pi-orchestrator-config 4.6.5 → 4.7.1

package/README.md

@@ -37,7 +37,7 @@ Single extension that provides:
 | **Task tracking**             | Structured task lists for multi-step workflows — live widget, progress tracking, reminder nudges (owned, based on [@tintinweb/pi-tasks](https://github.com/tintinweb/pi-tasks) MIT)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | **Neovim integration**        | Send changed files and review findings to nvim's quickfix list — only active when running inside nvim                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | **Inter-agent communication** | P2P (`/coms`) agent communication — on-demand activation via slash command                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| **Slash commands**            | `/pr-review`, `/issue-review`, `/release`, `/review-local`, `/review-status`, `/query-db`, `/btw`, `/async-status`, `/async-kill`, `/status`, `/dream`, `/remember`, `/coms`, `/pi-config-settings`, `/mcpc connect` — with autocomplete argument hints                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| **Slash commands**            | `/pr-review`, `/issue-review`, `/release`, `/review-local`, `/review-status`, `/query-db`, `/btw`, `/async-status`, `/async-kill`, `/status`, `/dream`, `/remember`, `/coms`, `/pi-config-settings` — with autocomplete argument hints                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | **GitHub autocomplete**       | Type `#` in the editor to get issue/PR suggestions from the current repo — lazy-loaded, 5min cache                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | **Command arg completions**   | Tab-complete arguments for slash commands — providers and models for `/external-ai`, branches for `/review-local`, PR numbers for `/pr-review`, and more                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | **Discord bot**               | Control pi sessions from your phone via Discord DMs — send prompts, answer ask_user dialogs, switch sessions                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
@@ -77,14 +77,13 @@ Single extension that provides:
 | `/dream`                                                                                        | Run memory consolidation — extract, deduplicate, maintain topic-based memory                                                                                                                                                                                                                                                                                                                                                                               |
 | `/remember <what>`                                                                              | Save a memory for future sessions                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `/dream-auto`                                                                                   | Toggle automatic memory dreaming (every 3h + session end)                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `/cron add\|list\|list-all\|remove [--persist]`                                                         | Schedule recurring tasks. Session jobs end with the session; `--persist` keeps a job across Pi sessions in this project. Add/remove mutations still work when leader election fails closed on an unsupported platform. For example: `/cron add every 2h check for new issues --persist` or `/cron remove persist:<uuid>`. `/cron list` opens an overlay for the selected jobs (or both when omitted). Persistent delivery is local at-least-once: a crash or leader recovery can repeat a run. Project cron writes use a stable OS `flock` (included in Docker via `util-linux`) across the entire transaction; native installations need `flock` and a shared filesystem that supports advisory locks. A busy or unavailable lock fails closed after two seconds. **Upgrade gate (enforced):** stop and drain every old Pi process writing crons on the shared mount before starting a version with this kernel lock; old directory-lock writers do not honor `flock` and must not resume. If a legacy `crons.json.mutation.lock` directory exists, new writes fail closed even if its PID is invisible or its heartbeat expired. Only after verifying every old writer cannot resume may an operator remove that stale directory (not `crons.json` or cron tasks). Never remove it merely because a write timed out. |
+| `/cron add\|list\|list-all\|remove [--persist]`                                                         | Schedule recurring tasks. Session jobs end with the session; `--persist` keeps a job across Pi sessions in this project. Add/remove mutations still work when leader election fails closed on an unsupported platform. For example: `/cron add every 2h check for new issues --persist` or `/cron remove persist:<uuid>`. Pin one job's model by naming it in the request: `/cron add every 2h check for new issues using openrouter/anthropic/claude-opus-5`. A bare `model-id` (e.g. `claude-opus-5`) keeps the normal provider resolution. An unpinned job uses the worker's normal resolution chain (`agent_overrides[worker]`, worker frontmatter, then `agent_provider`/`agent_model`) — cron does not pass the session model down, so a worker-level setting wins over the session model. An `acpx-*` provider cannot be pinned here: async children cannot register those providers, so the job runs on `internal_operations_provider`/`internal_operations_model` when both are set to a non-`acpx-*` pair, and is skipped with a logged error when they are not. `/cron list` opens an overlay for the selected jobs (or both when omitted). Persistent delivery is local at-least-once: a crash or leader recovery can repeat a run. Project cron writes use a stable OS `flock` (included in Docker via `util-linux`) across the entire transaction; native installations need `flock` and a shared filesystem that supports advisory locks. A busy or unavailable lock fails closed after two seconds. **Upgrade gate (enforced):** stop and drain every old Pi process writing crons on the shared mount before starting a version with this kernel lock; old directory-lock writers do not honor `flock` and must not resume. If a legacy `crons.json.mutation.lock` directory exists, new writes fail closed even if its PID is invisible or its heartbeat expired. Only after verifying every old writer cannot resume may an operator remove that stale directory (not `crons.json` or cron tasks). Never remove it merely because a write timed out. |
 | `/async-kill [name\|id\|all]`                                                                   | Kill async agents (overlay picker or by name/id)                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `/pi-config-settings [project\|global]`                                                         | Interactive TUI settings editor — browse all pi-config settings with scope indicators, smart pickers for providers/models, and immediate save                                                                                                                                                                                                                                                                                                              |
 | `/status`                                                                                       | Unified session snapshot — async agents, cron tasks, git branch, context usage                                                                                                                                                                                                                                                                                                                                                                             |
 | `/nvim-changed-files`                                                                           | Send git changed files to nvim's quickfix list (only inside nvim)                                                                                                                                                                                                                                                                                                                                                                                          |
 | `/pidiff start\|stop\|restart\|status`                                                          | Manage the pidiff diff viewer server (per-project)                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `/coms start\|stop\|status`                                                                     | P2P local agent communication (Unix socket)                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `/mcpc connect`                                                                                 | Connect MCP servers from `~/.pi/pi-config/mcp.json` (`mcpc connect --stdio`). Run after editing that file.                                                                                                                                                                                                                                                                                                                                                 |
 
 ### Inter-Agent Communication (coms)
 
@@ -159,7 +158,7 @@ The installer covers:
 
 - **Pi Packages** — pi-config, pi-vertex-claude, pi-web-access, myk-pi-tools, bun
 - **Python Tools** — prek
-- **npm Packages** — mcpc, acpx, agent-browser, graft
+- **npm Packages** — acpx, agent-browser, graft
 - **Browser Automation** — playwright + chromium
 - **Environment Setup** — gitignore configuration
 
@@ -215,7 +214,6 @@ Add retry logic to the HTTP client in src/api.py
 /release --dry-run
 /review-local main
 /query-db stats
-/mcpc connect
 ```
 
 ### Direct subagent usage
@@ -735,7 +733,6 @@ PI_PIDIFF_ENABLE=false pi
 | `uv` / `uvx`        | Python execution (enforced by orchestrator)                                                                                                                                                                                                                                                                                    |
 | `go`                | Go development and code review                                                                                                                                                                                                                                                                                                 |
 | `libxml2-dev`       | libxml2 headers — needed for building Python C extensions (e.g. ovirt-engine-sdk-python)                                                                                                                                                                                                                                       |
-| `mcpc`              | MCP CLI (`npm: @apify/mcpc`). Put servers in `~/.pi/pi-config/mcp.json` (already on the `~/.pi` mount). Pi runs `mcpc connect … --stdio` on start. After editing the file, `/mcpc connect`. `entrypoint.sh` reinstalls `@apify/mcpc` on every start so `PI_HOST_USER` host `.npm-global` mapping does not hide the image copy. |
 | `myk-pi-tools`      | PR review, release, and other CLI utilities                                                                                                                                                                                                                                                                                    |
 | `prek`              | Pre-commit hook runner                                                                                                                                                                                                                                                                                                         |
 | `acpx`              | Agent proxy for remote models                                                                                                                                                                                                                                                                                                  |
@@ -896,7 +893,7 @@ See [DEVELOPMENT.md](DEVELOPMENT.md) for tips on testing extensions locally, run
 
 ## Prerequisites
 
-- [pi](https://github.com/badlogic/pi-mono) (minimum version: **0.87.0**). Pidash uses Pi's `ui_prompt_start` and `ui_prompt_end` events to show prompt wait separately from agent work.
