pi-quiver 4.0.1 → 4.1.0

package/CHANGELOG.md

@@ -8,6 +8,10 @@ Published to npm as `pi-quiver` (`pi install npm:pi-quiver`). Pushing a
 via OIDC trusted publishing. The release helper at
 `.agents/skills/release/scripts/release.sh` cuts the tag; CI publishes.
 
+## v4.1.0 - 2026-08-14
+
+- **`session-name`: configurable naming policy** (#5). New `sessionAutoName` keys: `rules` (house conventions appended to the naming prompt, later rules win), `deny` (literal case-insensitive phrases stripped from every name, loose interior whitespace so `"acme corp"` also catches `AcmeCorp`), and `revisitFirstTurn`/`revisitEveryTurns` (re-derive the name once those round-trip counts are crossed; default `0` = off, each revisit is one short LLM call). Machine-generated names are replaced when stale; human-set names only get a non-blocking suggestion notification. Name provenance and cadence persist across resume. Revisits run detached and only after the agent has fully settled, so automated multi-turn runs (chains, workflows) are never renamed or delayed mid-flight.
+
 ## v4.0.1 - 2026-08-04
 
 - **Trimmed `fetch`/`doc_to_md` system-prompt guidelines that duplicated the tool descriptions** (~200 tokens). The two additive bits (degraded-result fidelity warning, grep-the-spilled-file guidance) moved into the tool descriptions; `promptGuidelines` dropped from both tools.

package/README.md

@@ -64,7 +64,7 @@ A 300 KB changelog page never touches your context window - you get a preview an
 | --- | --- | --- |
 | `extensions/fetch.ts` | `fetch` | Retrieve URLs over HTTP(S). HTML -> Markdown (Readability extraction, Turndown conversion). Binary saved untouched to a temp file. GitHub issue/PR/repo/actions-run URLs auto-route through `gh` (falls back to HTTP). Same size gate as `doc_to_md`. |
 | `extensions/doc_to_md.ts` | `doc_to_md` | Convert a local PDF/DOCX/PPTX to Markdown. High-fidelity via `pymupdf4llm` (run through `uv`); degraded pure-JS fallback (`unpdf`) when `uv`/Python is unavailable or conversion times out. DOCX/PPTX convert via LibreOffice first. |
-| `extensions/session-name.ts` | `/session-name` | Manual + opt-in automatic session naming, with Ghostty tab rename. OFF by default. |
+| `extensions/session-name.ts` | `/session-name` | Manual + opt-in automatic session naming, naming rules and deny list, long-session revisits, and Ghostty tab rename. OFF by default. |
 | `extensions/sword-header.ts` | `/builtin-header` | Themed ASCII startup header replacing pi's default logo. OFF by default. |
 | `extensions/fast-mode.ts` | `/fast` | Inject Anthropic fast-mode (`speed: "fast"` + `anthropic-beta: fast-mode-2026-02-01`) into every Claude Opus 4.8 / Opus 5 request, any thinking level. `--fast` flag + `/fast [on\|off\|status]`. OFF by default. |
 | `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Policy D offers each stall to Pi's retry loop until the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) is exhausted. OFF by default. |
@@ -141,14 +141,23 @@ These extensions are opt-in via `settings.json` (project `.pi/settings.json` ove
 
 ```jsonc
 {
-  "sessionAutoName": { "enabled": false, "ghosttyTab": true }, // or boolean shorthand
-  "swordHeader": false,                                        // or { "enabled": true }
+  "sessionAutoName": {
+    "enabled": false,
+    "ghosttyTab": true,
+    "rules": [],
+    "deny": [],
+    "revisitFirstTurn": 0,
+    "revisitEveryTurns": 0
+  }, // or boolean shorthand
+  "swordHeader": false, // or { "enabled": true }
   "fastMode": false,                                           // or { "enabled": true }
   "providerStallWatchdog": false                               // or { "enabled": true }
 }
 ```
 
