pi-skillful 0.3.12 → 0.3.14

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.14 - 2026-07-17
+
+## 0.3.13 - 2026-07-17
+
 ## 0.3.12 - 2026-07-12
 
 ## 0.3.11 - 2026-07-01
@@ -14,6 +18,12 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ### Fixed
 
+- Ignore project `skillful` settings and block project-scope writes when Pi does not trust the current project.
+- Let an explicit project `toggleModifier: "alt"` override a non-default global modifier; unsupported explicit values now follow the documented `"alt"` fallback.
+- Consume only configured modifier-slot combinations in the prompt editor instead of registering all 54 possible shortcuts.
+- Propagate focus and custom-editor hooks through the session-toggle editor wrapper for IME and extension compatibility.
+- Restore red/dim coloring for hidden and visible skills in Pi's startup `[Skills]` list while preserving project-trust-aware settings.
+- Remove the stale package-local `package-lock.json` in favor of the monorepo root lockfile.
 - Preserve configured hidden skills at session start. Skillful no longer treats a temporarily incomplete loaded-skill list as authoritative and removes global or project visibility settings.
 
 ## [0.3.10] - 2026-07-01

package/CONTRIBUTING.md

@@ -7,6 +7,7 @@ Thanks for your interest in contributing to `pi-skillful`.
 ```bash
 npm install
 npm run check
+npm test
 ```
 
 The package is source-distributed: Pi loads the TypeScript extension files directly. There is no build step for runtime use.
@@ -35,6 +36,7 @@ pi -e /path/to/pi-mono/packages/pi-skillful
 Before opening a pull request:
 
 - Run `npm run check`.
+- Run `npm test`.
 - Run `npm run pack:dry-run` and confirm the package contents are intentional.
 - Update `README.md` if user-facing behavior changes.
 - Update `CHANGELOG.md` for notable changes.

package/README.md

@@ -4,12 +4,12 @@
 
 # pi-skillful
 
-`pi-skillful` is a [Pi](https://pi.dev) package that improves skill workflows.
+Make [Pi](https://pi.dev) skills easier to invoke, curate, and control without editing their source files.
 
-It currently provides three extensions:
+`pi-skillful` provides three focused upgrades:
 
 - **Inline skill invocation**: invoke one or more skills anywhere in a prompt with `/skill:name`.
-- **Skill prompt visibility**: choose which skills are hidden from the model's automatic skill-discovery prompt, while keeping them explicitly invokable and visibly marked in Pi's startup skill list.
+- **Skill prompt visibility**: choose which skills are hidden from the model's automatic skill-discovery prompt while keeping them explicitly invokable.
 - **Session skill toggles**: assign up to nine skills to number slots and toggle model visibility while writing a prompt.
 
 > [!WARNING]
@@ -33,6 +33,7 @@ Hide skills from the `<available_skills>` section of the system prompt without e
 
 Hidden skills:
 
+- appear in the startup `[Skills]` list in the theme's error color, while visible skills appear dimmed;
 - are not advertised to the model for automatic skill selection;
 - remain loaded by Pi;
 - remain available for explicit invocation with `/skill:name`, including inline invocation.
@@ -64,9 +65,9 @@ Open the menu with:
 
 The menu lists configurable skills alphabetically. Toggle a skill off or on in the active scope. Use the Global/Project tabs to choose which settings file to edit. In the Project tab, inherited on/off values are shown normally; project overrides are highlighted. Press `1` through `9` on a selected skill to assign or clear that scope's session toggle slot. Visibility and toggle slots are independent.
 
-Pi's startup `[Skills]` list also highlights hidden skills in the error color (red in the default dark theme).
+Project settings are read and the Project tab is available only when Pi trusts the current project. In an untrusted project, `pi-skillful` ignores `.pi/settings.json` and exposes only global settings.
 
-When the project settings file contains only `skillful` settings and the project `hiddenSkills` list becomes empty, `.pi/settings.json` is deleted instead of leaving an empty settings file behind.
+When the project settings file contains only `skillful` settings and the project override is removed, `.pi/settings.json` is deleted instead of leaving an empty settings file behind.
 
