shariq-pi-extensions 0.2.22 → 0.2.24

package/README.md

@@ -31,6 +31,7 @@ The package contains:
 - Firecrawl search and scraping
 - Git status UI
 - persistent task goals
+- branch-safe model-maintained task lists with live progress UI and compaction continuity
 - configurable steer, interrupt, or follow-up input behavior
 - dedicated multi-agent orchestration
 - Smart Compaction with high-fidelity checkpointing, delta-merging, and custom model routing

package/docs/ARCHITECTURE.md

@@ -43,6 +43,7 @@ Installed package directories are treated as immutable. Extensions resolve writa
 - Pi Memory state: `<agent-dir>/pi-memory/`
 - Subagent configuration and catalog: paths derived from `getAgentDir()`
 - Orchestration settings and run ledgers: `<agent-dir>/orchestration/`
+- Goal and Task List state: branch-local Pi session entries; neither writes a separate runtime-state file
 - project configuration: paths derived from Pi's `CONFIG_DIR_NAME`
 
 Credentials remain in Pi auth storage, environment variables, service credential stores, or ignored machine-local files. Package source never contains an API key, OAuth token, database, cache, or session.

package/docs/EXTENSIONS.md

@@ -34,6 +34,12 @@ The curated catalog intentionally excludes `-fast` variants and the removals doc
 
 The goal extension adds persistent, branch-safe objectives, progress evidence, budgets, pause/resume controls, and strict completion/blocker gates. Use `/goal` for the operator UI and the `create_goal`, `get_goal`, `update_goal_progress`, and `update_goal` tools for agent-controlled state.
 
+### [Task List](../extensions/task-list/README.md)
+
+`task_list` gives the active model a branch-safe ordered checklist for ordinary multi-step work; it is separate from persistent Goals and may be used alongside them. Writes replace the full list, retain stable IDs, support pending/in-progress/completed/blocked/cancelled states and priorities, and require an active item while pending work remains. The prompt contract requires same-message list/action calls and verified updates only at task-level transitions—not after routine file reads, edits, commands, or other tool calls. A runtime reminder catches multi-action work that starts without a list; final reconciliation catches unfinished bookkeeping.
+
+State is stored in Pi session entries and reconstructed on resume, reload, and tree navigation. Active work is re-injected when compaction removes the latest snapshot from model context. `/tasks` opens the interactive dashboard and direct editor; the compact live widget auto-hides after all work finishes. Subagents receive the same tool under every capability policy, but each child maintains its own session-local list rather than changing the parent's list.
+
 ### [Subagents](../extensions/subagents/README.md)
 
 The subagent extension runs flat Pi child agents with profiles, capability policies, continuation, result delivery, optional worktrees, pre-warmed task dispatch, instant cascading cancellation, cross-session persistence, and a dashboard. Configuration lives in `<agent-dir>/subagents.json`; trusted projects may override it through their Pi config directory. The configured concurrency ceiling is 50.

package/extensions/antigravity-provider/README.md

@@ -10,7 +10,7 @@ Local persistent Pi provider for Google Antigravity-compatible models.
 
 The provider includes an IPv4 OAuth token-exchange fallback for Node environments where the default request fails. Its curated catalog follows current Antigravity model identifiers and runtime behavior.
 
-Successful logins are added to `<agent-dir>/antigravity/accounts.json`, written with owner-only permissions. Existing Pi OAuth credentials are migrated into that pool without exposing token values. Requests select the least recently used eligible account, skip disabled/cooling/exhausted accounts, refresh expiring OAuth tokens, and rotate to another account when an auth, rate, quota, or capacity failure occurs before response streaming begins. Cached per-model remaining quota and reset times guide selection; `/antigravity` refreshes the authoritative catalog and can reversibly enable or disable accounts.
+Successful logins are added to `<agent-dir>/antigravity/accounts.json`, written with owner-only permissions. A missing account file triggers one-time migration of an existing Pi OAuth credential; after that, the valid account file is authoritative, so removing an account cannot be undone by a stale credential in `auth.json`. Requests select the least recently used eligible account, skip disabled/cooling/exhausted accounts, refresh expiring OAuth tokens, and rotate to another account when an auth, rate, quota, or capacity failure occurs before response streaming begins. Cached per-model remaining quota and reset times guide selection; `/antigravity` refreshes the authoritative catalog, uses `d` to reversibly enable or disable an account, and uses `x` plus confirmation to remove one permanently.
 
