pi-jar 0.2.8 → 0.3.0

package/README.md

@@ -2,13 +2,13 @@
 
 A warm, role-aware TUI and workflow extension for [Pi](https://github.com/earendil-works/pi). pi-jar turns the terminal into a more expressive agent workspace with a living pixel-fire welcome, an adaptive composer, switchable **profiles**, first-class **plan**, **goal** and **role** workflows, tracked tasks, reviewable changes, background shells and parallel subagents.
 
-> Works with the current `@earendil-works/*` Pi API. Pi's core packages are peer dependencies (`"*"`), so pi-jar always runs against the Pi you have installed; it is tested against the latest release (0.87.x).
+> Works with the current `@earendil-works/*` Pi API. Pi's core packages are peer dependencies (`"*"`), so pi-jar always runs against the Pi you have installed; it is tested against Pi 1.2.0.
 
 ## See it in action
 
-![pi-jar welcome: pixel flame over the π, the hero message and workspace card, and the composer with Ember](https://raw.githubusercontent.com/ygrip/pi-jar/main/docs/assets/pi-jar-demo.gif)
+![pi-jar 0.3.0: logo, profile switching, welcome dismissal, jar_ask choices, bouncing Ember and split diff](https://raw.githubusercontent.com/ygrip/pi-jar/main/docs/assets/pi-jar-demo.gif)
 
-The showcase is captured from a real pi-jar terminal session: the torch-style `π`, animated flame and embers, live workspace state, tasks, roles and composer are the actual TUI rather than a mockup. Capture and media guidelines live in [docs/SHOWCASE.md](docs/SHOWCASE.md).
+[Watch the cinematic 77-second MP4](https://github.com/ygrip/pi-jar/blob/main/docs/assets/pi-jar-demo.mp4) for sharper text and the original soundtrack. The GIF is a shorter, silent preview. See actual profile switching, the welcome disappear after sending a prompt, and `jar_ask` choices. Terminal views are the real pi-jar TUI; model replies are scripted locally, and task, plan, code-change, mascot-reaction, idle-age and agent data are offline fixtures—not autonomous model execution. Recorded with isolated settings and no personal credentials, then framed with [fframes](https://fframes.studio). Details: [docs/SHOWCASE.md](docs/SHOWCASE.md).
 
 ## Highlights
 
@@ -25,7 +25,7 @@ The showcase is captured from a real pi-jar terminal session: the torch-style `
 | **Tasks & questions** | A Claude/omp-style `jar_todo` checklist with subtasks and per-task progress that the agent maintains itself, and `jar_ask` structured questions with options, multi-select and free-form answers. |
 | **Change review** | Every file the agent or its editing subagents change is remembered as it was; `/diff` (<kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>D</kbd>) shows changed files (each counted once) next to a colored diff, with accept or revert per file or all at once. |
 | **Background shells** | `jar_shell` runs dev servers, watchers and long tests in the background; watch/exit events wake an idle agent or reach it at the next safe turn boundary. Completion status appears immediately in the UI even during model reasoning. Running shells get a footer row; click it (or <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>A</kbd>) to tail or kill them. |
-| **Subagents** | The main agent becomes a moderator over a configurable retained pool (2, 4, 6, 8 or 16; default 2, or 4 in an opt-in Swarm profile). It delegates only when there are at least two independent chunks that each need about ten or more tool calls. `jar_delegate` starts `scout`, `fork` or sandboxed `worktree` agents and returns immediately, so the main agent can keep responding to user steering; Pi RPC event-bus messages deliver initial and resumed turn completions without polling. `jar_subagent` peeks, steers, asks BTW questions, pauses, resumes and stops them. Workers can exchange bounded structured Q/A through `jar_discuss`; worktree changes reach `/diff` only when the moderator stops a worker. |
+| **Subagents** | The main agent becomes a moderator over a configurable retained pool (2, 4, 6, 8 or 16; default 2, or 4 in an opt-in Swarm profile). It identifies substantial independent tasks before implementation and delegates when parallel ownership saves work, without requiring guessed tool-call counts. Use `scout` for external research, `fork` for contextual read-only review, and `worktree` for isolated implementation. `jar_delegate` starts `scout`, `fork` or sandboxed `worktree` agents and returns immediately, so the main agent can keep responding to user steering; Pi RPC event-bus messages deliver initial and resumed turn completions without polling. `jar_subagent` peeks, steers, asks BTW questions, pauses, resumes and stops them. Workers can exchange bounded structured Q/A through `jar_discuss`; worktree changes reach `/diff` only when the moderator stops a worker. |
 | **Sessions & history** | Recent sessions (with their goal and plan) on the welcome card, one click from resuming; <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>H</kbd> searches earlier prompts; pasted images show as chips under the composer. |
 | **Footer & themes** | Responsive footer (model, effort, session, cwd, context, RAM, cost, quota, goal, roles, branch, live subagents and shells) with unicode, [Nerd Font](https://www.nerdfonts.com) or ascii icons, and seven dark themes. |
 
@@ -122,20 +122,19 @@ The welcome stays until your first prompt, then dissolves (or hides immediately
 - **Image chips**: images you paste (<kbd>Ctrl</kbd>+<kbd>V</kbd>) or reference by path appear under the frame as `▣ pasted png · 1280×720 · 240 KB`.
 - **Prompt history search**: <kbd>Ctrl</kbd>+<kbd>Alt</kbd>+<kbd>H</kbd> fuzzy-searches every prompt in this session and the opening prompts of recent ones; <kbd>Enter</kbd> puts the pick in the composer to edit. <kbd>↑</kbd>/<kbd>↓</kbd> still walks Pi's history.
 - **Next-prompt suggestions**: when the agent finishes a request it proposes one likely next prompt (`jar_suggest`). It appears as dim ghost text in the empty input; <kbd>Tab</kbd> (or <kbd>→</kbd>, or a click on it) fills it in so you can edit and press <kbd>Enter</kbd>. Typing, sending, or a new run clears it. Toggle in settings.
-- **Ember the mascot** perches on the top-left of the input — the face sits in the border, the flickering tips just above:
+- **Ember the mascot** is an original shaded flame pet: **11 × 10 pixels** packed into **11 columns × 5 terminal rows**: a round, cute ember with a curled flame tuft, small 1 × 2 bean eyes, pink blush and a tiny mouth. It uses [pixel-pet's real raster/half-block approach](https://github.com/Namenomeaning/pixel-pet), not a decorative text face. No upstream code/assets or image protocols are required.
 
-  | Mood | Face | When |
-  | --- | --- | --- |
-  | idle / blink | `(•ᴗ•)` `(-ᴗ-)` | waiting for you; blinks every few seconds |
-  | happy / thinking | `(^ᴗ^)` `(°ᴗ°)` | the agent is generating |
-  | focused | `(>ᴗ<)` | a tool is running (sparks fly) |
-  | curious | `(•o•)` | a question or dialog is open |
-  | sleepy | `(-ω-)` | idle for two minutes (`z` rises) |
-  | oops | `(×_×)` | a run failed |
-  | proud | `(★ᴗ★)` | a goal was completed |
-  | poked | `(^o^)` | you clicked it |
+  | Mood | When |
+  | --- | --- |
+  | idle / blink | waiting for you; blinks every few seconds |
+  | happy / thinking | the agent is generating |
+  | focused / curious | a tool is running / a dialog is open |
+  | sleepy / error | idle for two minutes / a run failed |
+  | proud / poked | a goal completed / you clicked the pet |
+
+  Roomy terminals show the small pet above the composer, with a reserved mood-spark row: `zzz` when sleepy, `✦` on completion, and `?` while waiting. Happy, completed and poked moods squash and hop into the existing spark row; errors pout with puffed cheeks and a small huff. The six-row perch never moves the editor. There is no extra `Ember` name label. Below 60 columns or 24 rows it uses a compact face/crown. Motion-off freezes the entire sprite. Truecolor and 256-color rendering keep the same shaded silhouette. See [mascot rendering and visual research](docs/FLAME.md#ember-the-composer-mascot-srcmascotts).
 