+- [pi](https://github.com/badlogic/pi-mono) (minimum version: **0.99.0**). Pidash uses Pi's `ui_prompt_start` and `ui_prompt_end` events to show prompt wait separately from agent work.
 - `gh` CLI (for GitHub operations)
 - `uv` (for Python execution)
 - `myk-pi-tools` (optional, for `/pr-review` and `/release`)

package/extensions/orchestrator/async-agents.ts

@@ -886,7 +886,7 @@ export function registerAsyncAgents(
     if (!parentStartTime) {
       log.warn("async-spawn: could not read /proc/self/stat starttime after 3 attempts");
     }
-    const { model: effectiveModel, provider: effectiveProvider } = resolveAgentModelProvider(agentName, agent, options?.parentModelId, options?.parentProvider, cwd, options?.explicit);
+    let { model: effectiveModel, provider: effectiveProvider } = resolveAgentModelProvider(agentName, agent, options?.parentModelId, options?.parentProvider, cwd, options?.explicit);
     fs.writeFileSync(path.join(workerDir, "session.json"), JSON.stringify({
       resultsDir: ASYNC_RESULTS_DIR,
       fireAndForget: options?.fireAndForget || false,

package/extensions/orchestrator/cron-status-format.ts

@@ -1,6 +1,9 @@
 /**
  * Pure cron status display helpers — no TUI deps (unit-testable).
  */
+import { createLogger } from "../shared/logger.js";
+
+const log = createLogger("cron_status");
 
 export interface CronStatusTaskView {
   /** Unique scope-qualified overlay row id (e.g. "session:<uuid>"). */
@@ -12,6 +15,8 @@ export interface CronStatusTaskView {
   intervalMs?: number;
   atHour?: number;
   atMinute?: number;
+  /** "provider/model-id" or bare "model-id"; absent means the session default. */
+  model?: string;
   createdAt: number;
   lastRun?: number;
   nextRun?: number;
@@ -88,6 +93,28 @@ export function formatNextRunLabel(
   return `in ${formatRelativeMs(delta)}`;
 }
 
+/** Detail rows rendered by the cron task overlay, uncolored (label, value). */
+export function cronDetailRows(
+  task: CronStatusTaskView,
+  now = Date.now(),
+): Array<[string, string]> {
+  const rows: Array<[string, string]> = [
+    ["Schedule", formatCronSchedule(task)],
+    [
+      "Last run",
+      `${formatLastRunLabel(task, now)}${
+        task.lastRun ? ` · ${new Date(task.lastRun).toLocaleString()}` : ""
+      }`,
+    ],
+    ["Next run", formatNextRunLabel(task, now)],
+    ["Created", new Date(task.createdAt).toLocaleString()],
+  ];
+  if (task.sessionLabel) rows.push(["Session", task.sessionLabel]);
+  if (task.model) rows.push(["Model", task.model]);
+  log.debug("cron_detail_rows", { id: task.id, rows: rows.length, model: task.model || "inherit" });
+  return rows;
+}
+
 /** Map a CronTask-like object into an overlay row view. */
 export function toCronStatusTaskView(
   task: {
@@ -97,6 +124,7 @@ export function toCronStatusTaskView(
     intervalMs?: number;
     atHour?: number;
     atMinute?: number;
+    model?: string;
     createdAt: number;
     lastRun?: number;
     nextRun?: number;
@@ -116,6 +144,7 @@ export function toCronStatusTaskView(
     intervalMs: task.intervalMs,
     atHour: task.atHour,
     atMinute: task.atMinute,
+    model: task.model,
     createdAt: task.createdAt,
     lastRun: task.lastRun,
     nextRun: task.nextRun,

package/extensions/orchestrator/cron-status-ui.ts

@@ -4,6 +4,7 @@
 
 import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import {
+  cronDetailRows,
   formatCronSchedule,
   formatLastRunLabel,
   formatNextRunLabel,
@@ -16,6 +17,7 @@ import {
 
 export type { CronStatusTaskView } from "./cron-status-format.js";
 export {
+  cronDetailRows,
   formatCronSchedule,
   formatLastRunLabel,
   formatNextRunLabel,
@@ -103,24 +105,9 @@ export async function openCronStatusOverlay(
             if (!current) {
               return [t.fg("error", "Task removed."), t.fg("dim", "Esc back")];
             }
-            const now = Date.now();
-            const lines = [
-              `${t.fg("muted", "Schedule")}  ${formatCronSchedule(current)}`,
-              `${t.fg("muted", "Last run")}  ${formatLastRunLabel(current, now)}` +
-                (current.lastRun
-                  ? t.fg(
-                      "dim",
-                      ` · ${new Date(current.lastRun).toLocaleString()}`,
-                    )
-                  : ""),
-              `${t.fg("muted", "Next run")}  ${formatNextRunLabel(current, now)}`,
-              `${t.fg("muted", "Created")}   ${new Date(current.createdAt).toLocaleString()}`,
-            ];
-            if (current.sessionLabel) {
-              lines.push(
-                `${t.fg("muted", "Session")}  ${current.sessionLabel}`,
-              );
-            }
+            const lines = cronDetailRows(current).map(
+              ([label, value]) => `${t.fg("muted", label.padEnd(9))}  ${value}`,
+            );
             lines.push("", t.fg("muted", "Task"), current.task);
             return lines;
           },

package/extensions/orchestrator/cron-store.ts

@@ -4,6 +4,7 @@ import * as path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { parseProcStartTime } from "./utils.js";
+import { parseModelOverride } from "./parse-model-override.js";
 import { createLogger } from "../shared/logger.js";
 
 export type CronScope = "session" | "project";
@@ -16,6 +17,8 @@ export interface DurableCronTask {
   intervalMs?: number;
   atHour?: number;
   atMinute?: number;
+  /** "provider/model-id" or bare "model-id"; absent means inherit. */
+  model?: string;
   createdAt: number;
   lastRun?: number;
   nextRun?: number;
@@ -182,6 +185,8 @@ export function validateDurableCronTask(task: unknown): asserts task is DurableC
   if (value.atHour !== undefined && (!Number.isInteger(value.atHour) || value.atHour < 0 || value.atHour > 23)) throw new Error("Invalid durable cron hour");
   if (value.atMinute !== undefined && (!Number.isInteger(value.atMinute) || value.atMinute < 0 || value.atMinute > 59 || value.atHour === undefined)) throw new Error("Invalid durable cron minute");
   if (value.intervalMs === undefined && value.atHour === undefined) throw new Error("Invalid durable cron schedule");
+  // Disk data is untrusted: guard the type before parseModelOverride, which assumes a string.