-`sessionAutoName.enabled` makes one extra short LLM call per session (once, after the first turn) to title it; `false` (default) makes no model calls. `fastMode` only affects `claude-opus-4-8` and `claude-opus-5` requests on Anthropic's `anthropic-messages` API; enabling it opts into premium fast-mode pricing. `--fast` forces it on for one launch; `/fast on|off` toggles live. Proxy providers (opencode, cloudflare-ai-gateway) are excluded. `fastMode`'s header injection needs the `before_provider_headers` hook (pi bundling `@earendil-works/pi-coding-agent` >= 0.80.5); on older pi the beta header is silently not sent. See [doc/fetch.md](doc/fetch.md) and [doc/doc-to-md.md](doc/doc-to-md.md) for the ingestion tools' full reference; session-name/sword-header behavior above is complete.
+`sessionAutoName.enabled` makes one extra short LLM call per session (once, after the first turn) to title it; `false` (default) makes no model calls. `rules` appends house conventions to the naming prompt (later rules win when they conflict with the built-ins). Literal, case-insensitive `deny` phrases are stripped from every name; whitespace inside a phrase is loose, so `"acme corp"` also catches `AcmeCorp`. `revisitFirstTurn` re-evaluates the name once that many model round trips have completed, while `revisitEveryTurns` does so at every multiple; both default to `0` (off) because each revisit costs another short LLM call. For example, `10` and `100` mark round trips 10, 100, 200, 300. Revisits only run when the agent has fully settled (idle, nothing queued) - an automated multi-turn run such as a subagent chain is never renamed or delayed mid-flight; cadence points it crossed fire once, at the settle. A machine-generated name is replaced when stale. A name set by a human is never overwritten: the extension strongly prefers it, and announces a suggestion only when the work has clearly moved on. Counts come from the persisted transcript, so they survive resume.
+
+`fastMode` only affects `claude-opus-4-8` and `claude-opus-5` requests on Anthropic's `anthropic-messages` API; enabling it opts into premium fast-mode pricing. `--fast` forces it on for one launch; `/fast on|off` toggles live. Proxy providers (opencode, cloudflare-ai-gateway) are excluded. `fastMode`'s header injection needs the `before_provider_headers` hook (pi bundling `@earendil-works/pi-coding-agent` >= 0.80.5); on older pi the beta header is silently not sent. See [doc/fetch.md](doc/fetch.md) and [doc/doc-to-md.md](doc/doc-to-md.md) for the ingestion tools' full reference; session-name/sword-header behavior above is complete.
 
 `pi-ai` prices every fast request at standard rates - it has no `usage.speed` support and no request-level pricing modifier - so `fastMode` corrects the reported cost itself: a `message_end` handler scales all four `usage.cost` components by `FAST_MODE_COST_MULTIPLIER` (2x) and returns the corrected message. Persisted session JSONL and pi's own native cost display are always exact, since they're written from this corrected message. pi-cohort's live `Σ$` reflects the correction only when pi-quiver's `message_end` handler runs before pi-cohort's - best-effort, depending on extension load order - and is reconciled on pi-cohort's next `session_start` regardless. The upstream fix (teaching `pi-ai`'s `Usage`/`calculateCost` about `usage.speed`) is the better long-term path and is tracked separately.
 

package/extensions/session-name.ts

@@ -4,6 +4,10 @@
  * - /session-name [name]  : manually set or show the session name.
  * - Auto-naming           : after the first agent turn, derive a concise name
  *                           from the conversation (unless one is already set).
+ * - Revisiting            : re-derive the name later in a long session, once
+ *                           the work has revealed what it actually is.
+ * - Deny list             : keep chosen words out of every name, whatever set
+ *                           it - the model, /session-name, or pi's builtin.
  * - Ghostty tab rename     : whenever the name changes, rename the current
  *                           Ghostty tab - but only if the active terminal is
  *                           really Ghostty.
@@ -13,8 +17,20 @@
  * /session-name command always works.
  *
  * Config (settings.json, project overrides global). Defaults shown:
- *   "sessionAutoName": { "enabled": false, "ghosttyTab": true }
- * Boolean shorthand: "sessionAutoName": true  // enables everything
+ *   "sessionAutoName": {
+ *     "enabled": false,
+ *     "ghosttyTab": true,
+ *     "rules": [],              // extra naming rules appended to the prompt
+ *     "deny": [],               // phrases stripped from any name
+ *     "revisitFirstTurn": 0,    // re-derive once at this round trip (0 = off)
+ *     "revisitEveryTurns": 0    // and at every multiple of this (0 = off)
+ *   }
+ * Boolean shorthand: "sessionAutoName": true  // enables naming + tab sync
+ *
+ * Revisiting is opt-in and costs one short LLM call each time it fires, so
+ * both cadence knobs default to 0. `revisitFirstTurn: 10` with
+ * `revisitEveryTurns: 100` fires at round trips 10, 100, 200, 300 - early
+ * once, because the first turn rarely knows what the session is, then rarely.
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -33,8 +49,30 @@ async function loadComplete(): Promise<CompleteFn> {
 	return (await import("@earendil-works/pi-ai/compat")).complete;
 }
 