 ### Session skill toggles
 
@@ -86,9 +87,9 @@ Assign skills to up to nine prompt-editor slots with JSON settings:
 }
 ```
 
-Configured slots appear on the prompt editor's top border as `N skill-name`. Project `toggleSlots`, when defined as part of a project override, replace global `toggleSlots`; otherwise global slots are used and shown in the Project tab. Long names are truncated per slot when needed so all configured slot numbers remain visible. Active slots use the theme accent color; inactive slots use the muted color. Press `alt+1` through `alt+9` by default to toggle a slot for the current session only.
+Configured slots appear on the prompt editor's top border as `N skill-name`. Project `toggleSlots`, when defined as part of a project override, replace global `toggleSlots`; otherwise global slots are used and shown in the Project tab. Long names are truncated per slot when needed so all configured slot numbers remain visible. Active slots use the theme accent color; inactive slots use the muted color. Press `alt+1` through `alt+9` by default to toggle a slot for the current session only. Only the configured modifier and assigned slot numbers are consumed while the prompt editor has focus; no modifier-number keys are reserved when no slots are configured.
 
-`toggleModifier` defaults to `"alt"`. Supported values are `"alt"`, `"ctrl"`, `"ctrl+shift"`, `"alt+shift"`, `"ctrl+alt"`, and `"ctrl+alt+shift"`. Change it if your terminal reserves `alt+number` shortcuts.
+`toggleModifier` defaults to `"alt"`. Supported values are `"alt"`, `"ctrl"`, `"ctrl+shift"`, `"alt+shift"`, `"ctrl+alt"`, and `"ctrl+alt+shift"`. Change it if your terminal reserves `alt+number` shortcuts. An explicitly configured project value takes precedence over the global value, including explicit `"alt"`. Unsupported explicit values fall back to `"alt"` in that scope.
 
 On app startup, non-hidden skills are active and hidden skills are inactive. Within a running Pi process, `/new` preserves the current toggle state for the new session. Resuming, forking, cloning, reloading, or restarting Pi resets toggle state from settings. Inline `/skill:name` invocation remains explicit and works even when that skill is inactive. Skills bundled in Pi packages are never modified by these toggles.
 
@@ -146,6 +147,7 @@ Common commands:
 ```bash
 npm install
 npm run check
+npm test
 npm run pack:dry-run
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-skillful",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "Pi package with skill invocation and visibility improvements.",
   "type": "module",
   "exports": {
@@ -47,7 +47,7 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.80.0",
     "@earendil-works/pi-tui": "^0.80.0",
-    "@types/node": "^26.0.1",
+    "@types/node": "^26.1.0",
     "typescript": "^6.0.3"
   },
   "scripts": {

package/src/config.ts

@@ -24,6 +24,7 @@ export interface SkillfulSettings extends SkillToggleConfig {
   hiddenSkillsDefined: boolean;
   visibleSkills: string[];
   toggleSlotsDefined: boolean;
+  toggleModifierDefined: boolean;
 }
 
 export interface EffectiveSkillfulSettings extends SkillfulSettings {
@@ -113,21 +114,27 @@ export async function readSkillfulSettings(path: string): Promise<SkillfulSettin
   return settingsFromRecord(settings[SKILLFUL_SETTINGS_KEY]);
 }
 
-export async function readScopedSkillfulSettings(cwd: string): Promise<Record<SkillfulScope, SkillfulSettings>> {
+export async function readScopedSkillfulSettings(
+  cwd: string,
+  projectTrusted: boolean,
+): Promise<Record<SkillfulScope, SkillfulSettings>> {
   const [global, project] = await Promise.all([
     readSkillfulSettings(globalSettingsPath()),
-    readSkillfulSettings(projectSettingsPath(cwd)),
+    projectTrusted ? readSkillfulSettings(projectSettingsPath(cwd)) : Promise.resolve(settingsFromRecord(undefined)),
   ]);
   return { global, project };
 }
 
-export async function readEffectiveHiddenSkills(cwd: string): Promise<Set<string>> {
-  const scoped = await readScopedSkillfulSettings(cwd);
+export async function readEffectiveHiddenSkills(cwd: string, projectTrusted: boolean): Promise<Set<string>> {
+  const scoped = await readScopedSkillfulSettings(cwd, projectTrusted);
   return effectiveHiddenSkillSet(scoped);
 }
 
-export async function readEffectiveSkillfulSettings(cwd: string): Promise<EffectiveSkillfulSettings> {
-  const scoped = await readScopedSkillfulSettings(cwd);
+export async function readEffectiveSkillfulSettings(
+  cwd: string,
+  projectTrusted: boolean,
+): Promise<EffectiveSkillfulSettings> {
+  const scoped = await readScopedSkillfulSettings(cwd, projectTrusted);
   const hiddenSkills = normalizeSkillNames(effectiveHiddenSkillSet(scoped));
   const toggleSlots = scoped.project.toggleSlotsDefined ? scoped.project.toggleSlots : scoped.global.toggleSlots;
   return {
@@ -137,8 +144,8 @@ export async function readEffectiveSkillfulSettings(cwd: string): Promise<Effect
     hiddenSkillSet: new Set(hiddenSkills),
     toggleSlots,
     toggleSlotsDefined: scoped.global.toggleSlotsDefined || scoped.project.toggleSlotsDefined,
-    toggleModifier:
-      scoped.project.toggleModifier !== DEFAULT_TOGGLE_MODIFIER ? scoped.project.toggleModifier : scoped.global.toggleModifier,
+    toggleModifier: scoped.project.toggleModifierDefined ? scoped.project.toggleModifier : scoped.global.toggleModifier,
+    toggleModifierDefined: scoped.global.toggleModifierDefined || scoped.project.toggleModifierDefined,
   };
 }
 
