pi-orchestrator-config 4.4.0 → 4.4.1

package/README.md

@@ -28,6 +28,7 @@ Single extension that provides:
 | **Git status**                | Live git status in status line with colored icons — updates after every tool call. Shows clickable `#N` when the branch has an open PR. Last-activity clock `⏱ HH:MM (Xm/Xh ago)` shows time since last response                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | **Desktop notifications**     | Notifies via `notify-send` on task completion, waiting for input, and action required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | **File preview**              | Serves generated HTML/frontend files via HTTP for browser preview from container                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| **Graft integration**         | When `graft_enable=true`, main agents and subagents query the local Graft graph before raw project navigation on substantive prompts. Children only consume graphs. Stale graphs remain usable, retrieval failures fall back to raw tools, and main processes coordinate rebuilds with a cross-process lock.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | **Pidash dashboard**          | Live web dashboard — multi-session monitoring, browser messaging, model switching, live session name updates, reasoning token display                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | **Pidiff viewer**             | Per-project diff viewer with review comments — branch diffs, file tree, inline comments, git-based ignore rules                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | **Dreaming**                  | Background memory consolidation — extracts memories from sessions, deduplicates, maintains topic-based memory                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
@@ -157,7 +158,7 @@ The installer covers:
 
 - **Pi Packages** — pi-config, pi-vertex-claude, pi-web-access, myk-pi-tools, bun
 - **Python Tools** — prek
-- **npm Packages** — mcpc, acpx, agent-browser
+- **npm Packages** — mcpc, acpx, agent-browser, graft
 - **Browser Automation** — playwright + chromium
 - **Environment Setup** — gitignore configuration
 
@@ -404,6 +405,29 @@ Set `image_model` in `pi-config-settings.json` or use `PI_IMAGE_MODEL` env var.
 
 In containers, images are auto-served via HTTP for browser preview.
 
+### Graft repository graph (optional)
+
+Set `graft_enable` to `true` in `.pi/pi-config-settings.json` (or set
+`PI_GRAFT_ENABLE=true`) to enable local Graft repository graph context:
+
+```json
+{
+  "graft_enable": true
+}
+```
+
+Graft requires Node.js 22+, npm 12+, node-gyp prerequisites (Python 3, `make`, and
+G++), and the `graft` CLI. The container includes them; native installs can use
+`uv run scripts/install.py`. The installer downloads `@nanonets/graft@latest` with
+scripts disabled into a dedicated npm prefix, audits that isolated dependency tree
+for lifecycle scripts, and strictly rebuilds it with only those packages approved.
+The completed prefix is then published under the global npm prefix and its `graft`
+binary linked globally, so unrelated global packages are never evaluated. The
+installer verifies `graft --version`; `DO_NOT_TRACK=1` disables Graft telemetry.
+When enabled, Graft reads the trusted project and writes a regenerable `./graft/`
+cache. Delete that directory or set `graft_enable` to `false` to disable it. If the
+native CLI is unavailable or its installation fails, pi continues without Graft.
+
 ### Cache Miss Notices
 
 Enable `showCacheMissNotices` in pi settings to see transcript notices on significant prompt-cache misses — useful for investigating unexpected token costs:
@@ -425,6 +449,23 @@ Run pi inside a disposable container for **filesystem isolation** — the agent
 - **Consistent tooling** — All required tools pre-installed in a single image
 - **Disposable** — Container is destroyed after each session (`--rm`)
 
+**Graft (optional `graft_enable`):** The image installs the latest
+`@nanonets/graft` with `DO_NOT_TRACK=1`. It downloads with scripts disabled, derives
+an exact script allowlist by auditing the installed package's reachable dependency
+metadata in a dedicated npm prefix, then strictly rebuilds that isolated tree with
+those approvals. Only after the rebuild succeeds is the completed prefix moved under
+the global npm prefix and its `graft` binary linked globally. This prevents unrelated
+global packages from entering npm's strict preflight. The allowlist is command-scoped
+and changes with `@latest`; other npm commands keep npm 12's install-script
+protections. The image includes Python 3,
+`make`, and the GCC/G++ toolchain required by node-gyp for Graft and other native
+npm packages; these remain available for reliable package rebuilds. The build then
+verifies `graft --version`. Enable Graft in trusted project or global pi-config
+settings; it reads the project locally and stores its regenerable graph in `./graft/`. Set
+`graft_enable` to `false` and delete that directory to disable and remove the cache.
+Native installations require Node.js 22+, npm 12+, Python 3, `make`, and G++; the
+installer uses the same audited strict installation and failure remains non-fatal.
+
 **CLI provider binaries (optional `cli_agents`):** The image installs the CLIs used by
 `cli-*` providers — `claude` (Claude Code), `gemini` (`@google/gemini-cli`), and
 `agent` (Cursor Agent CLI). Enable with `cli_agents` in settings (e.g.
@@ -691,6 +732,7 @@ PI_PIDIFF_ENABLE=false pi
 | `acpx`              | Agent proxy for remote models                                                                                                                                                                                                                                                                                                  |
 | `kubectl` / `oc`    | Kubernetes and OpenShift CLI                                                                                                                                                                                                                                                                                                   |
 | `agent-browser`     | Browser automation CLI (navigate, click, screenshot, forms)                                                                                                                                                                                                                                                                    |
+| `graft`             | Local repository code graph for opt-in `graft_enable`; graph cache is stored in the mounted project’s `./graft/` directory                                                                                                                                                                                                        |
 | `procps`            | Process utilities (ps, top, pgrep, pkill)                                                                                                                                                                                                                                                                                      |
 | `passwd`            | `usermod`/`groupmod` — init remaps user `node` to `PI_HOST_UID`/`PI_HOST_GID`                                                                                                                                                                                                                                                  |
 | `docker` / `podman` | Container CLIs (used via `docker-safe` read-only wrapper)                                                                                                                                                                                                                                                                      |

package/extensions/openai-compatible-discovery/index.ts

@@ -4,13 +4,16 @@ import { createRuntimeProvider } from "../shared/create-runtime-provider.js";
 import { createLogger } from "../shared/logger.js";
 import {
   OpenAiCompatibleDiscoveryCache,
+  buildLiteLlmCapabilitiesUrl,
   buildOpenAiCompatibleModelsRequest,
+  enrichLiteLlmReasoning,
   findEligibleOpenAiCompatibleProviderConfigsResult,
   formatOpenAiCompatibleDiscoverySummary,
   materializeOpenAiCompatibleModels,
   openAiCompatibleConnectionFingerprint,
   redactOpenAiCompatibleDiagnostic,
   resolveStaticOpenAiCompatibleHeaders,
+  type LiteLlmCapabilityRecord,
   type OpenAiCompatibleModelRecord,
   type ResolvedOpenAiCompatibleConnection,
 } from "../shared/openai-compatible-discovery.js";
@@ -28,6 +31,18 @@ function responseRecords(payload: unknown): OpenAiCompatibleModelRecord[] {
   });
 }
 