-  The title also shows the active profile in parentheses, then Pi's session name (or a stable readable alias like `silver-lantern`): `mascot · (Default) silver-lantern`. Toggle the mascot in settings; `/jar composer off` restores Pi's editor with your draft intact.
+  The border shows the active profile in parentheses, then Pi's session name (or a stable readable alias like `silver-lantern`): `(Default) silver-lantern`. Toggle the mascot in settings; `/jar composer off` restores Pi's editor with your draft intact.
 
 ## Plan mode
 
@@ -183,6 +182,8 @@ Plan state is stored in the session branch, so reloading or navigating the tree
 - **Guard rails.** The loop pauses when you interrupt (<kbd>Esc</kbd>), a run fails, plan mode starts, the agent calls `jar_goal block` (it needs you), or the round budget runs out (default 8 automatic rounds per user message; settings → Pi → Goal auto rounds). A new message from you resets the budget. `/goal resume` continues.
 - The footer and welcome show progress: `◎ goal · Ship · 3/5 tasks · round 2/8 · auditing`.
 
+**Compaction and unfinished work:** Native automatic compaction preserves task/goal state and continues Pi's active request lifecycle. `jar_todo` tells the agent to resume unfinished authorized work after compaction, but a checklist alone does not schedule another model turn. Use `/goal <outcome>` when you want bounded, enforced continuation through implementation and audit. Manual `/compact` aborts the current run and pauses an active goal; use `/goal resume` when ready. Explicit stops, errors and round limits are not overridden.
+
 ## Model roles
 
