pi-openai-toolkit 0.20.8 → 0.21.1

package/README.md

@@ -1,6 +1,6 @@
 # pi-openai-toolkit
 
-Remote context windows, Responses compaction, web search, image generation, and tool-call review for Pi. Uses Pi's existing models, endpoints, authentication, and sessions without registering another provider or model.
+Remote context windows, Responses compaction, web search, and image generation for Pi. Uses Pi's existing models, endpoints, authentication, and sessions without registering another provider or model.
 
 [![npm version](https://img.shields.io/npm/v/pi-openai-toolkit.svg)](https://www.npmjs.com/package/pi-openai-toolkit)
 [![MIT](https://img.shields.io/npm/l/pi-openai-toolkit.svg)](LICENSE)
@@ -15,7 +15,7 @@ Requires Node.js **22.19.0+** and Pi **0.87.0+**. Current development dependenci
 pi install npm:pi-openai-toolkit
 ```
 
-Configure your model and credentials in Pi, then start Pi normally. Without a Toolkit config file, eligible models use remote compaction by default. Search remains managed by Pi and other extensions; image generation and Auto Mode are off.
+Configure your model and credentials in Pi, then start Pi normally. Without a Toolkit config file, eligible models use remote compaction by default. Search remains managed by Pi and other extensions; image generation is off.
 
 Toolkit reads one global configuration file, even for a project-local installation:
 
@@ -50,7 +50,9 @@ Set `defaults.context.mode` or an individual model's `context.mode`:
 - `remote-windows`: use Codex remote context windows, retrieve earlier work with `history`, and save handoff notes with `notes`
 - `pi`: leave context management to Pi
 
-**Remote compaction** accepts the `openai-responses`, `openai-codex-responses`, and `azure-openai-responses` API types. The backend must still support the checkpoint protocol. Set `context.remoteCompaction.model` to use a separate compaction model; remote compaction requires the same effective base URL as the active model. Native summary fallback has separate settings and does not apply to every failure: empty checkpoints, incompatible provenance, or edits to sealed history block storage or replay. See [context settings](docs/configuration.md#context) and [checkpoint rules](docs/internals.md#remote-compaction-v2-wire-contract).
+**Remote compaction** accepts `openai-responses`, `openai-codex-responses`, and `azure-openai-responses`. It tries V2 first. On the official OpenAI API-key route, a qualifying protocol failure can trigger one standalone `/v1/responses/compact` request; its complete encrypted replacement window is preserved for replay. OpenAI OAuth, native Codex, Azure, and gateways keep their existing V2 route. OpenAI subscription-sharing OAuth and native Codex login are separate grants, not interchangeable credentials. Backend/model access is still required.
+
+Set `context.remoteCompaction.model` to use a separate producer on the same effective base URL without changing the active model. Exhausted remote attempts warn before continuing with a native text summary. `nativeFallback.enabled: false` disables only Toolkit's configured-model tier, not Pi's default summary. Aborts, incompatible provenance, and edits to sealed history still cancel rather than bypassing checkpoint safety. See [context settings](docs/configuration.md#context) and [checkpoint rules](docs/internals.md#remote-compaction-v2-wire-contract).
 
 **Remote windows** require the native `openai-codex` provider with `openai-codex-responses`, or an `openai-responses` gateway implementing the protocol. Gateways require `compatibility.transport: "codex-gateway"` on the exact model entry. This setting does not add the capability to an ordinary compatible endpoint.
 
@@ -58,7 +60,7 @@ Change `mode` in the example above to `remote-windows`. Eligible sessions expose
 
 Remote windows use alpha endpoints that may change upstream. When switching models, the remote window remains persisted and reusable; see the [window lifecycle](docs/internals.md#rollover-lifecycle).
 
-## Search, images, and tool review
+## Search, images, and transport
 
 ### Web search
 
@@ -107,30 +109,10 @@ The Toolkit WebSocket adapter is disabled by default. Enable it globally for GPT
 
 It reuses the selected model's provider, base URL, credentials, headers, and model ID without registering another provider. Pi's `transport: "auto"` tries WebSocket first and falls back to SSE before streaming starts; with a stable session it also reuses the socket and sends only the new continuation input when the transcript matches. Use `transport: "websocket-cached"` to require that cached path, or `transport: "sse"` to keep the original HTTP/SSE path. Restart or reload Pi after changing the Toolkit setting. See [WebSocket configuration](docs/configuration.md#responses-websocket-transport).
 
-### Auto Mode
-
-Auto Mode uses model-based review before tool execution. Permit it and select a reviewer registered and authenticated in Pi, then engage it explicitly:
-
-```json
-{
-  "schemaVersion": 2,
-  "defaults": {
-    "autoMode": {
-      "available": true,
-      "reviewerModel": "provider/reviewer-model-id"
-    }
-  }
-}
-```
-
-Replace `provider/reviewer-model-id` with a real model reference. Use `/auto on` or the `--auto` startup flag to engage, and `/auto off` to disengage. Setting `available: true` alone does not engage the gate.
-
-The default `gate: "side-effect"` reviews `bash`, `write`, `edit`, and `extraTools`. Use `gate: "all"` to cover every tool. Read-only evidence gathering, denial circuit breakers, and optional background classifier pre-scoring are supported. With the classifier enabled, some calls can pass based on a pre-score.
-
-A timeout or unavailable review is never approval: interactive sessions ask for confirmation, while headless sessions block the call. This is not a sandbox or a guarantee of correct decisions. Selecting an ineligible model disengages Auto Mode. See [Auto Mode settings](docs/configuration.md#auto-mode).
-
 ## Compatibility and troubleshooting
 
+Auto Mode, `/auto`, and `--auto` have been removed. Toolkit no longer reviews tool calls through this feature. Existing `autoMode` configuration is ignored with a warning and can be deleted; other valid settings keep working. See [removal guidance](docs/configuration.md#removed-auto-mode).
+
 - Keep providers, endpoints, and credentials in Pi, not Toolkit configuration. See [provider setup](docs/configuration.md#provider-specific-responses-endpoints) for Azure deployment mapping, `api-version`, and authentication
 - `pi-virtual` capability checks use the physical provider/model resolved by Pi, without inferring support from the virtual model's name
 - Compaction and replay honor `inputLimits.images` resizing and count limits from Pi model metadata without changing the persisted session or original request object

package/README.zh.md

@@ -1,6 +1,6 @@
 # pi-openai-toolkit
 
-为 Pi 添加远程上下文窗口、Responses 压缩、联网搜索、图像生成和工具调用审查。沿用 Pi 的模型、端点、认证和会话配置，不另行注册提供商或模型。
+为 Pi 添加远程上下文窗口、Responses 压缩、联网搜索和图像生成。沿用 Pi 的模型、端点、认证和会话配置，不另行注册提供商或模型。
 
 [![npm 版本](https://img.shields.io/npm/v/pi-openai-toolkit.svg)](https://www.npmjs.com/package/pi-openai-toolkit)
 [![MIT](https://img.shields.io/npm/l/pi-openai-toolkit.svg)](LICENSE)
@@ -15,7 +15,7 @@
 pi install npm:pi-openai-toolkit
 ```
 