+  if (value.model !== undefined && (typeof value.model !== "string" || !parseModelOverride(value.model))) throw new Error("Invalid durable cron model");
   if ((value.lastRun !== undefined && !Number.isFinite(value.lastRun)) || (value.nextRun !== undefined && !Number.isFinite(value.nextRun))) throw new Error("Invalid durable cron timestamp");
 }
 function validate(tasks: DurableCronTask[]) { for (const task of tasks) validateDurableCronTask(task); }

package/extensions/orchestrator/cron.ts

@@ -8,12 +8,13 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { createLogger } from "../shared/logger.js";
 import { decideAsyncLlmDispatch } from "./async-capability.js";
 import { formatCronSchedule, toCronStatusTaskView } from "./cron-status-format.js";
+import { parseModelOverride } from "./parse-model-override.js";
 import { openCronStatusOverlay } from "./cron-status-ui.js";
 import { setSlot } from "./status-bar.js";
 import { acquireLeaderLock, durableCronSupported, isLeaderLockCurrent, mutateDurableCronStore, readDurableCronStore, refreshLeaderLock, releaseLeaderLock, validateDurableCronTask, type CronLockOwner, type CronScope, type DurableCronTask } from "./cron-store.js";
 
 const log = createLogger("cron");
-export interface CronTask { id: string; scope: CronScope; cwd: string; description: string; task: string; intervalMs?: number; atHour?: number; atMinute?: number; createdAt: number; lastRun?: number; nextRun?: number; leader?: boolean; }
+export interface CronTask { id: string; scope: CronScope; cwd: string; description: string; task: string; intervalMs?: number; atHour?: number; atMinute?: number; /** "provider/model-id" or bare "model-id"; undefined inherits the normal resolution chain. */ model?: string; createdAt: number; lastRun?: number; nextRun?: number; leader?: boolean; }
 type Timer = ReturnType<typeof setTimeout> | ReturnType<typeof setInterval>;
 const durable = (scope: CronScope) => scope === "project";
 let sessionStore = "";
@@ -30,6 +31,7 @@ function validateSessionCronTask(task: unknown): asserts task is CronTask {
   const value = task as CronTask;
   if (!value || typeof value !== "object" || typeof value.id !== "string" || !value.id || typeof value.description !== "string" || typeof value.task !== "string" || !value.task.trim() || !Number.isFinite(value.createdAt)) throw new Error("Invalid session cron task");
   validateSchedule({ interval_seconds: value.intervalMs === undefined ? undefined : value.intervalMs / 1000, at_hour: value.atHour, at_minute: value.atMinute });
+  if (value.model !== undefined && (typeof value.model !== "string" || !parseModelOverride(value.model))) throw new Error("Invalid session cron model");
   if ((value.lastRun !== undefined && !Number.isFinite(value.lastRun)) || (value.nextRun !== undefined && !Number.isFinite(value.nextRun))) throw new Error("Invalid session cron timestamp");
 }
 function writeSessionTasks(file: string, tasks: Iterable<CronTask>) {
@@ -67,6 +69,14 @@ function validateSchedule(details: any) {
   if (minute !== undefined && (!Number.isInteger(minute) || minute < 0 || minute > 59)) throw new Error("at_minute must be an integer from 0 to 59");
   if (minute !== undefined && hour === undefined) throw new Error("at_minute requires at_hour");
 }
+/** Normalize a "provider/model-id" or "model-id" override; undefined means inherit. */
+function normalizeModel(spec: unknown): string | undefined {
+  if (typeof spec !== "string" || !spec.trim()) { log.debug("cron_model_absent", { reason: typeof spec === "string" ? "blank" : "missing" }); return undefined; }
+  const parsed = parseModelOverride(spec);
+  if (!parsed) { log.warn("cron_model_rejected", { spec: spec.slice(0, 120) }); throw new Error('model must be "provider/model-id" or "model-id"'); }
+  log.debug("cron_model_normalized", { spec: spec.trim().slice(0, 120), provider: parsed.provider, model: parsed.model });
+  return parsed.provider ? `${parsed.provider}/${parsed.model}` : parsed.model!;
+}
 function nextDelay(task: CronTask) { if (task.intervalMs) return task.intervalMs; const target = new Date(); target.setHours(task.atHour!, task.atMinute!, 0, 0); if (+target <= Date.now()) target.setDate(target.getDate() + 1); return +target - Date.now(); }
 
 export function registerCron(pi: ExtensionAPI, spawnAsyncAgent: any): { getCronTasks: () => CronTask[] } {
@@ -115,7 +125,9 @@ export function registerCron(pi: ExtensionAPI, spawnAsyncAgent: any): { getCronT
         }
         pi.sendUserMessage(cmd, { deliverAs: "followUp" }); return;
       }
-      const dispatch = decideAsyncLlmDispatch({ parentProvider: ctx?.model?.provider, cwd: task.cwd, mustAsync: true });
+      const explicit = parseModelOverride(task.model);
+      const dispatch = decideAsyncLlmDispatch({ parentProvider: explicit?.provider ?? ctx?.model?.provider, cwd: task.cwd, mustAsync: true });
+      log.debug("cron_dispatch", { id: qualifyCronId(task), model: task.model || "inherit", action: dispatch.action });
       if (dispatch.action === "skip") { log.error("cron_error", qualifyCronId(task), dispatch.note); return; }
       const { discoverAgents } = await import("./agents.js");
       const { agents } = discoverAgents(task.cwd, "user");
@@ -123,7 +135,11 @@ export function registerCron(pi: ExtensionAPI, spawnAsyncAgent: any): { getCronT
         log.warn("cron_execution_fenced", { id: qualifyCronId(task), reason: "leader_lease_lost_before_dispatch" });
         election(); return;
       }
-      spawnAsyncAgent("worker", cmd, task.cwd, agents, { name: `Cron: ${task.description.slice(0, 40)}`, ...(dispatch.action === "sidecar-async" ? { parentProvider: dispatch.sidecar.provider, parentModelId: dispatch.sidecar.model } : {}) });
+      // The sidecar must be authoritative: passed as parent fields it could lose to worker
+      // overrides/frontmatter, which async children cannot always register. An unusable
+      // acpx-* override is discarded rather than passed at all.
