pi-orchestrator-config 4.20.1 → 4.22.0

package/README.md

@@ -26,7 +26,7 @@ Single extension that provides:
 | **Git status**                | Live git status in status line with colored icons — updates after every tool call. Shows clickable `#N` when the branch has an open PR. Last-activity clock `⏱ HH:MM (Xm/Xh ago)` shows time since last response                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | **Desktop notifications**     | Notifies via `notify-send` on task completion, waiting for input, and action required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | **File preview**              | Serves generated HTML/frontend files via HTTP for browser preview from container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| **Graft integration**         | When `graft_enable=true`, main agents and subagents query the local Graft graph before raw project navigation on substantive prompts. Children only consume graphs. Stale graphs remain usable, retrieval failures fall back to raw tools, and main processes coordinate rebuilds with a cross-process lock.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| **Trail-code integration**    | On by default when the `trail` binary is installed. Main agents and subagents query the local code map before raw project navigation: the first project navigation per turn is gated behind a `trail_*` call, guidance is map-first (`trail_find_code` first, `trail_repo_map` once per session), and injected hits carry source. Worktrees resolve the map under `graft/` or `.trail/cache/`, inherit enablement from the main checkout, and seed from it instead of cold-building. Stale maps stay usable and failures fall open. |
 | **Pidash dashboard**          | Live web dashboard — multi-session monitoring, browser messaging, model switching, live session name updates, reasoning token display                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | **Pidiff viewer**             | Per-project diff viewer with review comments — branch diffs, file tree, inline comments, git-based ignore rules                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | **Dreaming**                  | Background memory consolidation — extracts memories from sessions, deduplicates, maintains topic-based memory                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
@@ -179,7 +179,7 @@ The installer covers:
 
 - **Pi Packages** — pi-config, pi-vertex-claude, pi-web-access, myk-pi-tools, bun
 - **Python Tools** — prek
-- **npm Packages** — acpx, agent-browser, graft
+- **npm Packages** — acpx, agent-browser, trail-code (`@trailhq/trail-code`)
 - **Browser Automation** — playwright + chromium
 - **Environment Setup** — gitignore configuration
 
@@ -425,28 +425,74 @@ Set `image_model` in `pi-config-settings.json` or use `PI_IMAGE_MODEL` env var.
 
 In containers, images are auto-served via HTTP for browser preview.
 
-### Graft repository graph (optional)
+### Trail-code code map (on by default)
 
-Set `graft_enable` to `true` in `.pi/pi-config-settings.json` (or set
-`PI_GRAFT_ENABLE=true`) to enable local Graft repository graph context:
+Trail-code is the local code map behind the `trail_*` tools. It is **on by
+default** whenever the `trail` binary is on `PATH` — no setting required. In a
+trusted git worktree, pi indexes the project and gives main agents and
+subagents a queryable map, so the first project navigation of every substantive
+turn is a `trail_*` query instead of a blind `grep`.
+
+Install or upgrade the CLI:
+
+```bash
+DO_NOT_TRACK=1 npm install -g @trailhq/trail-code@latest
+uv run scripts/install.py   # audited install used by the container
+```
+
+The installer downloads `@trailhq/trail-code@latest` with scripts disabled into a
+dedicated npm prefix, audits that isolated dependency tree for lifecycle scripts,
+and strictly rebuilds it with only those packages approved. The completed prefix
+is published under the global npm prefix and its `trail` binary linked globally,
+so unrelated global packages are never evaluated. It verifies `trail --version`;
+`DO_NOT_TRACK=1` disables Trail telemetry. Requirements: Node.js 22+, npm 12+,
+and the node-gyp prerequisites (Python 3, `make`, G++). If the binary is missing
+or the install fails, pi continues without the map and the `trail_*` tools are
+simply absent.
+
+**Kill switch.** `trail_enable` (env `PI_TRAIL_ENABLE`) defaults to `true`. Set it
+to `false` in `.pi/pi-config-settings.json`, or globally in
+`~/.pi/pi-config-settings.json`, to keep the integration fully inactive:
 
 ```json
 {
-  "graft_enable": true
+  "trail_enable": false
 }
 ```
 