@@ -146,8 +153,9 @@ export async function writeHiddenSkills(
   scope: SkillfulScope,
   cwd: string,
   hiddenSkills: Iterable<string>,
+  projectTrusted = false,
 ): Promise<SkillfulSettings> {
-  return updateSkillfulSettings(scope, cwd, (current) => {
+  return updateSkillfulSettings(scope, cwd, projectTrusted, (current) => {
     current.hiddenSkills = normalizeSkillNames(hiddenSkills);
   });
 }
@@ -157,8 +165,9 @@ export async function writeSkillVisibility(
   cwd: string,
   hiddenSkills: Iterable<string>,
   visibleSkills: Iterable<string> = [],
+  projectTrusted = false,
 ): Promise<SkillfulSettings> {
-  return updateSkillfulSettings(scope, cwd, (current) => {
+  return updateSkillfulSettings(scope, cwd, projectTrusted, (current) => {
     const visible = normalizeSkillNames(visibleSkills);
     current.hiddenSkills = normalizeSkillNames(hiddenSkills);
     if (visible.length === 0) delete current.visibleSkills;
@@ -170,8 +179,9 @@ export async function writeToggleSlots(
   scope: SkillfulScope,
   cwd: string,
   toggleSlots: Partial<Record<SkillToggleSlot, string>>,
+  projectTrusted = false,
 ): Promise<SkillfulSettings> {
-  return updateSkillfulSettings(scope, cwd, (current) => {
+  return updateSkillfulSettings(scope, cwd, projectTrusted, (current) => {
     current.toggleSlots = normalizeToggleSlots(toggleSlots);
   });
 }
@@ -180,8 +190,9 @@ export async function writeProjectSkillfulOverride(
   cwd: string,
   hiddenSkills: Iterable<string> | undefined,
   toggleSlots: Partial<Record<SkillToggleSlot, string>> | undefined,
+  projectTrusted: boolean,
 ): Promise<SkillfulSettings> {
-  return updateSkillfulSettings("project", cwd, (current) => {
+  return updateSkillfulSettings("project", cwd, projectTrusted, (current) => {
     delete current.visibleSkills;
     if (hiddenSkills === undefined) delete current.hiddenSkills;
     else current.hiddenSkills = normalizeSkillNames(hiddenSkills);
@@ -193,8 +204,13 @@ export async function writeProjectSkillfulOverride(
 async function updateSkillfulSettings(
   scope: SkillfulScope,
   cwd: string,
+  projectTrusted: boolean,
   updater: (current: Record<string, unknown>) => void,
 ): Promise<SkillfulSettings> {
+  if (scope === "project" && !projectTrusted) {
+    throw new Error("Project skillful settings require a trusted project.");
+  }
+
   const path = settingsPath(scope, cwd);
   const document = await readSettingsDocument(path);
 
@@ -224,10 +240,15 @@ export async function updateHiddenSkills(
   scope: SkillfulScope,
   cwd: string,
   updater: (current: string[]) => string[],
+  projectTrusted = false,
 ): Promise<SkillfulSettings> {
+  if (scope === "project" && !projectTrusted) {
+    throw new Error("Project skillful settings require a trusted project.");
+  }
+
   const path = settingsPath(scope, cwd);
   const current = await readSkillfulSettings(path);
-  return writeHiddenSkills(scope, cwd, updater(current.hiddenSkills));
+  return writeHiddenSkills(scope, cwd, updater(current.hiddenSkills), projectTrusted);
 }
 
 function settingsFromRecord(value: unknown): SkillfulSettings {
@@ -240,6 +261,7 @@ function settingsFromRecord(value: unknown): SkillfulSettings {
     toggleSlots: normalizeToggleSlots(skillful.toggleSlots),
     toggleSlotsDefined: Object.hasOwn(skillful, "toggleSlots"),
     toggleModifier: normalizeToggleModifier(skillful.toggleModifier),
+    toggleModifierDefined: Object.hasOwn(skillful, "toggleModifier"),
   };
 }
 

package/src/extensions/session-skill-toggles.ts

@@ -1,19 +1,24 @@
-import { CustomEditor, type ExtensionAPI, type KeybindingsManager, type Skill, type Theme } from "@earendil-works/pi-coding-agent";
-import type { AutocompleteProvider, Component, EditorComponent, EditorTheme, TUI } from "@earendil-works/pi-tui";
-import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import {
+  CustomEditor,
+  type AppKeybinding,
+  type ExtensionAPI,
+  type KeybindingsManager,
+  type Skill,
+  type Theme,
+} from "@earendil-works/pi-coding-agent";
+import type { AutocompleteProvider, EditorComponent, EditorTheme, Focusable, KeyId, TUI } from "@earendil-works/pi-tui";
+import { isFocusable, isKeyRelease, isKeyRepeat, matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import {
   DEFAULT_TOGGLE_MODIFIER,
   normalizeSkillName,
   readEffectiveSkillfulSettings,
   SKILL_TOGGLE_SLOTS,
-  SUPPORTED_TOGGLE_MODIFIERS,
   type SkillToggleModifier,
   type SkillToggleSlot,
 } from "../config.js";
 import { replaceSkillsSection } from "../skill-prompt.js";
 import { isTopLevelSkill, listLoadedSkills } from "../skills.js";
 