+      const override = dispatch.action === "sidecar-async" ? dispatch.sidecar : explicit;
+      spawnAsyncAgent("worker", cmd, task.cwd, agents, { name: `Cron: ${task.description.slice(0, 40)}`, ...(override ? { explicit: override } : {}) });
     } catch (error: any) { log.error("cron_execute_failed", qualifyCronId(task), error?.message || error); }
   }
   function stop(id: string) { const timer = timers.get(id); if (timer) { clearTimeout(timer as any); clearInterval(timer as any); timers.delete(id); } }
@@ -162,7 +178,7 @@ export function registerCron(pi: ExtensionAPI, spawnAsyncAgent: any): { getCronT
     if (scope !== "session" && scope !== "project") throw new Error("scope must be session or project");
     if (durable(scope) && !durableCronSupported()) throw new Error("Persistent cron scheduling is unavailable on this platform");
     validateSchedule(details);
-    const task: CronTask = { id: randomUUID(), scope, cwd: ctx?.cwd || process.cwd(), description: details.description || details.task.slice(0, 60), task: details.task, intervalMs: details.interval_seconds !== undefined ? details.interval_seconds * 1000 : undefined, atHour: details.at_hour, atMinute: details.at_minute ?? (details.at_hour !== undefined ? 0 : undefined), createdAt: Date.now(), leader: scope === "session" };
+    const task: CronTask = { id: randomUUID(), scope, cwd: ctx?.cwd || process.cwd(), description: details.description || details.task.slice(0, 60), task: details.task, intervalMs: details.interval_seconds !== undefined ? details.interval_seconds * 1000 : undefined, atHour: details.at_hour, atMinute: details.at_minute ?? (details.at_hour !== undefined ? 0 : undefined), model: normalizeModel(details.model), createdAt: Date.now(), leader: scope === "session" };
     if (!task.task || (!task.intervalMs && task.atHour === undefined)) throw new Error("task and a schedule are required");
     if (durable(scope)) mutateDurableCronStore(projectStore(task.cwd), old => [...old, task as DurableCronTask]);
     tasks.set(task.id, task);
@@ -177,9 +193,9 @@ export function registerCron(pi: ExtensionAPI, spawnAsyncAgent: any): { getCronT
     const task = tasks.get(id); if (scope === "session") { if (!task) return false; stop(id); tasks.delete(id); if (sessionStore) writeSessionTasks(sessionStore, [...tasks.values()].filter(t => t.scope === "session")); } else { const file = projectStore(ctx.cwd); let found = false; mutateDurableCronStore(file, old => { found = old.some(t => t.id === id); return old.filter(t => t.id !== id); }); if (!found) return false; if (task) { stop(id); tasks.delete(id); } }
     updateStatus(); return true;
   }
-  pi.registerTool({ name: "cron_manage", description: "Manage scheduled tasks. Set persist=true to keep a task across Pi sessions in this project.", parameters: Type.Object({ action: Type.Union([Type.Literal("add"), Type.Literal("list"), Type.Literal("remove")]), persist: Type.Optional(Type.Boolean()), description: Type.Optional(Type.String()), task: Type.Optional(Type.String()), interval_seconds: Type.Optional(Type.Number()), at_hour: Type.Optional(Type.Number()), at_minute: Type.Optional(Type.Number()), id: Type.Optional(Type.String()) }), async execute(_id, params: any) {
+  pi.registerTool({ name: "cron_manage", description: "Manage scheduled tasks. Set persist=true to keep a task across Pi sessions in this project. Set model to \"provider/model-id\" (or a bare \"model-id\") to pin that cron's model.", parameters: Type.Object({ action: Type.Union([Type.Literal("add"), Type.Literal("list"), Type.Literal("remove")]), persist: Type.Optional(Type.Boolean()), description: Type.Optional(Type.String()), task: Type.Optional(Type.String()), model: Type.Optional(Type.String()), interval_seconds: Type.Optional(Type.Number()), at_hour: Type.Optional(Type.Number()), at_minute: Type.Optional(Type.Number()), id: Type.Optional(Type.String()) }), async execute(_id, params: any) {
     const scope: CronScope = params.persist ? "project" : "session";
-    try { if (params.action === "add" && (ctx?.mode === "print" || ctx?.mode === "json")) return { content: [{ type: "text", text: "Error: Cron scheduling is unavailable in one-shot mode." }] }; if (params.action === "add") { const task = add(scope, params); return { content: [{ type: "text", text: `Cron ${qualifyCronId(task)} created: ${formatCronSchedule(task)} → ${task.description}` }] }; } if (params.action === "remove") return { content: [{ type: "text", text: remove(params.id || "") ? "Cron removed." : "Task not found." }] }; const selected = [...tasks.values()].filter(t => !params.persist || t.scope === "project"); return { content: [{ type: "text", text: selected.length ? selected.map(t => `${qualifyCronId(t)} | ${formatCronSchedule(t)} | ${t.description} | ${t.leader === false ? "waiting for leader" : "active"}`).join("\n") : "No scheduled tasks." }] }; } catch (error: any) { return { content: [{ type: "text", text: `Error: ${error.message}` }] }; }
+    try { if (params.action === "add" && (ctx?.mode === "print" || ctx?.mode === "json")) return { content: [{ type: "text", text: "Error: Cron scheduling is unavailable in one-shot mode." }] }; if (params.action === "add") { const task = add(scope, params); return { content: [{ type: "text", text: `Cron ${qualifyCronId(task)} created: ${formatCronSchedule(task)} → ${task.description}${task.model ? ` [${task.model}]` : ""}` }] }; } if (params.action === "remove") return { content: [{ type: "text", text: remove(params.id || "") ? "Cron removed." : "Task not found." }] }; const selected = [...tasks.values()].filter(t => !params.persist || t.scope === "project"); return { content: [{ type: "text", text: selected.length ? selected.map(t => `${qualifyCronId(t)} | ${formatCronSchedule(t)} | ${t.description} | ${t.model || "inherited model"} | ${t.leader === false ? "waiting for leader" : "active"}`).join("\n") : "No scheduled tasks." }] }; } catch (error: any) { return { content: [{ type: "text", text: `Error: ${error.message}` }] }; }
   }, } as any);
   pi.registerCommand("cron", { description: "Schedule tasks: add, list, list-all, remove; use --persist to keep a cron", handler: async (args, commandCtx) => { ctx = commandCtx; const parsed = parseCronScope((args || "").trim().split(/\s+/).filter(Boolean)); if (parsed.error) { ctx.ui?.notify(parsed.error, "warning"); return; } const [sub, ...rest] = parsed.rest; if (sub === "list" || sub === "list-all") { const showAll = sub === "list-all"; if (ctx.hasUI) await openCronStatusOverlay(ctx, { title: showAll ? "All cron tasks" : "Cron tasks", listTasks: () => [...tasks.values()].filter(t => showAll || !args.includes("--persist") || t.scope === "project").map(t => toCronStatusTaskView(t, { overlayId: qualifyCronId(t), isLocal: t.scope === "session", sessionLabel: t.leader === false ? `${t.scope} (waiting for leader)` : t.scope })), removeTask: remove }); return; } if (["remove", "rm", "delete"].includes(sub) && rest[0]) { ctx.ui?.notify(remove(rest[0]) ? "Cron removed." : "Task not found.", "info"); return; } pi.sendUserMessage(`Schedule this cron request using cron_manage. Set persist to ${parsed.scope === "project"}. Use persistence only when the user requests it. User request: "${parsed.rest.join(" ")}"`, { deliverAs: "followUp" }); }});
   pi.events.on("pidash:cron-kill", (target: unknown) => {

package/extensions/orchestrator/extended-autocomplete.ts

@@ -20,7 +20,6 @@
  *   /cron <Tab>                  → add, list, remove
  *   /dream-auto <Tab>            → on, off
  *   /async-kill <Tab>            → all (or type name / id prefix)
- *   /mcpc <Tab>                  → connect
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
@@ -30,7 +29,6 @@ import { execFileSync } from "node:child_process";
 import * as path from "node:path";
 import { createLogger } from "../shared/logger.js";
 import { getCronRemoveAutocompleteItems } from "./cron.js";
-import { mcpcArgumentCompletions } from "./mcpc.js";
 
 const log = createLogger("autocomplete");
 
@@ -295,7 +293,6 @@ function registerCompletions(