-Graft requires Node.js 22+, npm 12+, node-gyp prerequisites (Python 3, `make`, and
-G++), and the `graft` CLI. The container includes them; native installs can use
-`uv run scripts/install.py`. The installer downloads `@nanonets/graft@latest` with
-scripts disabled into a dedicated npm prefix, audits that isolated dependency tree
-for lifecycle scripts, and strictly rebuilds it with only those packages approved.
-The completed prefix is then published under the global npm prefix and its `graft`
-binary linked globally, so unrelated global packages are never evaluated. The
-installer verifies `graft --version`; `DO_NOT_TRACK=1` disables Graft telemetry.
-When enabled, Graft reads the trusted project and writes a regenerable `./graft/`
-cache. Delete that directory or set `graft_enable` to `false` to disable it. If the
-native CLI is unavailable or its installation fails, pi continues without Graft.
+**Where the map lives.** Upstream owns the path: `./graft/` on older repos and
+`.trail/cache/` once a repo is on trail (upstream renames a legacy map itself).
+Both are regenerable and gitignored, and pi reads whichever is present. Never
+commit them.
+
+**Worktrees.** The map is resolved from the worktree root, and enablement is
+inherited from the main checkout when the worktree has no `.pi` settings file
+(`.pi/` is gitignored, so a fresh worktree would otherwise look disabled). A
+fresh worktree seeds its own cache from the main checkout on the first query — a
+copy plus branch-diff repair, never a cold rebuild — and never writes to the main
+checkout's map. Expect roughly 48 MB per worktree in this repo.
+
+**Layers.** This is not memory. Pi memory (`.pi/memory/`, dreaming, enforced
+entries) is what pi carries between sessions. Trail's own layer —
+`.trail/learnings/`, `trail note`, the pre-ship `trail check` — is upstream's and
+**we do not use it**. We only read the code map.
+
+### Migrating from Graft
+
+The integration was renamed from Graft to Trail-code. The break is intentional:
+
+- Only `@trailhq/trail-code` is installed and only `trail` is invoked. The `graft`
+  binary is no longer installed and there is no fallback — if you only have
+  `@nanonets/graft`, install trail to get the map tools back.
+- `graft_enable` / `PI_GRAFT_ENABLE` are gone, with no alias and no migration. An
+  existing `graft_enable: true` is a dead key, which is harmless: the feature is
+  default-on when the binary exists.
+- Tools are `trail_find_code`, `trail_find_all`, `trail_file_api`,
+  `trail_trace_calls`, `trail_repo_map`, `trail_refresh`, `trail_blast_radius`.
+- `log_graft` becomes `log_trail` (env `PI_LOG_TRAIL`); the old `~/.pi/logs/graft`
+  directory is neither read nor migrated.
+- `graft/` survives as a _path_ until upstream renames it: it is the map
+  directory, not the product.
 
 ### Cache Miss Notices
 
@@ -469,20 +515,20 @@ Run pi inside a disposable container for **filesystem isolation** — the agent
 - **Consistent tooling** — All required tools pre-installed in a single image
 - **Disposable** — Container is destroyed after each session (`--rm`)
 
-**Graft (optional `graft_enable`):** The image installs the latest
-`@nanonets/graft` with `DO_NOT_TRACK=1`. It downloads with scripts disabled, derives
+**Trail-code (`trail_enable`, on by default):** The image installs the latest
+`@trailhq/trail-code` with `DO_NOT_TRACK=1`. It downloads with scripts disabled, derives
 an exact script allowlist by auditing the installed package's reachable dependency
 metadata in a dedicated npm prefix, then strictly rebuilds that isolated tree with
 those approvals. Only after the rebuild succeeds is the completed prefix moved under
-the global npm prefix and its `graft` binary linked globally. This prevents unrelated
+the global npm prefix and its `trail` binary linked globally. This prevents unrelated
 global packages from entering npm's strict preflight. The allowlist is command-scoped
 and changes with `@latest`; other npm commands keep npm 12's install-script
 protections. The image includes Python 3,
-`make`, and the GCC/G++ toolchain required by node-gyp for Graft and other native
+`make`, and the GCC/G++ toolchain required by node-gyp for Trail-code and other native
 npm packages; these remain available for reliable package rebuilds. The build then
-verifies `graft --version`. Enable Graft in trusted project or global pi-config
-settings; it reads the project locally and stores its regenerable graph in `./graft/`. Set
-`graft_enable` to `false` and delete that directory to disable and remove the cache.
+verifies `trail --version`. The map is written to the mounted project's `./graft/` or
+`.trail/cache/` directory; set `trail_enable` to `false` and delete that directory to
+disable and remove the cache.
 Native installations require Node.js 22+, npm 12+, Python 3, `make`, and G++; the
 installer uses the same audited strict installation and failure remains non-fatal.
 