-type Config = { enabled: boolean; ghosttyTab: boolean };
-const DEFAULT_CONFIG: Config = { enabled: false, ghosttyTab: true };
+type Config = {
+	enabled: boolean;
+	ghosttyTab: boolean;
+	rules: string[];
+	deny: string[];
+	revisitFirstTurn: number;
+	revisitEveryTurns: number;
+};
+const DEFAULT_CONFIG: Config = {
+	enabled: false,
+	ghosttyTab: true,
+	rules: [],
+	deny: [],
+	revisitFirstTurn: 0,
+	revisitEveryTurns: 0,
+};
+
+const stringList = (v: unknown): string[] | undefined =>
+	Array.isArray(v) && v.every((s) => typeof s === "string")
+		? v.map((s) => s.trim()).filter(Boolean)
+		: undefined;
+
+const turnCount = (v: unknown): number | undefined =>
+	typeof v === "number" && Number.isInteger(v) && v >= 0 ? v : undefined;
 
 export function coerce(raw: unknown): Partial<Config> | undefined {
 	if (raw === undefined) return undefined;
@@ -44,6 +82,14 @@ export function coerce(raw: unknown): Partial<Config> | undefined {
 		const out: Partial<Config> = {};
 		if (typeof o.enabled === "boolean") out.enabled = o.enabled;
 		if (typeof o.ghosttyTab === "boolean") out.ghosttyTab = o.ghosttyTab;
+		const rules = stringList(o.rules);
+		if (rules) out.rules = rules;
+		const deny = stringList(o.deny);
+		if (deny) out.deny = deny;
+		const first = turnCount(o.revisitFirstTurn);
+		if (first !== undefined) out.revisitFirstTurn = first;
+		const every = turnCount(o.revisitEveryTurns);
+		if (every !== undefined) out.revisitEveryTurns = every;
 		return out;
 	}
 	return undefined;
@@ -80,7 +126,11 @@ export function stripSkillBodies(text: string): string {
 	);
 }
 
-export function buildConversationText(ctx: ExtensionContext, maxChars = 4000): string {
+export function buildConversationText(
+	ctx: ExtensionContext,
+	maxChars = 4000,
+	mostRecent = false,
+): string {
 	const sections: string[] = [];
 	for (const entry of ctx.sessionManager.getEntries()) {
 		const e = entry as { type?: string; message?: { role?: string; content?: unknown } };
@@ -96,7 +146,8 @@ export function buildConversationText(ctx: ExtensionContext, maxChars = 4000): s
 			if (text.length > 0) sections.push(`Result: ${text.slice(0, 400)}`);
 		}
 	}
-	return sections.join("\n\n").slice(0, maxChars);
+	const conversation = sections.join("\n\n");
+	return mostRecent ? conversation.slice(-maxChars) : conversation.slice(0, maxChars);
 }
 
 export function isGhosttyActive(
@@ -121,6 +172,91 @@ export function toTabLabel(name: string, maxWords = 4): string {
 		.join(" ");
 }
 