+function capabilityRecords(payload: unknown): LiteLlmCapabilityRecord[] {
+  if (!payload || typeof payload !== "object" || !Array.isArray((payload as { data?: unknown }).data))
+    throw new Error("LiteLLM capability response must contain a data array");
+  return (payload as { data: unknown[] }).data.filter(
+    (record): record is LiteLlmCapabilityRecord => Boolean(record) && typeof record === "object" && !Array.isArray(record),
+  );
+}
+
+function isLiteLlmProvider(sourceProviderId: string, source: Provider): boolean {
+  return `${sourceProviderId} ${source.name ?? ""}`.toLowerCase().includes("litellm");
+}
+
 function resolvedConnection(source: Provider, auth?: AuthResult, staticHeaders?: Record<string, string>): ResolvedOpenAiCompatibleConnection {
   return {
     baseUrl: auth?.auth.baseUrl ?? source.baseUrl,
@@ -84,7 +99,20 @@ async function discoverProvider(
         signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]),
       });
       if (!response.ok) throw new Error(`OpenAI-compatible /v1/models returned HTTP ${response.status}`);
-      return responseRecords(await response.json());
+      const records = responseRecords(await response.json());
+      if (!isLiteLlmProvider(sourceProviderId, source)) return records;
+      try {
+        const capabilityResponse = await fetch(buildLiteLlmCapabilitiesUrl(request.url), {
+          headers: request.headers,
+          redirect: "error",
+          signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]),
+        });
+        if (!capabilityResponse.ok) throw new Error(`LiteLLM capability endpoint returned HTTP ${capabilityResponse.status}`);
+        return enrichLiteLlmReasoning(records, capabilityRecords(await capabilityResponse.json()));
+      } catch (error) {
+        log.warn(`${sourceProviderId}: reasoning capability enrichment unavailable`, redactOpenAiCompatibleDiagnostic(error instanceof Error ? error.message : String(error), connection));
+        return records;
+      }
     } catch (error) {
       log.warn(`${sourceProviderId}: discovery refresh failed`, redactOpenAiCompatibleDiagnostic(error instanceof Error ? error.message : String(error), connection));
       throw error;

package/extensions/orchestrator/async-agents.ts

@@ -15,6 +15,7 @@ const require = createRequire(import.meta.url);
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { AgentConfig, AgentDiscoveryResult } from "./agents.js";
 import { resolveAgentModelProvider } from "./resolve-agent-model.js";
+import { withGraftTools } from "./graft.js";
 import { getPiInvocation, getProjectTmpDir, parseProcStartTime, djb2Hash } from "./utils.js";
 import { addReviewerPending, recordReviewerResult, countFindings, readReviewState } from "./pi-config-review-state.js";
 import {
@@ -924,7 +925,8 @@ export function registerAsyncAgents(
     piArgs.push("--session-id", deterministicSessionId);
     if (effectiveModel) piArgs.push("--model", effectiveModel);
     if (effectiveProvider) piArgs.push("--provider", effectiveProvider);
-    if (agent.tools?.length) piArgs.push("--tools", agent.tools.join(","));
+    const tools = withGraftTools(agent.tools, getSetting(cwd, "graft_enable"));
+    if (tools?.length) piArgs.push("--tools", tools.join(","));
 
     if (agent.systemPrompt?.trim()) {
       const promptPath = path.join(workerDir, "system-prompt.md");