-在 Pi 中配置好模型和凭据后，照常启动。没有 Toolkit 配置文件时，符合条件的模型默认使用远程压缩；搜索由 Pi 和其他扩展管理，生图和 Auto Mode 默认关闭。
+在 Pi 中配置好模型和凭据后，照常启动。没有 Toolkit 配置文件时，符合条件的模型默认使用远程压缩；搜索由 Pi 和其他扩展管理，生图默认关闭。
 
 Toolkit 只读取一个全局配置文件，即使扩展安装在项目内也一样：
 
@@ -50,7 +50,9 @@ Toolkit 只读取一个全局配置文件，即使扩展安装在项目内也一
 - `remote-windows`：使用 Codex 远程上下文窗口，通过 `history` 检索较早内容、`notes` 保存交接信息
 - `pi`：交给 Pi 管理上下文
 
-**远程压缩**支持的 API 类型是 `openai-responses`、`openai-codex-responses` 和 `azure-openai-responses`，但后端仍须支持对应的检查点协议。可用 `context.remoteCompaction.model` 指定独立的压缩模型；远程压缩要求它与当前模型使用相同的有效 base URL。原生摘要回退有独立配置，并非所有失败都会回退；空检查点、来源不匹配或被修改的已封存历史会阻止存储或重放。详见[上下文配置](docs/configuration.md#context)和[检查点规则](docs/internals.md#remote-compaction-v2-wire-contract)。
+**远程压缩**支持 `openai-responses`、`openai-codex-responses` 和 `azure-openai-responses`，先尝试 V2。官方 OpenAI API-key 路由遇到符合条件的协议失败时，可再尝试一次独立的 `/v1/responses/compact`，并完整保存返回的加密替换窗口用于重放。OpenAI OAuth、原生 Codex、Azure 和网关保持原有 V2 路由。OpenAI subscription-sharing OAuth 与原生 Codex 登录是两种独立授权，凭据不能互换；模型和后端仍须具备相应权限。
+
+可用 `context.remoteCompaction.model` 指定同一有效 base URL 下的独立压缩模型，不改变当前模型。远程尝试全部失败后，会明确提示并继续普通文本摘要。`nativeFallback.enabled: false` 只关闭 Toolkit 的指定模型回退层，不关闭 Pi 默认摘要。取消操作、来源不匹配或已封存历史被修改时，仍会取消，不能绕过检查点安全检查。详见[上下文配置](docs/configuration.md#context)和[检查点规则](docs/internals.md#remote-compaction-v2-wire-contract)。
 
 **远程窗口**需要原生 `openai-codex` 提供商的 `openai-codex-responses` API，或支持相应协议的 `openai-responses` 网关。网关必须在精确模型下设置 `compatibility.transport: "codex-gateway"`；这一设置不会让普通兼容端点自动获得该能力。
 
@@ -58,7 +60,7 @@ Toolkit 只读取一个全局配置文件，即使扩展安装在项目内也一
 
 远程窗口依赖 alpha 接口，上游可能随时调整。切换模型时远程窗口状态仍会持久化并可复用，详见[窗口生命周期](docs/internals.md#rollover-lifecycle)。
 
-## 搜索、生图与工具审查
+## 搜索、生图与传输
 
 ### 联网搜索
 
@@ -107,30 +109,10 @@ Toolkit 的 WebSocket adapter 默认关闭。对使用 Pi `openai-responses` API
 
 它沿用当前模型的 provider、base URL、凭据、headers 和 model ID，不注册新的 provider。Pi 的 `transport: "auto"` 会先尝试 WebSocket，并在开始流式输出前回退到 SSE；会话 ID 稳定时还会复用连接，并在历史匹配时只发送新的 continuation 输入。使用 `transport: "websocket-cached"` 可强制要求缓存连接路径，使用 `transport: "sse"` 则保持原有 HTTP/SSE 路径。修改 Toolkit 配置后请重启或 reload Pi。详见[WebSocket 配置](docs/configuration.md#responses-websocket-transport)。
 
-### Auto Mode
-
-Auto Mode 在工具执行前进行模型审查。先允许使用并指定 Pi 中已注册、可认证的审查模型，再手动开启：
-
-```json
-{
-  "schemaVersion": 2,
-  "defaults": {
-    "autoMode": {
-      "available": true,
-      "reviewerModel": "provider/reviewer-model-id"
-    }
-  }
-}
-```
-
-将 `provider/reviewer-model-id` 替换为实际模型。用 `/auto on` 或启动参数 `--auto` 开启，`/auto off` 关闭；只设置 `available: true` 不会自动开启。
-
-默认 `gate: "side-effect"` 审查 `bash`、`write`、`edit` 和 `extraTools` 中的工具，`gate: "all"` 审查所有工具。支持只读取证、拒绝次数熔断和可选的后台分类器预评分；开启分类器后，部分调用可依据预评分放行。
-
-审查超时或不可用不算批准：交互模式会请求用户确认，无界面模式会阻止调用。它不是沙箱，也不保证每次判断正确；选择不符合条件的模型会关闭 Auto Mode。完整配置见[Auto Mode](docs/configuration.md#auto-mode)。
-
 ## 兼容性与排查
 