@@ -661,6 +707,14 @@ Pidash is a web-based dashboard that runs alongside the TUI, accessible from any
 - Per-project diff viewer (pidiff) — opens in browser via clickable `pi-diff` status-line link, powered by `@pierre/diffs` + `@pierre/trees`, with review comments
 - Collapsible thinking and tool blocks with copy buttons
 - ask_user tool bridging (answer from browser or TUI)
+- **Full TUI parity (#968)** — every interactive prompt and surface is answerable/operable from either TUI or browser, first answer wins:
+  - Dangerous-command approvals, commit-trailer selection, project-agent confirmations, and `/tasks` menus render in both surfaces
+  - Tasks panel (view/create/start/complete/delete/clear) driven through the live TaskStore with live updates
+  - Coms peer list (busy state, queue depth, context %) + send message to a peer (same delivery path as `coms_send`)
+  - New-session creation (name + initial model) and `/compact` from the browser
+  - Memory status (usage, topics, situation report)
+  - MCP server management (list/login/logout)
+  - Full settings page — every key from `settings-keys.json`, project + global scopes, typed editors, written through the live settings module (same semantics as `/pi-config-settings`)
 - Mobile responsive
 - Event buffering for message replay on refresh
 - Browser push notifications for background events (configurable per event type)
@@ -781,7 +835,7 @@ PI_PIDIFF_ENABLE=false pi
 | `acpx`              | Agent proxy for remote models                                                                                                                                                                                                                                                                                                  |
 | `kubectl` / `oc`    | Kubernetes and OpenShift CLI                                                                                                                                                                                                                                                                                                   |
 | `agent-browser`     | Browser automation CLI (navigate, click, screenshot, forms)                                                                                                                                                                                                                                                                    |
-| `graft`             | Local repository code graph for opt-in `graft_enable`; graph cache is stored in the mounted project’s `./graft/` directory                                                                                                                                                                                                        |
+| `trail`             | Local code map for `trail_enable` (on by default); the regenerable cache lives in the mounted project's `./graft/` or `.trail/cache/` directory |
 | `procps`            | Process utilities (ps, top, pgrep, pkill)                                                                                                                                                                                                                                                                                      |
 | `passwd`            | `usermod`/`groupmod` — init remaps user `node` to `PI_HOST_UID`/`PI_HOST_GID`                                                                                                                                                                                                                                                  |
 | `docker` / `podman` | Container CLIs (used via `docker-safe` read-only wrapper)                                                                                                                                                                                                                                                                      |
@@ -960,7 +1014,8 @@ Control your pi sessions from your phone via Discord DMs.
    - Go to "Bot" section → click "Reset Token" → copy the token
    - Enable "Message Content Intent" under "Privileged Gateway Intents"
    - Go to "OAuth2 > URL Generator" → select scope `bot` → select permissions:
-     `Send Messages`, `Read Message History`, `Add Reactions`, `View Channels`
+     `Send Messages`, `Read Message History`, `Add Reactions`, `View Channels`,
+     and for per-session threads: `Create Public Threads`, `Send Messages in Threads`
    - Open the generated URL → add bot to your server
 
 2. **Configure:**
@@ -970,11 +1025,21 @@ Control your pi sessions from your phone via Discord DMs.
    cat > ~/.pi/discord.env << EOF
    DISCORD_BOT_TOKEN=your-token-here
    DISCORD_ALLOWED_USERS=your-discord-user-id
+   # Optional: open access without an allowlist (off by default)
+   # DISCORD_ALLOW_ALL=true
+   # Optional: how long a pending agent question waits (default 10m, min 30s)
+   # DISCORD_PROMPT_TTL_MS=600000
+   # Optional: forum channel id for /board (one post per session)
+   # DISCORD_FORUM_CHANNEL_ID=
    EOF
    ```
 
    Find your Discord user ID: Settings > Advanced > Developer Mode ON, then right-click yourself > Copy User ID.
 
+   > The bot refuses to start without `DISCORD_ALLOWED_USERS` — a token alone must
+   > not mean "anyone who DMs the bot drives your agent". Set
+   > `DISCORD_ALLOW_ALL=true` only if you really want open access.
+
 3. **Restart pidash:**
    The Discord bot runs inside the pidash server daemon. Restart it to pick up the config:
 
@@ -984,15 +1049,30 @@ Control your pi sessions from your phone via Discord DMs.
 