 Roles map a purpose to a model. They live in `~/.pi/agent/pi-jar-roles.json` (Pi's agent directory), with optional per-project overrides in `<project>/.pi/pi-jar-roles.json`:
@@ -302,9 +303,8 @@ Providers cache a prompt as an ordered prefix: tools, then the system prompt, th
   ```
   Use `parent` with `append` to add a genuinely new subtask to active work; `start`, `done`, `open`, `edit`, `list`, `add` and `delete` remain available.
 - **`jar_ask`** — structured questions: numbered options with descriptions, single or multi-select, *Type your own answer* (multi-line, paste-friendly) and *Chat about this* to discuss before choosing.
-- **`/diff`** — review what the agent (and its editing subagents) changed since the first edit to each file: files with `+/−` counts on the left, a full-path header and numbered, colored diff on the right. Changed lines get a colored rail and tinted background, replaced lines highlight the changed words, code is syntax-highlighted for known languages, and collapsed regions are labeled `┄ N unchanged lines ┄`. `/` filters files; `t` switches unified and aligned side-by-side views (unified below 70 columns), `←`/`→` (or `[`/`]`) change the context from 0 lines to the whole file, `w` wraps long lines, and `n`/`p`, `Home`/`End` navigate. Large changes offer summary or explicit windowed review (`v`), with clearly labeled coarse fallback and existing safety limits—not arbitrary-file streaming. See [diff review](docs/DIFF-REVIEW.md). `a` accept (keep, stop tracking), `r` then `y` revert (restore the original, or remove a file it created), `A`/`R` for all. The footer shows `± N files · /diff` while anything is unreviewed; each file counts once no matter who edited it. Only `edit`/`write` changes inside the project are tracked; shell-made changes are not.
-- **Context diet (opt-in)** — `/jar settings` → **Pi** → **Context diet (prior-turn reasoning)**. Saved independently per profile; OFF by default. Removes eligible thinking blocks from completed earlier user turns only in outgoing context, never from stored history. In the same completed turn, a `read` result that a later read of the same range or a successful edit/write of the same file superseded becomes a one-line stub; each turn is rewritten only once, when it completes, so later prefix-cache hits are kept. Current reasoning signatures, user requests, tool call/result pairing and workflow state remain intact; ambiguous tool chains are left unchanged. Opaque signature character counts are diagnostics, not token savings.
-- **Context budget** — `/jar settings` → **Pi** → **Context budget** (`off`, `suggest` default, `compact`) and **Context budget limit** (80k–200k, default 120k). When the last call's prompt (input plus cache) passes the limit, the footer's context metric turns amber and `suggest` shows one notice per crossing (`/compact`, or `/new` for the next task). `compact` compacts once at the next safe point: right after a `jar_todo` item completes while work remains (the run stops after that turn, compacts, then continues with a hidden note), or when the run settles; it never cuts a tool chain. The footer shows the average cost per call over the last ten calls next to the total. A prompt after a finished task list in a large context suggests `/new`; a prompt after more than five idle minutes with over 100k context warns that the provider cache has probably expired. No keep-warm requests are sent.
+- **`/diff`** — review what the agent (and its editing subagents) changed since the first edit to each file: files with `+/−` counts on the left, a full-path header and OMP-inspired split-first **Before/After** diff on the right (unified below 70 pane columns). Changed lines get a colored rail and soft tinted background, replaced lines highlight changed words with a stronger tint, code is syntax-highlighted for known languages, and collapsed regions are labeled `┄ N unchanged lines ┄`. `/` filters files; `t` switches unified and aligned side-by-side views (unified below 70 columns), `←`/`→` (or `[`/`]`) change the context from 0 lines to the whole file, `w` wraps long lines, and `n`/`p`, `Home`/`End` navigate. Large changes offer summary or explicit windowed review (`v`), with clearly labeled coarse fallback and existing safety limits—not arbitrary-file streaming. See [diff review](docs/DIFF-REVIEW.md). `a` accept (keep, stop tracking), `r` then `y` revert (restore the original, or remove a file it created), `A`/`R` for all. The footer shows `± N files · /diff` while anything is unreviewed; each file counts once no matter who edited it. Only `edit`/`write` changes inside the project are tracked; shell-made changes are not.
+- **Context ownership** — pi-jar does not prune prior reasoning/tool results, impose a soft context limit, or abort/compact/resume work at task boundaries. The context meter and cache diagnostics remain passive. Pi's native compaction and explicit `/compact` (including the user-selected plan approval action) remain available. Retired `contextDiet` and `contextBudget` settings are ignored and dropped on the next settings/profile save; loading does not rewrite user files.
 - **Read hygiene** — a whole-file `read` (no offset/limit) of a file over 50 KB returns its first 400 lines with a note on how to continue. Opt-in **Repeated-read stub** (`/jar settings` → **Pi**): re-reading the same range of an unchanged file returns `[unchanged since read #N (312 lines); pass force: true to re-read]`. Any edit/write of the file, a changed file revision, compaction, branch navigation or a new session clears it.
 - **`jar_shell`** — `start` (optional `name`, `watch` regex, `notify`, task/service `purpose`, `waitMs` up to 30 s), `list`, `peek`, bounded `wait`, `output`, `kill`. Use plain `bash` for finite commands expected to finish in about two minutes; `jar_shell` is for services, watchers and long jobs. `start` with `waitMs` returns the exit code and output tail in one call when the job finishes in time (acknowledged, so no later notification), otherwise the output so far; Esc cancels only the wait. `output` returns only lines new since your last read (with counts of trimmed or skipped lines); `all: true` repeats the trailing window. ANSI-stripped logs have per-job caps and a 4 MiB aggregate budget; surfaced finished jobs compact to a 32 KiB tail. Live jobs retain useful tails and are never killed to reclaim logs. Watch/exit notifications are compact and coalesced; reads acknowledge observed events. Active model responses cannot be interrupted by a completion event: the UI previews status without consuming it, and model delivery waits for a safe boundary. When no useful work remains, use bounded `wait` for the relevant finite jobs rather than waiting for an automatic wake-up. Each running shell gets a footer row and an activity view (`/jar shells`) with `x` kill and `f` follow. All shells stop when the session ends.
 - **`jar_delegate`** — spawns retained, session-scoped subagents up to **Max subagents** in `/jar settings` (2, 4, 6, 8 or 16; default 2). Idle, paused and hibernated agents count toward this pool; over-cap batches are rejected. `/profiles` → **Create Swarm profile** copies the current settings with a pool of 4. `scout` is fresh/read-only, `fork` inherits conversation read-only, and `worktree` forks context into a path-guarded Git worktree. Settled retained agents close their Pi process after 30 seconds of quiet while keeping their private session and workspace; `resume`/`ask` relaunch that same session. Launch returns before startup or the first turn completes, including legacy one-shot `write: true` mode. Turn and stop events carry a summary of at most 400 characters plus changed files; all events pending at one boundary arrive as one `pi-jar.subagent` message, together with the moderator's unread discussion mail. `/roles` warns when the `scout` or `reviewer` role would run on the main model while a cheaper model is available.
@@ -323,7 +323,7 @@ Providers cache a prompt as an ordered prefix: tools, then the system prompt, th
 
 - **Appearance** — accent, motion, rounded composer, Ember mascot, next-prompt suggestions, pi-jar UI, icons (`unicode` default, `nerd` for a [Nerd Font](https://www.nerdfonts.com) terminal like omp's nerd preset, `ascii` for plain labels).
 - **Footer** — field visibility. In fullscreen mode the session name (or `sessions` for an unnamed session) opens the session picker and each subagent/shell row opens the activity view. SoL-Pi's savings status is not repeated in the footer (it already notifies).
-- **Pi** — mouse clicks (Pi fullscreen mode), copy on select, goal auto rounds, **Max subagents** (explicit choice then Save; default 2, existing saved values are kept), advisor, advisor gates (default off), context diet, cache diagnostics (default on), context budget and its limit, repeated-read stub.
+- **Pi** — mouse clicks (Pi fullscreen mode), copy on select, goal auto rounds, **Max subagents** (explicit choice then Save; default 2, existing saved values are kept), advisor, advisor gates (default off), cache diagnostics (default on), repeated-read stub.
 
 pi-jar preferences are saved in `pi-jar-settings.json` in Pi's agent directory; the Pi tab writes Pi's own settings.
 
@@ -337,7 +337,6 @@ Other extensions can publish teammate roles and quota windows through Pi's publi
 pi-jar/