+/**
+ * Compile a deny phrase to a matcher. Phrases are literal, not regex: metachars
+ * are escaped so a user can't crash naming with a bad pattern from settings.
+ * Interior whitespace matches loosely, so one entry covers the spaced and
+ * jammed spellings alike (`acme corp` catches `AcmeCorp` and `Acme  Corp`).
+ * Word boundaries are added only where the phrase itself starts/ends on a word
+ * character, since `\b` next to punctuation asserts the opposite of what a
+ * reader expects.
+ */
+function denyMatcher(phrase: string): RegExp | undefined {
+	const escaped = phrase.trim().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	if (!escaped) return undefined;
+	const body = escaped.replace(/\s+/g, "\\s*");
+	const trimmed = phrase.trim();
+	const word = /[\p{L}\p{N}_]/u;
+	const lead = word.test(trimmed[0] ?? "") ? "(?<![\\p{L}\\p{N}_])" : "";
+	const tail = word.test(trimmed.at(-1) ?? "") ? "(?![\\p{L}\\p{N}_])" : "";
+	return new RegExp(`${lead}${body}${tail}`, "giu");
+}
+
+/**
+ * Strip every deny phrase from a name and tidy the seam left behind: doubled
+ * spaces, brackets emptied by the removal, and separators stranded against each
+ * other. Structure the author intended is preserved - dropping the middle of
+ * `Fix - Acme - login` leaves `Fix - login`, not `Fix login`.
+ *
+ * Returns `Session` when stripping would empty the name. A generic fallback is
+ * less informative, but unlike either a blank or the original it actually
+ * honors the deny-list contract.
+ */
+export function applyDenyList(name: string, deny: string[]): string {
+	if (deny.length === 0) return name;
+	let out = name;
+	for (const phrase of deny) {
+		const re = denyMatcher(phrase);
+		if (re) out = out.replace(re, " ");
+	}
+	out = out
+		.replace(/\s+/g, " ")
+		.replace(/\(\s*\)|\[\s*\]|\{\s*\}/g, "")
+		.replace(/([-:|/])(?:\s*[-:|/])+/g, "$1")
+		.replace(/^[\s\-:|/]+|[\s\-:|/]+$/g, "")
+		.replace(/\s+/g, " ")
+		.trim();
+	return out || "Session";
+}
+
+/**
+ * Whether a revisit point lies in `(prev, n]`. Points are `revisitFirstTurn`
+ * once, then every multiple of `revisitEveryTurns` - so 10/100 gives 10, 100,
+ * 200. Interval semantics rather than exact-hit because the check only runs
+ * when the agent settles: a 30-round-trip automated run never stops exactly on
+ * round trip 10, but it does cross it. Either knob at 0 disables its own
+ * trigger.
+ */
+export function shouldRevisit(
+	prev: number,
+	n: number,
+	cfg: { revisitFirstTurn: number; revisitEveryTurns: number },
+): boolean {
+	if (n <= 0 || n <= prev) return false;
+	const from = Math.max(prev, 0);
+	if (cfg.revisitFirstTurn > 0 && from < cfg.revisitFirstTurn && n >= cfg.revisitFirstTurn) {
+		return true;
+	}
+	return (
+		cfg.revisitEveryTurns > 0 &&
+		Math.floor(n / cfg.revisitEveryTurns) > Math.floor(from / cfg.revisitEveryTurns)
+	);
+}
+
+/**
+ * Assistant messages so far, i.e. completed model round trips. Derived from the
+ * transcript rather than tallied in memory so a resumed session keeps counting
+ * where it left off instead of restarting the revisit cadence.
+ */
+export function countRoundTrips(ctx: ExtensionContext): number {
+	let n = 0;
+	for (const entry of ctx.sessionManager.getEntries()) {
+		const e = entry as { type?: string; message?: { role?: string } };
+		if (e.type === "message" && e.message?.role === "assistant") n++;
+	}
+	return n;
+}
+
 function renameGhosttyTab(label: string, enabled: boolean): void {
 	if (!enabled || !isGhosttyActive()) return;
 	// OSC 2: set window/tab title. Ghostty shows this as the tab title and
@@ -150,21 +286,41 @@ export function parseGeneratedName(raw: string): GeneratedName | undefined {
 	return { sessionName, tabLabel: toTabLabel(tabLabel) };
 }
 
-async function generateName(ctx: ExtensionContext): Promise<GeneratedName | undefined> {
-	const conversation = buildConversationText(ctx);
-	if (conversation.length < 8) return undefined;
+/**
+ * A revisit may conclude the existing name still fits, which is the common case
+ * and must not cost a rename.
+ */
+export const KEEP = "keep" as const;
 
-	const model = ctx.model;
-	if (!model) return undefined;
-	const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-	// ok=true with apiKey=undefined is the env-key path: the key lives in
-	// process.env (e.g. ANTHROPIC_API_KEY), not auth.json. getApiKeyAndHeaders
-	// deliberately opts out of the env fallback (includeFallback: false), so it
-	// reports no apiKey. Don't bail on that - complete() resolves the env key
-	// itself via withEnvApiKey/getEnvApiKey. Only bail when auth genuinely failed.
-	if (!auth?.ok) return undefined;
+/**
+ * Parse a revisit reply: either the KEEP verdict or a fresh two-line name.
+ * Checked before {@link parseGeneratedName} because a KEEP reply has no SESSION
+ * line and would otherwise be indistinguishable from a failed generation.
+ */
+export function parseRevisitReply(raw: string): typeof KEEP | GeneratedName | undefined {
+	if (/^\W*KEEP\W*$/i.test(raw.trim())) return KEEP;
+	return parseGeneratedName(raw);
+}
 
