pi-ui-extend 1.0.13 → 1.0.15

package/README.md

@@ -34,7 +34,7 @@ Pi provides the agent runtime, models, tools, skills, extensions, and persistent
 - **Keep projects organized.** Tabs are scoped to the working directory and survive restarts. Search, resume, fork, clone, jump through, import, export, share, or delete sessions without leaving the terminal.
 - **Stay in flow.** Run quick commands with `!`, open a raw interactive terminal with `!!`, paste images, follow file links, dictate in English or Russian, and improve a prompt before sending it.
 - **Know what the agent is doing.** The status area exposes model, thinking level, context, usage, workspace, todos, sub-agents, voice state, and prompt actions — with mouse targets where useful.
-- **Bring a serious toolkit.** Pix ships with `pi-tools-suite`: 17 integrated modules for indexed repository discovery, AST edits, LSP diagnostics, parallel agents, durable todos, context compression, web access, provider accounts, and more.
+- **Bring a serious toolkit.** Pix ships with `pi-tools-suite`: 18 integrated modules for indexed repository discovery, AST edits, LSP diagnostics, parallel agents, durable todos, context compression, web access, provider accounts, and more.
 - **Use the models you want.** Pix runs on Pi's provider ecosystem and supports model switching, scoped model lists, per-model thinking levels, usage views, autocomplete, and fallback-aware helper workflows.
 
 Pix is not a separate agent protocol or an RPC wrapper around Pi. It runs on the Pi SDK, so the runtime, session format, extensions, skills, prompts, and tools remain part of the same ecosystem.

package/dist/app/session/session-event-controller.d.ts

@@ -125,6 +125,15 @@ export declare class AppSessionEventController {
     }): Promise<boolean>;
     handleSessionEvent(event: AgentSessionEvent): void;
     private retryFailedTurn;
+    /**
+     * The SDK only emits `auto_retry_end` (whose toast carries the Retry button)
+     * when auto-retry actually runs. When retry is disabled, a transient streaming
+     * error such as a 429 rate limit surfaces only as the error entry above, with
+     * no way to resume the failed turn. Offer a manual Retry toast in that case,
+     * mirroring the auto-retry path. User aborts and non-retryable errors are
+     * excluded, and retry being enabled means the auto-retry toast will handle it.
+     */
+    private showManualRetryOnTerminalError;
     private retryFailedTurnAsync;
     private isActiveRuntimeSession;
     addCustomMessageEntry(message: Record<string, unknown>): void;

package/dist/app/session/session-event-controller.js

@@ -1,3 +1,4 @@
+import { isRetryableAssistantError } from "@earendil-works/pi-ai";
 import { createId } from "../id.js";
 import { extractImageContents, renderContent, renderUserMessageContent, stringifyUnknown } from "../rendering/message-content.js";
 import { customMessageEntry, extensionSessionEntry, loadSessionHistoryEntries, loadSessionHistoryEntriesAsync } from "./session-history.js";
@@ -351,6 +352,25 @@ export class AppSessionEventController {
     retryFailedTurn(session) {
         void this.retryFailedTurnAsync(session);
     }
+    /**
+     * The SDK only emits `auto_retry_end` (whose toast carries the Retry button)
+     * when auto-retry actually runs. When retry is disabled, a transient streaming
+     * error such as a 429 rate limit surfaces only as the error entry above, with
+     * no way to resume the failed turn. Offer a manual Retry toast in that case,
+     * mirroring the auto-retry path. User aborts and non-retryable errors are
+     * excluded, and retry being enabled means the auto-retry toast will handle it.
+     */
+    showManualRetryOnTerminalError(error) {
+        const errorText = error.errorMessage;
+        if (!errorText || !isRetryableAssistantError(error))
+            return;
+        const session = this.host.runtime()?.session;
+        if (!session || session.autoRetryEnabled)
+            return;
+        this.host.showToast(`Request failed: ${errorText}`, "error", {
+            action: { label: "Retry", onSelect: () => this.retryFailedTurn(session) },
+        });
+    }
     async retryFailedTurnAsync(session) {
         const runtime = this.host.runtime();
         if (!runtime || !this.isActiveRuntimeSession(runtime, session))
@@ -693,12 +713,15 @@ export class AppSessionEventController {
                 this.assistantMessageClosed = true;
                 this.host.setSessionActivity(this.host.runtime()?.session.isStreaming ? "running" : "idle");
                 break;
-            case "error":
+            case "error": {
                 this.finishCurrentThinkingEntry();
                 this.flushAssistantTextBuffer(true);
                 this.host.setSessionActivity(this.host.runtime()?.session.isStreaming ? "running" : "idle");
-                this.addEntry({ id: createId("error"), kind: "error", text: assistantEvent.error.errorMessage ?? assistantEvent.reason });
+                const errorText = assistantEvent.error.errorMessage ?? assistantEvent.reason;
+                this.addEntry({ id: createId("error"), kind: "error", text: errorText });
+                this.showManualRetryOnTerminalError(assistantEvent.error);
                 break;
+            }
             default:
                 break;
         }