+Auto Mode、`/auto` 和 `--auto` 已移除，Toolkit 不再通过此功能审查工具调用。旧 `autoMode` 配置会被忽略并提示警告，可手动删除；其他有效设置继续正常工作。详见[移除说明](docs/configuration.md#removed-auto-mode)。
+
 - 提供商、端点和凭据仍由 Pi 管理，不写进 Toolkit 配置。Azure 的部署映射、`api-version` 和认证说明见[提供商配置](docs/configuration.md#provider-specific-responses-endpoints)
 - `pi-virtual` 使用 Pi 解析出的实际提供商和模型检查能力，不按虚拟模型名称推断支持情况
 - 压缩和重放时遵守 Pi 模型元数据中的 `inputLimits.images` 缩放与数量限制，不修改持久化会话或原始请求对象

package/config.schema.json

@@ -46,12 +46,6 @@
         }
       ]
     },
-    "stringList": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      }
-    },
     "responsesApis": {
       "type": "array",
       "items": {
@@ -194,91 +188,9 @@
         }
       }
     },
-    "autoMode": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "available": {
-          "type": "boolean"
-        },
-        "reviewerModel": {
-          "$ref": "#/$defs/modelRef"
-        },
-        "gate": {
-          "enum": [
-            "side-effect",
-            "all"
-          ]
-        },
-        "extraTools": {
-          "$ref": "#/$defs/stringList"
-        },
-        "timeoutMs": {
-          "type": "integer",
-          "minimum": 1000,
-          "maximum": 120000
-        },
-        "transcript": {
-          "type": "boolean"
-        },
-        "evidenceTools": {
-          "type": "boolean"
-        },
-        "maxEvidenceRounds": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 8
-        },
-        "classifier": {
-          "$ref": "#/$defs/classifier"
-        },
-        "circuitBreaker": {
-          "$ref": "#/$defs/circuitBreaker"
-        }
-      }
-    },
-    "classifier": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        },
-        "model": {
-          "$ref": "#/$defs/modelRef"
-        },
-        "timeoutMs": {
-          "type": "integer",
-          "minimum": 1000,
-          "maximum": 120000
-        },
-        "maxLag": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 20
-        }
-      }
-    },
-    "circuitBreaker": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "consecutiveDenials": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 100
-        },
-        "recentDenials": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 100
-        },
-        "windowSize": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 200
-        }
-      }
+    "retiredAutoMode": {
+      "deprecated": true,
+      "description": "Auto Mode has been removed. This value is ignored with a warning; tool calls are no longer reviewed by it. Remove this section from your configuration."
     },
     "compatibility": {
       "type": "object",
@@ -309,7 +221,7 @@
           "$ref": "#/$defs/responsesWebSocket"
         },
         "autoMode": {
-          "$ref": "#/$defs/autoMode"
+          "$ref": "#/$defs/retiredAutoMode"
         }
       }
     },
@@ -324,7 +236,7 @@
           "$ref": "#/$defs/webSearch"
         },
         "autoMode": {
-          "$ref": "#/$defs/autoMode"
+          "$ref": "#/$defs/retiredAutoMode"
         },
         "compatibility": {
           "$ref": "#/$defs/compatibility"

package/docs/configuration.md

@@ -21,8 +21,7 @@ Create the file and parent directory if absent. This example states the shipped
       "defaultModel": "grok-imagine-image-2.0",
       "allowedModels": ["grok-imagine-image-2.0"]
     },
-    "responsesWebSocket": { "enabled": false },
-    "autoMode": { "available": false }
+    "responsesWebSocket": { "enabled": false }
   },
   "models": {},
   "diagnostics": {
@@ -43,11 +42,11 @@ Create the file and parent directory if absent. This example states the shipped
 
 Precedence is built-ins, then `defaults`, then `models["provider/model-id"]`. Keys are exact and case-sensitive. Leading/trailing whitespace is trimmed; conflicting normalized keys are rejected. Model IDs may contain further slashes. No pattern matching or endpoint/capability guessing occurs.
 
-Known nested objects merge by field. Missing fields inherit, arrays replace instead of append, and `false`/`0` retain their meanings. Only optional model references accept `null`: context producer, native-fallback model, auto reviewer, and classifier model. `null` elsewhere is invalid. Defaults do not prohibit exact overrides; an exact model can set `available: true` over a default of `false`.
+Known nested objects merge by field. Missing fields inherit, arrays replace instead of append, and `false`/`0` retain their meanings. Only optional model references accept `null`: context producer and native-fallback model. Other active settings reject `null`. Defaults do not prohibit exact overrides; an exact model can select a different context mode or search route.
 
 A missing file uses independent built-in defaults. Invalid JSON, an unreadable file, missing/unsupported `schemaVersion` on a v2-shaped document, or mixed legacy/v2 fields are reported distinctly. Unknown v2 policy keys are errors in their owning scope. Invalid selected settings block dependent operations; they never silently pick a more permissive route. Errors in other models remain visible without replacing a valid current model's policy. A valid exact leaf may shadow an invalid default leaf, but cannot hide a malformed containing object or unknown field in that feature scope.
 
-Each public callback, tool execution, compaction, reviewer/classifier operation, or config command uses an immutable snapshot across its awaited helpers. The next operation reads again. This does not make separate Pi headers, payload, and tool events one atomic transaction. Engagement, overrides, scores, windows, and results stay out of the config file.
+Each public callback, tool execution, compaction, or config command uses an immutable snapshot across its awaited helpers. The next operation reads again. This does not make separate Pi headers, payload, and tool events one atomic transaction. Windows and results stay out of the config file.
 