       }
     },
 
-    "mcpc": mcpcArgumentCompletions,
 
     "dream-auto": (prefix: string) => {
       return filter([

package/extensions/orchestrator/graft.ts

@@ -10,7 +10,7 @@ import { createLogger } from "../shared/logger.js";
 import { isPiOneshotInvocation } from "../shared/oneshot.js";
 import { getSetting } from "./project-settings.js";
 import { clearSlot, setSlot } from "./status-bar.js";
-import { getProjectTmpDir, resolveWorktreeRoot } from "./utils.js";
+import { getProjectTmpDir, resolveWorktreeRoot, tryResolveWorktreeRoot } from "./utils.js";
 import { formatCompactTotal } from "../shared/format-total.js";
 
 const exec = promisify(execFile);
@@ -24,10 +24,10 @@ export function withGraftTools(tools: readonly string[] | undefined, enabled: bo
   if (!tools?.length || !enabled) return tools ? [...tools] : undefined;
   return [...new Set([...tools, ...GRAFT_QUERY_TOOLS])];
 }
-export type GraftState = "syncing" | "ready" | "stale" | "failed";
+export type GraftState = "syncing" | "ready" | "stale" | "absent" | "failed";
 export type GraftRun = (args: readonly string[], options: { cwd: string; timeoutMs?: number }) => Promise<{ stdout: string; stderr: string; code: number }>;
 type GraphStatus = "fresh" | "stale" | "absent";
-type Options = { enabled: boolean; setting?: (cwd: string) => boolean; executable?: () => Promise<boolean>; graph?: (cwd: string) => Promise<GraphStatus>; retrieve?: (query: string, cwd: string) => Promise<{ pointers: string[] }>; run?: GraftRun; interactiveTimeoutMs?: number };
+type Options = { enabled: boolean; setting?: (cwd: string) => boolean; executable?: () => Promise<boolean>; graph?: (cwd: string) => Promise<GraphStatus>; retrieve?: (query: string, cwd: string) => Promise<{ pointers: string[] }>; worktree?: (cwd: string) => string | null; run?: GraftRun; interactiveTimeoutMs?: number };
 type StatusTheme = { fg: (color: string, value: string) => string };
 type Hit = { title?: string; pointer?: string; snippet?: string };
 type Ask = { coverage?: number; coverageStrong?: number; hits?: Hit[] };
@@ -35,7 +35,11 @@ type Ask = { coverage?: number; coverageStrong?: number; hits?: Hit[] };
 /** Graft's statusline shape, adapted to Pi's theme API. */
 export function formatGraftFooter({ state, nodeCount, tokenSavings }: { state: GraftState; nodeCount: number; tokenSavings: number }, theme?: StatusTheme): string {
   const fg = (color: string, value: string) => theme?.fg(color, value) ?? value;
-  const freshness = state === "syncing" ? fg("warning", "syncing…") : state === "stale" ? fg("warning", "⚠ stale") : state === "failed" ? fg("error", "failed") : fg("success", "✓ synced");
+  // "absent" is deliberately dim, not error-red: the cwd is not a git worktree,
+  // so no graph is possible. Reporting that as "failed" made an ordinary
+  // directory look like a broken install.
+  const freshness = state === "syncing" ? fg("warning", "syncing…") : state === "stale" ? fg("warning", "⚠ stale") : state === "failed" ? fg("error", "failed") : state === "absent" ? fg("dim", "n/a") : fg("success", "✓ synced");
+  if (state === "absent") return fg("dim", "◤ graft · n/a");
   const parts = [fg("dim", "◤ ") + fg("accent", "graft"), fg("dim", `${nodeCount} nodes`), freshness];
   if (tokenSavings > 0) parts.push(fg("success", `~${formatCompactTotal(tokenSavings)} tok saved`));
   return parts.join(fg("dim", " · "));
@@ -172,6 +176,7 @@ export function createGraftIntegration(options: Options) {
     return result;
   };
   const available = options.executable ?? (async () => (await run(["--version"], { cwd: state.root })).code === 0);
+  const worktree = options.worktree ?? tryResolveWorktreeRoot;
   const graph = options.graph ?? (async cwd => (await run(["check", "--json"], { cwd })).code === 0 ? "fresh" : nodes(cwd) ? "stale" : "absent");
   const refresh = async (): Promise<boolean> => {
     if (child) return false;
@@ -235,15 +240,25 @@ export function createGraftIntegration(options: Options) {
       if (!trusted(ctx)) { invalidate(ctx, "untrusted"); log.info("session_start_exit", { decision: "untrusted" }); return; }
       const enabled = options.setting?.(ctx.cwd) ?? options.enabled;
       if (!enabled) { invalidate(ctx, "disabled"); log.info("session_start_exit", { decision: "disabled" }); return; }
-      registerTools(); const generation = ++state.generation; state.enabled = true; state.refresh = undefined; state.dirty = false; state.root = resolveWorktreeRoot(ctx.cwd); const root = state.root; state.nodeCount = nodes(root); state.value = "failed"; state.gate = { active: false, retrieved: false, pointers: new Set<string>() };
+      // Check for a worktree BEFORE anything goes live. This has to sit above
+      // registerTools() and `state.enabled = true`: with those already set, the
+      // guards compare resolveWorktreeRoot(cwd) against state.root (both the
+      // cwd, since resolution falls back to it) and pass, so the integration
+      // stayed live outside a repo -- a read flipped the footer to "synced" and
+      // every prompt ran a graft check subprocess in a plain directory.
+      if (!worktree(ctx.cwd)) { invalidate(ctx, "not_a_worktree"); setState("absent"); log.info("session_start_exit", { decision: "not_a_worktree", cwd: ctx.cwd }); return; }
+      registerTools(); const generation = ++state.generation; state.enabled = true; state.refresh = undefined; state.dirty = false; state.root = resolveWorktreeRoot(ctx.cwd); const root = state.root; state.nodeCount = nodes(root); state.value = "syncing"; state.gate = { active: false, retrieved: false, pointers: new Set<string>() };
       try { state.store = savingsStore(ctx, root); state.dirtySignal = state.store ? `${state.store}.dirty` : ""; if (state.dirtySignal) { mkdirSync(state.dirtySignal, { recursive: true, mode: 0o700 }); chmodSync(state.dirtySignal, 0o700); } state.tokenSavings = readSavings(state.store); } catch (error: any) { state.store = ""; state.dirtySignal = ""; state.tokenSavings = 0; log.warn("savings_restore_failed", { code: error?.code }); }
-      setState("failed");
+      // Provisional state while we probe. This used to be "failed", which made
+      // every session start — including healthy ones — flash the error-red state
+      // for a moment before settling.
+      setState("syncing");
       if (!child && !isEligibleGraftStartup(event, ctx) && !["new", "reload", "resume", "fork"].includes(event?.reason)) { log.info("session_start_exit", { decision: "ineligible" }); return; }
       if (!child) { const executable = await available(); if (state.generation !== generation || state.root !== root) return; if (!executable) { setState("failed"); log.info("session_start_exit", { decision: "unavailable" }); return; } }
       const status = await graph(root);
       if (state.generation !== generation || state.root !== root) return;
       if (status === "fresh") setState("ready");
-      else { setState(state.nodeCount ? "stale" : "failed"); if (!child) void refresh(); }
+      else { setState(state.nodeCount ? "stale" : "absent"); if (!child) void refresh(); }
       log.info("session_start_exit", { decision: status, nodes: state.nodeCount });
     });
     pi.on("tool_call", (event: any, ctx: any) => {

package/extensions/orchestrator/index.ts

@@ -39,6 +39,8 @@ import { registerMarkdownTransformer } from "./markdown-transformer.js";
 import { registerGraft } from "./graft.js";
 import { ensureGitSshTimeout, isRunningInContainer, terminalNotify } from "./utils.js";
 import { createLogger } from "../shared/logger.js";
+import { registerProviderStreamLog } from "../shared/provider-stream-log.js";
+import { migrateMcpConfig } from "../shared/mcp-config-migration.js";
 import { setGlobalSessionId } from "../shared/file-logger.js";
 
 const IN_CONTAINER = isRunningInContainer();
@@ -113,6 +115,10 @@ export default function (pi: ExtensionAPI) {
   registerSessionSearch(pi);
   registerSettingsTui(pi);
   registerMarkdownTransformer(pi);
+  // Raw provider stream logging — gated on `log_providers=debug` (#848).
