conversation text (plus earlier turns when a native
   session is reseeded) to the selected backend. In full permission mode the
   side agent can additionally read and edit the workspace.
-- **Guided Review requests**: PR identity/description, captured diff, relevant private discussion and preferences go to the selected backend, which can inspect captured files. Main-session context is not attached. Claude (`--restricted`, file tools only) and Muse (write/shell/web disabled) use strict file-only inspection and are recommended for untrusted PRs. Codex and Grok inspect the captured checkout under a read-only sandbox; Agy's `--sandbox` still allows in-project writes. All three run shell commands and show an advisory. Prompt injection can still corrupt conclusions or reveal captured content to the provider; this is not a general confidentiality guarantee. See [Guided Review access and storage](../guided-review.md#access-privacy-and-storage).
+- **Grill Me requests**: `/bro grill-me` sends the user-supplied topic, their answers, the full private Grill Me transcript so far, preferences, and up to 8 recent main-session text turns (40,000 characters) to the BTW-selected provider. It runs **fresh** each turn in the current workspace, via the Guided Review *inspection execution path* (not the Guided Review UI or checkout). Claude, Muse and Pi use file-only tools; Codex and Grok use a read-only sandbox with shell; **Agy can still write inside the project**. The model is always told not to edit or run mutating commands, but that prompt is not enforced. Optional `/access full` explicitly uses a fresh, full-permission backend call and gives the backend unrestricted tools; it never happens automatically. Grill Me and BTW hold separate in-memory threads, and nothing enters the main agent unless the user inserts it into an empty editor. See [Grill Me](../grill-me.md).
+- **Guided Review requests**: PR identity/description, captured diff, relevant private discussion and preferences go to the selected backend, which can inspect captured files. Main-session context is not attached. Claude (`--restricted`, file tools only), Muse (write/shell/web disabled), and Pi (`read/grep/find/ls` only, in-process) use strict file-only inspection and are recommended for untrusted PRs. Codex and Grok inspect the captured checkout under a read-only sandbox; Agy's `--sandbox` still allows in-project writes. All three run shell commands and show an advisory. Prompt injection can still corrupt conclusions or reveal captured content to the provider; this is not a general confidentiality guarantee. See [Guided Review access and storage](../guided-review.md#access-privacy-and-storage).
 - **Preferences**: `bro-preferences.md` is sent with every explain, Show,
   BTW, Elevate, and Guided Review request to the selected backend. It is never sent to the advisor or
   to Pi's main model.

package/docs/reference/settings.md

@@ -32,7 +32,8 @@ Settings live in this user-editable file, created when the extension loads
   "showTurns": 1,
   "overrides": {
     "explain": { "backend": "claude", "model": "sonnet", "effort": "medium" },
-    "advisor": { "backend": "grok", "model": "grok-4.7", "effort": "high" }
+    "advisor": { "backend": "grok", "model": "grok-4.7", "effort": "high" },
+    "review": { "backend": "pi", "model": "anthropic/claude-sonnet-4-5", "effort": "high" }
   }
 }
 ```
@@ -47,7 +48,11 @@ Bro reads the file again before each request, so manual edits apply next time.
   model decide). Agy selections are normalized against Agy's installed model
   catalog. Claude, Grok, Codex, and Muse accept seeded or custom model IDs; a model/effort
   combination the account does not support fails with the backend's own error
-  instead of silently falling back.
+  instead of silently falling back. **Pi** selections are a `"<provider>/<id>"` pair
+  from your Pi model catalog, chosen from your configured scoped models
+  (`enabledModels`, falling back to every model with configured credentials).
+  Explicit Pi efforts are clamped to the model's supported reasoning levels; the
+  picker's own step 1 chooses the backend and step 2 the model.
 - `mode` is `brief`, `balanced` (the default), or `faithful`. `showTurns` is
   the default number of turns `/bro show` draws (default 1); `/bro show
   <n-turns>` overrides it for one run.
@@ -106,3 +111,7 @@ that is set):
 `bro-prompt.md`, the full prompt template from earlier versions, is no longer
 read. Move what you want to keep into `/bro preferences`, and choose
 `/bro mode brief` for the original ELI-simpleton instruction.
+
+## Remember Me
+
+`/bro remember-me` manages approved personal memories in `bro-memories.json` in the same user agent directory. Each entry has a stable ID, a scan-first short statement, and optional scope, exceptions, uncertainty and source context in an expanded view. The agent-facing `about_user` tool reads them on demand. `/bro preferences` remains a separate legacy file; no automatic migration or duplicate injection occurs. See [Remember Me](../remember-me.md).