package/extensions/orchestrator/graft.ts

@@ -0,0 +1,306 @@
+/** Opt-in, local Graft graph integration. */
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, linkSync, mkdirSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import { createLogger } from "../shared/logger.js";
+import { isPiOneshotInvocation } from "../shared/oneshot.js";
+import { getSetting } from "./project-settings.js";
+import { clearSlot, setSlot } from "./status-bar.js";
+import { getProjectTmpDir, resolveWorktreeRoot } from "./utils.js";
+import { formatCompactTotal } from "../shared/format-total.js";
+
+const exec = promisify(execFile);
+const log = createLogger("graft");
+const TIMEOUT_MS = 45_000;
+const MAX_BUFFER = 64 * 1024;
+const MIN_PROMPT_CHARS = 12;
+const INTERACTIVE_TIMEOUT_MS = 2_000;
+export const GRAFT_QUERY_TOOLS = ["graft_find_code", "graft_find_all", "graft_file_api", "graft_trace_calls", "graft_repo_map"] as const;
+export function withGraftTools(tools: readonly string[] | undefined, enabled: boolean): string[] | undefined {
+  if (!tools?.length || !enabled) return tools ? [...tools] : undefined;
+  return [...new Set([...tools, ...GRAFT_QUERY_TOOLS])];
+}
+export type GraftState = "syncing" | "ready" | "stale" | "failed";
+export type GraftRun = (args: readonly string[], options: { cwd: string; timeoutMs?: number }) => Promise<{ stdout: string; stderr: string; code: number }>;
+type GraphStatus = "fresh" | "stale" | "absent";
+type Options = { enabled: boolean; setting?: (cwd: string) => boolean; executable?: () => Promise<boolean>; graph?: (cwd: string) => Promise<GraphStatus>; retrieve?: (query: string, cwd: string) => Promise<{ pointers: string[] }>; run?: GraftRun; interactiveTimeoutMs?: number };
+type StatusTheme = { fg: (color: string, value: string) => string };
+type Hit = { title?: string; pointer?: string; snippet?: string };
+type Ask = { coverage?: number; coverageStrong?: number; hits?: Hit[] };
+
+/** Graft's statusline shape, adapted to Pi's theme API. */
+export function formatGraftFooter({ state, nodeCount, tokenSavings }: { state: GraftState; nodeCount: number; tokenSavings: number }, theme?: StatusTheme): string {
+  const fg = (color: string, value: string) => theme?.fg(color, value) ?? value;
+  const freshness = state === "syncing" ? fg("warning", "syncing…") : state === "stale" ? fg("warning", "⚠ stale") : state === "failed" ? fg("error", "failed") : fg("success", "✓ synced");
+  const parts = [fg("dim", "◤ ") + fg("accent", "graft"), fg("dim", `${nodeCount} nodes`), freshness];
+  if (tokenSavings > 0) parts.push(fg("success", `~${formatCompactTotal(tokenSavings)} tok saved`));
+  return parts.join(fg("dim", " · "));
+}
+function text(value: unknown, max = 500): string | null { return typeof value === "string" && value.trim() && value.length <= max && !/[\0\r\n]/.test(value) ? value.trim() : null; }
+function projectPath(root: string, value: unknown): string | null {
+  const file = text(value); if (!file || isAbsolute(file)) return null;
+  const absolute = resolve(root, file); if (relative(root, absolute).startsWith("..")) return null;
+  try { const realRoot = realpathSync(root); const realFile = realpathSync(absolute); return realFile === realRoot || realFile.startsWith(realRoot + sep) ? file : null; } catch { return null; }
+}
+function wiring(root: string): any | null { try { return JSON.parse(readFileSync(resolve(root, "graft/.graph/wiring.json"), "utf8")); } catch { return null; } }
+function nodes(root: string): number { const graph = wiring(root); return Number.isSafeInteger(graph?.meta?.nodeCount) ? graph.meta.nodeCount : graph?.nodes?.length ?? 0; }
+function savedTokens(output: string): number { return [...output.matchAll(/\[graft\] tokens saved ≈ ([\d,]+)/g)].reduce((total, match) => total + (Number(match[1].replaceAll(",", "")) || 0), 0); }
+function savingsStore(ctx: any, root: string): string {
+  let id: unknown = process.env.PI_SUBAGENT_CHILD === "1" ? process.env.__PI_PARENT_SESSION_ID : undefined;
+  const source = id ? "parent" : "session";
+  try { id ||= ctx.sessionManager?.getSessionId?.(); } catch { log.debug("savings_store_resolved", { source, available: false }); return ""; }
+  if (typeof id !== "string" || !id) { log.debug("savings_store_resolved", { source, available: false }); return ""; }
+  const dir = getProjectTmpDir(root); chmodSync(dir, 0o700);
+  log.debug("savings_store_resolved", { source, available: true });
+  return join(dir, `graft-savings-${createHash("sha256").update(id).digest("hex")}.json`);
+}
+function validSavings(value: unknown): number { return Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : 0; }
+function readSavings(file: string): number {
+  if (!file) return 0;
+  try { return validSavings(JSON.parse(readFileSync(file, "utf8"))?.tokenSavings); } catch { return 0; }
+}
+function writeSavings(file: string, delta: number): number {
+  if (!file || !delta) return readSavings(file);
+  const lock = `${file}.lock`; const owner = { pid: process.pid, token: randomUUID() }; const ownerTmp = `${lock}.${owner.token}.tmp`; const valueTmp = `${file}.${owner.token}.tmp`;
+  for (let attempt = 0; attempt < 100; attempt++) {
+    let acquired = false;
+    try {
+      writeFileSync(ownerTmp, JSON.stringify(owner), { mode: 0o600, flag: "wx" }); linkSync(ownerTmp, lock); acquired = true; unlinkSync(ownerTmp);
+      const total = readSavings(file) + delta;
+      writeFileSync(valueTmp, JSON.stringify({ tokenSavings: total }), { mode: 0o600 }); renameSync(valueTmp, file);
+      return total;
+    } catch (error: any) {
+      if (error?.code !== "EEXIST") { log.warn("savings_persist_failed", { code: error?.code }); return readSavings(file); }
+      const existing = lockOwner(lock);
+      if (existing && !ownerAlive(existing)) {
+        const claim = `${lock}.claim-${owner.token}`;
+        try { renameSync(lock, claim); if (lockOwner(claim)?.token === existing.token && !ownerAlive(existing)) unlinkSync(claim); else try { renameSync(claim, lock); } catch {} } catch {}
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2);
+    } finally {
+      try { unlinkSync(ownerTmp); } catch {}