 Current public model IDs:
 - `antigravity/gemini-3.7-flash`

package/extensions/antigravity-provider/antigravity/accounts.ts

@@ -48,6 +48,22 @@ interface AntigravityAccountFile {
   accounts: AntigravityAccount[];
 }
 
+export type AntigravityAccountStore = {
+  status: "missing" | "invalid" | "valid";
+  accounts: AntigravityAccount[];
+};
+
+export type AntigravityStoredCredential = Pick<OAuthCredentials, "refresh" | "access" | "expires"> & {
+  projectId?: string;
+  email?: string;
+};
+
+export type AntigravityCredentialReconciliation =
+  | { action: "none" }
+  | { action: "migrate"; credentials: AntigravityStoredCredential }
+  | { action: "replace"; account: AntigravityAccount }
+  | { action: "delete" };
+
 export interface AntigravityAccountStatus extends AntigravityAccount {
   active: boolean;
 }
@@ -105,17 +121,40 @@ function normalizeAccount(value: unknown): AntigravityAccount | undefined {
   };
 }
 
-export function loadAntigravityAccounts(): AntigravityAccount[] {
+export function inspectAntigravityAccountStore(): AntigravityAccountStore {
   try {
     const parsed = JSON.parse(fs.readFileSync(ANTIGRAVITY_ACCOUNTS_PATH, "utf8")) as Partial<AntigravityAccountFile>;
-    return Array.isArray(parsed.accounts)
-      ? parsed.accounts.map(normalizeAccount).filter((account): account is AntigravityAccount => Boolean(account))
-      : [];
-  } catch {
-    return [];
+    if (!Array.isArray(parsed.accounts)) return { status: "invalid", accounts: [] };
+    return {
+      status: "valid",
+      accounts: parsed.accounts.map(normalizeAccount).filter((account): account is AntigravityAccount => Boolean(account)),
+    };
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? (error as { code?: unknown }).code : undefined;
+    return { status: code === "ENOENT" ? "missing" : "invalid", accounts: [] };
   }
 }
 
+export function loadAntigravityAccounts(): AntigravityAccount[] {
+  return inspectAntigravityAccountStore().accounts;
+}
+
+function matchesStoredCredential(account: AntigravityAccount, credentials: AntigravityStoredCredential) {
+  return account.refresh === credentials.refresh || Boolean(account.email && credentials.email && account.email === credentials.email);
+}
+
+export function reconcileAntigravityStoredCredential(
+  store: AntigravityAccountStore,
+  credentials: AntigravityStoredCredential | undefined,
+): AntigravityCredentialReconciliation {
+  if (store.status === "invalid") return { action: "none" };
+  if (store.status === "missing") return credentials ? { action: "migrate", credentials } : { action: "none" };
+  if (credentials && store.accounts.some((account) => matchesStoredCredential(account, credentials))) return { action: "none" };
+  const replacement = store.accounts.find((account) => !account.disabled) ?? store.accounts[0];
+  if (replacement) return { action: "replace", account: replacement };
+  return credentials ? { action: "delete" } : { action: "none" };
+}
+
 function saveAntigravityAccounts(accounts: AntigravityAccount[]) {
   fs.mkdirSync(ANTIGRAVITY_STATE_DIR, { recursive: true, mode: 0o700 });
   fs.chmodSync(ANTIGRAVITY_STATE_DIR, 0o700);

package/extensions/antigravity-provider/antigravity/dashboard.ts

@@ -78,6 +78,7 @@ export class AntigravityDashboard implements Component {
   private snapshot: AntigravityDashboardSnapshot;
   private readonly refreshData: (force: boolean) => Promise<AntigravityDashboardSnapshot>;
   private readonly toggleAccount: (id: string, enabled: boolean) => Promise<AntigravityDashboardSnapshot>;
+  private readonly removeAccount: (id: string, label: string) => Promise<AntigravityDashboardSnapshot>;
   private readonly done: () => void;
 
   constructor(
@@ -87,6 +88,7 @@ export class AntigravityDashboard implements Component {
     snapshot: AntigravityDashboardSnapshot,
     refreshData: (force: boolean) => Promise<AntigravityDashboardSnapshot>,
     toggleAccount: (id: string, enabled: boolean) => Promise<AntigravityDashboardSnapshot>,
+    removeAccount: (id: string, label: string) => Promise<AntigravityDashboardSnapshot>,
     done: () => void,
   ) {
     this.tui = tui;
@@ -95,6 +97,7 @@ export class AntigravityDashboard implements Component {
     this.snapshot = snapshot;
     this.refreshData = refreshData;
     this.toggleAccount = toggleAccount;
+    this.removeAccount = removeAccount;
     this.done = done;
   }
 