package/docs/reference/troubleshooting.md

@@ -16,6 +16,11 @@ feature. Failed checks explain what to fix.
 - **Codex**: installed version and configured authentication.
 - **Muse**: installed version only; authentication and connectivity are not
   verified.
+- **Pi**: physical model catalog, configured authentication, scope membership,
+  effective reasoning effort, and each feature's tool set. Uses the in-process
+  SDK with host registrations and runtime credentials plus current on-disk
+  models/auth; workspace settings follow the host's trust decision. No CLI or
+  connectivity probe runs.
 
 Doctor never sends source text or runs a model completion. A successful check
 confirms the setup but cannot guarantee that a later provider request will

package/docs/remember-me.md

@@ -0,0 +1,90 @@
+# Remember Me
+
+[Docs home](README.md) · [Commands](reference/commands.md) · [Preferences](reference/settings.md#preferences)
+
+Use `/bro remember-me` to browse your approved personal memories, or `/bro remember-me <thought>` to start drafting from your words and recent Pi conversation.
+
+## Write through conversation
+
+Bro reviews your statement and existing memories. It may ask one material question, flag a competing entry, or propose a short statement with deeper background. **Nothing saves until you type `/save`.** You can reply normally to refine a proposal. When you correct it, the old draft remains visible but cannot be approved until Bro returns a revised proposal. Questions and failed model calls never silently re-enable `/save`.
+
+A proposed memory always has:
+- **Subject:** a distinct topic, such as Testing or Delegation
+- **Short statement:** active, clear and usable on its own; include qualifications that change its meaning
+- **Expanded background:** context, explanations and original wording; optional scope, exceptions, source context, uncertainty and whether wording reflects a user statement or user-approved interpretation
+
+Use the same vocabulary across related memories. Put useful distinguishing words first. Never convert “prefers lean tests” into “dislikes tests,” or “autonomy within an approved plan” into “unrestricted autonomy.” Summaries and expanded content must agree.
+
+If the user hasn't resolved a conflict, don't pretend it is settled. Bro shows a potential conflict in the proposal. The user decides whether to revise it, update an existing memory or save a qualified entry.
+
+## Controls
+
+| Input | Action |
+| --- | --- |
+| Free text | Continue clarifying or refining |
+| `/save` | Approve and persist the current proposal |
+| `/list [page|all]` | Page through the current search (20 per page), or use `/list all` to return to all memories; preserve the proposal |
+| `/search <words>` | Start a filtered search; `/list 2` continues its second page without dropping the proposal |
+| `/expand <id>` | Show background, source, scope, exceptions and uncertainty |
+| `/edit <id>` | Edit an existing memory while keeping its stable ID |
+| `/delete <id>` | Delete after typing yes |
+| `/context show|on|off` | See or omit the captured Pi context before transmitting |
+| `/confirm-revision` | Approve after comparing a stale proposal with changed memories |
+| `/new` | Discard the draft without changing saved memories |
+| `/help` | Explain commands and boundaries |
+
+Before the first model call, Bro identifies the selected model/backend, the captured main-session context, and that related saved memories and legacy style preferences will be sent. The initial thought is prefilled but not sent until the user presses Enter. Use `/context show` to inspect what was captured or `/context off` to omit it.
+
+Browsing and failed saves preserve the proposal. If the store changed after the proposal was reviewed, `/save` compares the original and current target (and related entries) and **does not save**. An explicit `/confirm-revision` approves against that exact new revision; if it changes again, another review is required. Durable drafts across restarts are not implemented.
+
+Esc closes the modal and cancels an active model call. The draft conversation is not durable; **approved saved memories are durable**. Saved entries survive Pi restarts and project changes.
+
+## Agent access
+
+The main Pi agent gets a read-only `about_user` tool:
+
+```text
+about_user()                         → short statements and IDs
+about_user({query:"testing"})        → matching summaries
+about_user({offset:20,limit:20})      → next page of memories
+about_user({expand:["m-..."]})       → approved background for an ID
+```
+
+The agent can scan a summary before deciding what to unfold. The reader performs no new model call. It does not mutate stored entries. The user's current request wins over a standing memory.
+
+## Boundaries
+
+Stored memories live in `~/.pi/agent/bro-memories.json` (or under `$PI_CODING_AGENT_DIR`), not project Git repos. Files are personal: keep private backups and avoid sharing them in logs. Selected model providers receive the words you provide to Remember Me, recent session text captured at opening, and existing memory statements for conflict checking. Read-only `about_user` returns only the requested summaries/expansions to the calling main Pi agent; that agent may send returned content to its model provider.