package/dist/schemas/pi-tools-suite-schema.d.ts

@@ -9,7 +9,10 @@ export declare const PiToolsSuiteConfigSchema: Type.TObject<{
     $schema: Type.TOptional<Type.TString>;
     enabled: Type.TOptional<Type.TBoolean>;
     disabledModules: Type.TOptional<Type.TArray<Type.TString>>;
+    enabledModules: Type.TOptional<Type.TArray<Type.TString>>;
+    modules: Type.TOptional<Type.TRecord<"^.*$", Type.TBoolean>>;
     todoThinking: Type.TOptional<Type.TBoolean>;
+    todoThinkingOverrides: Type.TOptional<Type.TRecord<"^.*$", Type.TUnion<[Type.TLiteral<"off">, Type.TLiteral<"minimal">, Type.TLiteral<"low">, Type.TLiteral<"medium">, Type.TLiteral<"high">, Type.TLiteral<"xhigh">, Type.TLiteral<"max">, Type.TNull]>>>;
     lookupModel: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull]>>;
     terminalBell: Type.TOptional<Type.TObject<{
         sound: Type.TOptional<Type.TBoolean>;
@@ -163,6 +166,10 @@ export declare const PiToolsSuiteConfigSchema: Type.TObject<{
             prompt: Type.TString;
         }>>>;
     }>>;
+    secretFirewall: Type.TOptional<Type.TObject<{
+        sessionHygiene: Type.TOptional<Type.TBoolean>;
+        notify: Type.TOptional<Type.TBoolean>;
+    }>>;
     lsp: Type.TOptional<Type.TObject<{
         servers: Type.TOptional<Type.TArray<Type.TObject<{
             id: Type.TString;

package/dist/schemas/pi-tools-suite-schema.js

@@ -181,6 +181,10 @@ const PromptCommand = Type.Object({
 const PromptCommandsConfig = Type.Object({
     commands: Type.Optional(Type.Record(Type.String(), PromptCommand, { description: "Command definitions keyed by slash command name." })),
 }, { description: "User-defined slash commands." });
+const SecretFirewallConfig = Type.Object({
+    sessionHygiene: Type.Optional(Type.Boolean({ description: "Redact detected secret material from tool results and completed messages before it remains in session history." })),
+    notify: Type.Optional(Type.Boolean({ description: "Show a warning when one or more secrets are redacted. Secret values are never included in notifications." })),
+}, { description: "Settings for the opt-in credential-firewall module." });
 // ---------------------------------------------------------------------------
 // LSP
 // ---------------------------------------------------------------------------
@@ -214,13 +218,26 @@ export const PiToolsSuiteConfigSchema = Type.Object({
     $schema: Type.Optional(Type.String({ description: "JSON Schema URL used by editors for validation and autocomplete." })),
     enabled: Type.Optional(Type.Boolean({ description: "Enable or disable the entire pi-tools-suite extension." })),
     disabledModules: Type.Optional(Type.Array(Type.String(), { description: "List of disabled module names (e.g. ['lsp', 'prompt-commands'])." })),
+    enabledModules: Type.Optional(Type.Array(Type.String(), { description: "List of module names to explicitly enable, including modules that are disabled by default." })),
+    modules: Type.Optional(Type.Record(Type.String(), Type.Boolean(), { description: "Per-module enable/disable map. credential-firewall is disabled by default and can be enabled here." })),
     todoThinking: Type.Optional(Type.Boolean({ description: "Enable per-todo thinking levels and automatic thinking switch/restore when tasks become in-progress/completed." })),
+    todoThinkingOverrides: Type.Optional(Type.Record(Type.String(), Type.Union([
+        Type.Literal("off"),
+        Type.Literal("minimal"),
+        Type.Literal("low"),
+        Type.Literal("medium"),
+        Type.Literal("high"),
+        Type.Literal("xhigh"),
+        Type.Literal("max"),
+        Type.Null(),
+    ]), { description: "Force per-todo thinking for matching provider/model or bare-model keys. Keys support * and ? wildcards; null removes an inherited override." })),
     lookupModel: Type.Optional(Type.Union([Type.String(), Type.Null()], { description: "Vision-capable provider/model used by GLM's lookup tool; unset or null disables lookup." })),
     terminalBell: Type.Optional(TerminalBellConfig),
     dcp: Type.Optional(DcpConfig),
     asyncSubagents: Type.Optional(AsyncSubagentsConfig),
     toolRenderer: Type.Optional(ToolRendererConfig),
     promptCommands: Type.Optional(PromptCommandsConfig),
+    secretFirewall: Type.Optional(SecretFirewallConfig),
     lsp: Type.Optional(LspConfig),
 }, {
     $id: "https://unpkg.com/pi-ui-extend/schemas/pi-tools-suite.json",

package/external/pi-tools-suite/README.md

@@ -5,6 +5,7 @@ Local all-in-one Pi extension package.
 This package keeps shared Pi tools as ordinary source folders under `src/` and registers them through one entrypoint.
 
 - `src/coding-discipline` — injects a deduplicated silent-mode and quality-discipline block at the very top of the main-session per-turn system prompt for GLM main-session models only (`isGlmModel`) immediately before the LLM request; non-GLM models are left untouched; disabled for async sub-agents
+- `src/credential-firewall` — opt-in secret firewall for high-confidence outbound/session credential redaction; disabled by default
 - `src/ast-grep` — `ast_grep` / `ast_apply`
 - `src/async-subagents` — `subagents` tool and sub-agent slash commands, including oh-my-openagent-style `/ultrawork` (`/ulw`) and `/hyperplan` orchestration prompts, plus config-defined sub-agent model/thinking/args presets selected via `/subagent-preset` from `asyncSubagents` in `~/.config/pi/pi-tools-suite.jsonc`; includes the `frontend` profile for Gemini-friendly UI/UX and visual frontend work and the `oracle` profile for cross-provider second opinions; enforces a 30-minute per-agent execution timeout, project-wide `maxConcurrent` queueing, optional retry/backoff, and `result.json` structured metadata/chaining fields next to raw `result.md`; stores project-local run files and a registry under `.pi/subagents/` so result/status collection can recover after compaction or reload while the main session remains alive
 - `src/lsp` — shared LSP diagnostics hook/library that enriches mutating tool results with diagnostics and shuts down language servers on session shutdown
@@ -23,7 +24,7 @@ This package keeps shared Pi tools as ordinary source folders under `src/` and r
 
 `index.ts` is intentionally only a thin auto-discovery shim that re-exports `src/index.ts`. There is no `pi.extensions` manifest here, so local Pi auto-discovery loads the suite once via `~/.pi/agent/extensions/pi-tools-suite/index.ts` and does not double-register tools.
 