-const WIDGET_KEY = "pi-skillful-session-toggles";
 const STORE_KEY = Symbol.for("pi-skillful.sessionSkillTogglesStore");
 const BORDER_PREFIX = "─── ";
 const BORDER_SUFFIX = " ";
@@ -33,10 +38,10 @@ interface SessionToggleState {
   slots: ToggleSlotState[];
   activeBySkill: Map<string, boolean>;
   installedEditor: boolean;
-  installedWidget: boolean;
   previousEditorFactory: SkillfulEditorFactory | undefined;
   activeTui: TUI | undefined;
   theme: Theme | undefined;
+  notify: (message: string, type?: "info" | "warning" | "error") => void;
 }
 
 interface SessionToggleStore {
@@ -50,20 +55,8 @@ const store = (((globalThis as Record<PropertyKey, unknown>)[STORE_KEY] as Sessi
 let state: SessionToggleState = createEmptyState();
 
 export default function sessionSkillToggles(pi: ExtensionAPI) {
-  for (const modifier of SUPPORTED_TOGGLE_MODIFIERS) {
-    for (const slot of SKILL_TOGGLE_SLOTS) {
-      pi.registerShortcut(`${modifier}+${slot}`, {
-        description: `Toggle pi-skillful slot ${slot}`,
-        handler: (ctx) => {
-          if (state.modifier !== modifier) return;
-          toggleSlot(slot, ctx.ui.notify.bind(ctx.ui));
-        },
-      });
-    }
-  }
-
   pi.on("session_start", async (event, ctx) => {
-    const settings = await readEffectiveSkillfulSettings(ctx.cwd);
+    const settings = await readEffectiveSkillfulSettings(ctx.cwd, ctx.isProjectTrusted());
     const slots = configuredToggleSlots(pi, settings.toggleSlots);
 
     const preservedActiveBySkill =
@@ -84,13 +77,13 @@ export default function sessionSkillToggles(pi: ExtensionAPI) {
         ]),
       ),
       installedEditor: false,
-      installedWidget: false,
       previousEditorFactory: undefined,
       activeTui: undefined,
       theme: ctx.ui.theme,
+      notify: ctx.ui.notify.bind(ctx.ui),
     };
 
-    if (ctx.hasUI && slots.length > 0) installEditor(ctx.ui);
+    if (ctx.mode === "tui" && slots.length > 0) installEditor(ctx.ui);
     refreshUi();
   });
 
@@ -108,7 +101,6 @@ export default function sessionSkillToggles(pi: ExtensionAPI) {
 
   pi.on("session_shutdown", (event, ctx) => {
     if (state.installedEditor) ctx.ui.setEditorComponent(state.previousEditorFactory);
-    if (state.installedWidget) ctx.ui.setWidget(WIDGET_KEY, undefined);
     store.preservedNewSessionActiveBySkill =
       event.reason === "new" ? { cwd: state.cwd, activeBySkill: new Map(state.activeBySkill) } : undefined;
     state = createEmptyState();
@@ -123,10 +115,10 @@ function createEmptyState(): SessionToggleState {
     slots: [],
     activeBySkill: new Map<string, boolean>(),
     installedEditor: false,
-    installedWidget: false,
     previousEditorFactory: undefined,
     activeTui: undefined,
     theme: undefined,
+    notify: () => undefined,
   };
 }
 
@@ -134,8 +126,13 @@ export function hasActiveSessionSkillToggles(): boolean {
   return state.slots.length > 0;
 }
 
-export async function refreshSessionSkillToggles(pi: ExtensionAPI, cwd: string, ui: SkillfulUi): Promise<void> {
-  const settings = await readEffectiveSkillfulSettings(cwd);
+export async function refreshSessionSkillToggles(
+  pi: ExtensionAPI,
+  cwd: string,
+  projectTrusted: boolean,
+  ui: SkillfulUi,
+): Promise<void> {
+  const settings = await readEffectiveSkillfulSettings(cwd, projectTrusted);
   const slots = configuredToggleSlots(pi, settings.toggleSlots);
 
   const previousActiveBySkill = state.activeBySkill;
@@ -146,13 +143,11 @@ export async function refreshSessionSkillToggles(pi: ExtensionAPI, cwd: string,
     slots.map(({ skillName }) => [skillName, previousActiveBySkill.get(skillName) ?? !settings.hiddenSkillSet.has(skillName)]),
   );
 
-  if (slots.length > 0 && !state.installedEditor && !state.installedWidget) {
+  if (slots.length > 0 && !state.installedEditor) {
     installEditor(ui);
-  } else if (slots.length === 0) {
-    if (state.installedEditor) ui.setEditorComponent(state.previousEditorFactory);
-    if (state.installedWidget) ui.setWidget(WIDGET_KEY, undefined);
+  } else if (slots.length === 0 && state.installedEditor) {
+    ui.setEditorComponent(state.previousEditorFactory);
     state.installedEditor = false;
-    state.installedWidget = false;
     state.previousEditorFactory = undefined;
   }
 