 ├── extensions/index.ts   extension entry: wiring, welcome, footer, commands
 ├── src/
-│   ├── context-budget.ts context budget, per-call cost average, topic and cold-cache hints
 │   ├── cache-breaks.ts   prompt-cache break diagnostics: payload fingerprints, diff, usage correlation, JSONL log; cache-breaks-view.ts is its tab
 │   ├── flame.ts          pixel fire simulation
 │   ├── mascot.ts         Ember's moods and sprites

package/docs/DIFF-REVIEW.md

@@ -1,14 +1,15 @@
 # Diff review
 
-`/diff` is pi-jar's post-edit review UI: it inspects captured before/after content, then lets you accept (stop tracking) or explicitly confirm a revert. It is inspired by the split-pane, hunk-navigation and bounded-rendering ideas in [pi-show-diffs](https://github.com/xRyul/pi-show-diffs), but does not copy its code or change the tool pre-approval flow.
+`/diff` is pi-jar's post-edit review UI: it inspects captured before/after content, then lets you accept (stop tracking) or explicitly confirm a revert. Its split-first presentation and soft/strong change backgrounds follow [Oh My Pi's Git diff pane](https://github.com/can1357/oh-my-pi/blob/b91db66e9b0b65a2c977e6a5bc74b0f4b1d58d1c/packages/tui/src/apps/git/diff-pane.ts). Existing hunk-navigation and bounded-rendering ideas also draw on [pi-show-diffs](https://github.com/xRyul/pi-show-diffs). No upstream code is copied, and the tool pre-approval flow is unchanged.
 
 - Type `/` in the file list to filter by absolute/relative path or change status (content search is intentionally omitted to keep keystrokes bounded over large retained snapshots). Press Enter to keep the filter, Escape to clear it, and `n`/`N` to move through matching files.
 - The right pane starts with the selected file's absolute path and change summary.
 - Normal previews render a viewport of Git-style hunks. Each hunk header is preceded by a `┄ N unchanged lines ┄` label for the region it skips. `PgUp`/`PgDn`, `g`/`G`, `Home`/`End`, or the mouse wheel move through the preview; `n`/`p` jump hunks. Rendering windows the requested rows instead of constructing a rendered row for every file line.
-- `t` toggles unified rows and aligned side-by-side Original/Updated columns: within a replacement, the k-th removed line sits beside the k-th added line, and a longer side continues alone. Panes narrower than 70 columns keep the unified layout. Toggling keeps the hunk at the top of the viewport.
+- Wide panes open in aligned side-by-side **Before/After** columns with wrapping off, matching OMP's split-first defaults. `t` toggles unified rows and split columns: within a replacement, the k-th removed line sits beside the k-th added line, and a longer side continues alone. Panes narrower than 70 columns keep the unified layout. Toggling keeps the hunk at the top of the viewport. Split columns show one line number per side; unified rows retain old/new line-number gutters.
 - `←`/`→` (or `[`/`]`) step the context through 0, 1, 3 (default), 5, 10, 25 lines and the whole file. `w` wraps long lines onto continuation rows instead of truncating them; with wrapping, `End` shows the last full page.
-- Changed lines carry a colored `▌` rail and the theme's tool success/error background. For a replaced line pair, the changed words are shown in inverse video, computed by a bounded token LCS (lines that share no word, very long lines and coarse previews are not emphasized). Files whose language Pi recognizes are syntax-highlighted per line with the active theme; lines over 1,000 characters keep plain diff colours.
+- Changed lines retain a colored `▌` rail. Native truecolor themes blend the neutral tool background with the added/removed foreground colors: soft backgrounds cover the padded text body, and stronger backgrounds mark changed words. The blend strengths follow OMP (18% soft/42% strong on dark palettes, 24%/48% on light palettes); pi-jar uses the theme's neutral tool background because terminal canvas RGB is not exposed here. Themes without accessible RGB colors retain tool success/error backgrounds and inverse-video word emphasis.
+- Word changes use a bounded token LCS (lines that share no word, very long lines and coarse previews are not emphasized). Files whose language Pi recognizes are syntax-highlighted per line with the active theme; lines over 1,000 characters keep plain diff colours. Syntax resets restore active background/word emphasis instead of erasing it.
 - Changes over 256 KiB or 1,500 combined lines initially show summary counts. Press `v` to explicitly review a bounded preview or return to summary. Previews are capped at 100,000 combined lines per file. When exact LCS diff exceeds its existing CPU/memory budget, the full-review choice uses a clearly marked coarse replacement hunk that preserves common prefix/suffix and line order.
 - Safe revert tracking remains capped at 1 MiB per file and 8 MiB of retained baselines. Binary, oversized, or otherwise untracked files cannot be reverted from this UI. The summary does not imply content beyond those safety caps is reviewable.
 
-The implementation uses the pi-tui custom component and windowed split-frame renderer already used by pi-jar. Upstream visual reference: [xRyul/pi-show-diffs README](https://github.com/xRyul/pi-show-diffs#diff-review-ux), MIT-licensed: aligned split rows, intraline highlights, rail markers, labeled collapsed regions, adjustable context and wrapping. No upstream source was copied, and pi-show-diffs' pre-apply approval and inline editing are not part of `/diff`, which reviews changes after they are applied.
+The implementation uses the pi-tui custom component and windowed split-frame renderer already used by pi-jar. OMP reference pinned to commit `b91db66e9b0b65a2c977e6a5bc74b0f4b1d58d1c`: [`packages/tui/src/apps/git/diff-pane.ts`](https://github.com/can1357/oh-my-pi/blob/b91db66e9b0b65a2c977e6a5bc74b0f4b1d58d1c/packages/tui/src/apps/git/diff-pane.ts), specifically `palette()`, `#renderSide`, and `#renderLine`. Its split default, wrap-off default, padded soft backgrounds and stronger word backgrounds are the visual reference—not its Git patching or minimap features. Additional MIT-licensed reference: [xRyul/pi-show-diffs README](https://github.com/xRyul/pi-show-diffs#diff-review-ux) for aligned split rows, rail markers, collapsed regions, context and wrapping. No upstream source was copied. Pre-apply approval and inline editing are not part of `/diff`, which reviews changes after they are applied.

package/docs/EFFICIENCY_PLAN.md

@@ -40,18 +40,17 @@ Baseline: a 309-call, $6.34 session (`node scripts/session-cost.mjs 01a101ba-…
 
 | Change | Where | Effect |
 | --- | --- | --- |
-| Context budget (`suggest` by default at 120k; opt-in `compact` at a safe point) and average cost per call in the footer | `src/context-budget.ts` | Long sessions are compacted or split before every call re-sends 200k+ |
-| Topic-switch and cold-cache hints | `src/context-budget.ts` | `/new` for unrelated work; `/compact` before re-sending a large expired context |
+| Context controls retired in 0.3.0 | Pi owns compaction; pi-jar meters/diagnostics only observe | No prior-turn pruning, soft-limit notices or budget-triggered abort/compact/resume |
 | `bash` for finite commands; `jar_shell start` `waitMs`; incremental `output` | `src/shells.ts` | Short jobs take one call instead of start → output → wait, and repeated reads don't resend old output |
-| 400-line cap on whole reads of files over 50 KB; opt-in repeated-read stub; diet stubs superseded reads | `src/compact-tools.ts`, `src/context-diet.ts` | Smaller tool results and fewer duplicate reads in the context |
-| Pool default 2 (opt-in Swarm profile: 4); delegate only for ≥2 chunks of ≥10 tool calls | `src/settings.ts`, `src/delegate.ts`, `src/profile-ui.ts` | Fewer moderation round-trips |
+| 400-line cap on whole reads of files over 50 KB; opt-in repeated-read stub | `src/compact-tools.ts` | Smaller new tool results without rewriting previous turns |
+| Pool default 2 (opt-in Swarm profile: 4); route substantial independent tasks before implementation | `src/settings.ts`, `src/delegate.ts`, `src/profile-ui.ts` | Scouts research external references; worktrees implement without duplicate main-agent work |
 | Events: ≤400-char summary + changed files, one message per boundary, discussion mail inlined | `src/delegate.ts`, `src/discussion.ts` | Events shrink from ~1.9 KB to ~0.5 KB; no `list` call to read mail; no echoes of own messages |
 | `/roles` warns when `scout`/`reviewer` run on the main model while a cheaper one is available | `src/model-roles.ts` | Subagent calls move to a cheaper model |
 | Advisor gates off by default; loop threshold 4; re-reads, shell polls and test reruns are never loops | `src/advisor.ts` | No side calls from normal fix loops |
 | Cache-break diagnostics: one notice per costly prompt-cache break, `/cache-breaks`, a per-session JSONL log | `src/cache-breaks.ts`, `src/cache-breaks-view.ts` | The tool list, system section or message that forced a rewrite is named instead of guessed |
 | Rules moved into tool descriptions; `jar_plan_submit`/`jar_goal` active only in their mode | all tool modules, `src/tool-activation.ts` | Smaller fixed prompt (below) |
 