@@ -139,10 +142,13 @@ export class AntigravityDashboard implements Component {
       if (accounts.length) this.selected = (this.selected + 1) % accounts.length;
     } else if (data === "r") {
       this.startRefresh(true);
-    } else if (data === "d" && accounts[this.selected] && !this.refreshing) {
+    } else if ((data === "d" || data === "x") && accounts[this.selected] && !this.refreshing) {
       const account = accounts[this.selected]!;
       this.refreshing = true;
-      void this.toggleAccount(account.id, account.disabled === true)
+      const action = data === "x"
+        ? this.removeAccount(account.id, account.email || `account-${account.id.slice(0, 6)}`)
+        : this.toggleAccount(account.id, account.disabled === true);
+      void action
         .then((snapshot) => this.replaceSnapshot(snapshot))
         .catch((error) => {
           if (!this.closed) this.snapshot = { ...this.snapshot, warning: error instanceof Error ? error.message : String(error) };
@@ -188,7 +194,7 @@ export class AntigravityDashboard implements Component {
       for (let row = 0; row < bodyHeight; row++) lines.push(this.theme.fg("border", "│") + padLine(list[row] ?? "", inner) + this.theme.fg("border", "│"));
     }
     lines.push(frameBottom(this.theme, width));
-    lines.push(truncateToWidth(`${this.theme.fg("accent", "  ↑↓ / j k")} ${this.theme.fg("dim", "select")}  ${this.theme.fg("accent", "r")} ${this.theme.fg("dim", "refresh")}  ${this.theme.fg("accent", "d")} ${this.theme.fg("dim", "enable/disable")}  ${this.theme.fg("accent", "esc")} ${this.theme.fg("dim", "close")}`, width, ""));
+    lines.push(truncateToWidth(`${this.theme.fg("accent", "  ↑↓ / j k")} ${this.theme.fg("dim", "select")}  ${this.theme.fg("accent", "r")} ${this.theme.fg("dim", "refresh")}  ${this.theme.fg("accent", "d")} ${this.theme.fg("dim", "enable/disable")}  ${this.theme.fg("accent", "x")} ${this.theme.fg("dim", "remove")}  ${this.theme.fg("accent", "esc")} ${this.theme.fg("dim", "close")}`, width, ""));
     return lines.map((line) => truncateToWidth(line, width, ""));
   }
 
@@ -250,10 +256,11 @@ export async function openAntigravityDashboard(
   initial: AntigravityDashboardSnapshot,
   refresh: (force: boolean) => Promise<AntigravityDashboardSnapshot>,
   toggle: (id: string, enabled: boolean) => Promise<AntigravityDashboardSnapshot>,
+  remove: (id: string, label: string) => Promise<AntigravityDashboardSnapshot>,
 ) {
   await ctx.ui.custom<void>(
     (tui, theme, keys, done) => {
-      const dashboard = new AntigravityDashboard(tui, theme, keys, initial, refresh, toggle, () => done(undefined));
+      const dashboard = new AntigravityDashboard(tui, theme, keys, initial, refresh, toggle, remove, () => done(undefined));
       queueMicrotask(() => dashboard.startRefresh(false));
       return dashboard;
     },

package/extensions/antigravity-provider/antigravity/index.ts

@@ -24,8 +24,12 @@ import {
 import { streamAntigravity } from "./cloud-code-assist.ts";
 import {
 	antigravityAccountStatuses,
+	inspectAntigravityAccountStore,
+	reconcileAntigravityStoredCredential,
+	removeAntigravityAccount,
 	setAntigravityAccountEnabled,
 	upsertAntigravityAccount,
+	type AntigravityStoredCredential,
 } from "./accounts.ts";
 import { refreshAntigravityQuotas } from "./quotas.ts";
 import {
@@ -43,19 +47,43 @@ export default function antigravityProviderExtension(pi: ExtensionAPI) {
 		};
 	};
 