-Registration order is preserved in `src/index.ts`: coding-discipline, ast-grep, async-subagents, lsp, comment-checker, session-name, repo-discovery command/tool gate, antigravity-auth provider, OpenCode import, todo, model-tools, usage, web-search, dcp, prompt-commands, then skill-installer. Tool metadata and active model-specific tool sets have two modes: standard and repo-aware. When `.indexer-cli` enables `repo_*`, those tools stay active ahead of overlapping lower-level aliases so the indexed discovery surface has priority.
+Registration order is preserved in `src/index.ts`: coding-discipline, ast-grep, async-subagents, lsp, comment-checker, session-name, repo-discovery command/tool gate, antigravity-auth provider, OpenCode import, todo, model-tools, usage, web-search, dcp, prompt-commands, skill-installer, credential-firewall, then codex-reasoning-fix. Tool metadata and active model-specific tool sets have two modes: standard and repo-aware. When `.indexer-cli` enables `repo_*`, those tools stay active ahead of overlapping lower-level aliases so the indexed discovery surface has priority.
 
 ## Disabling modules
 
@@ -44,6 +45,8 @@ PI_TOOLS_SUITE_DISABLED=1 pi ...   # disables all pi-tools-suite modules
 
 `disabledExtensions`, `enabledModules`, `enabledExtensions`, and an `extensions` map are accepted as aliases for the same module names. Use `*` or `all` in `PI_TOOLS_SUITE_DISABLED_MODULES` to skip every registered module.
 
+`credential-firewall` is disabled by default. Enable it explicitly with `"modules": { "credential-firewall": true }`. When enabled it replaces high-confidence secret material in the final provider payload with stable placeholders such as `<SECRET:github_token:1>`. `secretFirewall.sessionHygiene` (default `true`) applies the same redactor to tool results and completed messages before they remain in session history; `secretFirewall.notify` controls warnings. Entropy-only detection is intentionally not used yet to avoid corrupting hashes, IDs, minified assets, and other high-entropy non-secrets.
+
 Saved prompt slash commands are stored under `promptCommands`. Use `/prompt-commands` to create, edit, rename, delete, list, show the config path, or run them from an interactive menu. After a CRUD edit the module reloads Pi resources so the slash-command list reflects the config. Each saved command sends its saved prompt as a user message.
 
 ```jsonc
@@ -59,6 +62,18 @@ Saved prompt slash commands are stored under `promptCommands`. Use `/prompt-comm
 }
 ```
 