+  registerProviderStreamLog(pi);
+  // Copy a pre-#848 `~/.pi/pi-config/mcp.json` to where builtin:mcp reads it (#848).
+  migrateMcpConfig();
 
   // ── list_models tool — LLM-callable model discovery ──
   pi.registerTool({

package/extensions/orchestrator/session-validation.ts

@@ -9,7 +9,6 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { setUvAvailable, isUvAvailable } from "./enforcement-helpers.js";
-import { registerMcpc } from "./mcpc.js";
 import { checkMinPiVersion } from "./utils.js";
 import { createLogger } from "../shared/logger.js";
 
@@ -216,10 +215,6 @@ async function checkSessionTools(ctx: any): Promise<void> {
   // Optional
   if (!hasCmd("gh"))
     optional.push("gh — GitHub CLI. Install: https://cli.github.com/");
-  if (!hasCmd("mcpc"))
-    optional.push(
-      "mcpc — MCP CLI. Install: npm install -g @apify/mcpc",
-    );
   if (!hasCmd("myk-pi-tools"))
     optional.push(
       "myk-pi-tools — PR/release/review CLI. Install: uv tool install myk-pi-tools",
@@ -355,7 +350,6 @@ async function checkUpgradeChangelog(ctx: any): Promise<void> {
 
 export function registerSessionValidation(pi: ExtensionAPI): void {
   registerRepairCommand(pi);
-  registerMcpc(pi);
 
   pi.on("session_start", async (_event, ctx) => {
     // Always check uv availability — even in headless mode.

package/extensions/orchestrator/utils.ts

@@ -5,6 +5,7 @@
 import { execFile, execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createLogger } from "../shared/logger.js";
 
 /** Whether notify-send is available (false = ENOENT, never retry) */
 let notifyAvailable: boolean | undefined;
@@ -94,22 +95,36 @@ export function resolveRepoRoot(cwd: string): string {
  *  @returns The worktree's top-level directory, or `cwd` as fallback */
 const worktreeRootCache = new Map<string, string>();
 
-export function resolveWorktreeRoot(cwd: string): string {
+const log = createLogger("utils");
+
+/**
+ * Resolve the worktree root, or null when `cwd` is not inside a git worktree.
+ *
+ * Prefer this over {@link resolveWorktreeRoot} when the difference matters: that
+ * function deliberately falls back to `cwd`, so a plain directory and a repo
+ * root are indistinguishable in its return value, and a caller cannot tell
+ * "no graph possible here" from "the graph build failed".
+ */
+export function tryResolveWorktreeRoot(cwd: string): string | null {
   const key = path.resolve(cwd);
   const cached = worktreeRootCache.get(key);
-  if (cached !== undefined) return cached;
+  if (cached !== undefined) return cached === "" ? null : cached;
+  let root: string | null = null;
   try {
     const toplevel = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf-8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (toplevel && !toplevel.startsWith("fatal")) {
-      const root = path.resolve(toplevel);
-      worktreeRootCache.set(key, root);
-      return root;
-    }
+    if (toplevel && !toplevel.startsWith("fatal")) root = path.resolve(toplevel);
   } catch (e: any) {
-    console.debug("[utils] resolveWorktreeRoot failed:", e?.message);
+    // Expected whenever the cwd is not a git repo, so this is a debug line in a
+    // file log — never console.*, which would dump it into the chat transcript.
+    log.debug("resolveWorktreeRoot", { cwd: key, reason: e?.message?.slice(0, 200) });
   }
-  worktreeRootCache.set(key, cwd);
-  return cwd;
+  // "" is the not-a-worktree sentinel; resolveWorktreeRoot maps it back to cwd.
+  worktreeRootCache.set(key, root ?? "");
+  return root;
+}
+
+export function resolveWorktreeRoot(cwd: string): string {
+  return tryResolveWorktreeRoot(cwd) ?? cwd;
 }
 
 /** Get project-scoped temp dir under <cwd>/.pi/tmp/ */
@@ -147,8 +162,14 @@ export function tryGetSystemPromptOptions(ctx: any): { contextFiles?: any[]; ski
   }
 }
 
-/** Minimum pi version required by this pi-config version. */
-export const MIN_PI_VERSION = "0.87.0";
+/**
+ * Minimum pi version required by this pi-config version.
+ *
+ * 0.99.0: `builtin:mcp` replaces the external `mcpc` binary (so MCP servers are
+ * read from ~/.pi/agent/mcp.json by pi itself), and the built-in MCP/codemode/
+ * tool-search extensions become the ones we must not collide with.
+ */
+export const MIN_PI_VERSION = "0.99.0";
 
 /** Get the installed pi version from its package.json. */
 export function getPiVersion(): string | null {

package/extensions/pidiff/pidiff-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pidiff-ui",
   "private": true,
-  "version": "4.6.5",
+  "version": "4.7.1",
   "type": "module",
   "scripts": {
     "dev": "vite",

package/extensions/shared/create-runtime-provider.ts

@@ -3,7 +3,7 @@
  *
  * Prefer this over legacy `pi.registerProvider(name, { streamSimple })` bags so
  * providers get /login auth, fetchModels refresh, filterModels, and native
- * ProviderStreams (requires pi >= 0.87.0).
+ * ProviderStreams (requires pi >= 0.99.0).
  */
 
 import { createLogger } from "./logger.js";

package/extensions/shared/mcp-config-migration.ts

@@ -0,0 +1,59 @@
+/**
+ * One-time MCP config migration (#848).
+ *
+ * MCP used to be reached through the external `mcpc` binary, which read
+ * `~/.pi/pi-config/mcp.json`. It is now pi's built-in `builtin:mcp`, which reads
+ * `~/.pi/agent/mcp.json`. Without this, an existing install upgrades to a pi
+ * that finds no MCP config at all — every server silently disappears, with no
+ * error anywhere to look at.
+ *
+ * Deliberately a copy, not a move, and only when the new file is absent: the
+ * old file stays as the user's to delete, and an existing `~/.pi/agent/mcp.json`
+ * is never touched. Nothing is written when either file is missing.
+ */
+
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createLogger } from "./logger.js";
+
+const log = createLogger("mcp-config-migration");
+
+/** Where `mcpc` kept servers, and where `builtin:mcp` reads them from. */
+export function mcpConfigPaths(home: string = homedir()): { legacy: string; current: string } {
+  return {
+    legacy: join(home, ".pi", "pi-config", "mcp.json"),
+    current: join(home, ".pi", "agent", "mcp.json"),
+  };
+}
+
+/**
+ * Copy the legacy config into place when it is safe to do so.
+ * Returns the path written, or undefined when nothing was done.