-	const migrateStoredCredential = () => {
+	const readOAuthCredential = (): AntigravityStoredCredential | undefined => {
+		const credential = readStoredCredential(PROVIDER_ID) as any;
+		if (credential?.type !== "oauth" || typeof credential.refresh !== "string" || typeof credential.access !== "string") return undefined;
+		return {
+			refresh: credential.refresh,
+			access: credential.access,
+			expires: typeof credential.expires === "number" ? credential.expires : 0,
+			projectId: typeof credential.projectId === "string" ? credential.projectId : undefined,
+			email: typeof credential.email === "string" ? credential.email : undefined,
+		};
+	};
+
+	const reconcileStoredCredential = async (ctx?: ExtensionContext) => {
 		try {
-			const credential = readStoredCredential(PROVIDER_ID) as any;
-			if (credential?.type !== "oauth" || typeof credential.refresh !== "string" || typeof credential.access !== "string") return;
-			upsertAntigravityAccount({
-				refresh: credential.refresh,
-				access: credential.access,
-				expires: typeof credential.expires === "number" ? credential.expires : 0,
-				projectId: typeof credential.projectId === "string" ? credential.projectId : undefined,
-				email: typeof credential.email === "string" ? credential.email : undefined,
-			});
+			const credentials = readOAuthCredential();
+			const reconciliation = reconcileAntigravityStoredCredential(inspectAntigravityAccountStore(), credentials);
+			if (reconciliation.action === "migrate") {
+				upsertAntigravityAccount(reconciliation.credentials);
+				return;
+			}
+			const authStorage = (ctx?.modelRegistry as any)?.authStorage;
+			if (!authStorage) return;
+			if (reconciliation.action === "replace") {
+				const account = reconciliation.account;
+				await authStorage.modify(PROVIDER_ID, async () => ({
+					type: "oauth",
+					refresh: account.refresh,
+					access: account.access,
+					expires: account.expires,
+					projectId: account.projectId,
+					email: account.email,
+				}));
+			} else if (reconciliation.action === "delete") {
+				await authStorage.delete(PROVIDER_ID);
+			}
 		} catch {
-			// A malformed or unavailable Pi credential must not block extension startup.
+			// Malformed or unavailable credential state must not block extension startup.
 		}
 	};
 
@@ -67,9 +95,9 @@ export default function antigravityProviderExtension(pi: ExtensionAPI) {
 		oauth: {
 			name: PROVIDER_NAME,
 			login: ((callbacks: Parameters<typeof loginAntigravity>[0]) => {
-				// Pi replaces its single stored provider credential after login. Archive
-				// the current account first so signing into another account cannot lose it.
-				migrateStoredCredential();
+				// A missing account store is a legacy installation, so archive Pi's single
+				// credential before login. A valid store remains authoritative after edits.
+				void reconcileStoredCredential();
 				return loginAntigravity(callbacks);
 			}) as any,
 			refreshToken: refreshAntigravityToken as any,
@@ -78,9 +106,9 @@ export default function antigravityProviderExtension(pi: ExtensionAPI) {
 		streamSimple: streamAntigravity,
 	} as any);
 
-	pi.on("session_start", (_event, ctx) => {
+	pi.on("session_start", async (_event, ctx) => {
 		(ctx.modelRegistry as any).authStorage?.reload?.();
-		migrateStoredCredential();
+		await reconcileStoredCredential(ctx);
 		void refreshAntigravityQuotas({ signal: ctx.signal }).catch(() => {
 			// Cached quota state remains available; /antigravity reports refresh failures.
 		});
@@ -94,7 +122,7 @@ export default function antigravityProviderExtension(pi: ExtensionAPI) {
 	pi.registerCommand("antigravity", {
 		description: "Open Antigravity accounts, rotation, and quota dashboard",
 		handler: async (_args, ctx) => {
-			migrateStoredCredential();
+			await reconcileStoredCredential(ctx);
 			await openAntigravityDashboard(
 				ctx,
 				dashboardSnapshot(ctx),
@@ -107,6 +135,13 @@ export default function antigravityProviderExtension(pi: ExtensionAPI) {
 					if (enabled) await refreshAntigravityQuotas({ force: true, signal: ctx.signal });
 					return dashboardSnapshot(ctx);
 				},
+				async (id, label) => {
+					const confirmed = await ctx.ui.confirm("Remove Antigravity account?", `Permanently remove ${label} from this Pi installation?`);
+					if (!confirmed) return dashboardSnapshot(ctx);
+					removeAntigravityAccount(id);
+					await reconcileStoredCredential(ctx);
+					return dashboardSnapshot(ctx);
+				},
 			);
 		},
 	});