 ### Discord Commands
 
-| Command     | Description                         |
-| ----------- | ----------------------------------- |
-| `!sessions` | List active pi sessions             |
-| `!watch N`  | Watch/switch to session N           |
-| `!status`   | Show current session info           |
-| `!abort`    | Abort current operation             |
-| `!help`     | Show commands                       |
-| Any text    | Send as prompt to watched session   |
-| `/command`  | Forward slash command to pi session |
+| Command              | Description                                        |
+| -------------------- | -------------------------------------------------- |
+| `/sessions`          | Paginated, ephemeral list with watch buttons       |
+| `/watch session:<n>` | Watch a session by name (autocomplete)             |
+| `/status`            | Watched session: model, branch, state, cwd         |
+| `/stop`              | Interrupt the running turn                         |
+| `/compact`           | Compact the watched session's context              |
+| `/model [value]`     | Show or switch the model                           |
+| `/thinking [value]`  | Show or set the thinking level                     |
+| `/tasks` `/coms` `/memory` `/mcp` `/diff` | Inspect the watched session       |
+| `/file path:<rel>`   | Send a file from the session cwd (8MB max)         |
+| `/notify on\|off`     | DM when a turn finishes in an unwatched session    |
+| Any text (DM/thread) | Send as a prompt to the watched session            |
+| `/cancel`            | Dismiss a pending agent question                   |
+
+Agent questions arrive with **Approve/Deny** buttons or a dropdown; you can also
+reply `yes`/`no`, an option number, or the option text. In a server, watching a
+session opens a **thread** for it (DMs are used as a fallback).
+
+The bot fails closed: without `DISCORD_ALLOWED_USERS` it refuses to start unless
+you set `DISCORD_ALLOW_ALL=true`. Commands, reaction shortcuts (⏹ 🔁 🗑), the
+forum session board and every environment variable are documented in
+[docs/discord-bot.md](docs/discord-bot.md)
+for the full surface.
 
 ### How It Works
 
@@ -1013,7 +1093,7 @@ it also runs as a pre-commit hook when TypeScript files change.
 
 ## Prerequisites
 
-- [pi](https://github.com/badlogic/pi-mono) (minimum version: **0.99.0**). Pidash uses Pi's `ui_prompt_start` and `ui_prompt_end` events to show prompt wait separately from agent work.
+- [pi](https://github.com/badlogic/pi-mono) (minimum version: **1.4.0**). Pidash uses Pi's `ui_prompt_start` and `ui_prompt_end` events to show prompt wait separately from agent work.
 - `gh` CLI (for GitHub operations)
 - `uv` (for Python execution)
 - `myk-pi-tools` (optional, for `/pr-review` and `/release`)

package/extensions/coms/coms-p2p.ts

@@ -19,7 +19,8 @@ import type { AgentToolResult, ExtensionAPI, ExtensionContext, Theme } from "@ea
 import { Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { applyExtensionDefaults } from "./themeMap.js";
-import { ulid, hexFg, isValidHex, fallbackColor, comsParseYamlFrontmatter as parseFrontmatter, nowIso, abbreviateModel, findSystemPromptPath, readFrontmatterFromArgv, readTaskSummary, buildInboundContent, renderTasksPart, renderQueuePart, formatQueueStr, formatComsResponseText, formatComsResponseType, formatComsResponseBody, formatComsInboundType, sanitizeComsName, createComsInboundTasks, shouldEvictOnLeaving, shouldAnnouncePeerLeft, isSessionStillRegistered, FALLBACK_PALETTE, type TasksSummary, insertInboundByPriority, shouldAcceptSteer, summarizeBroadcast, formatBusyStr, selectSenderBundle, type BroadcastTargetResult } from "./coms-shared.js";
+import {
+	buildComsPeersPayload, ulid, hexFg, isValidHex, fallbackColor, comsParseYamlFrontmatter as parseFrontmatter, nowIso, abbreviateModel, findSystemPromptPath, readFrontmatterFromArgv, readTaskSummary, buildInboundContent, renderTasksPart, renderQueuePart, formatQueueStr, formatComsResponseText, formatComsResponseType, formatComsResponseBody, formatComsInboundType, sanitizeComsName, createComsInboundTasks, shouldEvictOnLeaving, shouldAnnouncePeerLeft, isSessionStillRegistered, FALLBACK_PALETTE, type TasksSummary, insertInboundByPriority, shouldAcceptSteer, summarizeBroadcast, formatBusyStr, selectSenderBundle, type BroadcastTargetResult } from "./coms-shared.js";
 import { appendHistoryRecord, queryHistoryRecords, truncatePreview, type HistoryRecord } from "./coms-history.js";
 import { openListDetailOverlay, OverlayScrollDetail } from "../orchestrator/overlay-dashboard.js";
 import * as net from "node:net";
@@ -785,6 +786,7 @@ export default function (pi: ExtensionAPI) {
 		const key = `pending=${pc}|busy=${busyKey}|prog=${progressKey}`;
 		if (key === lastPoolSnapshot) return;
 		lastPoolSnapshot = key;
+		emitComsPeers();
 		try { installPoolWidget(currentCtx); } catch {}
 	}
 