-	const prompt = [
+type NameAuthor = "auto" | "human";
+type NameAuthorEntry = { name: string; author: NameAuthor };
+const NAME_AUTHOR_ENTRY = "pi-quiver.session-name-author";
+
+type PromptOptions = { rules?: string[]; currentName?: string };
+
+/**
+ * Build the naming prompt. With `currentName` set this is a revisit: the model
+ * is told what the session is already called and given the option to keep it,
+ * because a long session usually earns its name early and churning it on every
+ * revisit would be worse than not revisiting at all.
+ *
+ * User `rules` land after the built-in ones so they win on conflict - that is
+ * the point of exposing them, since house naming conventions routinely
+ * contradict a general-purpose default.
+ */
+export function buildNamingPrompt(conversation: string, opts: PromptOptions = {}): string {
+	const { rules = [], currentName } = opts;
+	const lines = [
 		"Name this work session based on the concrete task being done below.",
 		"Reply with EXACTLY two lines:",
 		"SESSION: <3-6 word descriptive title>",
@@ -174,12 +330,41 @@ async function generateName(ctx: ExtensionContext): Promise<GeneratedName | unde
 		"- Lead with an action verb (e.g. refine, fix, add, rework).",
 		"- Preserve ticket/issue IDs (e.g. ABC-123, PROJ-42, #99) verbatim.",
 		"- No quotes, no trailing punctuation, plain ASCII.",
+		...rules.map((r) => `- ${r}`),
 		"Example -> SESSION: Refine Linear Ticket ABC-123 / TAB: Refine ABC-123",
-		"",
-		"<conversation>",
-		conversation,
-		"</conversation>",
-	].join("\n");
+	];
+	if (currentName) {
+		lines.push(
+			"",
+			`This session is already named: ${currentName}`,
+			"That name may have been chosen by a human, so prefer keeping it.",
+			"Reply with the single word KEEP if it still describes the work below,",
+			"even loosely. Only propose a new name if the session has clearly moved",
+			"on to different work, or the rules above are now plainly violated.",
+		);
+	}
+	lines.push("", "<conversation>", conversation, "</conversation>");
+	return lines.join("\n");
+}
+
+async function generateName(
+	ctx: ExtensionContext,
+	opts: PromptOptions = {},
+): Promise<typeof KEEP | GeneratedName | undefined> {
+	const conversation = buildConversationText(ctx, 4000, Boolean(opts.currentName));
+	if (conversation.length < 8) return undefined;
+
+	const model = ctx.model;
+	if (!model) return undefined;
+	const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+	// ok=true with apiKey=undefined is the env-key path: the key lives in
+	// process.env (e.g. ANTHROPIC_API_KEY), not auth.json. getApiKeyAndHeaders
+	// deliberately opts out of the env fallback (includeFallback: false), so it
+	// reports no apiKey. Don't bail on that - complete() resolves the env key
+	// itself via withEnvApiKey/getEnvApiKey. Only bail when auth genuinely failed.
+	if (!auth?.ok) return undefined;
+
+	const prompt = buildNamingPrompt(conversation, opts);
 
 	const complete = await loadComplete();
 	const response = await complete(
@@ -197,11 +382,29 @@ async function generateName(ctx: ExtensionContext): Promise<GeneratedName | unde
 		.map((c) => c.text)
 		.join("\n");
 
-	return parseGeneratedName(raw);
+	return opts.currentName ? parseRevisitReply(raw) : parseGeneratedName(raw);
 }
 