+      try { unlinkSync(valueTmp); } catch {}
+      if (acquired) try { if (lockOwner(lock)?.token === owner.token) unlinkSync(lock); } catch {}
+    }
+  }
+  log.warn("savings_persist_failed", { code: "LOCK_BUSY" }); return readSavings(file);
+}
+function toolText(content: unknown): string { return Array.isArray(content) ? content.map((part: any) => typeof part?.text === "string" ? part.text : "").join("\n") : ""; }
+export function classifyToolUse(name: unknown, input: any): "graft" | "source" | null {
+  const tool = typeof name === "string" ? name.toLowerCase() : "";
+  if (tool.startsWith("graft_")) return "graft";
+  if (["read", "grep", "find", "ls"].includes(tool)) return "source";
+  if (["bash", "powershell"].includes(tool) && /(^|[|&;]\s*)(npx\s+(-y\s+)?(@nanonets\/)?\s*)?graft(-dev)?\b/i.test(String(input?.command ?? ""))) return "graft";
+  return null;
+}
+function forceUseGuidance(stale = false): string { return `[graft] This trusted project has a ${stale ? "stale but usable" : "ready"} local Graft graph. Use Graft before raw grep/read: graft_find_code for where/how, graft_trace_calls for callers/callees or blast radius, graft_file_api for a file API, graft_repo_map for orientation, and graft_find_all only when every occurrence is required. Use raw tools only to inspect a Graft result or when Graft has no answer.${stale ? " The owner is rebuilding the graph; verify pointers against source." : ""}`; }
+function substantive(query: string): boolean { return query.length >= MIN_PROMPT_CHARS && !query.startsWith("/"); }
+function pointerPath(pointer: string): string | null { const match = /^(.+?):\d+(?::\d+)?$/.exec(pointer.trim()); return match?.[1] ?? null; }
+function navigationTool(event: any): boolean {
+  const tool = String(event?.toolName ?? event?.name ?? "").toLowerCase();
+  if (["grep", "find", "glob", "search"].includes(tool)) return true;
+  if (tool !== "bash" && tool !== "powershell") return false;
+  return /(^|[|;&]\s*)(?:\S+=\S+\s+)*(?:rg|grep|find|ag|ack)\b/i.test(String(event?.input?.command ?? ""));
+}
+function graftGateReason(): string { return "[graft] Project navigation is blocked until Graft retrieval runs for this turn. Use graft_find_code (or graft_repo_map/graft_trace_calls), then inspect its returned file pointers. If Graft has no relevant result, retry the raw navigation."; }
+function diagnostic(stderr: string): string { return text(stderr.split(/\r?\n/, 1)[0], 240) ?? "no diagnostic output"; }
+async function withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {
+  let timer: NodeJS.Timeout | undefined; let timedOut = false;
+  log.debug("retrieval_timeout_setup", { timeoutMs });
+  try { return await Promise.race([promise, new Promise<never>((_, reject) => { timer = setTimeout(() => { timedOut = true; log.warn("retrieval_timeout", { timeoutMs }); reject(new Error("automatic retrieval timed out")); }, timeoutMs); })]); }
+  finally { if (timer) clearTimeout(timer); log.debug("retrieval_timeout_cleanup", { timeoutMs, timedOut }); }
+}
+type LockOwner = { pid: number; token: string };
+function lockOwner(lock: string): LockOwner | null { try { const raw = readFileSync(lock, "utf8"); const legacyPid = Number(raw); if (Number.isSafeInteger(legacyPid)) return { pid: legacyPid, token: `legacy-${legacyPid}` }; const owner = JSON.parse(raw); return Number.isSafeInteger(owner?.pid) && typeof owner?.token === "string" ? owner : null; } catch { return null; } }
+function ownerAlive(owner: LockOwner | null): boolean { if (!owner) return false; try { process.kill(owner.pid, 0); return true; } catch (error: any) { return error?.code === "EPERM"; } }
+export function acquireBuildLock(root: string, afterClaim?: () => void): (() => void) | null {
+  const lock = resolve(root, "graft/.graph/pi-build.lock"); const claim = `${lock}.claim`; const owner = { pid: process.pid, token: randomUUID() };
+  try { mkdirSync(dirname(lock), { recursive: true }); } catch { log.warn("build_lock_unavailable", { root }); return null; }
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const claimant = lockOwner(claim);
+    if (claimant) { if (ownerAlive(claimant)) return null; try { unlinkSync(claim); } catch { return null; } }
+    try {
+      const fd = openSync(lock, "wx", 0o600); writeFileSync(fd, JSON.stringify(owner)); closeSync(fd);
+      if (lockOwner(claim)) { try { if (lockOwner(lock)?.token === owner.token) unlinkSync(lock); } catch {} return null; }
+      return () => { try { if (lockOwner(lock)?.token === owner.token) unlinkSync(lock); } catch {} };
+    } catch (error: any) {
+      if (error?.code !== "EEXIST") return null;
+      try {
+        renameSync(lock, claim);
+        const claimedOwner = lockOwner(claim);
+        if (ownerAlive(claimedOwner)) { try { renameSync(claim, lock); } catch {} return null; }
+        afterClaim?.(); unlinkSync(claim);
+      } catch { return null; }
+    }
+  }
+  return null;
+}
+function trusted(ctx: any): boolean { return typeof ctx?.isProjectTrusted !== "function" || ctx.isProjectTrusted() === true; }
+function relevant(ask: Ask): Hit[] { const hits = ask.hits?.filter(hit => text(hit.pointer) && text(hit.title)) ?? []; if (!hits.length) return []; if ((typeof ask.coverage === "number" || typeof ask.coverageStrong === "number") && (ask.coverageStrong ?? 0) < .1 && (ask.coverage ?? 0) < .5) return []; return hits.slice(0, 3); }
+function pointerText(hits: Hit[]): string { return hits.map((hit, i) => { const snippet = text(hit.snippet, 140); return ` ${i + 1}. ${text(hit.title)!}: ${text(hit.pointer)!}${snippet ? `\n    ${snippet.replace(/\s+/g, " ")}` : ""}`; }).join("\n"); }
+function blastHint(root: string, path: unknown): string | null {
+  const file = typeof path === "string" ? path : null; const graph = file && wiring(root); if (!file || !graph) return null;
+  const names = new Map((graph.nodes ?? []).map((node: any) => [node.id, node]));
+  const ids = new Set((graph.nodes ?? []).filter((node: any) => node.path === file || file.endsWith(`/${node.path}`)).map((node: any) => node.id));