 ---
 
@@ -68,9 +67,13 @@ Place `context` under `defaults` or an exact `models` entry.
 | `remoteWindows.leaveManagedMode` | `"warn"` | Legacy compatibility field. Both values preserve the same behavior: non-window models receive only the current local window, and no bulk close-out compaction is started for retired Remote Context history. |
 | `remoteWindows.reminderThresholdPercent` | `5` | Integer 0-100. `0` disables both the once-per-window reminder and exhausted-window fallback. |
 
+Ordinary remote compaction tries V2 first. One automatic standalone `/v1/responses/compact` attempt is available only for the official HTTPS OpenAI endpoint, an `openai-responses` physical producer, public Pi auth metadata explicitly indicating configured non-OAuth auth, and an outgoing Bearer header matching Pi's resolved key. Missing/unknown auth metadata, an unrelated Authorization override, Codex affinity, OAuth, Azure, and third-party gateways do not opt in. A protocol-compatible rejection or invalid successful V2 checkpoint can qualify; auth/subscription, quota/rate-limit, network, abort, and unrelated server failures do not. No protocol selector, credential switch, or capability cache is added; a selected standalone attempt may add latency/cost.
+
+Standalone success preserves the full canonical output window, including retained items, rather than treating retained assistant text as a summary. When actual remote attempts are exhausted, Toolkit warns that no encrypted checkpoint was produced and starts the existing native text-summary chain: the configured remote producer after a remote attempt, or `nativeFallback.model` when remote compaction is unavailable. `nativeFallback.enabled: false` disables only the configured-model tier; disabled/unset/same-model selections still permit Pi's default summary. Explicit summary-model failures and checkpoint-integrity failures cancel. OpenAI subscription-sharing OAuth can reject compaction; separately authenticating native Codex is a different route, not a way to reuse that grant. See the [wire contract](internals.md#remote-compaction-v2-wire-contract).
+
 Native Codex eligibility derives from the actual Pi provider/API. Gateways additionally need the exact transport opt-in below. `remote-windows` keeps the Remote Window state persisted when a model without window capability is selected: that model receives only the current local window, while retired/managed Remote Context history is excluded from live requests and compaction producers. A no-summary boundary preserves the marker for later reuse. A configured window model whose activation fails does not silently receive a summary fallback. Normal `new_context` keeps its persisted-notes, duplicate and cooldown gates. Synthetic Remote V2 producer/consumer identity and checkpoint provenance are unchanged. See [Toolkit internals](internals.md).
 
-In active `remote-windows`, `/compact [instructions]` starts checkpoint duty rather than producing a summary. The selected model must authenticate to the same native backend/account or gateway credential/affinity domain, fit the projected window plus its output reserve, and retain the required permitted context tools. Invalid or unsuitable explicit targets are refused without switching to a fallback model. If Auto Mode is engaged, the target must also be eligible for its gate. The entire handoff uses the initiating context-policy snapshot; no config or global Pi defaults are rewritten.
+In active `remote-windows`, `/compact [instructions]` starts checkpoint duty rather than producing a summary. The selected model must authenticate to the same native backend/account or gateway credential/affinity domain, fit the projected window plus its output reserve, and retain the required permitted context tools. Invalid or unsuitable explicit targets are refused without switching to a fallback model. The entire handoff uses the initiating context-policy snapshot; no config or global Pi defaults are rewritten.
 
 Only a new persisted successful notes write/append after the handoff and the latest delivered user message authorizes its rollover. After the exact target marker is durable, Toolkit restores the original model/thinking before new-window inference and asks it to read the receipt first. Failure or cancellation restores an owned selection; a later user selection takes priority. Failed restoration blocks further handoff requests until selection/auth is repaired. Reload can recover selection, but does not automatically restart inference.
 
@@ -90,19 +93,23 @@ This selects an existing Toolkit protocol profile, independently of context mode
 
 The Responses WebSocket extension is disabled by default. Enable it globally with `defaults.responsesWebSocket.enabled: true`; it is intentionally not a model-scoped override. Restart or reload Pi after changing this setting. An invalid or legacy configuration keeps the feature disabled.
 
-The extension is an API-adapter override, not a provider registration. It applies to GPT model IDs whose Pi API is `openai-responses`, regardless of provider name. The active model's `baseUrl`, `apiKey`, configured headers, session id, and payload remain the source of truth.
+The extension is an API-adapter override, not a provider registration. For requests dispatched through this API adapter, it applies to GPT model IDs whose Pi API is `openai-responses`, regardless of provider name. Providers that bypass the compat API adapter keep their own transport behavior. The active model's `baseUrl`, `apiKey`, configured headers, session id, and payload remain the source of truth.
 
 The extension honors Pi's global `transport` setting:
 
 | Pi `transport` | Behavior |
 | --- | --- |
-| `auto` | Try `wss://.../responses?model=...` first; fall back to the original SSE adapter only before a stream starts. With a stable session id, reuse the WebSocket and send a continuation delta when possible. |
+| `auto` | Try `wss://.../responses?model=...` first; allow one original HTTP/SSE fallback per fetch call for a recoverable WS failure before the first valid event is exposed. With a stable session id, reuse the WebSocket and send a continuation delta when possible. |
 | `websocket` | Require the WebSocket path; do not fall back to SSE. This mode opens a request-scoped connection. |
 | `websocket-cached` | Require the WebSocket path and keep a session-scoped connection for later turns. |
 | `sse` | Bypass the extension and use the original HTTP/SSE adapter. |
 
 The endpoint is derived from the model's base URL by appending `/responses` when needed and switching `https:`/`http:` to `wss:`/`ws:`. The first frame is a standard `response.create` object and incoming frames are passed through Pi's existing Responses event normalizer. For `auto` and `websocket-cached`, Toolkit caches an open socket by session/model/endpoint/auth identity for up to five minutes idle or 55 minutes of age. When the current transcript has the cached request and response as a prefix, the next frame uses `previous_response_id` and only the new input items; if it cannot prove that relationship, it sends the full payload instead. A missing session id or `cacheRetention: "none"` disables reuse. The upstream must support the standard Responses WebSocket contract, including continuation semantics for `previous_response_id`; this does not rewrite a server that only exposes Codex's `/codex/responses` path or Codex-only authentication.
 