@@ -1803,6 +1805,10 @@ Do not respond to this message.`;
 							existing.staleCount = 0;
 							existing.model = entry.model ?? existing.model;
 							log.debug("fs_watch_heartbeat", entry.name, "ctx", entry.context_used_pct, "busy", existing.busy);
+							// Heartbeats mutate peer fields without touching the widget
+							// refresh snapshot key — re-emit so browser peer cards stay
+							// current (Qodo R1: stale peer status otherwise lingers).
+							emitComsPeers();
 						} else if (entry && entry.coms_session_id && !peerCards.has(entry.coms_session_id)) {
 							const card: AgentCard & { staleCount: number } = {
 								name: entry.name, purpose: entry.purpose, model: entry.model,
@@ -3613,6 +3619,43 @@ Do not respond to this message.`;
 		handler: comsRefreshHandler,
 	});
 
+	// ━━ #968 part C: pidash browser bridge ─━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+	// Peer list + messaging from the browser, routed through the SAME
+	// resolveTarget/deliverPrompt path as coms_send — identical delivery
+	// semantics, browser is just another transport.
+	function emitComsPeers(): void {
+		try {
+			pi.events.emit("pidash:coms-peers", buildComsPeersPayload(
+				peerCards.values(),
+				identity ? { name: identity.name, purpose: identity.purpose, project: identity.project } : null,
+			));
+		} catch { /* pidash not loaded */ }
+	}
+	pi.events.on("pidash:coms-peers-request", () => emitComsPeers());
+	pi.events.on("pidash:coms-send", async (data: unknown) => {
+		const d = data as { requestId?: string; target?: string; prompt?: string; steer?: boolean; priority?: boolean };
+		if (!d?.target || !d?.prompt) {
+			pi.events.emit("pidash:coms-send-result", { requestId: d?.requestId, ok: false, error: "target and prompt required" });
+			return;
+		}
+		try {
+			if (!identity) throw new Error("coms not initialised");
+			const target = await resolveTarget(d.target);
+			if (!target) throw new Error(`peer not found: ${d.target}`);
+			const { msg_id } = await deliverPrompt(target, {
+				prompt: d.prompt,
+				...(d.steer ? { steer: true } : {}),
+				...(d.priority ? { priority: true } : {}),
+			});
+			log.info("pidash_coms_send", { target: target.name, msg_id, steer: !!d.steer });
+			pi.events.emit("pidash:coms-send-result", { requestId: d.requestId, ok: true, msg_id, target: target.name });
+		} catch (e) {
+			const error = e instanceof Error ? e.message : String(e);
+			log.warn("pidash_coms_send_failed", { target: d.target, error });
+			pi.events.emit("pidash:coms-send-result", { requestId: d.requestId, ok: false, error });
+		}
+	});
+
 	// ━━ /coms-queue command — view and kill queued messages ━━━━━━━━━━━━━━━
 	let comsQueueCmdHandler: any;
 	pi.registerCommand("coms-queue", {

package/extensions/coms/coms-shared.ts

@@ -551,6 +551,41 @@ export function formatComsResponseText(targetName: string, response: any, error:
 		: `[coms response from ${targetName}${arrow}${queueNote}] ${JSON.stringify(response, null, 2)}`;
 }
 