+
+**Agent access is currently the registered main Pi tool only.** External CLIs and isolated Bro sessions do not receive it automatically. The existing `/bro preferences` file remains unchanged; no automatic migration or conflict reconciliation is claimed.
+
+Remember Me uses **the backend and model selected for BTW**. Every valid BTW backend is supported through Bro's existing restricted **explain** execution path. It never silently changes provider or model. Restricted means different things across backends, not a universal promise of no tools or no side effects:
+
+| Backend | Current restricted drafting behavior |
+| --- | --- |
+| Agy (default) | `--sandbox`, temporary working directory. Sandbox limits shell actions; it is **not** a no-tools or no-write guarantee. |
+| Codex | `--sandbox read-only`, ephemeral execution and temporary working directory; read-only sandbox, **not** no-tools. |
+| Claude | CLI tools disabled with `--tools ""`, strict empty MCP config, temporary working directory, no session persistence. |
+| Pi | Fresh SDK session with no tools, extensions, skills, or project context files, using the **selected configured physical model**. |
+| Muse | Write and shell disabled, approvals disabled, temporary working directory. Do not infer that all other abilities are disabled. |
+| Grok | A restricted **prompt request**, but CLI sandbox off and permissions bypassed; it is **not** a technical tool/write boundary. |
+
+The modal shows a backend-specific notice before sending data. Bro's `/save` gate controls **only writes to its approved memory store**. It does not prevent any action that the selected backend's own permissions might allow. See [execution configuration](reference/settings.md) for backend details.
+
+Live model behavior and the actual backend installation are separate from controlled-response tests.
+
+**Coexistence policy:** `/bro preferences` remains active as a legacy *answer-style* file for older Bro features. `about_user` reads only approved Remember Me memories. Current user instructions take precedence. If an approved memory conflicts with legacy preferences, the approved memory is the source for the personal fact or lasting rule; do not treat two conflicting stores as equally authoritative. Bro should surface the disagreement during drafting. There is no silent migration or overwrite; a reviewed migration remains a separate task.
+
+## Examples
+
+**Short:** `Testing: Seek sufficient confidence at the lowest reasonable maintenance cost; do not optimize for raw test count.`
+
+**Expanded:** The user values tests that protect meaningful behavior and rejects needless duplication. This does **not** mean the user dislikes tests. Scope: project test strategy. Source: explicit user preference.
+
+**Short:** `Delegation: Allow agents to act independently within an approved coordination plan; reserve consequential scope changes for human approval.`
+
+**Expanded:** The user wants strong initiative after authorizing the plan, not unrestricted delegation. An agent can coordinate approved subtasks but should return for approval when changing agreed goals or major commitments.
+
+**Short:** `Answer length: Lead with a short answer; give enough detail for consequential design reviews. [Apparent tension: brevity versus depth depends on task.]`
+
+**Expanded:** “Keep answers concise” and “go deep on important trade-offs” are not necessarily conflicting. Their scope differs: routine replies versus material design decisions. Preserve that distinction rather than deciding the user dislikes detailed work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-bro",
-  "version": "0.25.1",
+  "version": "0.27.0",
   "description": "A sidekick for you and your Pi agent: plain-language explanations, side questions, diagrams, PR review and second opinions, without cluttering the agent's context.",
   "type": "module",
   "license": "MIT",
@@ -48,6 +48,12 @@
     "src/btw.ts",
     "src/elevate.ts",
     "src/elevate-engine.ts",
+    "src/grill.ts",
+    "src/grill-engine.ts",
+    "src/remember-store.ts",
+    "src/remember-engine.ts",
+    "src/remember-tool.ts",
+    "src/remember.ts",
     "src/explain-modal.ts",
     "src/review.ts",
     "src/review-source.ts",
@@ -72,6 +78,8 @@
     "docs/pig-compatibility.md",
     "docs/guided-review.md",
     "docs/elevate.md",
+    "docs/grill-me.md",
+    "docs/remember-me.md",
     "docs/examples.md",
     "docs/features",