@@ -179,17 +174,16 @@ function isSkillActive(skillName: string): boolean {
   return state.activeBySkill.get(skillName) ?? !state.hiddenSkills.has(skillName);
 }
 
-function toggleSlot(slot: SkillToggleSlot, notify: (message: string, type?: "info" | "warning" | "error") => void): void {
-  const entry = state.slots.find((candidate) => candidate.slot === slot);
-  if (!entry) {
-    notify(`No pi-skillful skill assigned to slot ${slot}.`, "info");
-    return;
-  }
+function handleToggleShortcut(data: string): boolean {
+  const entry = state.slots.find(({ slot }) => matchesKey(data, `${state.modifier}+${slot}` as KeyId));
+  if (!entry) return false;
+  if (isKeyRelease(data) || isKeyRepeat(data)) return true;
 
   const next = !isSkillActive(entry.skillName);
   state.activeBySkill.set(entry.skillName, next);
-  notify(`${entry.skillName} ${next ? "active" : "inactive"} for this session.`, "info");
+  state.notify(`${entry.skillName} ${next ? "active" : "inactive"} for this session.`, "info");
   refreshUi();
+  return true;
 }
 
 type SkillfulEditorFactory = (tui: TUI, theme: EditorTheme, keybindings: KeybindingsManager) => EditorComponent;
@@ -197,31 +191,17 @@ type SkillfulEditorFactory = (tui: TUI, theme: EditorTheme, keybindings: Keybind
 type SkillfulUi = {
   getEditorComponent: () => SkillfulEditorFactory | undefined;
   setEditorComponent: (factory: SkillfulEditorFactory | undefined) => void;
-  setWidget: (
-    key: string,
-    content: ((tui: TUI, theme: Theme) => Component & { dispose?(): void }) | undefined,
-    options?: { placement?: "aboveEditor" | "belowEditor" },
-  ) => void;
 };
 
 function installEditor(ui: SkillfulUi): void {
   state.previousEditorFactory = ui.getEditorComponent();
-
-  try {
-    const previous = state.previousEditorFactory;
-    ui.setEditorComponent((tui, theme, keybindings) => {
-      state.activeTui = tui;
-      if (previous) return new SkillToggleEditorWrapper(previous(tui, theme, keybindings));
-      return new SkillToggleEditor(tui, theme, keybindings);
-    });
-    state.installedEditor = true;
-  } catch {
-    ui.setWidget(WIDGET_KEY, (tui) => {
-      state.activeTui = tui;
-      return new SkillToggleWidget();
-    });
-    state.installedWidget = true;
-  }
+  const previous = state.previousEditorFactory;
+  ui.setEditorComponent((tui, theme, keybindings) => {
+    state.activeTui = tui;
+    if (previous) return new SkillToggleEditorWrapper(previous(tui, theme, keybindings));
+    return new SkillToggleEditor(tui, theme, keybindings);
+  });
+  state.installedEditor = true;
 }
 
 function refreshUi(): void {
@@ -229,6 +209,11 @@ function refreshUi(): void {
 }
 
 class SkillToggleEditor extends CustomEditor {
+  handleInput(data: string): void {
+    if (handleToggleShortcut(data)) return;
+    super.handleInput(data);
+  }
+
   render(width: number): string[] {
     const lines = super.render(width);
     if (lines.length === 0) return lines;
@@ -237,11 +222,78 @@ class SkillToggleEditor extends CustomEditor {
   }
 }
 
-class SkillToggleEditorWrapper implements EditorComponent {
-  borderColor?: (str: string) => string;
+interface CustomEditorHooks {
+  actionHandlers: Map<AppKeybinding, () => void>;
+  onEscape?: () => void;
+  onCtrlD?: () => void;
+  onPasteImage?: () => void;
+  onExtensionShortcut?: (data: string) => boolean;
+}
+
+function hasCustomEditorHooks(editor: EditorComponent): editor is EditorComponent & CustomEditorHooks {
+  return "actionHandlers" in editor && editor.actionHandlers instanceof Map;
+}
+
+class SkillToggleEditorWrapper implements EditorComponent, Focusable {
+  private _focused = false;
+
+  constructor(private readonly inner: EditorComponent) {}
+
+  get borderColor(): ((str: string) => string) | undefined {
+    return this.inner.borderColor?.bind(this.inner);
+  }
+
+  set borderColor(color: ((str: string) => string) | undefined) {
+    this.inner.borderColor = color;
+  }
+
+  get focused(): boolean {
+    return this._focused;
+  }
+
+  set focused(value: boolean) {
+    this._focused = value;
+    if (isFocusable(this.inner)) this.inner.focused = value;
+  }
 