-Fixed prompt that pi-jar contributes, measured from Pi's built system message in RPC mode (same project, same Pi 1.0.4): the `rules` section went from 7,584 to 1,675 characters and `tools` from 1,773 to 1,476; two schemas (~900 characters) are no longer sent outside their mode. Tool descriptions and schemas grew by ~1.1k characters because the guidance moved there. Net: ~5k characters (~1.3k tokens) less on every call. That is modest next to context growth, so the context budget and shell/read changes carry most of the saving.
+Fixed prompt that pi-jar contributes, measured from Pi's built system message in RPC mode (same project, same Pi 1.0.4): the `rules` section went from 7,584 to 1,675 characters and `tools` from 1,773 to 1,476; two schemas (~900 characters) are no longer sent outside their mode. Tool descriptions and schemas grew by ~1.1k characters because the guidance moved there. Net: ~5k characters (~1.3k tokens) less on every call. These historical measurements do not establish current savings; context-budget controls were subsequently removed at the user's request.
 
 Cache breaks: an audit of a $30 session found ~68% of the cost was cache rewrites caused by prompt-prefix changes: tools activated mid-session (the cache read fell to 0 and ~230k tokens were rewritten per call), an extension replacing old tool results with placeholders (the read stuck at a mid-history offset), and one unexplained break at a user-turn boundary. Pi reports *that* a call missed the cache, not why. `src/cache-breaks.ts` fingerprints each provider payload (model, tools, system-prompt sections, messages; hashes and sizes only), finds the first segment where the previous request stopped being a prefix of this one, and joins that with the call's usage; a call whose cache read falls more than 4,096 tokens short of the previous prompt is a costly break. It only observes, and is on by default (`cacheDiagnostics`).
 
@@ -69,11 +68,11 @@ Not done: Pi's compaction thresholds and the user's own settings are left alone;
 
 | Item | Why |
 | --- | --- |
-| 1. Single Context Projector | The four `context` hooks (child automation filter, diet, plan, goal) are each one `customType` scan that allocates only when something is stale — negligible next to request serialization. Merging them couples independent modules for no measurable gain. Revisit only if `/jar perf` shows context hooks in a profile. |
-| 2. Context Diet v2 (`stripper` model, `DietSnapshot`) | A model-written summary replaces exact history with a lossy one, adds a side call per compression and duplicates Pi's own compaction. Needs its own design (fidelity, resumability, cache-hit impact) before code. |
-| 3. Diet-aware delegation | Depends on item 2. Today `scout` already starts fresh and `fork` is an explicit mode; changing the defaults alters subagent results. |
+| 1. Single Context Projector | The workflow `context` hooks (child automation filter, plan, goal) are each one `customType` scan that allocates only when something is stale — negligible next to request serialization. Merging them couples independent modules for no measurable gain. Revisit only if `/jar perf` shows context hooks in a profile. |
+| 2. Context Diet v2 (`stripper` model, `DietSnapshot`) | Retired, not planned: the user requested removal of pi-jar context rewriting as inefficient. Native Pi owns compaction. |
+| 3. Diet-aware delegation | Retired with context diet. `scout` already starts fresh and `fork` explicitly inherits context. |
 | 4. Strict utility roles | Side calls without a role use the current model by design (`askRole`); making them fail or go deterministic breaks advisor and commit messages for users without roles. Addressed instead by the one-time notice above. |
-| 10. Compact workflow history | Rewriting persisted session history is ruled out; provider context is handled by the cache-stable projection above. |
+| 10. Compact workflow history | Rewriting persisted session history is ruled out; pi-jar no longer projects prior-turn provider history. |
 
 ## Success criteria
 

package/docs/FLAME.md

@@ -32,23 +32,26 @@ The welcome ticks every 90 ms only while it is visible and motion is on. On term
 
 ## Ember, the composer mascot (`src/mascot.ts`)
 
-Ember is two layers:
+Ember is an original, shaded **11 × 10 pixel ember pet**, packed into **11 columns × 5 terminal rows** using `▀`/`▄` cells with independently colored upper/lower halves. Its round bulb body has a curled flame tuft, dark outline, orange shadow, golden face and pale highlight. The face sits low and wide for a cute read: small 1 × 2 bean eyes, pink blush and a one-pixel mouth (red and open when happy). Expressions fit within 3 × 2 eye patches. It sits above the composer without an `Ember` name label; the border retains only profile/session context.
 
-- a **face** in the composer's top border — always `( + three glyphs + )`, five columns wide in every mood, so the title never shifts;
-- **flame tips** on the row above the frame, five columns wide, aligned over the face.
+A full pet appears at **60+ columns and 24+ terminal rows**. A fixed extra row above it holds mood sparks: `zzz` for sleep, `✦` for completion and `?` for waiting, blank otherwise. Happy, completed and poked moods squash, hop one terminal row into the spark row, and settle. The spark returns when grounded. Errors pout with puffed cheeks and a short grounded huff; thinking glances sideways. Every pose preserves the same six-row perch, so the editor never jumps. Smaller terminals use a compact five-column face/crown (also with sleepy `zzz`); below 40 columns the crown is omitted. Draft expansion reserves the six-row perch, and mouse coordinates subtract its actual height. Clicking anywhere in the pet pokes it. Turning the mascot off removes every layer.
+
+`mascotPixels()` authors the raster and squash/pout poses; `mascotSprite()` packs it into terminal cells; `mascotSpark()` supplies the fixed-width mood marker; `mascotPerch()` owns the fixed-height hop layout. Truecolor terminals get the eight-color Ember palette; other terminals get corresponding ANSI 256-color cells. No image protocol, image assets, browser overlay, renderer dependency or extra animation loop is required.
+
+### Pixel-pet research
+
+[Pixel-pet](https://github.com/Namenomeaning/pixel-pet) (MIT) uses a real pixel raster—not decorative text faces. Its [`assets/slime.json`](https://github.com/Namenomeaning/pixel-pet/blob/main/plugins/pixel-pet/assets/slime.json) defines a 17 × 11 body, a layered color palette and eye/cheek anchors. [`hooks/pixels.ts`](https://github.com/Namenomeaning/pixel-pet/blob/main/plugins/pixel-pet/hooks/pixels.ts) stamps 3 × 3 expressions, props and companions onto a canvas; `encodeCells()` packs two pixels into each terminal half-block cell. Its SVG renderer is for Desktop.
+
+The initial five-column glyph-only adaptation was rejected during visual review. The revised Ember uses the raster, shading, eye-overlay and half-cell approach with original warm flame artwork; no upstream sprites or code are copied. Reference GIFs and a side-by-side raster comparison were inspected, in addition to layout/state tests. Tool-specific props and companion trails are not included in this version.
 
 Moods come from Pi's observed activity plus local timers:
 
-| Mood | Face | Tips | Trigger |
-| --- | --- | --- | --- |
-| idle | `(•ᴗ•)` | swaying `▴▲▴` | nothing happening |
-| blink | `(-ᴗ-)` | still | 180 ms, every 3–6 s at random |
-| happy / thinking | `(^ᴗ^)` / `(°ᴗ°)` | bouncing / orbiting `∙` | generating (alternates every few seconds) |
-| tool | `(>ᴗ<)` | sparks `*` `·` | a tool is running |
-| waiting | `(•o•)` | `?` | a dialog or question is open |
-| sleepy | `(-ω-)` | dimmed, rising `z` | idle for two minutes |
-| error | `(×_×)` | drooping `ˇ` | a run failed (3 s) |
-| complete | `(★ᴗ★)` | star and sparks | a goal was completed (4 s) |
-| poke | `(^o^)` | bounce | you clicked the face (1.5 s) |
-
-Faces and tips are painted from the flame palette (pale-gold eyes, orange shell, redder when upset) or theme colors without 24-bit color. One unref'd 240 ms timer drives expressions, and it requests a render **only when the sprite actually changes**. Motion-off stops the timer and shows a calm face; turning the mascot off removes both layers. Below 40 columns the tips row is dropped.
+| Mood | Full-sprite expression | Trigger |
+| --- | --- | --- |
+| idle / blink | single-pixel pupils / short horizontal eyelids | idle; 180 ms blink every 3–6 s |
+| happy / thinking | smiling eyes and mouth / side-looking pupils | generating; alternates every few seconds |
+| tool / waiting | inward-focused eyes / wide eyes and round mouth | running tool / dialog or question |
+| sleepy / error | lowered eyelids / pursed mouth and puffed cheeks | idle for two minutes / failed run (3 s) |
+| complete / poke | sparkling eyes and smile / surprised eyes and mouth | goal complete (4 s) / click (1.5 s) |
+
+Active poses use 600 ms frames driven by Pi's existing render cadence, never a separate active timer. Transient completion, poke and error reactions schedule only their remaining pose frames, ending at the flash deadline. Idle is deliberately calm between exact blink and sleep deadlines. Sleepy idle stops scheduling. Motion-off stops timers and freezes the **entire raster** to idle, even while a tool or error flash is active. Tests cover every pixel frame's dimensions/colors, truecolor and 256-color cells, responsive fallback, draft-height reservation, mouse mapping and motion-off stability. These checks prove mechanics; visual comparison is a separate review.