+/** #968 C: pidash browser peer-list payload — pure projection of live cards. */
+export interface ComsPeerCard {
+	name: string;
+	purpose: string;
+	model: string;
+	color: string;
+	context_used_pct?: number;
+	queue_depth?: number;
+	busy?: boolean;
+	tasks_summary?: unknown;
+	staleCount: number;
+}
+
+export function buildComsPeersPayload(
+	cards: Iterable<ComsPeerCard>,
+	self: { name: string; purpose?: string; project?: string } | null,
+): { self: { name: string; purpose: string; project: string } | null; peers: Array<Record<string, unknown>> } {
+	const peers: Array<Record<string, unknown>> = [];
+	for (const card of cards) {
+		peers.push({
+			name: card.name,
+			purpose: card.purpose,
+			model: card.model,
+			busy: card.busy ?? false,
+			queueDepth: card.queue_depth ?? 0,
+			contextUsedPct: card.context_used_pct ?? 0,
+			tasksSummary: card.tasks_summary ?? null,
+		});
+	}
+	return {
+		self: self ? { name: self.name, purpose: self.purpose || "", project: self.project || "" } : null,
+		peers,
+	};
+}
+
 /** Sanitize a coms identity name for safe embedding in header strings.
  *  Strips all control characters (C0/C1), brackets; replaces whitespace with hyphens. */
 export function sanitizeComsName(name: string): string {

package/extensions/orchestrator/async-agents.ts

@@ -17,7 +17,7 @@ const require = createRequire(import.meta.url);
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { AgentConfig, AgentDiscoveryResult } from "./agents.js";
 import { resolveAgentModelProvider } from "./resolve-agent-model.js";
-import { withGraftTools } from "./graft.js";
+import { trailToolsArgs } from "./trail.js";
 import { getPiInvocation, getProjectTmpDir, parseProcStartTime, djb2Hash } from "./utils.js";
 import { addReviewerPending, recordReviewerResult, countFindings, readReviewState } from "./pi-config-review-state.js";
 import {
@@ -1097,8 +1097,7 @@ export function registerAsyncAgents(
     piArgs.push("--session-id", deterministicSessionId);
     if (effectiveModel) piArgs.push("--model", effectiveModel);
     if (effectiveProvider) piArgs.push("--provider", effectiveProvider);
-    const tools = withGraftTools(agent.tools, getSetting(cwd, "graft_enable"));
-    if (tools?.length) piArgs.push("--tools", tools.join(","));
+    piArgs.push(...trailToolsArgs(agent.tools, cwd));
 
     if (agent.systemPrompt?.trim()) {
       const promptPath = path.join(workerDir, "system-prompt.md");

package/extensions/orchestrator/enforcement.ts

@@ -6,6 +6,7 @@
  */
 
 import { createLogger } from "../shared/logger.js";
+import { createBridgedUi } from "../shared/ui-bridge.js";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { isToolCallEventType } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
@@ -119,6 +120,9 @@ function commitTrailerModelId(ctx: any): string {
 }
 
 /** Inject commit trailer into command (Assisted-by, Co-authored-by, etc.) */
+/** #968 B: set by registerEnforcement; null → plain ctx.ui prompts (tests, unregistered). */
+let bridgedUi: ReturnType<typeof createBridgedUi> | null = null;
+
 async function handleCommitTrailer(command: string, event: any, ctx: any, gitCwd: string): Promise<EnforcementResult> {
   // #932: rewrite a literal `$PI_MODEL` in the trailer identity — an agent
   // following the git-expert trailer instruction may write the placeholder
@@ -159,10 +163,9 @@ async function handleCommitTrailer(command: string, event: any, ctx: any, gitCwd
       // No UI available — default to first option
       trailerName = options[0];
     } else {
-      const selected = await ctx.ui.select(
-        "Select commit trailer:",
-        options,
-      );
+      const selected = bridgedUi
+        ? await bridgedUi.select(ctx, "Select commit trailer:", options)
+        : await ctx.ui.select("Select commit trailer:", options);
       if (!selected || !options.includes(selected)) {
         return {
           block: true,
@@ -579,10 +582,10 @@ async function checkDangerousCommands(command: string, cwd: string, ctx: any): P
           : []),
         "No",
       ];
-      const ok = await ctx.ui.select(
-        `⚠️ Dangerous statement${remaining.length > 1 ? "s" : ""} (of the full command):\n\n${list}${scopeNote}\n\nAllow?`,
-        options,
-      );
+      const promptTitle = `⚠️ Dangerous statement${remaining.length > 1 ? "s" : ""} (of the full command):\n\n${list}${scopeNote}\n\nAllow?`;
+      const ok = bridgedUi
+        ? await bridgedUi.select(ctx, promptTitle, options)
+        : await ctx.ui.select(promptTitle, options);
       if (ok === "No" || ok === undefined)
         return { block: true, reason: "Blocked by user. Do NOT retry with an equivalent command (e.g., find -delete, perl, python os.remove). Stop and report this block to the user." };
       if (ok === "Yes — run once" || ok.startsWith("Always allow all of the above")) {
@@ -639,6 +642,11 @@ async function checkDangerousCommands(command: string, cwd: string, ctx: any): P
 }
 