+Todo thinking can be enabled globally and forced to a fixed level for selected models. `todoThinkingOverrides` keys accept exact `provider/model` or bare-model names plus `*` and `?` wildcards. Full provider/model matches beat bare-model matches, exact matches beat wildcards, and the more specific wildcard wins. The override is applied at runtime to create/update and batch create/update mutations even when the model requests another level or omits `thinking`. Unsupported levels are normalized to the nearest level supported by the current model. Later config layers can remove an inherited entry with `null`.
+
+```jsonc
+{
+  "todoThinking": true,
+  "todoThinkingOverrides": {
+    "zai/glm-5.3": "max",
+    "cheap-provider/*": "high"
+  }
+}
+```
+
 DCP settings are stored only under `dcp` in the user shared config file `~/.config/pi/pi-tools-suite.jsonc`. Legacy standalone `dcp.jsonc`, `$PI_CONFIG_DIR`, and project-local `.pi/pi-tools-suite.jsonc` DCP settings are intentionally ignored by the ported headless DCP module.
 
 ```jsonc

package/external/pi-tools-suite/src/config.ts

@@ -9,6 +9,7 @@ export interface PiToolsSuiteConfig {
 	enabled: boolean;
 	disabledModules: string[];
 	todoThinking: boolean;
+	todoThinkingOverrides: Record<string, TodoThinkingLevel>;
 	/** Vision-capable model used by the coding-discipline lookup tool; unset disables lookup. */
 	lookupModel?: string;
 	/**
@@ -25,6 +26,7 @@ type MutableConfig = {
 	enabled: boolean;
 	disabledModules: Set<string>;
 	todoThinking: boolean;
+	todoThinkingOverrides: Map<string, TodoThinkingLevel>;
 	lookupModel: string | undefined;
 	codingDisciplineStrictness: CodingDisciplineStrictness;
 };
@@ -32,6 +34,8 @@ type MutableConfig = {
 export const CODING_DISCIPLINE_STRICTNESS_VALUES = ["strict", "lenient"] as const;
 export type CodingDisciplineStrictness = (typeof CODING_DISCIPLINE_STRICTNESS_VALUES)[number];
 export const DEFAULT_CODING_DISCIPLINE_STRICTNESS: CodingDisciplineStrictness = "lenient";
+const TODO_THINKING_OVERRIDE_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
+export type TodoThinkingLevel = (typeof TODO_THINKING_OVERRIDE_LEVELS)[number];
 
 type Env = Record<string, string | undefined>;
 
@@ -41,7 +45,8 @@ const FALSE_VALUES = new Set(["0", "false", "off", "no"]);
 const DISABLED_LIST_KEYS = ["disabledModules", "disabledExtensions"];
 const ENABLED_LIST_KEYS = ["enabledModules", "enabledExtensions"];
 const MODULE_MAP_KEYS = ["modules", "extensions"];
-const DEFAULT_DISABLED_MODULES = new Set<string>();
+const DEFAULT_DISABLED_MODULES = new Set<string>(["credential-firewall"]);
+const DEFAULT_TODO_THINKING_OVERRIDES = new Map<string, TodoThinkingLevel>([["zai/glm-5.3", "max"]]);
 
 export function getPiToolsSuiteUserConfigPath(homeDir = homedir()): string {
 	return join(homeDir, ".config", "pi", "pi-tools-suite.jsonc");
@@ -79,6 +84,23 @@ function normalizeCodingDisciplineStrictness(raw: unknown): CodingDisciplineStri
 	return raw === "strict" ? "strict" : "lenient";
 }
 
+function isTodoThinkingLevel(raw: unknown): raw is TodoThinkingLevel {
+	return TODO_THINKING_OVERRIDE_LEVELS.includes(raw as TodoThinkingLevel);
+}
+
+function mergeTodoThinkingOverrides(config: MutableConfig, raw: unknown): void {
+	if (!isRecord(raw)) return;
+	for (const [rawPattern, value] of Object.entries(raw)) {
+		const pattern = rawPattern.trim().toLowerCase();
+		if (!pattern) continue;
+		if (value === null) {
+			config.todoThinkingOverrides.delete(pattern);
+			continue;
+		}
+		if (isTodoThinkingLevel(value)) config.todoThinkingOverrides.set(pattern, value);
+	}
+}
+
 function boolFromEnv(value: string | undefined): boolean | undefined {
 	if (value === undefined) return undefined;
 	const normalized = value.trim().toLowerCase();
@@ -137,6 +159,7 @@ function removeDisabled(config: MutableConfig, value: unknown, knownModules: Rea
 function mergeConfigLayer(config: MutableConfig, raw: Record<string, unknown>, knownModules: ReadonlySet<string>): MutableConfig {
 	if (typeof raw.enabled === "boolean") config.enabled = raw.enabled;
 	if (typeof raw.todoThinking === "boolean") config.todoThinking = raw.todoThinking;
+	mergeTodoThinkingOverrides(config, raw.todoThinkingOverrides);
 	if (Object.prototype.hasOwnProperty.call(raw, "lookupModel")) config.lookupModel = normalizeLookupModel(raw.lookupModel);
 	if (Object.prototype.hasOwnProperty.call(raw, "codingDisciplineStrictness")) {
 		config.codingDisciplineStrictness = normalizeCodingDisciplineStrictness(raw.codingDisciplineStrictness);
@@ -197,6 +220,7 @@ export function loadPiToolsSuiteConfig(moduleNames: readonly string[], options:
 		enabled: true,
 		disabledModules: new Set([...DEFAULT_DISABLED_MODULES].filter((name) => knownModules.has(name))),
 		todoThinking: false,
+		todoThinkingOverrides: new Map(DEFAULT_TODO_THINKING_OVERRIDES),
 		lookupModel: undefined,
 		codingDisciplineStrictness: DEFAULT_CODING_DISCIPLINE_STRICTNESS,
 	};
@@ -217,6 +241,7 @@ export function loadPiToolsSuiteConfig(moduleNames: readonly string[], options:
 		enabled: config.enabled,
 		disabledModules: [...config.disabledModules].sort(),
 		todoThinking: config.todoThinking,
+		todoThinkingOverrides: Object.fromEntries(config.todoThinkingOverrides),
 		...(config.lookupModel ? { lookupModel: config.lookupModel } : {}),
 		codingDisciplineStrictness: config.codingDisciplineStrictness,
 	};

package/external/pi-tools-suite/src/credential-firewall/config.ts

@@ -0,0 +1,77 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, parse, resolve } from "node:path";
+import { parse as parseJsonc } from "jsonc-parser";
+
+import { getPiToolsSuiteUserConfigPath } from "../config.js";
+