+ */
+export function migrateMcpConfig(home: string = homedir()): string | undefined {
+  const { legacy, current } = mcpConfigPaths(home);
+  if (existsSync(current)) {
+    log.debug("mcp config present, nothing to do", { path: current });
+    return undefined;
+  }
+  if (!existsSync(legacy)) {
+    log.debug("no legacy mcp config", { path: legacy });
+    return undefined;
+  }
+  try {
+    mkdirSync(join(home, ".pi", "agent"), { recursive: true });
+    copyFileSync(legacy, current);
+    log.info("migrated MCP config for builtin:mcp", { from: legacy, to: current });
+    return current;
+  } catch (error) {
+    // A failed migration must not stop pi from starting — worst case the user
+    // copies the file by hand, which the message tells them how to do.
+    log.warn("MCP config migration failed; copy it by hand", {
+      from: legacy,
+      to: current,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+}

package/extensions/shared/provider-stream-log.ts

@@ -0,0 +1,94 @@
+/**
+ * Provider stream diagnostics — the shared hook for raw provider stream logging
+ * (issue #848, pi 0.99 `provider_stream_event`).
+ *
+ * GATING IS MANDATORY. `provider_stream_event` fires once per parsed chunk and
+ * pi AWAITS handlers inline in the stream loop
+ * (`await options?.onProviderStreamEvent?.(chunk, model)`), so registering a
+ * slow handler delays stream consumption. We only register when the user opts
+ * into provider debug logging.
+ *
+ * Gate: the existing `log_providers` setting (default `info`), so `debug` is off
+ * by default and no new settings key is needed. Reuses the `providers` log
+ * namespace → ~/.pi/logs/providers/<session-id>/main.log. Never console.*
+ */
+
+import type { ExtensionAPI, ProviderStreamEvent } from "@earendil-works/pi-coding-agent";
+import { createLogger } from "./logger.js";
+
+const LOG_NAME = "providers";
+const PREFIX = "provider-stream";
+
+const MAX_VALUE_LEN = 200;
+const MAX_ITEMS = 8;
+const MAX_DEPTH = 4;
+// ponytail: per-turn cap; one runaway stream writes 2k lines, not 2M. Raise if
+// a real diagnosis ever needs more than that within a single turn.
+const MAX_EVENTS_PER_TURN = 2000;
+
+const SECRET_KEY = /api[-_]?key|authorization|bearer|token|secret|password|cookie/i;
+
+function truncate(text: string): string {
+  return text.length > MAX_VALUE_LEN ? `${text.slice(0, MAX_VALUE_LEN)}…(+${text.length - MAX_VALUE_LEN})` : text;
+}
+
+/**
+ * Depth-bounded, size-bounded, secret-redacting preview of an arbitrary stream
+ * chunk. Depth bounding also makes cycles terminate — no `seen` set needed.
+ */
+export function previewStreamData(value: unknown, depth = 0): string {
+  if (value === null || value === undefined) return String(value);
+  if (typeof value === "string") return truncate(value);
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (typeof value === "bigint") return `${value.toString()}n`;
+  if (typeof value === "function" || typeof value === "symbol") return `[${typeof value}]`;
+  if (typeof value !== "object") return truncate(String(value));
+  if (depth >= MAX_DEPTH) return Array.isArray(value) ? `[array(${value.length})]` : "{…}";
+  if (Array.isArray(value)) {
+    const head = value.slice(0, MAX_ITEMS).map(item => previewStreamData(item, depth + 1));
+    return `[${head.join(",")}${value.length > MAX_ITEMS ? ",…" : ""}]`;
+  }
+  const entries = Object.entries(value as Record<string, unknown>);
+  const body = entries
+    .slice(0, MAX_ITEMS)
+    .map(([key, item]) => `${truncate(key)}:${SECRET_KEY.test(key) ? "…redacted" : previewStreamData(item, depth + 1)}`)
+    .join(",");
+  return `{${body}${entries.length > MAX_ITEMS ? ",…" : ""}}`;
+}
+
+/**
+ * Register the provider stream log hook. No-op unless provider debug logging is
+ * enabled — see the gating note above.
+ */
+export function registerProviderStreamLog(pi: ExtensionAPI): void {
+  const log = createLogger(LOG_NAME, PREFIX);
+  if (!log.isDebugEnabled()) return;
+
+  let seen = 0;
+  let dropped = 0;
+  pi.on("turn_start", () => {
+    if (dropped) log.warn("provider stream events dropped this turn", { dropped });
+    seen = 0;
+    dropped = 0;
+  });
+  pi.on("provider_stream_event", (event: ProviderStreamEvent) => {
+    try {
+      if (++seen > MAX_EVENTS_PER_TURN) {
+        dropped++;
+        return;
+      }
+      let data: unknown = event.data;
+      try {
+        // data is read-only to extensions — clone before retaining/logging.
+        data = structuredClone(event.data);
+      } catch {
+        log.warn("stream event data not cloneable, logged un-cloned", { provider: event.provider, api: event.api });
+      }
+      log.debug("stream_event", `${event.provider}/${event.api}/${event.model}`, previewStreamData(data));
+    } catch (err) {
+      // Never throw: pi reports handler errors, but a hot-path handler must not
+      // interfere with stream consumption.
+      log.error("stream event logging failed", err);
+    }
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-orchestrator-config",
-  "version": "4.6.5",
+  "version": "4.7.1",
   "description": "Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands",
   "keywords": [
     "pi-package"
@@ -75,6 +75,10 @@
     "ws": "^8.0.0"
   },
   "devDependencies": {
+    "@earendil-works/pi-agent-core": "^0.99.1",
+    "@earendil-works/pi-ai": "^0.99.1",
+    "@earendil-works/pi-coding-agent": "^0.99.1",
+    "@earendil-works/pi-tui": "^0.99.1",
     "@types/node": "^22.20.1",
     "tsx": "^4.0.0"
   },

package/rules/00-orchestrator-core.md

@@ -15,10 +15,10 @@
 The orchestrator delegates — never implements directly.
 ⚠️ Pi does not enforce these restrictions — you SHOULD NOT violate them.
 
-**Allowed direct actions:** read files, run `mcpc`, ask questions, analyze, plan,
+**Allowed direct actions:** read files, run `codemode` scripts, ask questions, analyze, plan,
 route to agents via `subagent`, execute slash commands AND all their internal operations.
 
-Outside slash commands, never use edit, write, or bash directly (except `mcpc`) — delegate to specialists.
+Outside slash commands, never use edit, write, or bash directly (except `codemode` scripts) — delegate to specialists.
 
 **Always delegate via `subagent`:**
 

package/extensions/orchestrator/mcpc.ts

@@ -1,172 +0,0 @@
-/**
- * mcpc — connect MCP servers from ~/.pi/pi-config/mcp.json.
- *
- * Auto-connect on pi process start (session_start reason "startup").
- * /mcpc connect reconnects after the user edits that file.
- * Connect failure is logged; it never fails the pi session.