 export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): void {
+  // #968 part B: enforcement prompts (dangerous-command approvals, trailer
+  // selection) are bridged — answerable from TUI or pidash browser, first
+  // answer wins, same enforcement semantics either way. Module-level check
+  // functions read this ref; null (unregistered / tests) falls back to plain ui.
+  bridgedUi = createBridgedUi(pi);
 
   pi.on("session_start", (_event, ctx) => {
     cachedTrailerSelection = null;

package/extensions/orchestrator/index.ts

@@ -34,8 +34,10 @@ import { registerMemoryTools } from "./memory-tools.js";
 import { registerReviewUI } from "./review-ui.js";
 import { registerSessionSearch } from "./session-search.js";
 import { registerSettingsTui } from "./settings-tui.js";
+import { buildSituationReport } from "./situation-report.js";
+import { listTopics } from "./memory-tree.js";
 import { registerMarkdownTransformer } from "./markdown-transformer.js";
-import { registerGraft } from "./graft.js";
+import { registerTrail } from "./trail.js";
 import { registerReviewLearning } from "./review-learning.js";
 import { ensureGitSshTimeout, isRunningInContainer, terminalNotify } from "./utils.js";
 import { createLogger } from "../shared/logger.js";
@@ -89,6 +91,36 @@ export default function (pi: ExtensionAPI) {
     }
   });
 
+  // ── #968 part E: memory status surface for pidash ──────────────────
+  // Read-only snapshot through the live orchestrator memory modules —
+  // situation report, topic hotness, entry counts, budget usage.
+  // The requesting session's cwd comes in the event payload (the pidash
+  // browser may be watching a session in a different project than this
+  // process's cwd).
+  pi.events.on("pidash:memory-status-request", (data: unknown) => {
+    try {
+      const payload = (typeof data === "object" && data !== null ? data : {}) as { cwd?: unknown };
+      const cwd = typeof payload.cwd === "string" && payload.cwd ? payload.cwd : process.cwd();
+      const report = buildSituationReport(cwd);
+      const topics = listTopics(cwd).map((t) => ({
+        name: t.name,
+        entryCount: t.entryCount,
+        hotness: Math.round(t.hotness),
+        newestEntry: t.newestEntry,
+      }));
+      const usageMatch = report.match(/# Project Memory \[([0-9]+)%[^\]]*\]/);
+      pi.events.emit("pidash:memory-status", {
+        topics,
+        usagePct: usageMatch ? Number(usageMatch[1]) : null,
+        report,
+      });
+      log.info("pidash_memory_status_sent", { topics: topics.length });
+    } catch (e: any) {
+      log.warn("pidash_memory_status_failed", { error: e?.message });
+      pi.events.emit("pidash:memory-status", { topics: [], usagePct: null, report: "", error: e?.message });
+    }
+  });
+
   // Extended autocomplete must register FIRST — it wraps registerCommand
   // to inject getArgumentCompletions before other modules register their commands.
   registerExtendedAutocomplete(pi);
@@ -97,7 +129,7 @@ export default function (pi: ExtensionAPI) {
   const { spawnAsyncAgent, killAsyncAgent, getAsyncJobs } = registerAsyncAgents(pi, terminalNotify);
   registerSubagentTool(pi, spawnAsyncAgent, killAsyncAgent);
   registerProjectSettings(pi);
-  registerGraft(pi);
+  registerTrail(pi);
   registerEnforcement(pi, IN_CONTAINER);
   registerReviewUI(pi);
   registerRules(pi, getAsyncJobs);