-  constructor(private readonly inner: EditorComponent) {
-    this.borderColor = inner.borderColor?.bind(inner);
+  get wantsKeyRelease(): boolean | undefined {
+    return this.inner.wantsKeyRelease;
+  }
+
+  get actionHandlers(): Map<AppKeybinding, () => void> | undefined {
+    return hasCustomEditorHooks(this.inner) ? this.inner.actionHandlers : undefined;
+  }
+
+  get onEscape(): (() => void) | undefined {
+    return hasCustomEditorHooks(this.inner) ? this.inner.onEscape : undefined;
+  }
+
+  set onEscape(handler: (() => void) | undefined) {
+    if (hasCustomEditorHooks(this.inner)) this.inner.onEscape = handler;
+  }
+
+  get onCtrlD(): (() => void) | undefined {
+    return hasCustomEditorHooks(this.inner) ? this.inner.onCtrlD : undefined;
+  }
+
+  set onCtrlD(handler: (() => void) | undefined) {
+    if (hasCustomEditorHooks(this.inner)) this.inner.onCtrlD = handler;
+  }
+
+  get onPasteImage(): (() => void) | undefined {
+    return hasCustomEditorHooks(this.inner) ? this.inner.onPasteImage : undefined;
+  }
+
+  set onPasteImage(handler: (() => void) | undefined) {
+    if (hasCustomEditorHooks(this.inner)) this.inner.onPasteImage = handler;
+  }
+
+  get onExtensionShortcut(): ((data: string) => boolean) | undefined {
+    return hasCustomEditorHooks(this.inner) ? this.inner.onExtensionShortcut : undefined;
+  }
+
+  set onExtensionShortcut(handler: ((data: string) => boolean) | undefined) {
+    if (hasCustomEditorHooks(this.inner)) this.inner.onExtensionShortcut = handler;
   }
 
   get onSubmit(): ((text: string) => void) | undefined {
@@ -280,6 +332,7 @@ class SkillToggleEditorWrapper implements EditorComponent {
   }
 
   handleInput(data: string): void {
+    if (handleToggleShortcut(data)) return;
     this.inner.handleInput(data);
   }
 
@@ -312,14 +365,6 @@ class SkillToggleEditorWrapper implements EditorComponent {
   }
 }
 
-class SkillToggleWidget implements Component {
-  render(width: number): string[] {
-    return [renderToggleBorder(width, (text) => text)];
-  }
-
-  invalidate(): void {}
-}
-
 function renderToggleBorder(width: number, borderColor: (text: string) => string): string {
   if (width <= 0) return "";
   if (state.slots.length === 0) return borderColor("─".repeat(width));

package/src/extensions/skill-visibility.ts

@@ -24,11 +24,10 @@ import { isTopLevelSkill, listLoadedSkills, type LoadedSkillInfo } from "../skil
 import { hasActiveSessionSkillToggles, refreshSessionSkillToggles } from "./session-skill-toggles.js";
 const SCOPES: SkillfulScope[] = ["global", "project"];
 const STORE_KEY = Symbol.for("pi-skillful.skillVisibilityStore");
-const STARTUP_PATCH_KEY = Symbol.for("pi-skillful.startupPatchV2");
+const STARTUP_PATCH_KEY = Symbol.for("pi-skillful.startupPatchV3");
 
 interface SkillVisibilityStore {
   hiddenSkillsByCwd: Map<string, Set<string>>;
-  lastHiddenSkills: Set<string>;
   theme: Theme | null;
 }
 
@@ -50,7 +49,6 @@ interface InteractiveModeLike {
 
 const store = (((globalThis as Record<PropertyKey, unknown>)[STORE_KEY] as SkillVisibilityStore | undefined) ??= {
   hiddenSkillsByCwd: new Map<string, Set<string>>(),
-  lastHiddenSkills: new Set<string>(),
   theme: null,
 }) as SkillVisibilityStore;
 
@@ -61,6 +59,7 @@ type DefinedByScope = Record<SkillfulScope, boolean>;
 
 interface SkillfulVisibilityMenuOptions {
   cwd: string;
+  projectTrusted: boolean;
   skills: SkillListItem[];
   hiddenByScope: HiddenSkillsByScope;
   hiddenSkillsDefinedByScope: DefinedByScope;
@@ -85,13 +84,13 @@ export default function skillVisibility(pi: ExtensionAPI) {
 
   pi.on("session_start", async (_event, ctx) => {
     store.theme = ctx.ui.theme;
-    await refreshHiddenSkillCache(ctx.cwd);
+    await refreshHiddenSkillCache(ctx.cwd, ctx.isProjectTrusted());
   });
 
   pi.on("before_agent_start", async (event, ctx) => {
     if (hasActiveSessionSkillToggles()) return;
 