+  const dependents = (graph.edges ?? []).filter((edge: any) => ids.has(edge.target) && !ids.has(edge.source)).slice(0, 8).map((edge: any) => { const node = names.get(edge.source); return ` • ${edge.relation} ← ${node ? `${node.name} (${basename(node.path)})` : edge.source}`; });
+  return dependents.length ? `[graft] blast radius for ${basename(file)}, who depends on it:\n${dependents.join("\n")}` : null;
+}
+export function isEligibleGraftStartup(event: any, ctx: any): boolean { return event?.reason === "startup" && ctx?.mode !== "print" && ctx?.mode !== "json" && process.env.PI_SUBAGENT_CHILD !== "1" && !isPiOneshotInvocation(); }
+
+export function createGraftIntegration(options: Options) {
+  const child = process.env.PI_SUBAGENT_CHILD === "1";
+  const state = { generation: 0, root: "", store: "", dirtySignal: "", enabled: false, events: undefined as ExtensionAPI["events"] | undefined, value: "stale" as GraftState, nodeCount: 0, tokenSavings: 0, graftReads: 0, sourceReads: 0, dirty: false, refresh: undefined as Promise<boolean> | undefined, ctx: undefined as any, gate: { active: false, retrieved: false, pointers: new Set<string>() } };
+  const publishSavings = () => {
+    if (child || !state.events) return;
+    state.events.emit("pidash:graft-savings", { tokenSavings: state.tokenSavings });
+    log.debug("savings_published", { tokenSavings: state.tokenSavings });
+  };
+  const setState = (value: GraftState) => { state.value = value; setSlot("graft", formatGraftFooter({ state: value, nodeCount: state.nodeCount, tokenSavings: state.tokenSavings }, state.ctx?.ui?.theme), state.ctx); publishSavings(); };
+  const addSavings = (amount: number) => { if (!amount) return; state.tokenSavings = state.store ? writeSavings(state.store, amount) : state.tokenSavings + amount; };
+  const rawRun: GraftRun = options.run ?? (async (args, { cwd, timeoutMs }) => { try { const result = await exec("graft", args as string[], { cwd, timeout: timeoutMs ?? TIMEOUT_MS, maxBuffer: MAX_BUFFER, env: { ...process.env, DO_NOT_TRACK: "1", npm_config_offline: "true" } }); return { stdout: String(result.stdout).slice(0, MAX_BUFFER), stderr: String(result.stderr).slice(0, MAX_BUFFER), code: 0 }; } catch (error: any) { return { stdout: String(error?.stdout ?? "").slice(0, MAX_BUFFER), stderr: String(error?.stderr || error?.message || "").slice(0, MAX_BUFFER), code: Number(error?.code) || 1 }; } });
+  const run: GraftRun = async (args, options) => {
+    const started = Date.now();
+    // Do not log ask arguments: they contain the user's prompt.
+    log.info("subprocess_start", { command: args[0], argCount: args.length, cwd: options.cwd });
+    const result = await rawRun(args, options);
+    const timing = { command: args[0], argCount: args.length, code: result.code, elapsedMs: Date.now() - started, stdoutBytes: result.stdout.length, stderrBytes: result.stderr.length };
+    if (result.code) log.warn("subprocess_end", timing); else log.info("subprocess_end", timing);
+    return result;
+  };
+  const available = options.executable ?? (async () => (await run(["--version"], { cwd: state.root })).code === 0);
+  const graph = options.graph ?? (async cwd => (await run(["check", "--json"], { cwd })).code === 0 ? "fresh" : nodes(cwd) ? "stale" : "absent");
+  const refresh = async (): Promise<boolean> => {
+    if (child) return false;
+    if (state.refresh) { log.info("refresh_join", { dirty: state.dirty }); return state.refresh; }
+    const generation = state.generation;
+    const root = state.root;
+    const release = acquireBuildLock(root);
+    if (!release) { log.info("refresh_locked", { root }); return false; }
+    const started = Date.now();
+    log.info("refresh_start", { root, dirty: state.dirty });
+    setState(state.value === "stale" || state.nodeCount ? "stale" : "syncing");
+    let pending!: Promise<boolean>;
+    pending = (async () => {
+      const result = await run(["build"], { cwd: root });
+      const nodeCount = nodes(root);
+      if (state.generation !== generation || state.root !== root) {
+        log.info("refresh_end_stale", { root, ok: result.code === 0, nodes: nodeCount, elapsedMs: Date.now() - started });
+        return false;
+      }
+      state.nodeCount = nodeCount; state.dirty = result.code !== 0;
+      if (!result.code && state.dirtySignal) try { for (const signal of readdirSync(state.dirtySignal)) try { unlinkSync(join(state.dirtySignal, signal)); } catch {} } catch {}
+      setState(result.code === 0 ? "ready" : state.nodeCount ? "stale" : "failed");
+      log.info("refresh_end", { ok: result.code === 0, nodes: state.nodeCount, elapsedMs: Date.now() - started });
+      return result.code === 0;
+    })().finally(() => { release(); if (state.refresh === pending) state.refresh = undefined; });
+    state.refresh = pending;
+    return pending;
+  };
+  const markDirty = (source: string) => { if (state.dirty) { log.debug("graph_dirty_repeat", { source }); return; } state.dirty = true; setState("stale"); log.info("graph_dirty", { source }); };
+  const consumeDirtySignals = () => {
+    if (child || !state.dirtySignal) return;
+    try { const signals = readdirSync(state.dirtySignal); if (!signals.length) return; markDirty("child"); log.info("child_dirty_consumed", { count: signals.length }); } catch {}
+  };
+  const invalidate = (ctx: any, reason: string) => {
+    state.generation++; state.ctx = ctx; state.enabled = false; state.root = ""; state.store = ""; state.dirtySignal = ""; state.refresh = undefined; state.dirty = false; state.nodeCount = 0; state.tokenSavings = 0; state.gate = { active: false, retrieved: false, pointers: new Set<string>() };
+    clearSlot("graft", ctx); publishSavings(); log.info("session_invalidated", { reason });
+  };
+  const invoke = async (args: string[]) => {
+    log.info("tool_invoke", { command: args[0], enabled: state.enabled, dirty: state.dirty }); if (!state.enabled || !state.root || !trusted(state.ctx) || resolveWorktreeRoot(state.ctx.cwd) !== state.root) return "Graft is disabled or untrusted for this project.";
+    if (args[0] === "build") return await refresh() ? "Graft graph rebuilt." : "Graft rebuild was skipped or failed; the existing graph remains available when present.";