+export interface SecretFirewallConfig {
+	sessionHygiene: boolean;
+	notify: boolean;
+}
+
+const TRUE_VALUES = new Set(["1", "true", "on", "yes"]);
+const FALSE_VALUES = new Set(["0", "false", "off", "no"]);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function readJsonc(filePath: string): Record<string, unknown> {
+	if (!existsSync(filePath)) return {};
+	try {
+		const parsed = parseJsonc(readFileSync(filePath, "utf8"));
+		return isRecord(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+
+function findProjectConfig(startDir: string): string | undefined {
+	let dir = resolve(startDir);
+	const root = parse(dir).root;
+	while (true) {
+		const candidate = join(dir, ".pi", "pi-tools-suite.jsonc");
+		if (existsSync(candidate)) return candidate;
+		if (dir === root) return undefined;
+		const parent = dirname(dir);
+		if (parent === dir) return undefined;
+		dir = parent;
+	}
+}
+
+function boolFromEnv(value: string | undefined): boolean | undefined {
+	if (value === undefined) return undefined;
+	const normalized = value.trim().toLowerCase();
+	if (TRUE_VALUES.has(normalized)) return true;
+	if (FALSE_VALUES.has(normalized)) return false;
+	return undefined;
+}
+
+export function loadSecretFirewallConfig(
+	cwd: string = process.cwd(),
+	env: NodeJS.ProcessEnv = process.env,
+	homeDir: string = env.HOME ?? process.env.HOME ?? "",
+): SecretFirewallConfig {
+	let sessionHygiene = true;
+	let notify = true;
+
+	const layers = [getPiToolsSuiteUserConfigPath(homeDir)];
+	if (env.PI_CONFIG_DIR) layers.push(join(env.PI_CONFIG_DIR, "pi-tools-suite.jsonc"));
+	const projectConfig = findProjectConfig(cwd);
+	if (projectConfig) layers.push(projectConfig);
+
+	for (const filePath of layers) {
+		const root = readJsonc(filePath);
+		const section = root.secretFirewall;
+		if (!isRecord(section)) continue;
+		if (typeof section.sessionHygiene === "boolean") sessionHygiene = section.sessionHygiene;
+		if (typeof section.notify === "boolean") notify = section.notify;
+	}
+
+	const envSessionHygiene = boolFromEnv(env.PI_SECRET_FIREWALL_SESSION_HYGIENE);
+	if (envSessionHygiene !== undefined) sessionHygiene = envSessionHygiene;
+	const envNotify = boolFromEnv(env.PI_SECRET_FIREWALL_NOTIFY);
+	if (envNotify !== undefined) notify = envNotify;
+
+	return { sessionHygiene, notify };
+}

package/external/pi-tools-suite/src/credential-firewall/index.ts

@@ -0,0 +1,62 @@
+import { loadSecretFirewallConfig } from "./config.js";
+import { SecretRedactor, type SecretKind, type SecretRedactionResult, type SecretRedactionSummary } from "./redact.js";
+
+type ExtensionAPI = any;
+type ExtensionContext = {
+	cwd?: string;
+	ui?: { notify?: (message: string, type?: "info" | "warning" | "error") => void };
+};
+
+function maybeNotify(ctx: ExtensionContext, result: SecretRedactionSummary, source: string, enabled: boolean): void {
+	if (!enabled || result.count === 0) return;
+	try {
+		ctx.ui?.notify?.(
+			`Secret firewall redacted ${result.count} secret${result.count === 1 ? "" : "s"} from ${source}: ${result.kinds.join(", ")}.`,
+			"warning",
+		);
+	} catch {
+		// Protection must not fail because a headless or stale UI cannot notify.
+	}
+}
+
+export default function credentialFirewall(pi: ExtensionAPI): void {
+	const redactor = new SecretRedactor();
+
+	pi.on("before_provider_request", async (event: { payload?: unknown }, ctx: ExtensionContext) => {
+		const config = loadSecretFirewallConfig(ctx.cwd ?? process.cwd());
+		const result = redactor.redact(event.payload);
+		if (result.count === 0) return undefined;
+		maybeNotify(ctx, result, "provider payload", config.notify);
+		return result.value;
+	});
+
+	pi.on("tool_result", async (event: { content?: unknown; details?: unknown }, ctx: ExtensionContext) => {
+		const config = loadSecretFirewallConfig(ctx.cwd ?? process.cwd());
+		if (!config.sessionHygiene) return undefined;
+
+		const content = redactor.redact(event.content);
+		const details = redactor.redact(event.details);
+		const count = content.count + details.count;
+		if (count === 0) return undefined;
+		const kinds = [...new Set([...content.kinds, ...details.kinds])] as SecretKind[];
+		maybeNotify(ctx, { count, kinds }, "tool result", config.notify);
+		return {
+			...(content.count > 0 ? { content: content.value } : {}),
+			...(details.count > 0 ? { details: details.value } : {}),
+		};
+	});
+
+	pi.on("message_end", async (event: { message?: unknown }, ctx: ExtensionContext) => {
+		const config = loadSecretFirewallConfig(ctx.cwd ?? process.cwd());
+		if (!config.sessionHygiene || !event.message) return undefined;
+		const result = redactor.redact(event.message);
+		if (result.count === 0) return undefined;
+		maybeNotify(ctx, result, "session message", config.notify);
+		return { message: result.value };
+	});
+}
+
+export { loadSecretFirewallConfig } from "./config.js";
+export { SecretRedactor } from "./redact.js";
+export type { SecretFirewallConfig } from "./config.js";
+export type { SecretKind, SecretRedactionResult, SecretRedactionSummary } from "./redact.js";

package/external/pi-tools-suite/src/credential-firewall/redact.ts

@@ -0,0 +1,222 @@
+import { createHash } from "node:crypto";
+
+export type SecretKind =
+	| "private_key"
+	| "github_token"
+	| "gitlab_token"
+	| "api_key"
+	| "google_api_key"
+	| "aws_access_key"
+	| "slack_token"
+	| "stripe_key"
+	| "npm_token"
+	| "pypi_token"
+	| "telegram_bot_token"
+	| "bearer_token"
+	| "basic_auth"
+	| "password"
+	| "credential";
+
+export interface SecretRedactionSummary {
+	count: number;
+	kinds: SecretKind[];
+}
+
+export interface SecretRedactionResult<T = unknown> extends SecretRedactionSummary {
+	value: T;
+}