+The first valid exposed event commits the WS attempt, including `response.created` even before text or tool arguments arrive. After that boundary, Toolkit never switches transport or splices a new generation into the same stream. Local transient WS failures and compatible WS error envelopes containing `stream closed before response.completed` retain their diagnostics with a Pi-recognized transport indication; Pi's native retry settings and budget decide whether to retry the failed step. Authentication, quota/billing, context/invalid-request/policy errors, malformed frames, and cancellation do not authorize Toolkit fallback. An SDK request deadline can cancel startup before a fallback is possible.
+
+A failed connection is evicted. Any permitted fallback receives the original complete effective request, not a cached input delta; a new WS connection also starts from the full request. Pi remains responsible for effective context, completed tool results, failed-attempt history, tool execution, and usage. This prevents Toolkit from replaying completed tools as part of recovery, but does not guarantee idempotency if the model explicitly requests the same operation again. Direct SSE and errors from the original fallback SSE path are unchanged. Recovery depends on backend health and Pi's native retry policy; it is not token-level resumption or an unlimited retry loop.
+
 This feature does not write Pi settings, model files, auth files, or global extensions. To keep the Toolkit adapter disabled, set `defaults.responsesWebSocket.enabled` to `false` or omit it. Once enabled, Pi's global `transport: "sse"` still bypasses the WebSocket path for a request.
 
 ---
@@ -236,29 +243,11 @@ At the compaction and replay boundary, Toolkit applies the declared resize profi
 
 ---
 
-### Auto Mode
+### Removed Auto Mode
 
-Place `autoMode` under `defaults` or an exact model. `available` permits engagement; it does not engage the runtime. Use `/auto on` or `--auto`, and `/auto off` to disengage. If an engaged session encounters invalid policy, calls remain blocked until policy is corrected or the user explicitly turns the gate off. A review timeout never means approval.
+Auto Mode, `/auto`, and `--auto` have been removed. Toolkit no longer performs this feature's tool-call review, background classification, or review confirmations. No replacement approval gate is installed.
 
-| Relative field | Default | Contract |
-| --- | --- | --- |
-| `available` | `false` | Model eligibility for engagement. |
-| `reviewerModel` | `null` | Exact review-model reference; required for useful engagement. |
-| `gate` | `"side-effect"` | Reviews `bash`, `write`, `edit`, and `extraTools`; `"all"` reviews every tool. Session gate overrides remain runtime state. |
-| `extraTools` | `[]` | Additional names for the side-effect gate. |
-| `timeoutMs` | `30000` | Integer 1000-120000 milliseconds. |
-| `transcript` | `true` | Include transcript context in the blocking review. |
-| `evidenceTools` | `true` | Permit the reviewer's existing read-only evidence tools. |
-| `maxEvidenceRounds` | `3` | Integer 0-8. |
-| `classifier.enabled` | `false` | Enable nonblocking trajectory pre-scoring. |
-| `classifier.model` | `null` | Exact reference; `null` uses the reviewer. |
-| `classifier.timeoutMs` | `15000` | Integer 1000-120000 milliseconds. |
-| `classifier.maxLag` | `2` | Integer 0-20. |
-| `circuitBreaker.consecutiveDenials` | `3` | Integer 0-100; `0` disables this limit. |
-| `circuitBreaker.recentDenials` | `10` | Integer 0-100; `0` disables this limit. |
-| `circuitBreaker.windowSize` | `50` | Integer 1-200, recent-verdict window size. |
-
-Reviewer and classifier references are not active-session overrides. Classifier scores, denial history, and human decisions never become config entries. The reviewer and its read-only evidence calls share one cancellable deadline, including dependencies that ignore abort. Denial history resets on actual delivery of a user message, including identical queued messages, not on enqueue or an ordinary tool continuation. Pre-scores are bound to a full structured authorization fingerprint; the bounded review transcript prioritizes recent user instructions and reports omissions.
+Legacy root `autoMode`, v2 `defaults.autoMode`, and exact-model `autoMode` sections are ignored with an explicit removal warning, regardless of their contents. They do not invalidate other valid settings. The editor schema retains only deprecated compatibility entries, not the old controls. Remove these sections and any `--auto` launcher argument manually; Toolkit does not rewrite your configuration, session history, or saved review artifacts. Unrelated invalid settings and mixed legacy/v2 documents still fail validation.
 
 ---
 
@@ -283,7 +272,7 @@ Diagnostics are plugin-wide, not model-scoped.
 
 ### Legacy compatibility and migration
 
-Do not combine unversioned roots (`compaction`, `webSearch`, `imageGeneration`, `autoMode`) with `schemaVersion: 2`. Valid legacy behavior is retained through a compatibility adapter, including nullable model clears, legacy image-list defaults, and source-dependent hosted-search failure handling. Invalid selected legacy route values are now blocked instead of disappearing into another selection.
+Do not combine unversioned roots (`compaction`, `webSearch`, `imageGeneration`, `autoMode`) with `schemaVersion: 2`. Remaining legacy features are retained through a compatibility adapter, including nullable model clears, legacy image-list defaults, and source-dependent hosted-search failure handling. Invalid selected legacy route values are now blocked instead of disappearing into another selection.
 
 The preview maps recognized fields into a candidate, supplies leaf origins, lists unmapped/dormant paths, and reports `ready`, `needs-review`, `already-v2`, or `unavailable`. `ready` means no known semantic difference was found in recognized active policy; it is not authorization to apply or proof of provider support. Unknown names are masked and their values are never copied into the report. The original source bytes remain the authoritative copy of unknown and dormant content.
 