package/docs/INTEGRATIONS.md

@@ -80,7 +80,7 @@ pi-jar registers `/usage`, `/context`, `/cache-breaks` and `/advisor`. Pi keeps
 
 Every model call re-sends the whole context, so cost grows with session length far more than with the work done (see [EFFICIENCY_PLAN.md](./EFFICIENCY_PLAN.md#session-cost-reduction)). pi-jar never edits these files; apply them yourself if they fit:
 
-- **Compact earlier.** In `~/.pi/agent/settings.json` set `"compaction": { "reserveTokens": 140000, "keepRecentTokens": 20000 }`. With a 272k-window model this compacts around 130k instead of near the limit. pi-jar's context budget (`/jar settings` → Context budget) suggests `/compact` or `/new` at the same point, or compacts at the next finished task when set to `compact`.
+- **Own context explicitly.** Use Pi's `/compact` to carry a summary forward or `/new` for unrelated work. Native auto-compaction is controlled by Pi's settings, not pi-jar. pi-jar no longer strips prior-turn context or enforces a soft limit; it never changes your Pi compaction preferences.
 - **Enable heavy tool packages per project.** A package such as `pi-mono-figma` (~20 tools) sends every schema on every call; enable it only in projects that use it.
 - **Load each MCP server once.** Use codebase-memory either through the lazy `mcp` proxy **or** as direct tools, not both.
 - **Activate tools at startup, not mid-session.** Changing the tool list, the system prompt or an earlier message makes the provider re-process the whole prefix after it: an MCP server or tool package switched on halfway through a long session rewrote ~230k tokens on every call until the cache caught up. pi-jar announces costly cache breaks and `/cache-breaks` lists what changed (see [Cache break diagnostics](../README.md#cache-break-diagnostics)).

package/docs/SHOWCASE.md

@@ -17,6 +17,48 @@ The primary loop should make the product understandable without narration:
 
 ## Capture guidelines
 
-Keep the source capture in a dark terminal using a pi-jar theme. Crop dead time before the UI appears, avoid showing secrets or unrelated desktop chrome, and prefer a short loop over a full recording. The README version should be optimized for quick loading; the original recording can remain outside the repository.
+Keep the source capture in a dark terminal (a bundled pi-jar theme is preferred). Crop dead time before the UI appears, avoid showing secrets or unrelated desktop chrome, and prefer a short loop over a full recording. The README version should be optimized for quick loading; the original recording can remain outside the repository.
 
 The visual is supporting evidence, not the documentation itself. Every demonstrated feature should still be explained in the README or the focused docs.
+
+## Version 0.3.0 walkthrough
+
+- **MP4:** [`pi-jar-demo.mp4`](https://github.com/ygrip/pi-jar/blob/main/docs/assets/pi-jar-demo.mp4), 76.5 seconds, 1920 × 1080, 24 fps, H.264 + AAC, web-optimized (`faststart`), approximately 9.3 MB.
+- **README GIF:** [`pi-jar-demo.gif`](https://raw.githubusercontent.com/ygrip/pi-jar/main/docs/assets/pi-jar-demo.gif), a condensed 48-second loop at 1280 × 720 and 12 fps, 256 colors, approximately 11.4 MB. Silent, as GIFs are.
+- **Film:** the actual flame-over-π pi-jar logo vectorized for the opening, warm/violet glow, eased reveals, terminal closeups, chapter captions and an original synthesized score. Both exports show profile switching, sending a prompt that dismisses the welcome, real `jar_ask` choices, the cute bean-eyed Ember, celebration hops, pouting, plan review, tasks, split diff, delegation activity and sleepy `zzz`. The MP4 also includes settings and unified diff.
+
+Local exports are `docs/assets/pi-jar-demo.mp4` and `docs/assets/pi-jar-demo.gif`. README media uses hosted repository URLs so npm installations do not carry roughly 21 MB of video assets. Hosted links reflect the committed/uploaded repository version; local exports are the review source before publication.
+
+### What is real, and what is a fixture
+
+The recording runs the current extension in Pi and captures its actual terminal rendering, including the raster mascot, animated welcome, native settings/profile dialogs, `jar_ask`, plan view, task editor, split diff and activity view. The profile picker really selects Focus; `/profiles Swarm` switches again, and `/profiles Default` returns before the first prompt locks the session profile. Sending “Give me three tiny weekend project ideas and let me pick one.” dismisses the welcome through the normal lifecycle. fframes supplies the surrounding logo/title card, frame and progress bar.
+
+A scripted localhost-only provider responds to the real prompt with a `jar_ask` tool call; the real tool presents options and consumes the recorded selection. Its replies are deterministic fixture data, not inference by an external model. Task and plan content, the small `ember.ts` change, completion/error reactions, idle age for the sleepy shot, and three completed agent records are also offline fixtures. The activity scene explicitly says no model or child agent was started. Footer roles come from the existing labeled `/jar demo` mode. This is a UI walkthrough, not a claim that an agent autonomously implemented or verified the illustrated change. Goal execution, real child-process execution, network quota lookups and every possible panel are not demonstrated.
+
+### Isolation and rendering
+
+Install the video skill in a fresh temporary directory, not the repository or personal agent directory:
+
+```bash
+mkdir -p /tmp/pi-jar-feature-demo
+cd /tmp/pi-jar-feature-demo
+npx --yes skills add https://fframes.studio --yes --agent pi
+```
+
+The capture used a separate project, `HOME`, `PI_CODING_AGENT_DIR` and session directory, with normal extension/skill/prompt/theme discovery disabled and only the recording driver loaded explicitly. The driver loads a snapshot of pi-jar and sends the recorded prompt only to a scripted provider bound to `127.0.0.1` on an ephemeral port. No external model/API requests occur. Pi and the local provider are terminated and reaped after capture. No personal auth, sessions or other extensions enter the recording. Only the exported MP4 and GIF belong in the repository; source capture, video project, Cargo build products and installed skills stay outside it.
+
+The actual toolchain was asciicast → `agg` → FFmpeg terminal MP4 → fframes 1.2.0 Rust/SVG + Skia/Metal render → FFmpeg web MP4 and condensed GIF. The revised capture uses a 128 × 40 terminal, the smaller mascot and no name label. Original music is synthesized from oscillators, pulses and transition swells; no third-party audio is used. Encoded audio was measured at about −14.2 LUFS and −3.7 dBTP, without clipping. The terminal uses Pi's dark theme. fframes reads the terminal MP4 through a runtime `MediaDirectory`; video cannot be placed in its compile-time `include_media_dir!` folder, which holds the font.
+
+In the prepared fframes project, inspect representative frames before rendering:
+
+```bash
+cargo run --release -- frame 1.5s,17s,23s,25s,28s,35s,39s,70s
+cargo run --release -- render
+ffmpeg -i out.mp4 -c copy -movflags +faststart pi-jar-demo.mp4
+```
+
+For a full-length GIF, use `fps=12,scale=1280:-1:flags=lanczos`, a 256-color `palettegen`, and `paletteuse=dither=none:diff_mode=rectangle` with `-an -loop 0`. The README's 48-second preview instead concatenates MP4 ranges **0.5–5.5, 13–20.5, 21.5–33, 34.5–42, 43–46, 49.5–52.5, 54–57, 63–65, 69.5–72.5 and 74–76.5 seconds** before applying that palette pipeline. Reset each trimmed range's timestamps before concatenating.
+
+Pad the source terminal clip through the entire film's final frame; a shorter clip makes fframes return an empty SVG at the end. Avoid CSS color names such as `violet` as SVG IDs in fframes 1.2.0's compile-time macro; use a non-color identifier such as `violetGlow`.
+
+The media was fully decoded. The logo, profile picker and switched profile labels, welcome before/after submission, `jar_ask`, mascot pose strip, and representative plan/diff/activity/sleep and final GIF frames were visually inspected. fframes inspected 307 frames without diagnostics. `ffprobe` verifies duration, dimensions and frame rates. No remote upload or publication is part of this workflow.

package/docs/SUBAGENT-TOOLS.md

@@ -16,6 +16,7 @@ Subagents use Pi's standard `--tools` allowlist. Each `jar_delegate` task can cu
 - `skills` (per task) uses the same syntax for Pi skills, by name or path: `["mom", "punakawan"]` (or `[]`) is exact, `["-lavish"]` removes from the defaults; omit it to keep the defaults. Children then run `--no-skills --skill <path>...`.
 - `inheritTools: true` snapshots the parent's currently active tool names, then filters them for mode safety plus the trusted extras from `pi-jar-subagents.json`. It does not grant tools registered later. Pi hosts must expose `getActiveTools()` (or the integration must supply an active-name getter); otherwise inheritance/configurable lists fail with an actionable error.
 - Inherited `scout`/`fork` tools are known read-only/discovery tools, named web tools and trusted extras.