+
+type MatchPattern = { kind: SecretKind; pattern: RegExp };
+
+const EXACT_SECRET_PATTERNS: MatchPattern[] = [
+	{ kind: "private_key", pattern: /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----[\s\S]*?-----END \1-----/g },
+	{ kind: "github_token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,255}|github_pat_[A-Za-z0-9_]{20,255})\b/g },
+	{ kind: "gitlab_token", pattern: /\bglpat-[A-Za-z0-9_-]{20,255}\b/g },
+	{ kind: "api_key", pattern: /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{24,255}\b/g },
+	{ kind: "google_api_key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+	{ kind: "aws_access_key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+	{ kind: "slack_token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{20,255}\b/g },
+	{ kind: "stripe_key", pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,255}\b/g },
+	{ kind: "npm_token", pattern: /\bnpm_[A-Za-z0-9]{30,255}\b/g },
+	{ kind: "pypi_token", pattern: /\bpypi-[A-Za-z0-9_-]{40,255}\b/g },
+	{ kind: "telegram_bot_token", pattern: /\b\d{8,12}:[A-Za-z0-9_-]{30,}\b/g },
+];
+
+const SENSITIVE_ASSIGNMENT = /((?:["']?)(?:api[_-]?key|secret(?:[_-]?key)?|client[_-]?secret|access[_-]?token|refresh[_-]?token|auth[_-]?token|password|passwd|pwd|private[_-]?key|npm[_-]?token|github[_-]?token|gitlab[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token)(?:["']?)\s*[:=]\s*)(["']?)([^\s"',}{;]{8,})(["']?)/gi;
+const BEARER_AUTH = /(\bAuthorization\s*:\s*Bearer\s+)([A-Za-z0-9._~+\/=:-]{12,})/gi;
+const BASIC_AUTH = /(\bAuthorization\s*:\s*Basic\s+)([A-Za-z0-9+/=]{8,})/gi;
+const URL_PASSWORD = /(\b[a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)([^@\s/]{4,})(@)/gi;
+
+const SAFE_EXACT_VALUES = new Set([
+	"[redacted]",
+	"redacted",
+	"placeholder",
+	"changeme",
+	"change-me",
+	"not-a-secret",
+	"not_secret",
+	"example",
+	"dummy",
+	"replace_me",
+	"replace-me",
+]);
+
+function shouldSkipCandidate(value: string): boolean {
+	const normalized = value.trim().toLowerCase();
+	if (!normalized) return true;
+	if (normalized.includes("<secret:")) return true;
+	if (normalized.startsWith("$") || normalized.startsWith("${") || normalized.startsWith("{{")) return true;
+	if (normalized.startsWith("process.env") || normalized.startsWith("env.")) return true;
+	if (/^\*+$/.test(normalized) || /^x+$/.test(normalized)) return true;
+	if (/^your[_-][a-z0-9_-]+$/i.test(normalized)) return true;
+	return SAFE_EXACT_VALUES.has(normalized);
+}
+
+function kindForAssignmentPrefix(prefix: string): SecretKind {
+	const normalized = prefix.toLowerCase();
+	if (normalized.includes("password") || normalized.includes("passwd") || /\bpwd\b/.test(normalized)) return "password";
+	if (normalized.includes("api") && normalized.includes("key")) return "api_key";
+	if (normalized.includes("aws") && normalized.includes("access") && normalized.includes("key")) return "aws_access_key";
+	if (normalized.includes("private") && normalized.includes("key")) return "private_key";
+	return "credential";
+}
+
+function kindForSensitiveKey(key: string): SecretKind | undefined {
+	const normalized = key.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+	if (normalized === "password" || normalized === "passwd" || normalized === "pwd") return "password";
+	if (normalized.includes("private_key")) return "private_key";
+	if (normalized.includes("api_key")) return "api_key";
+	if (normalized === "aws_access_key_id") return "aws_access_key";
+	if (
+		normalized.includes("secret") ||
+		normalized.includes("token") ||
+		normalized === "authorization" ||
+		normalized === "credential" ||
+		normalized === "credentials"
+	) return "credential";
+	return undefined;
+}
+
+function uniqueKinds(kinds: SecretKind[]): SecretKind[] {
+	return [...new Set(kinds)];
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+
+function shouldSkipOpaqueField(parent: Record<string, unknown>, key: string): boolean {
+	if (key === "encrypted_content" || key === "signature") return true;
+	return key === "data" && (parent.type === "image" || parent.type === "input_image" || parent.type === "image_url");
+}
+
+export class SecretRedactor {
+	// Keep only a one-way digest for stable placeholders; never retain plaintext
+	// secret material merely to correlate repeated redactions.
+	private readonly placeholders = new Map<string, string>();
+	private readonly counters = new Map<SecretKind, number>();
+
+	private placeholder(secret: string, kind: SecretKind): string {
+		const fingerprint = createHash("sha256").update(secret).digest("hex");
+		const existing = this.placeholders.get(fingerprint);
+		if (existing) return existing;
+		const next = (this.counters.get(kind) ?? 0) + 1;
+		this.counters.set(kind, next);
+		const placeholder = `<SECRET:${kind}:${next}>`;
+		this.placeholders.set(fingerprint, placeholder);
+		return placeholder;
+	}
+
+	redactString(input: string): SecretRedactionResult<string> {
+		let value = input;
+		let count = 0;
+		const kinds: SecretKind[] = [];
+
+		const replaceSecret = (secret: string, kind: SecretKind): string => {
+			if (shouldSkipCandidate(secret)) return secret;
+			count++;
+			kinds.push(kind);
+			return this.placeholder(secret, kind);
+		};
+
+		SENSITIVE_ASSIGNMENT.lastIndex = 0;
+		value = value.replace(SENSITIVE_ASSIGNMENT, (match, prefix: string, openingQuote: string, secret: string, closingQuote: string) => {
+			if (openingQuote && closingQuote && openingQuote !== closingQuote) return match;
+			const replacement = replaceSecret(secret, kindForAssignmentPrefix(prefix));
+			return `${prefix}${openingQuote}${replacement}${closingQuote}`;
+		});
+
+		BEARER_AUTH.lastIndex = 0;