@@ -296,8 +285,7 @@ The preview maps recognized fields into a candidate, supplies leaf origins, list
 | `compaction.gatewayContextModels` | Exact `models[key].compatibility.transport` |
 | `webSearch.defaultRoute`, `routes`, `models` | Default/exact search route candidates, subject to review below |
 | `imageGeneration.models` | `allowedModels` plus an explicit default taken from the legacy first entry |
-| `autoMode.enabled` / `models` | Default/exact `autoMode.available` |
-| Legacy auto reviewer/classifier/breaker controls | Corresponding `autoMode` controls |
+| `autoMode` | Removed; omitted from the candidate with a warning and `needs-review` |
 | Legacy compaction debug/capture/path settings | `diagnostics` |
 
 The preview cannot claim universal lossless conversion:

package/docs/internals.md

@@ -11,7 +11,6 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 - [Rollover lifecycle](#rollover-lifecycle)
 - [Managed manual compact](#managed-manual-compact)
 - [Remote Compaction v2 wire contract](#remote-compaction-v2-wire-contract)
-- [Auto Mode TUI review renderer](#auto-mode-tui-review-renderer)
 - [Artifacts and debugging](#artifacts-and-debugging)
 - [Provenance](#provenance)
 
@@ -23,7 +22,7 @@ The single global document is loaded through [src/config.ts](../src/config.ts).
 
 Feature entrypoints resolve once per public operation and pass that immutable snapshot through awaited helpers. A separately named compaction producer is resolved from the same decoded document for its own identity. Subsequent independent callbacks reload; a managed manual handoff retains its initiating context-policy snapshot until selection is restored. There is no general cross-event provider transaction, project lookup, singleton cache, or config state writer. Internal legacy-shaped engine adapters preserve compaction/search algorithms without exposing v2 parsing to consumers. Cross-feature gateway policy belongs to the resolver, not the context enable switch.
 
-Selected invalid policy blocks dependent operations; unrelated model errors remain reportable without replacing the selected model. An engaged auto gate stays blocking when its policy becomes invalid. Image choices are checked before auth, uploads, or paid requests. The human `/toolkit-config` command inspects effective values, validation, or a migration candidate without action APIs or network access. Migration is preview-only; source bytes and unknown/dormant content stay untouched.
+Selected invalid policy blocks dependent operations; unrelated model errors remain reportable without replacing the selected model. Retired `autoMode` sections are ignored with a warning; they never create effective policy or invalidate other features. Image choices are checked before auth, uploads, or paid requests. The human `/toolkit-config` command inspects effective values, validation, or a migration candidate without action APIs or network access. Migration is preview-only; source bytes and unknown/dormant content stay untouched.
 
 ---
 
@@ -105,7 +104,7 @@ State invariants the lifecycle code must keep honest:
 
 [src/context-management/manual-compact.ts](../src/context-management/manual-compact.ts) owns manual checkpoint duty. It uses public Pi lifecycle and selection APIs; it does not replace the built-in command or patch the scheduler. [src/context-management/window-manager.ts](../src/context-management/window-manager.ts) remains the sole owner of notes pairing, window identity, projection and trim.
 
-1. An active managed `session_before_compact` with reason `manual` validates the source/target policies from one snapshot, actual permitted tools, remaining capacity, backend/account scope and approval eligibility. It records the original model/thinking and cancels the native compact attempt. Internal window-bulk maintenance has a separate in-process owner even though Pi also labels it `manual`.
+1. An active managed `session_before_compact` with reason `manual` validates the source/target policies from one snapshot, actual permitted tools, remaining capacity and backend/account scope. It records the original model/thinking and cancels the native compact attempt. Internal window-bulk maintenance has a separate in-process owner even though Pi also labels it `manual`.
 2. The matching `session_compact_failed` callback launches duty only after Pi is idle. Public `setModel` changes the session selection, and a visible `sendUserMessage` rebuilds the target's normal prompt/tools. Delivery is observed through `message_start`; return from the fire-and-forget send API is not proof. A delivery timeout restores an abandoned idle selection.
 3. The existing `new_context` gate additionally requires a successful paired notes result after this operation and any later delivered user message. It records the exact target window before queueing a context-only marker, and returns a terminating result. Ordinary tools are blocked during checkpoint duty. Normal `new_context` outside this operation is unchanged.
 4. A terminating result alone does not stop mixed batches or queued messages. At `turn_end`, Toolkit requests abort without awaiting idle; context/request guards also refuse an unsafe continuation. The standard Responses and native Codex transports must not send an already-aborted continuation. Pi can deliver queued user content during that stop; it remains persisted and ordered for the original model.
@@ -113,8 +112,6 @@ State invariants the lifecycle code must keep honest:
 
 Versioned `pi-openai-toolkit:manual-compact` custom entries record operation/session/branch/window identities, exact model keys, original thinking and phase. They contain no credentials, transcript copy or note contents. Reload/navigation reads the current branch and only recovers still-owned selection; it never retries notes, rollover or paid inference. A newer user model/thinking selection ends ownership. Failed restoration stays durable and blocks further provider requests until recovery or an explicit user selection.
 
-An engaged Auto Mode gate grants a session/operation-scoped selection lease through [src/auto-mode/model-selection-guard.ts](../src/auto-mode/model-selection-guard.ts). An ineligible target is refused. While switching, a later eligibility change cannot silently disengage the gate: calls remain blocked. The lease neither enables Auto Mode nor widens its allowlist.
-
 The underlying native compact promise still rejects its intentional cancellation. Empty/already-compacted sessions can fail before the extension hook. This is a separate handoff operation, not a fabricated successful native compaction. An observed user cancellation before the owned checkpoint stop restores selection without automatically resuming. Tests use the official Pi runtime, disk-backed sessions, isolated HOME/settings and synthetic Responses/native Codex traffic in [test/pi-managed-compact.test.ts](../test/pi-managed-compact.test.ts); they assert every request's model/thinking, marker/note order, retained tool head and queue preservation.
 