+- `worktree` can **read** its selected skill instructions and relative references inside their skill directory. Grants come only from the resolved, deny-filtered child skill list—not all discovered resources. Standalone Markdown skills and symlinked instruction files grant only that file. Traversal, Git administrative paths, and symlinks escaping a granted directory are rejected; `edit`, `write`, search/list tools and multi-file edits remain workspace-confined. Extension/package roots are never added to this read exception.
 - `worktree` rejects shell tools even when explicitly requested (a shell would escape the path guard). Inherited worktree tools are path-guarded file tools, named web tools and trusted extras. `multi_file_edit` is included in defaults only when active in the parent; each effective edit target, default path and recognized alternate path field is validated, including traversal and existing symlink escapes.
 - Named web capabilities are `web_enable`, `web_search`, `fetch_content`, `get_search_content` and `source_check`. Newly enabled tools must still be in the child's original capability list.
 - These are tool-call restrictions, not an OS sandbox. Extensions execute trusted code; named web tools can access external services, and legacy direct-write mode is not workspace-confined.
@@ -24,6 +25,10 @@ Subagents use Pi's standard `--tools` allowlist. Each `jar_delegate` task can cu
 
 Retained scout/fork/worktree children hibernate after 30 seconds idle: their Pi process exits, but the private child session and worktree remain for `jar_subagent resume` or `ask`. Hibernated records count against Max subagents. Unresolved worktree recovery records do not occupy a pool slot, but at most four active/recovery worktrees are admitted. `jar_subagent stop` retries reconciliation; `discard` explicitly removes an unresolved recovery workspace without applying it. On session shutdown pi-jar reports paths for worktrees it preserves on disk, including still-active worktrees that might contain edits.
 
+## Research before implementation
+
+Use `scout` for external docs and other repositories, `fork` for a review that needs the conversation, and `worktree` for isolated edits. Give the scout the needed active web tools explicitly, including `web_enable` if bootstrap is required, then pass its findings to the implementer. Do not send a worktree worker to browse arbitrary local paths or run verification commands: the moderator runs checks after reconciliation. Initial main-agent routing guidance is present before a fleet exists; substantial independent tasks no longer require guessing a minimum tool-call count.
+
 ## `~/.pi/agent/pi-jar-subagents.json`
 
 User-owned and profile-independent; read on every launch. A missing file means no rules; malformed content fails the launch with an error. Each list takes `+entry` (or bare `entry`) to allow and `-entry` to disallow; a disallow wins over an allow, and user disallows always win over the moderator's task requests (which are then rejected with an error).
@@ -40,6 +45,7 @@ User-owned and profile-independent; read on every launch. A missing file means n
 - `extensions` — entries are Pi package sources (`npm:@scope/name`, `git:host/owner/repo`, URLs), short names (npm package, git repo, a top-level extension file/dir name, or a builtin such as `mcp`), or paths (`~/`, absolute, `./`, or `dir/file` relative to the agent dir). Sources and names resolve to the installed paths from the parent's own Pi resolution (settings filters included); an allowed source that is not installed is passed to Pi as-is (Pi installs it temporarily, slower).
   - allow: loaded by every child. Default read-only scouts/forks run `--no-extensions` plus pi-jar for fast startup, so a provider extension such as Anthropic OAuth compatibility must be allowed here or those children fail authentication. Children with normal discovery get it added only when it is not already loaded.
   - disallow: children that would use normal discovery instead get `--no-extensions` plus the parent's enabled extensions (top-level, packages and enabled builtins) minus the disallowed ones. A parent started with `--no-extensions` never gains discovered extensions.
+- **Plugins/packages** use Pi's `extensions` list; there is no separate plugin loader. Grant both the extension that registers a capability and the needed active tool names. Loading an extension is permission to execute trusted code, not just read documentation.
 - `skills` — names or paths. allow: added to children's default skills, even when disabled in the parent. Disallow: never loaded by children; a task asking for one is rejected. When any skill rule (config or task) applies, children get an exact `--no-skills --skill ...` list; otherwise Pi's normal discovery is unchanged.
 - The running pi-jar is always loaded explicitly; another installed pi-jar copy is never loaded twice.
 

package/extensions/index.ts

@@ -26,7 +26,6 @@ import { fetchQuota, QuotaCache, type QuotaProvider } from "../src/quota.ts";
 import { ModelRoleManager } from "../src/model-roles.ts";
 import { jarCommit } from "../src/commit.ts";
 import { registerAdvisor } from "../src/advisor.ts";
-import { registerContextDiet } from "../src/context-diet.ts";
 import { registerCacheBreaks } from "../src/cache-breaks.ts";
 import { registerInfoPanels } from "../src/info-panels.ts";
 import { SideUsage } from "../src/side-model.ts";
@@ -39,7 +38,6 @@ import { manageTasks } from "../src/tasks-ui.ts";
 import { registerTaskTool } from "../src/task-tool.ts";
 import { TASK_ENTRY, TodoStore, todoTotals } from "../src/tasks.ts";
 import { formatCost, sessionCost } from "../src/usage.ts";
-import { branchCalls, compactForBudget, CONTEXT_CONTINUATION, ContextBudgetGuard, providerCall, resumeAfterBudget } from "../src/context-budget.ts";
 import { WorkingState } from "../src/working.ts";
 import { ChangeTracker } from "../src/changes.ts";
 import { CHILD_ENV, DelegateRegistry, registerDelegate, SUBAGENT_MESSAGE, type DelegateRun } from "../src/delegate.ts";
@@ -55,7 +53,7 @@ import { registerChangeReview } from "../src/diff-view.ts";
 import { registerShells, ShellManager, type ShellEvent, type ShellJob } from "../src/shells.ts";
 import { registerShellNotifications } from "../src/shell-notifications.ts";
 import { loadResourceCatalog } from "../src/subagent-resources.ts";
-import { CHILD_TOOLS_ENV, childToolAllowlist, loadSubagentConfig, RECURSIVE_TOOLS, worktreeToolViolation } from "../src/subagent-tools.ts";
+import { CHILD_SKILL_READS_ENV, CHILD_TOOLS_ENV, childSkillReadRoots, childToolAllowlist, loadSubagentConfig, RECURSIVE_TOOLS, worktreeToolViolation } from "../src/subagent-tools.ts";
 import { hopefulWelcomeMessage, welcomeHit, welcomeLines, type WelcomeAction } from "../src/welcome.ts";
 
 const WELCOME_KEY = "pi-jar.welcome";
@@ -75,7 +73,7 @@ export default function piJar(pi: ExtensionAPI): void {
     // and handlers are disabled. Remove only parent automation, not task/user context.
     const parentAutomation = new Set([
       "pi-jar.goal-context", "pi-jar.goal-continuation",
-      "pi-jar.plan-context", "pi-jar.plan-reminder", "pi-jar.moderator-context", SUBAGENT_MESSAGE, DISCUSSION_NOTICE, CONTEXT_CONTINUATION
+      "pi-jar.plan-context", "pi-jar.plan-reminder", "pi-jar.moderator-context", SUBAGENT_MESSAGE, DISCUSSION_NOTICE, "pi-jar.context-continuation"
     ]);
     pi.on("context", (event) => {
       const messages = event.messages.filter((message) => !parentAutomation.has((message as { customType?: string }).customType ?? ""));
@@ -84,6 +82,7 @@ export default function piJar(pi: ExtensionAPI): void {
   }
   if (delegatedChild) {
     const allowed = childToolAllowlist(process.env[CHILD_TOOLS_ENV]);
+    const skillRoots = childSkillReadRoots(process.env[CHILD_SKILL_READS_ENV]);
     pi.on("tool_call", (event, ctx) => {
       // Enforce capabilities per call as well as CLI startup. A web/MCP bootstrap must not
       // accidentally activate unrelated tools or permit recursive orchestration.
@@ -91,7 +90,7 @@ export default function piJar(pi: ExtensionAPI): void {
         return { block: true, reason: "Tool was not granted to this subagent: " + event.toolName };
       }
       if (delegatedWorktree) {
-        const reason = worktreeToolViolation(delegatedWorktree, ctx.cwd, event.toolName, event.input);
+        const reason = worktreeToolViolation(delegatedWorktree, ctx.cwd, event.toolName, event.input, skillRoots);
         if (reason) return { block: true, reason };
       }
     });
@@ -134,15 +133,6 @@ export default function piJar(pi: ExtensionAPI): void {
     if (footerTui && footerSettings.quota) quotaCache?.refresh(ctx.model?.provider, welcomeStatuses(), Date.now());
   };
   let cost = 0;
-  /**
-   * Context budget: footer chip, average cost per call, prompt hints and safe-point compaction.
-   * Delegated children never run it; the parent session owns the budget.
-   */
-  const contextGuard = new ContextBudgetGuard(() => delegatedChild ? { ...visualSettings.contextBudget, action: "off" } : visualSettings.contextBudget);
-  /** jar_todo calls in flight → completed count before each ran; a raised count marks a safe point. */
-  const todoCalls = new Map<string, number>();
-  /** Bumped per session: a compaction finishing after a session change resumes nothing. */
-  let budgetGeneration = 0;
   let welcomeInterval: ReturnType<typeof setInterval> | undefined;
   let welcomeFrame = 0;
   let welcomeDismiss = 0;