-export default function (pi: ExtensionAPI) {
+type NameGenerator = (
+	ctx: ExtensionContext,
+	opts?: PromptOptions,
+) => Promise<typeof KEEP | GeneratedName | undefined>;
+
+export function installSessionName(pi: ExtensionAPI, generate: NameGenerator = generateName) {
 	let autoNameTried = false;
+	// Who chose the current name. A human's wording is never overwritten by a
+	// revisit - at most we suggest - so unknown provenance (a resumed session, a
+	// rename from outside this extension) is treated as human.
+	let nameAuthor: NameAuthor = "human";
+	// Round trips already acted on; the next check covers (lastRevisitAt, n].
+	let lastRevisitAt = 0;
+	let revisitInFlight = false;
+	// Last detached revisit, exposed so tests (and a curious host) can await
+	// completion of work that deliberately outlives the agent_settled handler.
+	let revisitDone: Promise<void> = Promise.resolve();
+	// The next name-change event expected from our own write. Tracking the value
+	// rather than a synchronous flag also covers hosts that emit the event later.
+	let expectedInternalName: string | null = null;
 	// The session name is the single source of truth; the tab label is derived
 	// from it. We remember the name we last reflected and the (possibly curated)
 	// label we wrote so turn_start can re-assert it - pi writes its own OS title
@@ -214,10 +417,40 @@ export default function (pi: ExtensionAPI) {
 	// Adopt a name we set ourselves, keeping any curated tab label (auto-naming
 	// produces a separate TAB line that need not match the first words of the
 	// session name), then write the tab.
-	const setName = (cfg: Config, name: string, tabLabel?: string): void => {
-		pi.setSessionName(name);
-		lastSyncedName = name;
-		currentTabLabel = toTabLabel(tabLabel ?? name);
+	const recordNameAuthor = (name: string, author: NameAuthor): void => {
+		nameAuthor = author;
+		pi.appendEntry<NameAuthorEntry>(NAME_AUTHOR_ENTRY, { name, author });
+	};
+
+	const restoredNameAuthor = (ctx: ExtensionContext, name: string): NameAuthor => {
+		const entries = ctx.sessionManager.getEntries();
+		for (let i = entries.length - 1; i >= 0; i--) {
+			const entry = entries[i] as {
+				type?: string;
+				customType?: string;
+				data?: Partial<NameAuthorEntry>;
+			};
+			if (entry.type !== "custom" || entry.customType !== NAME_AUTHOR_ENTRY) continue;
+			if (entry.data?.name === name && (entry.data.author === "auto" || entry.data.author === "human")) {
+				return entry.data.author;
+			}
+			break;
+		}
+		return "human";
+	};
+
+	const setName = (
+		cfg: Config,
+		name: string,
+		tabLabel?: string,
+		author?: NameAuthor,
+	): void => {
+		const clean = applyDenyList(name, cfg.deny);
+		if (author) recordNameAuthor(clean, author);
+		expectedInternalName = clean;
+		pi.setSessionName(clean);
+		lastSyncedName = clean;
+		currentTabLabel = toTabLabel(applyDenyList(tabLabel ?? clean, cfg.deny));
 		renameGhosttyTab(currentTabLabel, cfg.ghosttyTab);
 	};
 
@@ -241,8 +474,8 @@ export default function (pi: ExtensionAPI) {
 			const name = args.trim();
 			if (name) {
 				autoNameTried = true; // manual name wins; don't auto-overwrite later
-				setName(loadConfig(ctx), name);
-				ctx.ui.notify(`Session named: ${name}`, "info");
+				setName(loadConfig(ctx), name, undefined, "human");
+				ctx.ui.notify(`Session named: ${pi.getSessionName()}`, "info");
 			} else {
 				const current = pi.getSessionName();
 				ctx.ui.notify(current ? `Session: ${current}` : "No session name set", "info");
@@ -258,16 +491,38 @@ export default function (pi: ExtensionAPI) {
 			// A loaded/resumed/reloaded session already carries a name; reflect it.
 			// The curated tab label is not persisted, so derive from the name.
 			autoNameTried = true;
-			lastSyncedName = current;
-			currentTabLabel = toTabLabel(current);
-			renameGhosttyTab(currentTabLabel, cfg.ghosttyTab);
+			nameAuthor = restoredNameAuthor(ctx, current);
+			setName(cfg, current);
 		} else {
 			// Fresh session: clear carryover so a new name re-derives cleanly and
 			// auto-naming can run again.
 			autoNameTried = false;
+			nameAuthor = "human";
 			lastSyncedName = null;
 			currentTabLabel = null;
 		}
+		lastRevisitAt = countRoundTrips(ctx);
+	});
+
+	// The deny gate. setName cleans everything this extension writes, but pi's
+	// builtin rename and any other extension bypass it, so re-clean whatever the
+	// name ends up as. session_info_changed cannot veto a change - it only
+	// reports one - so the correction is a second write, guarded against the
+	// echo of our own.
+	pi.on("session_info_changed", async (_event, ctx) => {
+		const current = pi.getSessionName();
+		if (current === expectedInternalName) {
+			expectedInternalName = null;
+			return;
+		}
+		expectedInternalName = null;
+		if (!current) return;
+		const cfg = loadConfig(ctx);
+		if (!cfg.enabled) return;
+		recordNameAuthor(current, "human");
+		if (cfg.deny.length === 0) return;
+		const clean = applyDenyList(current, cfg.deny);
+		if (clean !== current) setName(cfg, clean, undefined, "human");
 	});
 