package/extensions/orchestrator/project-settings.ts

@@ -46,8 +46,8 @@ interface ProjectSettings {
   cli_agents?: string | string[];
   pidash_enable?: boolean;
   pidiff_enable?: boolean;
-  /** Enable local Graft repository graph integration. Default: false. */
-  graft_enable?: boolean;
+  /** Enable local Trail code map integration. Default: true. */
+  trail_enable?: boolean;
   pidash_port?: number;
   task_auto_clear_enabled?: boolean;
   task_auto_clear_minutes?: number;
@@ -123,7 +123,7 @@ const PROJECT_SETTINGS_KEYS: (keyof ProjectSettings)[] = [
   "cli_agents",
   "pidash_enable",
   "pidiff_enable",
-  "graft_enable",
+  "trail_enable",
   "pidash_port",
   "task_auto_clear_enabled",
   "task_auto_clear_minutes",
@@ -185,7 +185,7 @@ export function parseSettingsFile(filePath: string): ProjectSettings {
     if (typeof raw.orchestrator_edit_write_block === "boolean") result.orchestrator_edit_write_block = raw.orchestrator_edit_write_block;
     if (typeof raw.pidash_enable === "boolean") result.pidash_enable = raw.pidash_enable;
     if (typeof raw.pidiff_enable === "boolean") result.pidiff_enable = raw.pidiff_enable;
-    if (typeof raw.graft_enable === "boolean") result.graft_enable = raw.graft_enable;
+    if (typeof raw.trail_enable === "boolean") result.trail_enable = raw.trail_enable;
     if (typeof raw.pidash_port === "number" && Number.isInteger(raw.pidash_port) && raw.pidash_port > 0 && raw.pidash_port <= 65535) {
       result.pidash_port = raw.pidash_port;
     }
@@ -238,7 +238,7 @@ export function parseSettingsFile(filePath: string): ProjectSettings {
     const SPECIAL_CASE_KEYS = new Set<string>([
       "commit_trailer", "allow_push_to_protected_branches", "use_worktrees",
       "dream_interval_hours", "dco", "comment_signature", "review_loop_enforcement",
-      "orchestrator_edit_write_block", "pidash_enable", "pidiff_enable", "graft_enable", "pidash_port",
+      "orchestrator_edit_write_block", "pidash_enable", "pidiff_enable", "trail_enable", "pidash_port",
       "image_model", "internal_operations_provider", "internal_operations_model",
       "review_loop_max_cycles", "acpx_agents", "cli_agents", "agent_provider",
       "agent_model", "agent_overrides",
@@ -485,7 +485,7 @@ export function getSetting(cwd: string, key: "acpx_agents"): string[];
 export function getSetting(cwd: string, key: "cli_agents"): string[];
 export function getSetting(cwd: string, key: "pidash_enable"): boolean;
 export function getSetting(cwd: string, key: "pidiff_enable"): boolean;
-export function getSetting(cwd: string, key: "graft_enable"): boolean;
+export function getSetting(cwd: string, key: "trail_enable"): boolean;
 export function getSetting(cwd: string, key: "pidash_port"): number;
 export function getSetting(cwd: string, key: "task_auto_clear_enabled"): boolean;
 export function getSetting(cwd: string, key: "task_auto_clear_minutes"): number;

package/extensions/orchestrator/review-learning.ts

@@ -1391,12 +1391,12 @@ export function createReviewLearning(options: ReviewLearningOptions = {}) {
       }
     });
 
-    // Surface 1 — before_agent_start injection (graft-gate pattern).
+    // Surface 1 — before_agent_start injection (trail-gate pattern).
     // Purely mechanical path extraction (prompt tokens + branch diff), sync
     // DB/git with timeouts, no model calls. Diff paths are repo-relative —
     // normalized against the worktree ROOT so nested sessions still match
     // the DB's repo-relative paths. Must be fast and never throw — other
-    // before_agent_start handlers (graft gate, rules) must not stall.
+    // before_agent_start handlers (trail gate, rules) must not stall.
     pi.on("before_agent_start", (event: any, ctx: any) => {
       try {
         const cwd = ctx?.cwd;
@@ -1415,7 +1415,7 @@ export function createReviewLearning(options: ReviewLearningOptions = {}) {
         recall.fullBlockInjected = true;
         log.info("recall_injected_prompt", { paths: findings.length, chars: block.length });
         // Prefer a custom prompt section (rules.ts pattern — preserves cached
-        // prompt prefixes); fall back to the graft return shape when a prior
+        // prompt prefixes); fall back to a replacement prompt when a prior
         // handler forced the whole prompt or sections are unavailable.
         const opts = event?.systemPromptOptions;
         const sections = opts?.sections;
@@ -1430,7 +1430,7 @@ export function createReviewLearning(options: ReviewLearningOptions = {}) {
       }
     });
 
-    // Surface 2 — first-write tool_result hint (graft blastHint pattern):
+    // Surface 2 — first-write tool_result hint (trail blastHint pattern):
     // catches paths discovered mid-run that prompt extraction missed. Appends
     // once per path per session; a path is checked once per session whether
     // or not it has findings (a no-findings path must not re-query the DB on