@@ -295,7 +285,6 @@ export default function piJar(pi: ExtensionAPI): void {
   registerAskTool(pi);
   const modelRoles = new ModelRoleManager(pi);
   const sideUsage = new SideUsage();
-  registerContextDiet(pi, () => visualSettings.contextDiet === true);
   // Observe-only: explains costly prompt-cache breaks; subagent processes have no UI to tell.
   const cacheBreaks = registerCacheBreaks(pi, { enabled: () => !delegatedChild && visualSettings.cacheDiagnostics !== false });
   const advisor = registerAdvisor(pi, modelRoles, { enabled: () => !delegatedChild && visualSettings.advisor, gates: () => !delegatedChild && visualSettings.advisorGates, usage: sideUsage });
@@ -632,7 +621,7 @@ export default function piJar(pi: ExtensionAPI): void {
                 sessionName: footerSessionName,
                 cwd: ctx.cwd, settings: footerSettings, branch: footerData.getGitBranch(),
                 context: contextUsage?.label ?? "ctx ?", goal: goalLoop.progress(), chips: footerChips(), activity: footerActivity(now),
-                memory, cost: formatCost(cost, contextGuard.perCall), overBudget: contextGuard.over, quota, roles, extras: live.extras,
+                memory, cost: formatCost(cost), quota, roles, extras: live.extras,
                 demo, animations, frame, motionBudget: ctx.isIdle() ? 2 : 1
               }, width, ctx.ui.theme ?? theme);
               hits = layout.hits;
@@ -804,16 +793,6 @@ export default function piJar(pi: ExtensionAPI): void {
   const restoreGoal = (ctx: ExtensionContext, branch?: readonly unknown[]) => {
     try { goals?.restore(branch ?? sessionBranch(ctx)); } catch { goals?.restore([]); }
   };
-  /** Awaited by agent_settled (see compactForBudget), whose handler is the last pi-jar settle handler. */
-  const settleBudget = async (ctx: ExtensionContext) => {
-    const job = contextGuard.settle({ idle: ctx.isIdle(), blocked: planMode.isEnabled() });
-    if (!job) return;
-    const open = (todos?.all() ?? []).filter((item) => !item.done).map((item) => item.title);
-    if (!job.compact) { resumeAfterBudget(pi, ctx, open); return; }
-    const generation = budgetGeneration;
-    await compactForBudget(pi, ctx, { resume: job.resume, tokens: contextGuard.lastTokens, softTokens: visualSettings.contextBudget.softTokens, open },
-      () => generation === budgetGeneration);
-  };
   pi.on("session_start", (event, ctx) => {
     sideUsage.clear();
     if (!profileStore) initializeProfiles(ctx);
@@ -865,9 +844,6 @@ export default function piJar(pi: ExtensionAPI): void {
       restoreTodos(ctx, branch);
       restoreGoal(ctx, branch);
     }
-    contextGuard.reset(branchCalls(branch, Date.now()));
-    todoCalls.clear();
-    budgetGeneration++;
     // Quota is enabled per session; no credentials or consent are persisted.
     quotaCache = new QuotaCache(
       (provider: QuotaProvider, signal) => fetchQuota(provider, (id) => ctx.modelRegistry.getProviderAuth(id), signal),
@@ -932,11 +908,6 @@ export default function piJar(pi: ExtensionAPI): void {
     }
     if (event.source !== "interactive") return;
     dismissWelcome(ctx);
-    // Hints read a finished list before this prompt acknowledges (hides) it.
-    if (!event.streamingBehavior) {
-      const hint = contextGuard.prompt(Date.now(), todoCounts());
-      if (hint) ctx.ui.notify(hint, "info");
-    }
     if (!todosAcknowledged && todos?.all().every((item) => item.done)) { todosAcknowledged = true; updateTaskWidget(ctx); }
   });
   pi.on("agent_start", (_event, ctx) => {
@@ -954,46 +925,26 @@ export default function piJar(pi: ExtensionAPI): void {
     if (event.message.role === "assistant") {
       working.reportOutputTokens(event.message.usage?.output ?? 0);
       addMessageCost(event.message);
-      // Each provider call moves the per-call average and the budget; a crossing turns the context chip amber.
-      const notice = contextGuard.call(providerCall(event.message, Date.now()));
-      if (notice) ctx.ui.notify(notice, "warning");
       applyWorking(ctx);
       repaint("cost", "background");
     }
   });
   pi.on("tool_execution_start", (event, ctx) => {
-    if (event.toolName === "jar_todo") todoCalls.set(event.toolCallId, todoCounts().done);
     working.toolStart(event.toolCallId, event.toolName); applyWorking(ctx);
   });
   pi.on("tool_execution_end", (event, ctx) => {
-    const before = todoCalls.get(event.toolCallId);
-    if (before !== undefined) {
-      todoCalls.delete(event.toolCallId);
-      if (todoCounts().done > before) contextGuard.todoCompleted();
-    }
     working.toolEnd(event.toolCallId); applyWorking(ctx);
   });
   pi.on("ui_prompt_start", (_event, ctx) => { working.prompt(true); applyWorking(ctx); });
   pi.on("ui_prompt_end", (_event, ctx) => { working.prompt(false); applyWorking(ctx); });
   // A request may span several tool turns; keep its elapsed time and reported tokens until agent_end.
-  pi.on("turn_end", (event, ctx) => {
-    applyWorking(ctx); refreshQuota(ctx);
-    todoCalls.clear();
-    // Safe point: every tool result of this turn is in. Stop before the next request; agent_settled compacts and resumes.
-    const stop = event.message?.role === "assistant" ? event.message.stopReason : undefined;
-    if (contextGuard.turnEnd({ open: () => { const { done, total } = todoCounts(); return total - done; },
-      interrupted: stop === "error" || stop === "aborted" || ctx.signal?.aborted === true || ctx.hasPendingMessages?.() === true,
-      blocked: planMode.isEnabled() })) ctx.abort();
-  });
+  pi.on("turn_end", (_event, ctx) => { applyWorking(ctx); refreshQuota(ctx); });
   pi.on("agent_end", (_event, ctx) => { working.end(); applyWorking(ctx); sampleFooter(ctx); });
   pi.on("agent_before_settle", (event) => { if (event.outcome === "error") composer.flash("error"); });
   // Retries or compaction after agent_end may have added messages; otherwise the agent_end sample stands.
   pi.on("agent_settled", (_event, ctx) => {
     working.end(); applyWorking(ctx); if (contextUsage?.dirty) sampleFooter(ctx); refreshQuota(ctx);
-    if (contextGuard.busy) return settleBudget(ctx);
   });
-  // Pi's idle cache warming keeps the prompt cache alive; the cold-cache hint counts from its last refresh.
-  pi.on("cache_warming_decision", (event) => { if (event.action === "warm") contextGuard.warmed(Date.now()); });
   pi.on("session_tree", (_event, ctx) => {
     let branch: readonly unknown[] = [];
     try { branch = sessionBranch(ctx); } catch { /* keep empty */ }
@@ -1002,7 +953,6 @@ export default function piJar(pi: ExtensionAPI): void {
       restoreTodos(ctx, branch);
       restoreGoal(ctx, branch);
     }
-    contextGuard.reset(branchCalls(branch, Date.now()));
     updateCost(ctx);
     composer.refreshSession(ctx);
     sampleFooter(ctx);
@@ -1012,7 +962,6 @@ export default function piJar(pi: ExtensionAPI): void {
     try { branch = sessionBranch(ctx); } catch { /* keep empty */ }
     renders?.setEntries(branch.length);
     if (!delegatedChild) { restoreTodos(ctx, branch); restoreGoal(ctx, branch); }
-    contextGuard.compacted();
     updateCost(ctx);
     sampleFooter(ctx);
   });
@@ -1035,9 +984,6 @@ export default function piJar(pi: ExtensionAPI): void {
     renders = undefined;
     contextUsage?.dispose();
     contextUsage = undefined;
-    contextGuard.reset();
-    todoCalls.clear();
-    budgetGeneration++;
     todos = undefined;
     changes = undefined;
     changeCount = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jar",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "description": "A warm, role-aware Pi terminal workspace with switchable profiles, animated UI, plan and goal workflows, tasks, change review, model roles, background shells and subagents.",
   "type": "module",
   "license": "MIT",
@@ -54,8 +54,8 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^1.1.0",
-    "@earendil-works/pi-tui": "^1.1.0",
+    "@earendil-works/pi-coding-agent": "^1.2.0",
+    "@earendil-works/pi-tui": "^1.2.0",
     "typebox": "^1.3.34",
     "typescript": "5.9.2"
   },

package/src/cache-breaks.ts

@@ -2,7 +2,6 @@ import { createHash } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { CACHE_IDLE_MS, contextTokens, formatTokens } from "./context-budget.ts";
 import { duration, money } from "./panel.ts";
 
 /**
@@ -20,6 +19,18 @@ import { duration, money } from "./panel.ts";
  * Decisions here are pure; {@link registerCacheBreaks} feeds Pi events in.
  */
 
+/** Approximate inactivity window used only to classify cache misses; never a compaction trigger. */
+const CACHE_IDLE_MS = 5 * 60_000;
+const amount = (value: unknown): number => typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+function contextTokens(usage: { input?: unknown; cacheRead?: unknown; cacheWrite?: unknown } | undefined): number {
+  return amount(usage?.input) + amount(usage?.cacheRead) + amount(usage?.cacheWrite);
+}
+function formatTokens(tokens: number): string {
+  if (tokens < 1000) return String(Math.round(tokens));
+  if (tokens < 999_500) return `${Math.round(tokens / 1000)}k`;
+  return `${(tokens / 1_000_000).toFixed(1)}M`;
+}
+
 /** A call is a costly break when its cache read falls short of the previous prompt by more than this... */
 export const BREAK_SHORTFALL_TOKENS = 4096;
 /** ...or reads nothing from the cache although its prompt is larger than this. */