 ---
@@ -127,34 +124,27 @@ A `compaction_trigger` item appended to the live streaming request yields one ou
 
 The incremental SSE consumer validates the first terminal event and reconciles its checkpoint with prior item evidence. A valid completed frame ends the operation even if the HTTP body stays open; reader cancellation is best-effort cleanup and is not awaited. Incomplete frames at EOF, conflicting checkpoint evidence and terminal errors cannot become successful checkpoints.
 
-A v2 response with a missing or empty checkpoint is never stored, and the `nativeFallback` tier is skipped. Pi's own threshold drives the next attempt, which may use `remoteCompactModel` when configured. `remoteCompactModel` must resolve to the same effective base URL as the active model.
-
-Pi 0.87 makes `SessionManager` the source of model-visible context. An omitted `context.remoteCompaction.inputSource` keeps `"legacy"` behavior: first compaction reads `buildSessionProjection()` (falling back to Pi's preparation if unavailable), and recursion uses the opaque window plus the canonically projected branch tail. Both paths honor persisted context edits. Legacy mode still bypasses request-time extension transforms.
-
-Setting `context.remoteCompaction.inputSource: "pi-context-hook"` opts into a narrow runtime bridge around Pi's public `ExtensionRunner.createContext()`. It adds a non-enumerable `ctx.projectContextForCompaction(messages)` method backed by `ExtensionRunner.emitContext()`. This runs the ordered conversation-only and full-transcript phases on the canonical projection. If the bridge, session projection, or recursive summary anchor is unavailable, the extension cancels rather than sending unprojected history.
+A missing, empty, or invalid V2 checkpoint is never stored. Ordinary compaction may then try the gated standalone protocol below; exhausted remote attempts warn once and enter the unchanged native text-summary chain. A failed remote operation selects `remoteCompactModel` for the configured native tier; a remote-ineligible model selects `nativeFallback.model`. Disabled/unset/same-model selections delegate to Pi's default summary, including when `nativeFallback.enabled` is false. Explicit summary-model failures cancel instead of retrying with the active model. Aborts and projection/provenance/context-edit failures still cancel immediately. `remoteCompactModel` must resolve to the same effective base URL as the active consumer, which is never switched for synthetic requests.
 
-Retained-message matching uses the SDK projection and source entry IDs, including omissions and replacements made before compaction. Older retained compaction entries contribute no second summary. A compaction whose kept boundary is its own ID retains no earlier messages. Edits to post-checkpoint input are applied to the live tail; an edit targeting history already sealed in an opaque checkpoint blocks replay and recursive compaction with `checkpoint-context-edited`. The encrypted checkpoint cannot be selectively rewritten. Start a new session or navigate before that checkpoint to rebuild from editable history; the raw log remains unchanged.
+#### Official API-key standalone fallback
 
-New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-context-v1"`, and replay/recursion reject missing or mode-mismatched markers without searching past the latest compaction. Retained `role: "custom"` messages are optional during replay because they may be changed or removed by context hooks; required user, assistant, and complete tool-call/result content remains ordered and fail-closed.
+The ordinary path reuses one resolved physical producer, auth snapshot, and prepared full input. After a qualifying V2 failure, it makes at most one POST to `https://api.openai.com/v1/responses/compact`. Eligibility requires `openai-responses`, no Codex gateway affinity, public `ModelRegistry.hasConfiguredAuth(model) === true` and `isUsingOAuth(model) === false`, and the final Authorization header matching the resolved Bearer key. Missing/throwing/nonboolean metadata is unknown, not API-key evidence. Provider aliases may qualify at the official endpoint; OAuth, native Codex, Azure, custom gateways, managed handoff and inactive Remote Context recovery retain their previous routing. No token-shape inspection, extra auth resolution, model/account switch, redirect, capability cache, or generated version/beta header is introduced.
 
----
+Qualifying failures are HTTP 400/404/405/422/501 without auth/quota exclusions, invalid/empty successful V2 checkpoint responses, or streamed errors with a recognized unsupported-protocol code. HTTP 401/403/429, known subscription/auth/billing/rate-limit restrictions, network failures, aborts, and generic server outages never trigger another protocol probe. OpenAI subscription-sharing OAuth and native Codex OAuth are distinct grants; selecting a separately authenticated Codex route does not authorize copying its credential to OpenAI.
 
-### Auto Mode TUI review renderer
+Standalone JSON contains `model`, `input`, `instructions` and only validated SDK-supported service-tier/cache fields. It omits `previous_response_id`, stream/store/tools/reasoning/text and the V2 trigger. A nonempty output must contain at least one nonempty encrypted `compaction` item and no malformed checkpoint. Every returned item and unknown structured field survives in original order, including retained user/assistant messages. Unlike V2, this protocol does not impose a single-output-item invariant. The existing `openai-native-compact-v1` strategy and an honest opaque window marker are persisted with consumer/producer identity, input provenance, deferred tools and Pi's `tokensBefore`. Retained assistant text is not a portable summary.
 
-Approval state is scoped to actual user-message delivery. Full structured user content is SHA-256 hashed independently of transcript truncation, and generation-owned classifier completions cannot overwrite newer samples. The bounded transcript selects recent user instructions first and reports omissions. The blocking reviewer and its read-only evidence loop share one deadline that also races uncooperative dependencies; timeout/cancellation is an unavailable review, never approval or a safety denial.
+Existing persistence/replay splices the entire canonical window between the leading prompt and live tail. Recursion uses that window plus current live tail once; verified Pi-retained copies are removed, current deferred schemas load after the end of the whole window, and historical declarations remain intact. Standalone cancellation can win before JSON checkpoint acceptance; V2's validated terminal remains authoritative over later reader cleanup cancellation.
 