- */
-
-import { execFile } from "node:child_process";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { promisify } from "node:util";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { isPiOneshotInvocation } from "../shared/oneshot.js";
-import { createLogger } from "../shared/logger.js";
-
-const execFileAsync = promisify(execFile);
-const log = createLogger("orchestrator", "mcpc");
-
-const CONNECT_TIMEOUT_MS = 120_000;
-const MAX_BUFFER = 10 * 1024 * 1024;
-
-export type McpcExecFile = (
-  file: string,
-  args: readonly string[],
-  options: { timeout: number; maxBuffer: number; env?: NodeJS.ProcessEnv },
-) => Promise<{ stdout: string | Buffer; stderr: string | Buffer }>;
-
-let execMcpcConnect: McpcExecFile = execFileAsync as McpcExecFile;
-
-/** Replace the mcpc subprocess (tests). Pass undefined to restore. */
-export function setMcpcExecFile(fn: McpcExecFile | undefined): void {
-  execMcpcConnect = fn ?? (execFileAsync as McpcExecFile);
-  log.debug("setMcpcExecFile", fn ? "override" : "restore");
-}
-
-export function mcpcConfigPath(): string {
-  const home = process.env.HOME || os.homedir();
-  const configPath = path.join(home, ".pi", "pi-config", "mcp.json");
-  log.debug("mcpcConfigPath", configPath);
-  return configPath;
-}
-
-export type McpcConnectResult = {
-  ok: boolean;
-  skipped: boolean;
-  message: string;
-};
-
-export type McpcCompletionItem = {
-  value: string;
-  label: string;
-  description: string;
-};
-
-const MCPC_CONNECT_COMPLETION: McpcCompletionItem = {
-  value: "connect",
-  label: "connect",
-  description: "Connect ~/.pi/pi-config/mcp.json (--stdio)",
-};
-
-export function mcpcArgumentCompletions(prefix: string): McpcCompletionItem[] | null {
-  log.debug("mcpc argument completions", prefix);
-  const needle = prefix.trim().toLowerCase();
-  const haystack = `${MCPC_CONNECT_COMPLETION.label} ${MCPC_CONNECT_COMPLETION.description}`.toLowerCase();
-  if (!needle || haystack.includes(needle) || MCPC_CONNECT_COMPLETION.value.startsWith(needle)) {
-    return [MCPC_CONNECT_COMPLETION];
-  }
-  return null;
-}
-
-function formatExecError(err: unknown): string {
-  if (!err || typeof err !== "object") {
-    log.debug("formatExecError non-object", String(err));
-    return String(err);
-  }
-  const e = err as {
-    code?: string;
-    killed?: boolean;
-    message?: string;
-    stdout?: string;
-    stderr?: string;
-  };
-  log.debug("formatExecError", { code: e.code ?? "none", killed: Boolean(e.killed) });
-  const parts: string[] = [];
-  if (e.code === "ENOENT") {
-    parts.push("mcpc not on PATH. Install: npm install -g @apify/mcpc");
-  } else if (e.killed) {
-    parts.push(`mcpc connect timed out after ${CONNECT_TIMEOUT_MS / 1000}s`);
-  } else if (e.message) {
-    parts.push(e.message);
-  }
-  const out = [e.stdout, e.stderr].filter(Boolean).join("\n").trim();
-  if (out) parts.push(out);
-  return parts.join("\n") || "mcpc connect failed";
-}
-
-/** Run `mcpc connect <mcp.json> --stdio`. Never throws. */
-export async function connectMcpc(): Promise<McpcConnectResult> {
-  const configPath = mcpcConfigPath();
-  log.debug("connectMcpc entry", configPath);
-
-  if (!fs.existsSync(configPath)) {
-    log.debug("skip: mcp.json missing", configPath);
-    return {
-      ok: true,
-      skipped: true,
-      message: `No MCP config at ${configPath} — skip connect (create that file to use mcpc).`,
-    };
-  }
-
-  log.info("mcpc connect start", configPath);
-  try {
-    const { stdout, stderr } = await execMcpcConnect(
-      "mcpc",
-      ["connect", configPath, "--stdio"],
-      {
-        timeout: CONNECT_TIMEOUT_MS,
-        maxBuffer: MAX_BUFFER,
-        env: process.env,
-      },
-    );
-    const out = [stdout, stderr].filter(Boolean).join("\n").trim();
-    log.info("mcpc connect finished", configPath);
-    log.debug("mcpc connect output", out);
-    return {
-      ok: true,
-      skipped: false,
-      message: out || `mcpc connect finished (${configPath} --stdio)`,
-    };
-  } catch (err) {
-    const message = formatExecError(err);
-    log.warn("mcpc connect failed; continuing", message);
-    return { ok: false, skipped: false, message };
-  }
-}
-
-export function registerMcpc(pi: ExtensionAPI): void {
-  log.info("registerMcpc");
-  pi.registerCommand("mcpc", {
-    description:
-      "Reconnect MCP servers from ~/.pi/pi-config/mcp.json (mcpc connect --stdio). Run after editing that file.",
-    handler: async (args, ctx) => {
-      const sub = (args || "").trim();
-      if (sub && sub !== "connect") {
-        log.debug("/mcpc ignored unknown args", sub);
-        if (ctx.hasUI) ctx.ui.notify("Usage: /mcpc connect", "warning");
-        return;
-      }
-      log.info("/mcpc connect");
-      const result = await connectMcpc();
-      if (!ctx.hasUI) return;
-      if (result.skipped) ctx.ui.notify(result.message, "info");
-      else if (result.ok) ctx.ui.notify(result.message, "info");
-      else ctx.ui.notify(result.message, "warning");
-    },
-  });
-
-  pi.on("session_start", async (event, _ctx) => {
-    const reason = (event as { reason?: string })?.reason ?? "unknown";
-    if (reason !== "startup") {
-      log.debug("skip auto-connect: session_start reason", reason);
-      return;
-    }
-    if (isPiOneshotInvocation()) {
-      log.debug("skip auto-connect: oneshot");
-      return;
-    }
-    await connectMcpc();
-  });
-}

package/rules/15-mcpc.md

@@ -1,35 +0,0 @@
-# MCP client (mcpc)
-
-Use the `mcpc` command for all MCP server interactions.
-If a task needs a tool outside current capabilities, check `mcpc` for available tools.
-Orchestrator discovers tools via `mcpc grep` / `mcpc @<session> tools-list` and delegates execution to agents.
-
-Config file (user-owned): `~/.pi/pi-config/mcp.json`.
-Pi runs `mcpc connect ~/.pi/pi-config/mcp.json --stdio` on process start when that file exists.
-After you edit `mcp.json`, run `/mcpc connect` (or restart pi). Already-active servers stay as `mcpc` reports them.
-
-## mcpc commands
-
-| Command | Purpose |
-|---|---|
-| `mcpc` / `mcpc --json` | Active sessions and OAuth profiles |
-| `mcpc grep "<query>"` | Search tools across sessions |
-| `mcpc @<session>` | Server info and tools overview |
-| `mcpc @<session> tools-list` | List tools |
-| `mcpc @<session> tools-get <name>` | Tool schema |
-| `mcpc @<session> tools-call <name> …` | Call a tool (`arg:=value` or JSON) |
-| `mcpc @<session> restart` | Restart that session bridge |
-
-`--stdio` is required on connect. Do not omit it.
-
-## Workflow
-
-1. **Search** → `mcpc grep "list projects"` (or `mcpc @<session> tools-list`)
-2. **Inspect** → `mcpc @<session> tools-get <tool>`
-3. **Call** → `mcpc @<session> tools-call <tool> '{"param":"v"}'`
-
-## Troubleshooting
-
-- **Connect failed at pi start:** session still works; check `~/.pi/logs/orchestrator/` and `/mcpc connect`
-- **Missing binary:** `npm install -g @apify/mcpc`
-- **No config file:** create `~/.pi/pi-config/mcp.json` (standard `mcpServers` JSON)