 	// Re-assert at the start of every turn. This is the only signal we get that
@@ -283,13 +538,65 @@ export default function (pi: ExtensionAPI) {
 		if (!cfg.enabled) return; // off by default; opt in via settings.json
 		autoNameTried = true;
 		try {
-			const generated = await generateName(ctx);
-			if (generated && !pi.getSessionName()) {
-				setName(cfg, generated.sessionName, generated.tabLabel);
-				if (ctx.hasUI) ctx.ui.notify(`Auto-named session: ${generated.sessionName}`, "info");
+			const generated = await generate(ctx, { rules: cfg.rules });
+			if (generated && generated !== KEEP && !pi.getSessionName()) {
+				setName(cfg, generated.sessionName, generated.tabLabel, "auto");
+				if (ctx.hasUI) ctx.ui.notify(`Auto-named session: ${pi.getSessionName()}`, "info");
 			}
 		} catch {
 			// best-effort; ignore failures
 		}
 	});
+
+	// Revisit. A name derived from the first turn describes the opening move,
+	// which is frequently not what the session turns out to be about - the work
+	// only reveals itself after the agent has been at it a while. Re-deriving at
+	// a couple of points catches that drift.
+	//
+	// agent_settled, not turn_end: it fires only once the run is fully idle (no
+	// retry, compaction, or queued continuation pending), so an automated
+	// multi-turn workflow - a subagent chain, a gauntlet phase - is never
+	// renamed mid-flight and never waits on a naming call. Cadence points the
+	// run crossed fire once, at the settle. The LLM call still runs detached so
+	// the freed-up UI is not held hostage by a slow provider.
+	pi.on("agent_settled", (_event, ctx) => {
+		if (revisitInFlight) return;
+		const cfg = loadConfig(ctx);
+		if (!cfg.enabled) return;
+		if (cfg.revisitFirstTurn === 0 && cfg.revisitEveryTurns === 0) return;
+		const current = pi.getSessionName();
+		if (!current) return; // unnamed; auto-naming owns that case
+		const n = countRoundTrips(ctx);
+		if (!shouldRevisit(lastRevisitAt, n, cfg)) return;
+		lastRevisitAt = n;
+		revisitInFlight = true;
+		revisitDone = (async () => {
+			try {
+				const result = await generate(ctx, { rules: cfg.rules, currentName: current });
+				if (!result || result === KEEP) return;
+				if (pi.getSessionName() !== current) return; // renamed under us mid-call
+				if (nameAuthor === "auto") {
+					setName(cfg, result.sessionName, result.tabLabel, "auto");
+					if (ctx.hasUI) ctx.ui.notify(`Renamed session: ${pi.getSessionName()}`, "info");
+				} else if (ctx.hasUI) {
+					// Human wording is theirs to change; surface the drift and stop.
+					const suggestion = applyDenyList(result.sessionName, cfg.deny);
+					ctx.ui.notify(
+						`Session name looks stale. Suggested: ${suggestion} - /session-name to apply`,
+						"info",
+					);
+				}
+			} catch {
+				// best-effort; ignore failures
+			} finally {
+				revisitInFlight = false;
+			}
+		})();
+	});
+
+	return { revisitSettled: () => revisitDone };
+}
+
+export default function (pi: ExtensionAPI) {
+	installSessionName(pi);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-quiver",
-  "version": "4.0.1",
+  "version": "4.1.0",
   "description": "Personal pack of Pi coding-agent extensions: context-safe fetch, doc_to_md PDF/DOCX/PPTX-to-Markdown conversion, session naming, a themed ASCII startup header, Opus 4.8 fast mode, and a provider-stall watchdog.",
   "author": "Jacek Juraszek",
   "license": "MIT",