-    const hidden = await refreshHiddenSkillCache(ctx.cwd);
+    const hidden = await refreshHiddenSkillCache(ctx.cwd, ctx.isProjectTrusted());
     if (hidden.size === 0 || !event.systemPromptOptions.skills?.length) return;
 
     const filteredSkills: Skill[] = event.systemPromptOptions.skills.map((skill) =>
@@ -105,7 +104,7 @@ export default function skillVisibility(pi: ExtensionAPI) {
   pi.registerCommand("skillful", {
     description: "Open the pi-skillful skill visibility menu.",
     handler: async (_args, ctx) => {
-      if (!ctx.hasUI) {
+      if (ctx.mode !== "tui") {
         ctx.ui.notify("/skillful requires interactive UI", "warning");
         return;
       }
@@ -116,10 +115,12 @@ export default function skillVisibility(pi: ExtensionAPI) {
         return;
       }
 
-      const scoped = await readScopedSkillfulSettings(ctx.cwd);
+      const projectTrusted = ctx.isProjectTrusted();
+      const scoped = await readScopedSkillfulSettings(ctx.cwd, projectTrusted);
       await ctx.ui.custom<void>((tui, theme, _keybindings, done) =>
         new SkillfulVisibilityMenu({
           cwd: ctx.cwd,
+          projectTrusted,
           skills,
           hiddenByScope: {
             global: new Set(scoped.global.hiddenSkills),
@@ -140,7 +141,7 @@ export default function skillVisibility(pi: ExtensionAPI) {
           theme,
           tui,
           notify: (message, type) => ctx.ui.notify(message, type),
-          onToggleSlotsChanged: () => refreshSessionSkillToggles(pi, ctx.cwd, ctx.ui),
+          onToggleSlotsChanged: () => refreshSessionSkillToggles(pi, ctx.cwd, projectTrusted, ctx.ui),
           done,
         }),
       );
@@ -148,16 +149,17 @@ export default function skillVisibility(pi: ExtensionAPI) {
   });
 }
 
-async function refreshHiddenSkillCache(cwd: string): Promise<Set<string>> {
-  const hidden = await readEffectiveHiddenSkills(cwd);
+async function refreshHiddenSkillCache(cwd: string, projectTrusted: boolean): Promise<Set<string>> {
+  const hidden = await readEffectiveHiddenSkills(cwd, projectTrusted);
   store.hiddenSkillsByCwd.set(cwd, hidden);
-  store.lastHiddenSkills = hidden;
   return hidden;
 }
 
-// Must patch the real prototype from pi's module — separate module resolutions have distinct class identities.
-function installStartupSkillListPatch(): void {
-  const realPrototype = (InteractiveMode as unknown as { prototype: InteractiveModeLike }).prototype;
+// Pi has no public hook for styling the built-in startup resource list, so patch the
+// prototype from Pi's own module and keep the workaround isolated here.
+export function installStartupSkillListPatch(
+  realPrototype: InteractiveModeLike = (InteractiveMode as unknown as { prototype: InteractiveModeLike }).prototype,
+): void {
   if (!realPrototype) return;
 
   const patchState = realPrototype as Record<PropertyKey, unknown>;
@@ -175,16 +177,14 @@ function installStartupSkillListPatch(): void {
     }
 
     const cwd = this.sessionManager?.getCwd?.();
-
     let rawSkillNames: string[] = [];
     loader.getSkills = () => {
       const result = originalGetSkills.call(loader);
-      rawSkillNames = result.skills.map((s) => normalizeSkillName(s.name));
+      rawSkillNames = result.skills.map((skill) => normalizeSkillName(skill.name));
       return result;
     };
 
     const childrenBefore = this.loadedResourcesContainer?.children.length ?? 0;
-
     try {
       original.call(this, options);
     } finally {
@@ -193,14 +193,14 @@ function installStartupSkillListPatch(): void {
 
     if (rawSkillNames.length === 0 || !cwd || !this.loadedResourcesContainer) return;
 
+    const hidden = store.hiddenSkillsByCwd.get(cwd) ?? new Set<string>();
     const children = this.loadedResourcesContainer.children;
-    for (let i = childrenBefore; i < children.length; i++) {
-      const child = children[i] as ExpandableTextLike | undefined;
+    for (let index = childrenBefore; index < children.length; index++) {
+      const child = children[index] as ExpandableTextLike | undefined;
       if (!child || typeof child.getCollapsedText !== "function") continue;
-      const collapsed = child.getCollapsedText();
-      if (!collapsed.includes("[Skills]")) continue;
+      if (!child.getCollapsedText().includes("[Skills]")) continue;
 
-      const colorized = buildColorizedSkillList(rawSkillNames, store.lastHiddenSkills, store.theme);
+      const colorized = buildColorizedSkillList(rawSkillNames, hidden, store.theme);
       child.getCollapsedText = () => colorized;
       child.setText(colorized);
       break;
@@ -210,13 +210,12 @@ function installStartupSkillListPatch(): void {
   patchState[STARTUP_PATCH_KEY] = true;
 }
 