+		value = value.replace(BEARER_AUTH, (_match, prefix: string, secret: string) => `${prefix}${replaceSecret(secret, "bearer_token")}`);
+
+		BASIC_AUTH.lastIndex = 0;
+		value = value.replace(BASIC_AUTH, (_match, prefix: string, secret: string) => `${prefix}${replaceSecret(secret, "basic_auth")}`);
+
+		URL_PASSWORD.lastIndex = 0;
+		value = value.replace(URL_PASSWORD, (_match, prefix: string, secret: string, suffix: string) => `${prefix}${replaceSecret(secret, "password")}${suffix}`);
+
+		// Exact token formats run last so placeholders introduced by contextual
+		// detectors are never reinterpreted as new secret assignments.
+		for (const { kind, pattern } of EXACT_SECRET_PATTERNS) {
+			pattern.lastIndex = 0;
+			value = value.replace(pattern, (secret) => replaceSecret(secret, kind));
+		}
+
+		return { value, count, kinds: uniqueKinds(kinds) };
+	}
+
+	redact<T>(input: T): SecretRedactionResult<T> {
+		const result = this.redactValue(input);
+		return { value: result.value as T, count: result.count, kinds: uniqueKinds(result.kinds) };
+	}
+
+	private redactValue(input: unknown): SecretRedactionResult {
+		if (typeof input === "string") return this.redactString(input);
+		if (Array.isArray(input)) {
+			let changed = false;
+			let count = 0;
+			const kinds: SecretKind[] = [];
+			const next = input.map((item) => {
+				const result = this.redactValue(item);
+				if (result.value !== item) changed = true;
+				count += result.count;
+				kinds.push(...result.kinds);
+				return result.value;
+			});
+			return { value: changed ? next : input, count, kinds };
+		}
+		if (!isPlainRecord(input)) return { value: input, count: 0, kinds: [] };
+
+		let changed = false;
+		let count = 0;
+		const kinds: SecretKind[] = [];
+		const next: Record<string, unknown> = {};
+		for (const [key, item] of Object.entries(input)) {
+			if (typeof item === "string" && shouldSkipOpaqueField(input, key)) {
+				next[key] = item;
+				continue;
+			}
+			if (typeof item === "string") {
+				const keyKind = kindForSensitiveKey(key);
+				if (keyKind && !shouldSkipCandidate(item)) {
+					const replacement = this.placeholder(item, keyKind);
+					next[key] = replacement;
+					if (replacement !== item) {
+						changed = true;
+						count++;
+						kinds.push(keyKind);
+					}
+					continue;
+				}
+			}
+			const result = this.redactValue(item);
+			next[key] = result.value;
+			if (result.value !== item) changed = true;
+			count += result.count;
+			kinds.push(...result.kinds);
+		}
+		return { value: changed ? next : input, count, kinds };
+	}
+}

package/external/pi-tools-suite/src/default-pi-tools-suite-config.ts

@@ -5,9 +5,22 @@ export const DEFAULT_PI_TOOLS_SUITE_CONFIG_JSONC = String.raw`{
     // "ast-grep",
     // "dcp"
   ],
+  // Secret firewall is deliberately opt-in for now. Flip this to true to enable
+  // high-confidence outbound redaction plus session-history hygiene.
+  "modules": { "credential-firewall": false },
+  "secretFirewall": {
+    "sessionHygiene": true,
+    "notify": true
+  },
   // When true, todo items may carry a per-task thinking level and the todo
   // module will switch/restore Pi's thinking level as in-progress tasks change.
   "todoThinking": true,
+  // Force every todo mutation made under matching models to the configured
+  // thinking level. Supports provider/model or bare-model keys with * / ? globs.
+  // Set an inherited key to null in a later config layer to remove it.
+  "todoThinkingOverrides": {
+    "zai/glm-5.3": "max"
+  },
   // Vision-capable model used by the coding-discipline lookup tool for blind-model
   // screenshot/image questions. Remove or set to null to disable lookup.
   "lookupModel": "openai-codex/gpt-5.4-mini",

package/external/pi-tools-suite/src/index.ts

@@ -26,6 +26,8 @@ export const MODULES: Array<{ name: string; load: () => Promise<ExtensionModule>
 	{ name: "dcp", load: () => import("./dcp/index") },
 	{ name: "prompt-commands", load: () => import("./prompt-commands/index") },
 	{ name: "skill-installer", load: () => import("./skill-installer/index") },
+	// Secret firewall is intentionally opt-in. Keep it after payload-shaping modules.
+	{ name: "credential-firewall", load: () => import("./credential-firewall/index") },
 	// Keep this last: its before_provider_request handler is the final payload
 	// sanitizer after DCP and any other provider-payload modifiers.
 	{ name: "codex-reasoning-fix", load: () => import("./codex-reasoning-fix/index") },

package/external/pi-tools-suite/src/todo/index.ts

@@ -1,5 +1,5 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { loadPiToolsSuiteConfig } from "../config.js";
+import { loadPiToolsSuiteConfig, type TodoThinkingLevel as ConfigTodoThinkingLevel } from "../config.js";
 import { isAgentBusyRaceError } from "../context-usage.js";
 import { autoClearCompletedTodos } from "./state/auto-clear.js";
 import { loadPersistedPlan, syncPersistedPlan } from "./state/persistence.js";
@@ -31,6 +31,7 @@ function isStaleExtensionContextError(error: unknown): boolean {
 
 type ModelLike = {
 	provider?: string;
+	providerId?: string;
 	id?: string;
 	modelId?: string;
 	reasoning?: boolean;
@@ -38,6 +39,51 @@ type ModelLike = {
 	compat?: { thinkingFormat?: unknown };
 };
 
+function escapeRegExp(text: string): string {
+	return text.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+}
+
+function modelPatternMatches(pattern: string, candidate: string): boolean {
+	let source = "^";
+	for (const char of pattern) {
+		if (char === "*") source += ".*";
+		else if (char === "?") source += ".";
+		else source += escapeRegExp(char);
+	}
+	return new RegExp(`${source}$`, "i").test(candidate);
+}
+