     "docs/reference"
@@ -85,7 +93,7 @@
   "scripts": {
     "docs:check": "node scripts/check-docs.mjs && node --test test/docs-quality.test.mjs",
     "typecheck": "tsc --noEmit",
-    "test": "npm run typecheck && npm run docs:check && node .github/scripts/release-utils.mjs selftest && node --test test/elevate-docs.test.mjs test/elevate.test.ts test/review-ux.test.mjs test/review-doctor.test.mjs test/review-versions.test.mjs test/review-regeneration.test.mjs test/review-modal.test.mjs test/review.test.ts test/review-ui.test.mjs test/review-session.test.mjs test/helpers.test.mjs test/prompt.test.ts test/backend.test.ts test/claude.test.ts test/grok.test.ts test/codex.test.ts test/muse.test.ts test/settings.test.ts test/sources.test.ts test/release.test.ts test/show-html.test.ts test/smoke-rpc.test.ts test/ui-capabilities.test.ts test/modal-contract.test.mjs benchmark/*.test.ts && sh ./test/smoke-test.sh",
+    "test": "npm run typecheck && npm run docs:check && node .github/scripts/release-utils.mjs selftest && node --test test/elevate-docs.test.mjs test/elevate.test.ts test/grill.test.ts test/remember.test.ts test/remember-modal.test.mjs test/review-ux.test.mjs test/review-doctor.test.mjs test/review-versions.test.mjs test/review-regeneration.test.mjs test/review-modal.test.mjs test/review.test.ts test/review-ui.test.mjs test/review-session.test.mjs test/helpers.test.mjs test/prompt.test.ts test/backend.test.ts test/claude.test.ts test/grok.test.ts test/codex.test.ts test/muse.test.ts test/settings.test.ts test/sources.test.ts test/release.test.ts test/show-html.test.ts test/smoke-rpc.test.ts test/ui-capabilities.test.ts test/modal-contract.test.mjs benchmark/*.test.ts && sh ./test/smoke-test.sh",
     "benchmark:dry-run": "node benchmark/run.ts dry-run",
     "benchmark:run": "node benchmark/run.ts run",
     "benchmark:report": "node benchmark/run.ts report",
@@ -98,13 +106,15 @@
     "image": "https://raw.githubusercontent.com/tranhoangnguyen03/pi-bro/main/docs/images/social-preview.png"
   },
   "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-tui": "*",
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "1.2.0",
-    "@earendil-works/pi-tui": "1.2.0",
+    "@earendil-works/pi-ai": "1.3.0",
+    "@earendil-works/pi-coding-agent": "1.3.0",
+    "@earendil-works/pi-tui": "1.3.0",
     "@types/node": "^24.0.0",
     "typebox": "1.3.27",
     "typescript": "6.0.3"

package/src/advisor.ts

@@ -4,7 +4,7 @@ import type { ExtensionAPI, ExtensionContext, SessionEntry } from "@earendil-wor
 import { convertToLlm, getAgentDir, getMarkdownTheme } from "@earendil-works/pi-coding-agent";
 import { Container, Markdown, Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
-import { execute as executeBackend, type BackendSelection } from "./backend.ts";
+import { execute as executeBackend, setPiHostContext, type BackendSelection } from "./backend.ts";
 import { MAX_ADVISOR_STEERING_CHARS, buildAdvisorPrompt } from "./prompt.ts";
 import { type BackendName, readSettings, selectionForCapability } from "./settings.ts";
 import { errorMessage, isRecord } from "./util.ts";
@@ -376,7 +376,7 @@ export function advisorAttemptLabel(details: AdvisorToolDetails): string {
 		return `Bro advisor · ${details.model ?? "unknown model"} · ${Math.ceil((details.durationMs ?? details.elapsedMs) / 1_000)}s`;
 	}
 	const latest = details.activity?.at(-1);
-	const backendLabel = details.backend === "claude" ? "Claude" : details.backend === "grok" ? "Grok" : details.backend === "codex" ? "Codex" : details.backend === "muse" ? "Muse" : "Agy";
+	const backendLabel = details.backend === "claude" ? "Claude" : details.backend === "grok" ? "Grok" : details.backend === "codex" ? "Codex" : details.backend === "muse" ? "Muse" : details.backend === "pi" ? "Pi" : "Agy";
 	// "last reported" + freshness, never a claim about what the backend is doing right now and never
 	// "stalled" -- silence since lastActivityAt is not itself evidence of a stuck run.
 	const activityLabel = latest
@@ -404,6 +404,8 @@ export function registerAdvisorTool(pi: ExtensionAPI): void {
 			),
 		}),
 		async execute(_toolCallId, params, signal, onUpdate, ctx) {
+			// The in-process Pi backend needs the host registry; publish it before any consultation.
+			setPiHostContext(ctx);
 			const state = resolveAdvisorState(ctx.sessionManager.getBranch());
 			const durableSteering = await readAdvisorSteering();
 			const settings = await readSettings();