+    let result = await run(args, { cwd: state.root });
+    const scoped = args.indexOf("--in");
+    if (result.code && scoped >= 0) { const retry = [...args]; retry.splice(scoped, 2); log.info("scope_retry_root", { command: args[0] }); result = await run(retry, { cwd: state.root }); }
+    if (result.code) return `Graft ${args[0]} failed: ${diagnostic(result.stderr)}`;
+    state.nodeCount = nodes(state.root); setState(state.dirty || state.value === "stale" ? "stale" : "ready"); return result.stdout.slice(0, MAX_BUFFER);
+  };
+  const register = (pi: ExtensionAPI) => {
+    if (!options.enabled) return;
+    state.events = pi.events;
+    let toolsRegistered = false;
+    const registerTools = () => { if (toolsRegistered) return; toolsRegistered = true; const tool = (name: string, description: string, parameters: any, args: (params: any) => string[] | null) => pi.registerTool({ name, label: name.replace("graft_", "Graft ").replace(/_/g, " "), description, parameters, async execute(_id, params) { const command = args(params); return { content: [{ type: "text" as const, text: command ? await invoke(command) : "Invalid input: use an existing project-relative path." }], details: {} }; } });
+      tool("graft_find_code", "Find compact ranked code references in the local Graft graph.", Type.Object({ query: Type.String(), limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 20 })), path: Type.Optional(Type.String()) }), p => { const q = text(p.query), file = p.path === undefined ? undefined : projectPath(state.root, p.path); return q && (p.path === undefined || file) ? ["ask", q, ".", "--limit", String(p.limit ?? 8), ...(file ? ["--in", file] : [])] : null; });
+      tool("graft_find_all", "Search indexed project files.", Type.Object({ pattern: Type.String(), path: Type.Optional(Type.String()), fixed: Type.Optional(Type.Boolean()) }), p => { const pattern = text(p.pattern), file = p.path === undefined ? undefined : projectPath(state.root, p.path); return pattern && (p.path === undefined || file) ? ["grep", ...(p.fixed ? ["--fixed"] : []), ...(file ? ["--in", file] : []), pattern] : null; });
+      tool("graft_file_api", "Get a signatures-only API view for a project file.", Type.Object({ path: Type.String() }), p => { const file = projectPath(state.root, p.path); return file ? ["skeleton", file] : null; });
+      tool("graft_trace_calls", "Trace callers or callees of a symbol.", Type.Object({ symbol: Type.String(), direction: Type.Optional(Type.Union([Type.Literal("in"), Type.Literal("out")])), depth: Type.Optional(Type.Integer({ minimum: 1, maximum: 10 })) }), p => { const symbol = text(p.symbol); return symbol ? ["callers", "--direction", p.direction ?? "in", "--depth", String(p.depth ?? 1), symbol] : null; });
+      tool("graft_repo_map", "Show a compact graph-based repository map.", Type.Object({ max_dirs: Type.Optional(Type.Integer({ minimum: 1, maximum: 30 })) }), p => ["map", "--max-dirs", String(p.max_dirs ?? 16)]);
+      if (!child) { tool("graft_refresh", "Rebuild the local Graft graph.", Type.Object({}), () => ["build"]); tool("graft_blast_radius", "Find dependencies affected by the local diff.", Type.Object({ depth: Type.Optional(Type.Integer({ minimum: 1, maximum: 10 })) }), p => ["blast", "--depth", String(p.depth ?? 2)]); }
+    };
+    pi.on("session_start", async (event: any, ctx: any) => {
+      state.ctx = ctx; log.info("session_start_enter", { reason: event?.reason, mode: ctx?.mode, trusted: trusted(ctx) });
+      if (!trusted(ctx)) { invalidate(ctx, "untrusted"); log.info("session_start_exit", { decision: "untrusted" }); return; }
+      const enabled = options.setting?.(ctx.cwd) ?? options.enabled;
+      if (!enabled) { invalidate(ctx, "disabled"); log.info("session_start_exit", { decision: "disabled" }); return; }
+      registerTools(); const generation = ++state.generation; state.enabled = true; state.refresh = undefined; state.dirty = false; state.root = resolveWorktreeRoot(ctx.cwd); const root = state.root; state.nodeCount = nodes(root); state.value = "failed"; state.gate = { active: false, retrieved: false, pointers: new Set<string>() };
+      try { state.store = savingsStore(ctx, root); state.dirtySignal = state.store ? `${state.store}.dirty` : ""; if (state.dirtySignal) { mkdirSync(state.dirtySignal, { recursive: true, mode: 0o700 }); chmodSync(state.dirtySignal, 0o700); } state.tokenSavings = readSavings(state.store); } catch (error: any) { state.store = ""; state.dirtySignal = ""; state.tokenSavings = 0; log.warn("savings_restore_failed", { code: error?.code }); }
+      setState("failed");
+      if (!child && !isEligibleGraftStartup(event, ctx) && !["new", "reload", "resume", "fork"].includes(event?.reason)) { log.info("session_start_exit", { decision: "ineligible" }); return; }
+      if (!child) { const executable = await available(); if (state.generation !== generation || state.root !== root) return; if (!executable) { setState("failed"); log.info("session_start_exit", { decision: "unavailable" }); return; } }
+      const status = await graph(root);
+      if (state.generation !== generation || state.root !== root) return;
+      if (status === "fresh") setState("ready");
+      else { setState(state.nodeCount ? "stale" : "failed"); if (!child) void refresh(); }
+      log.info("session_start_exit", { decision: status, nodes: state.nodeCount });
+    });
+    pi.on("tool_call", (event: any, ctx: any) => {
+      const tool = String(event?.toolName ?? event?.name ?? "").toLowerCase();
+      const allowedPointerRead = tool === "read" && typeof event?.input?.path === "string" && state.gate.pointers.has(event.input.path.replace(/^\.\//, ""));
+      if (!state.enabled || !["ready", "stale"].includes(state.value) || !state.gate.active || state.gate.retrieved || allowedPointerRead || !(navigationTool(event) || tool === "read")) return;
+      log.info("navigation_blocked", { tool: event.toolName });
+      return { block: true, reason: graftGateReason() };
+    });
+    pi.on("tool_result", (event: any, ctx: any) => {
+      state.ctx = ctx;