+function modelKeys(model: unknown): { bare?: string; full?: string } {
+	const candidate = model as ModelLike | undefined;
+	const provider = candidate?.provider ?? candidate?.providerId;
+	const rawId = candidate?.modelId ?? candidate?.id;
+	if (!rawId) return {};
+	if (rawId.includes("/")) {
+		const slash = rawId.indexOf("/");
+		return { bare: rawId.slice(slash + 1), full: rawId };
+	}
+	return { bare: rawId, ...(provider ? { full: `${provider}/${rawId}` } : {}) };
+}
+
+function resolveTodoThinkingOverride(
+	model: unknown,
+	overrides: Record<string, ConfigTodoThinkingLevel>,
+): TodoThinkingLevel | undefined {
+	const keys = modelKeys(model);
+	let best: { level: TodoThinkingLevel; score: number } | undefined;
+	for (const [rawPattern, level] of Object.entries(overrides)) {
+		const pattern = rawPattern.trim();
+		const isFull = pattern.includes("/");
+		const candidate = isFull ? keys.full : keys.bare;
+		if (!candidate || !modelPatternMatches(pattern, candidate)) continue;
+		const exact = !pattern.includes("*") && !pattern.includes("?");
+		const literalLength = pattern.replace(/[?*]/g, "").length;
+		const score = (isFull ? 30_000 : 10_000) + (exact ? 10_000 : 0) + literalLength;
+		if (!best || score >= best.score) best = { level, score };
+	}
+	return best?.level;
+}
+
 function isTodoThinkingLevel(value: unknown): value is TodoThinkingLevel {
 	return TODO_THINKING_LEVEL_VALUES.includes(value as TodoThinkingLevel);
 }
@@ -167,7 +213,9 @@ function emitPersistedPlanPrompt(pi: ExtensionAPI, ctx: ExtensionContext, prompt
 
 export default function (pi: ExtensionAPI) {
 	let currentModel: unknown;
-	const todoThinkingEnabled = loadPiToolsSuiteConfig(["todo"]).todoThinking;
+	const todoConfig = loadPiToolsSuiteConfig(["todo"]);
+	const todoThinkingEnabled = todoConfig.todoThinking;
+	const todoThinkingOverrides = todoConfig.todoThinkingOverrides;
 	const rememberedThinkingByTaskId = new Map<number, TodoThinkingLevel>();
 	let lastNudgedSignature: string | undefined;
 	let nudgeTimer: ReturnType<typeof setTimeout> | undefined;
@@ -237,7 +285,11 @@ export default function (pi: ExtensionAPI) {
 
 	function prepareTodoThinkingMutation(state: ReturnType<typeof getState>, params: TaskMutationParams): TaskMutationParams {
 		let nextParams = params;
-		if (params.thinking !== undefined) {
+		const configuredOverride = resolveTodoThinkingOverride(currentModel, todoThinkingOverrides);
+		if (configuredOverride !== undefined) {
+			const forced = normalizeTodoThinkingLevelForModel(currentModel, configuredOverride);
+			nextParams = { ...nextParams, thinking: forced };
+		} else if (params.thinking !== undefined) {
 			const normalized = normalizeTodoThinkingLevelForModel(currentModel, params.thinking);
 			if (normalized !== params.thinking) nextParams = { ...nextParams, thinking: normalized };
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-ui-extend",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Pix: a workspace-first terminal UI for Pi with tabs, readable tool activity, voice input, and bundled agent tools.",
   "private": false,
   "repository": {

package/schemas/pi-tools-suite.json

@@ -16,10 +16,67 @@
       },
       "description": "List of disabled module names (e.g. ['lsp', 'prompt-commands'])."
     },
+    "enabledModules": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "List of module names to explicitly enable, including modules that are disabled by default."
+    },
+    "modules": {
+      "type": "object",
+      "patternProperties": {
+        "^.*$": {
+          "type": "boolean"
+        }
+      },
+      "description": "Per-module enable/disable map. credential-firewall is disabled by default and can be enabled here."
+    },
     "todoThinking": {
       "type": "boolean",
       "description": "Enable per-todo thinking levels and automatic thinking switch/restore when tasks become in-progress/completed."
     },
+    "todoThinkingOverrides": {
+      "type": "object",
+      "patternProperties": {
+        "^.*$": {
+          "anyOf": [
+            {
+              "type": "string",
+              "const": "off"
+            },
+            {
+              "type": "string",
+              "const": "minimal"
+            },
+            {
+              "type": "string",
+              "const": "low"
+            },
+            {
+              "type": "string",
+              "const": "medium"
+            },
+            {
+              "type": "string",
+              "const": "high"
+            },
+            {
+              "type": "string",
+              "const": "xhigh"
+            },
+            {
+              "type": "string",
+              "const": "max"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "description": "Force per-todo thinking for matching provider/model or bare-model keys. Keys support * and ? wildcards; null removes an inherited override."
+    },
     "lookupModel": {
       "anyOf": [
         {
@@ -812,6 +869,20 @@
       },
       "description": "User-defined slash commands."
     },
+    "secretFirewall": {
+      "type": "object",
+      "properties": {
+        "sessionHygiene": {
+          "type": "boolean",
+          "description": "Redact detected secret material from tool results and completed messages before it remains in session history."
+        },
+        "notify": {
+          "type": "boolean",
+          "description": "Show a warning when one or more secrets are redacted. Secret values are never included in notifications."
+        }
+      },
+      "description": "Settings for the opt-in credential-firewall module."
+    },
     "lsp": {
       "type": "object",
       "properties": {