-function buildColorizedSkillList(names: string[], hidden: Set<string>, theme: Theme | null): string {
+export function buildColorizedSkillList(names: string[], hidden: Set<string>, theme: Theme | null): string {
   const sorted = [...names].sort((a, b) => a.localeCompare(b));
-  if (!theme) {
-    return `[Skills]\n  ${sorted.join(", ")}`;
-  }
+  if (!theme) return `[Skills]\n  ${sorted.join(", ")}`;
+
   const header = theme.fg("mdHeading", "[Skills]");
-  const parts = sorted.map((n) => (hidden.has(n) ? theme.fg("error", n) : theme.fg("dim", n)));
+  const parts = sorted.map((name) => (hidden.has(name) ? theme.fg("error", name) : theme.fg("dim", name)));
   return `${header}\n  ${parts.join(", ")}`;
 }
 
@@ -226,6 +225,8 @@ function getSkillItems(pi: ExtensionAPI): SkillListItem[] {
 
 class SkillfulVisibilityMenu implements Component {
   private readonly cwd: string;
+  private readonly projectTrusted: boolean;
+  private readonly scopes: SkillfulScope[];
   private readonly skills: SkillListItem[];
   private readonly hiddenByScope: HiddenSkillsByScope;
   private readonly hiddenSkillsDefinedByScope: DefinedByScope;
@@ -238,12 +239,15 @@ class SkillfulVisibilityMenu implements Component {
   private readonly done: () => void;
   private readonly topBorder: DynamicBorder;
   private readonly bottomBorder: DynamicBorder;
-  private scope: SkillfulScope = "project";
+  private scope: SkillfulScope;
   private settingsList: SettingsList;
   private saveQueue: Promise<void> = Promise.resolve();
 
   constructor(options: SkillfulVisibilityMenuOptions) {
     this.cwd = options.cwd;
+    this.projectTrusted = options.projectTrusted;
+    this.scopes = options.projectTrusted ? SCOPES : ["global"];
+    this.scope = options.projectTrusted ? "project" : "global";
     this.skills = options.skills;
     this.hiddenByScope = options.hiddenByScope;
     this.hiddenSkillsDefinedByScope = options.hiddenSkillsDefinedByScope;
@@ -267,7 +271,7 @@ class SkillfulVisibilityMenu implements Component {
       "",
       ...this.settingsList.render(width),
       "",
-      truncateToWidth(this.theme.fg("dim", "  Tab/←/→ switch scope · 1-9 assign/clear toggle · Enter/Space on/off · Esc close"), width),
+      truncateToWidth(this.theme.fg("dim", this.renderHelp()), width),
       ...this.bottomBorder.render(width),
     ];
   }
@@ -297,7 +301,7 @@ class SkillfulVisibilityMenu implements Component {
   }
 
   private renderTabs(): string {
-    return SCOPES
+    return this.scopes
       .map((scope) => {
         const label = scope === "global" ? "Global" : "Project";
         return scope === this.scope
@@ -307,9 +311,14 @@ class SkillfulVisibilityMenu implements Component {
       .join(" ");
   }
 
+  private renderHelp(): string {
+    const scopeHelp = this.projectTrusted ? "Tab/←/→ switch scope · " : "";
+    return `  ${scopeHelp}1-9 assign/clear toggle · Enter/Space on/off · Esc close`;
+  }
+
   private switchScope(direction: 1 | -1): void {
-    const current = SCOPES.indexOf(this.scope);
-    this.scope = SCOPES[(current + direction + SCOPES.length) % SCOPES.length];
+    const current = this.scopes.indexOf(this.scope);
+    this.scope = this.scopes[(current + direction + this.scopes.length) % this.scopes.length];
     this.settingsList = this.createSettingsList();
     this.tui.requestRender();
   }
@@ -431,7 +440,7 @@ class SkillfulVisibilityMenu implements Component {
       .then(async () => {
         if (scope === "project") await this.writeProjectOverrideOrInheritance();
         else await writeHiddenSkills(scope, this.cwd, hiddenSnapshot);
-        await refreshHiddenSkillCache(this.cwd);
+        await refreshHiddenSkillCache(this.cwd, this.projectTrusted);
       })
       .catch((error) => {
         this.notify(`Failed to save ${scope} skill visibility: ${error instanceof Error ? error.message : String(error)}`, "error");
@@ -465,13 +474,18 @@ class SkillfulVisibilityMenu implements Component {
     if (this.projectMatchesGlobal()) {
       this.hiddenSkillsDefinedByScope.project = false;
       this.toggleSlotsDefinedByScope.project = false;
-      await writeProjectSkillfulOverride(this.cwd, undefined, undefined);
+      await writeProjectSkillfulOverride(this.cwd, undefined, undefined, this.projectTrusted);
       return;
     }
 
     this.hiddenSkillsDefinedByScope.project = true;
     this.toggleSlotsDefinedByScope.project = true;
-    await writeProjectSkillfulOverride(this.cwd, this.hiddenByScope.project, this.toggleSlotsByScope.project);
+    await writeProjectSkillfulOverride(
+      this.cwd,
+      this.hiddenByScope.project,
+      this.toggleSlotsByScope.project,
+      this.projectTrusted,
+    );
   }
 
   private projectMatchesGlobal(): boolean {