+      const attemptedGraft = String(event.toolName).toLowerCase().startsWith("graft_");
+      if (attemptedGraft) { state.gate.retrieved = true; state.gate.active = false; }
+      const kind = !event.isError ? classifyToolUse(event.toolName, event.input) : null;
+      const savings = !event.isError ? savedTokens(toolText(event.content)) : 0;
+      if (kind === "graft") state.graftReads++; else if (kind === "source") state.sourceReads++;
+      addSavings(savings);
+      if (kind || savings) { setState(state.dirty || state.value === "stale" ? "stale" : "ready"); log.info("session_metric", { tool: event.toolName, kind, savings, graftReads: state.graftReads, sourceReads: state.sourceReads, tokenSavings: state.tokenSavings }); }
+      const eligible = state.enabled && !event.isError && ["write", "edit"].includes(event.toolName);
+      log.info("tool_result", { tool: event.toolName, eligible, kind, savings }); if (!eligible) return;
+      if (child) { if (!state.dirtySignal) { log.warn("child_dirty_signal_unavailable", { tool: event.toolName }); return; } try { writeFileSync(join(state.dirtySignal, `${process.pid}-${randomUUID()}`), event.toolName, { mode: 0o600, flag: "wx" }); log.info("child_dirty_signaled", { tool: event.toolName }); } catch (error: any) { log.warn("child_dirty_signal_failed", { code: error?.code }); } return; }
+      markDirty(event.toolName); const hint = blastHint(state.root, event.input?.path);
+      return hint ? { content: [...(event.content ?? []), { type: "text", text: hint }] } : undefined;
+    });
+    pi.on("before_agent_start", async (event: any, ctx: any) => {
+      const started = Date.now(); state.ctx = ctx; const query = text(event?.prompt); const generation = state.generation; const root = state.root;
+      state.gate = { active: false, retrieved: false, pointers: new Set<string>() }; const gate = state.gate;
+      const current = () => {
+        const generationMatches = state.generation === generation; const rootMatches = state.root === root; const gateMatches = state.gate === gate;
+        log.debug("retrieval_current", { generationMatches, rootMatches, gateMatches });
+        return generationMatches && rootMatches && gateMatches;
+      };
+      const finish = (decision: string, extra = {}) => log.info("prompt_retrieval_exit", { decision, elapsedMs: Date.now() - started, ...extra });
+      log.info("prompt_retrieval_enter", { enabled: state.enabled, trusted: trusted(ctx), dirty: state.dirty, refreshing: Boolean(state.refresh), queryLength: query?.length ?? 0 });
+      if (!trusted(ctx) || !state.enabled || !state.root || resolveWorktreeRoot(ctx.cwd) !== state.root) { finish("disabled_or_untrusted"); return; }
+      consumeDirtySignals(); state.tokenSavings = Math.max(state.tokenSavings, readSavings(state.store)); setState(state.value);
+      if (!["ready", "stale"].includes(state.value)) {
+        const status = await graph(root);
+        if (!current()) return;
+        if (status === "fresh") setState("ready"); else if (status === "stale") setState("stale"); else { finish("graph_absent"); return; }
+      }
+      const guidance = forceUseGuidance(state.value === "stale");
+      if (!query || !substantive(query)) { finish("guidance_only_control_prompt"); return { systemPrompt: `${event.systemPrompt}\n\n${guidance}` }; }
+      state.gate.active = true;
+      let hits: Hit[] = [];
+      try {
+        if (options.retrieve) { const result = await withTimeout(options.retrieve(query, root), options.interactiveTimeoutMs ?? INTERACTIVE_TIMEOUT_MS); if (!current()) return; hits = result.pointers.map(pointer => ({ title: pointer, pointer })); }
+        else { const result = await withTimeout(run(["ask", query, ".", "--json", "-n", "3"], { cwd: root, timeoutMs: options.interactiveTimeoutMs ?? INTERACTIVE_TIMEOUT_MS }), options.interactiveTimeoutMs ?? INTERACTIVE_TIMEOUT_MS); if (!current()) return; if (result.code) { state.gate.active = false; finish("ask_failed", { diagnostic: diagnostic(result.stderr) }); return { systemPrompt: `${event.systemPrompt}\n\n${guidance}\n\n[graft] Retrieval failed: ${diagnostic(result.stderr)}. Raw navigation is available.` }; } const savings = savedTokens(result.stdout); addSavings(savings); setState(state.value); try { hits = relevant(JSON.parse(result.stdout.replace(/^\[graft\] tokens saved ≈ [\d,]+\s*$/gm, "").trim())); } catch { state.gate.active = false; finish("invalid_ask_json"); return { systemPrompt: `${event.systemPrompt}\n\n${guidance}\n\n[graft] Retrieval returned malformed output. Raw navigation is available.` }; } }
+      } catch (error: any) { if (!current()) return; state.gate.active = false; finish("ask_error"); return { systemPrompt: `${event.systemPrompt}\n\n${guidance}\n\n[graft] Retrieval failed: ${text(error?.message, 240) ?? "unknown error"}. Raw navigation is available.` }; }
+      if (!hits.length) { state.gate.active = false; finish("guidance_only_no_relevant_hits"); return { systemPrompt: `${event.systemPrompt}\n\n${guidance}` }; }
+      hits.forEach(hit => { const path = pointerPath(hit.pointer!); if (path) state.gate.pointers.add(path); });
+      state.gate.retrieved = true; finish("injected", { hits: hits.length });
+      return { systemPrompt: `${event.systemPrompt}\n\n${guidance}\n\n[graft] starting points for this task:\n${pointerText(hits)}` };
+    });
+    pi.on("agent_end", (_event: any, ctx: any) => { state.ctx = ctx; consumeDirtySignals(); const shouldRefresh = !child && trusted(ctx) && state.enabled && state.dirty && !state.refresh; log.info("agent_end", { dirty: state.dirty, refreshing: Boolean(state.refresh), shouldRefresh }); if (shouldRefresh) void refresh(); });
+    pi.on("session_shutdown", () => { log.info("session_shutdown", { state: state.value, dirty: state.dirty, graftReads: state.graftReads, sourceReads: state.sourceReads, tokenSavings: state.tokenSavings }); clearSlot("graft", state.ctx); });
+  };
+  return { register };
+}
+export function registerGraft(pi: ExtensionAPI): void { createGraftIntegration({ enabled: true, setting: cwd => getSetting(cwd, "graft_enable") }).register(pi); }