-Auto Mode owns the review decision, but Pi owns the built-in tool-block component. Pi 0.87 exports `ToolExecutionComponent` without a public decorator interface, so `src/auto-mode/tool-review-tui.ts` installs a narrow, idempotent compatibility patch on its `render()` method. The patch only reads the component's existing tool-call ID and appends one bounded, single-line status after the normal block output; it never changes tool execution, event ordering, or provider payloads.
+The API-key path is covered by isolated mocked wire tests and real Pi persistence/reopen/continuation fixtures in both input-source modes. This is not live API-key acceptance. Earlier credentialed evidence used native Codex OAuth only; it does not establish API-key or OpenAI subscription-sharing OAuth support for every model/account.
 
-The extension updates an ephemeral per-call state through the same `tool_call` lifecycle that performs the review:
+Pi 0.87 makes `SessionManager` the source of model-visible context. An omitted `context.remoteCompaction.inputSource` keeps `"legacy"` behavior: first compaction reads `buildSessionProjection()` (falling back to Pi's preparation if unavailable), and recursion uses the opaque window plus the canonically projected branch tail. Both paths honor persisted context edits. Legacy mode still bypasses request-time extension transforms.
 
-- `skipped` when the tool is outside the configured Auto Mode gate;
-- `reviewing` while the reviewer model is running;
-- `awaiting-user` when an unavailable review reaches interactive confirmation;
-- `allowed`, `denied`, or `blocked` after the final decision.
+Setting `context.remoteCompaction.inputSource: "pi-context-hook"` opts into a narrow runtime bridge around Pi's public `ExtensionRunner.createContext()`. It adds a non-enumerable `ctx.projectContextForCompaction(messages)` method backed by `ExtensionRunner.emitContext()`. This runs the ordered conversation-only and full-transcript phases on the canonical projection. If the bridge, session projection, or recursive summary anchor is unavailable, the extension cancels rather than sending unprojected history.
 
-The state is intentionally not persisted to the session. It is bounded to recent calls and cleared at `session_start`, so reloading a session does not invent historical approval claims. The renderer uses Pi's current theme when available, truncates untrusted rationale text, and preserves the original render output when no state exists.
+Retained-message matching uses the SDK projection and source entry IDs, including omissions and replacements made before compaction. Older retained compaction entries contribute no second summary. A compaction whose kept boundary is its own ID retains no earlier messages. Edits to post-checkpoint input are applied to the live tail; an edit targeting history already sealed in an opaque checkpoint blocks replay and recursive compaction with `checkpoint-context-edited`. The encrypted checkpoint cannot be selectively rewritten. Start a new session or navigate before that checkpoint to rebuild from editable history; the raw log remains unchanged.
 
-This is a version-coupled adapter, not a stable Pi extension contract. It is feature-detected at registration time and marked with a global symbol so extension reloads do not wrap the class repeatedly. If the exported component shape changes or becomes non-writable, the adapter becomes a no-op, emits one warning in TUI mode, and the existing footer/working-message review indicators remain the fallback.
+New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-context-v1"`, and replay/recursion reject missing or mode-mismatched markers without searching past the latest compaction. Retained `role: "custom"` messages are optional during replay because they may be changed or removed by context hooks; required user, assistant, and complete tool-call/result content remains ordered and fail-closed.
 
 ---
 
@@ -165,6 +155,7 @@ With `diagnostics.level: "debug"`, the toolkit writes lifecycle and compaction a
 - Each `session_start` writes a lifecycle artifact whose `activation` field records `active` or the exact inactive reason, such as `unsupported-model`, `unsupported-api`, `missing-api-key`, `auth-resolution-failed`, or `tool-name-conflict`.
 - `diagnostics.captureRequests` independently writes provider request metadata and payloads, while `diagnostics.captureResponses` writes compact status and structural summaries with complete response and body fields critically redacted. Keep both off unless inspecting a specific request.
 - Artifacts always redact Authorization credentials, API keys and tokens, Codex account IDs, and opaque `encrypted_content` or `encrypted_output`, even when `diagnostics.redactSensitiveData` is `false`.
+- Compaction failures record protocol, stable reason/status, controlled public error identifiers/hints and the next step. Arbitrary provider messages and raw bodies are never promoted into diagnostics; unknown identifiers are omitted, and network exceptions use a generic content-free message. Debug-enabled headless runs record the same remote-to-native transition without requiring UI notifications.
 
 ---
 

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.20.8",
+  "version": "0.21.1",
   "private": false,
   "type": "module",
   "engines": {
     "node": ">=22.19.0"
   },
-  "description": "OpenAI toolkit for Pi: Codex Remote Context windows, remote compaction v2, routed Web Search, image gen, auto mode.",
+  "description": "OpenAI toolkit for Pi: Codex Remote Context windows, remote compaction v2, routed Web Search, image gen.",
   "author": "awoaCrim and contributors",
   "license": "MIT",
   "repository": {
@@ -28,7 +28,6 @@
     "compaction",
     "web-search",
     "image-generation",
-    "auto-mode",
     "codex",
     "responses"
   ],
@@ -37,13 +36,13 @@
       "./src/extension-runtime.ts",
       "./src/web-search/extension.ts",
       "./src/image-generation/extension.ts",
-      "./src/auto-mode/extension.ts",
       "./src/codex-astra/extension.ts",
       "./src/responses-websocket/extension.ts"
     ]
   },
   "files": [
     "src/compact-client.ts",
+    "src/compaction-errors.ts",
     "src/compaction-projection.ts",
     "src/pi-context-hook.ts",
     "src/config.ts",
@@ -79,15 +78,6 @@
     "src/image-generation/render.ts",
     "src/image-generation/service.ts",
     "src/image-generation/types.ts",
-    "src/auto-mode/extension.ts",
-    "src/auto-mode/tool-review-tui.ts",
-    "src/auto-mode/policy.ts",
-    "src/auto-mode/model-selection-guard.ts",
-    "src/auto-mode/prompt.ts",
-    "src/auto-mode/transcript.ts",
-    "src/auto-mode/reviewer.ts",
-    "src/auto-mode/classifier.ts",
-    "src/auto-mode/types.ts",
     "src/codex-astra/effort-planner.ts",
     "src/codex-astra/extension.ts",
     "src/responses-websocket/extension.ts",