package/extensions/orchestrator/index.ts

@@ -36,6 +36,7 @@ import { registerReviewUI } from "./review-ui.js";
 import { registerSessionSearch } from "./session-search.js";
 import { registerSettingsTui } from "./settings-tui.js";
 import { registerMarkdownTransformer } from "./markdown-transformer.js";
+import { registerGraft } from "./graft.js";
 import { ensureGitSshTimeout, isRunningInContainer, terminalNotify } from "./utils.js";
 import { createLogger } from "../shared/logger.js";
 import { setGlobalSessionId } from "../shared/file-logger.js";
@@ -94,6 +95,7 @@ export default function (pi: ExtensionAPI) {
   const { spawnAsyncAgent, killAsyncAgent, getAsyncJobs } = registerAsyncAgents(pi, terminalNotify);
   registerSubagentTool(pi, spawnAsyncAgent, killAsyncAgent);
   registerProjectSettings(pi);
+  registerGraft(pi);
   registerEnforcement(pi, IN_CONTAINER);
   registerReviewUI(pi);
   registerRules(pi, getAsyncJobs);

package/extensions/orchestrator/memory-tools.ts

@@ -339,7 +339,7 @@ function registerMemoryAdd(pi: ExtensionAPI): void {
           return {
             content: [{
               type: "text",
-              text: `Invalid action "${params.action}". run_after requires a command (e.g., 'run_after .dev/deploy-all.sh')`,
+              text: `Invalid action "${params.action}". run_after requires a command (e.g., 'run_after npm test')`,
             }],
           };
         }

package/extensions/orchestrator/project-settings.ts

@@ -41,6 +41,8 @@ interface ProjectSettings {
   cli_agents?: string | string[];
   pidash_enable?: boolean;
   pidiff_enable?: boolean;
+  /** Enable local Graft repository graph integration. Default: false. */
+  graft_enable?: boolean;
   pidash_port?: number;
   task_auto_clear_enabled?: boolean;
   task_auto_clear_minutes?: number;
@@ -105,6 +107,7 @@ export interface SettingsKeyDef {
   max?: number;
   strict_digits?: boolean;
   per_key_resolution?: boolean;
+  enum?: string[];
 }
 
 const SETTINGS_FILENAMES = ["pi-config-settings.jsonc", "pi-config-settings.json"];
@@ -136,6 +139,7 @@ const PROJECT_SETTINGS_KEYS: (keyof ProjectSettings)[] = [
   "cli_agents",
   "pidash_enable",
   "pidiff_enable",
+  "graft_enable",
   "pidash_port",
   "task_auto_clear_enabled",
   "task_auto_clear_minutes",
@@ -196,6 +200,7 @@ export function parseSettingsFile(filePath: string): ProjectSettings {
     if (typeof raw.orchestrator_edit_write_block === "boolean") result.orchestrator_edit_write_block = raw.orchestrator_edit_write_block;
     if (typeof raw.pidash_enable === "boolean") result.pidash_enable = raw.pidash_enable;
     if (typeof raw.pidiff_enable === "boolean") result.pidiff_enable = raw.pidiff_enable;
+    if (typeof raw.graft_enable === "boolean") result.graft_enable = raw.graft_enable;
     if (typeof raw.pidash_port === "number" && Number.isInteger(raw.pidash_port) && raw.pidash_port > 0 && raw.pidash_port <= 65535) {
       result.pidash_port = raw.pidash_port;
     }
@@ -248,7 +253,7 @@ export function parseSettingsFile(filePath: string): ProjectSettings {
     const SPECIAL_CASE_KEYS = new Set<string>([
       "commit_trailer", "allow_push_to_protected_branches", "use_worktrees",
       "dream_interval_hours", "dco", "comment_signature", "review_loop_enforcement",
-      "orchestrator_edit_write_block", "pidash_enable", "pidiff_enable", "pidash_port",
+      "orchestrator_edit_write_block", "pidash_enable", "pidiff_enable", "graft_enable", "pidash_port",
       "image_model", "internal_operations_provider", "internal_operations_model",
       "review_loop_max_cycles", "acpx_agents", "cli_agents", "agent_provider",
       "agent_model", "agent_overrides",
@@ -466,6 +471,7 @@ export function getSetting(cwd: string, key: "acpx_agents"): string[];
 export function getSetting(cwd: string, key: "cli_agents"): string[];
 export function getSetting(cwd: string, key: "pidash_enable"): boolean;
 export function getSetting(cwd: string, key: "pidiff_enable"): boolean;
+export function getSetting(cwd: string, key: "graft_enable"): boolean;
 export function getSetting(cwd: string, key: "pidash_port"): number;
 export function getSetting(cwd: string, key: "task_auto_clear_enabled"): boolean;
 export function getSetting(cwd: string, key: "task_auto_clear_minutes"): number;

package/extensions/orchestrator/settings-tui-helpers.ts

@@ -9,6 +9,7 @@ import { dirname, join as joinPath } from "node:path";
 import stripJsonComments from "strip-json-comments";
 import {
   type SettingsKeyDef,
+  SETTINGS_KEYS,
   getSettingsPath,
   getGlobalSettingsPath,
 } from "./project-settings.js";
@@ -40,14 +41,12 @@ export interface CategoryDef {
   keys: string[];
 }
 
-import settingsSchema from "../../settings-keys.json" with { type: "json" };
-
 // Build CATEGORIES dynamically from schema `group` field.
 // Preserves insertion order from settings-keys.json — groups appear
 // in the order their first key is declared.
 export const CATEGORIES: CategoryDef[] = (() => {
   const groupMap = new Map<string, string[]>();
-  for (const [key, def] of Object.entries(settingsSchema)) {
+  for (const [key, def] of Object.entries(SETTINGS_KEYS)) {
     const group = (def as any).group || "Other";
     if (!groupMap.has(group)) groupMap.set(group, []);
     groupMap.get(group)!.push(key);

package/extensions/orchestrator/settings-tui.ts

@@ -55,7 +55,6 @@ import {
   AgentOverridesSubmenu,
   SelectSubmenu,
 } from "./settings-tui-submenus.js";
-import settingsSchema from "../../settings-keys.json" with { type: "json" };
 
 // Re-export helpers for external consumers
 const log = createLogger("settings_tui");
@@ -229,8 +228,7 @@ export function buildCategoryItems(
           break;
 
         case "string": {
-          const schemaDef = settingsSchema[key as keyof typeof settingsSchema] as any;
-          const enumValues: string[] | undefined = schemaDef?.enum;
+          const enumValues = def.enum;
 
           if (enumValues && enumValues.length > 0) {
             item.submenu = (current: string, done: (val?: string) => void): Component => {

package/extensions/orchestrator/status-bar.ts

@@ -15,6 +15,7 @@ const SLOTS = {
   crons:  "3-crons",
   dream:  "3b-dream",
   git:    "4-git",
+  graft:  "4b-graft",
   review: "5-review",
 } as const;