package/extensions/subagents/README.md

@@ -42,7 +42,7 @@ Capability modes:
 - `execute` — the read-only allowlist plus shell and background-terminal execution, without direct file edit tools
 - `all` — full child tool access
 
-Restrictive modes fail closed: newly registered extension tools remain unavailable until they are explicitly classified. This prevents another extension from silently bypassing the selected capability.
+Restrictive modes fail closed: newly registered extension tools remain unavailable until they are explicitly classified. This prevents another extension from silently bypassing the selected capability. The session-only `task_list` planning tool is explicitly classified as safe in every capability mode, so each child can maintain its own task list without receiving file-write or command-execution authority.
 
 Optional user profiles and personas can be defined in `~/.pi/agent/subagents.json`. Trusted projects may override them in `.pi/subagents.json`:
 
@@ -64,7 +64,7 @@ Optional user profiles and personas can be defined in `~/.pi/agent/subagents.jso
 }
 ```
 
-Project configuration is ignored when the project is not trusted. Concurrency is bounded to 1–50; this private package defaults to 50. `/subagents profiles` provides discovery, while `/subagents config` opens a validated editor for global or trusted-project configuration.
+Project configuration is ignored when the project is not trusted. Concurrency is bounded to 1–50; this suite defaults to 50. `/subagents profiles` provides discovery, while `/subagents config` opens a validated editor for global or trusted-project configuration.
 
 ## Context and continuation
 

package/extensions/subagents/src/backends/pi.ts

@@ -65,6 +65,7 @@ const READ_CAPABILITY_TOOLS = new Set([
   "pi_memory_read",
   "pi_memory_status",
   "get_goal",
+  "task_list",
   "read_terminal",
   "list_terminals",
   "message_parent",

package/extensions/task-list/README.md

@@ -0,0 +1,107 @@
+# Pi Task List
+
+A branch-safe task list for ordinary multi-step work. The active model creates and maintains the list while it works; there is no background planner or separate task-list agent.
+
+This extension is independent of the Goal extension. A normal task can use Task List without becoming a persistent goal, and an explicitly created goal can use its own evidence ledger and Task List at the same time.
+
+## Model tool
+
+`task_list` reads or replaces the current session list:
+
+- omit `tasks` to read the current list;
+- supply `tasks` to replace the entire ordered list;
+- send stable IDs so progress survives revisions;
+- use `explanation` when scope, order, or approach changes.
+
+Each item has:
+
+- `id` — stable letters/numbers/dots/underscores/hyphens identifier;
+- `content` — a concrete outcome, including exact user-provided commands or literals when relevant;
+- `status` — `pending`, `in_progress`, `completed`, `blocked`, or `cancelled`;
+- `priority` — `high`, `medium`, or `low` (`medium` by default);
+- `note` — optional evidence, blocker, cancellation reason, or execution detail.
+
+A list may contain up to 64 items. A model write with pending work must keep at least one item `in_progress`. Sequential work should have one active item; several are allowed only when work is genuinely running in parallel.
+
+## Update discipline
+
+The tool definition and Pi prompt guidance explicitly require the model to:
+
+1. create a list for requests with at least three distinct actions, multiple requested tasks, or meaningful phases;
+2. skip the list for direct answers and one- or two-action work;
+3. send the initial list in the same assistant message as the first real action;
+4. update the list as each step changes instead of batching bookkeeping at the end;
+5. mark work complete only after its outcome is verified;
+6. preserve every user-requested item and exact command, flag, path, and success condition;
+7. reconcile the full list before the final response.
+
+The runtime reinforces these instructions without assigning the list to another worker:
+
+- after two substantive tool calls with no list, the next model context receives a conditional reminder;
+- routine file reads, edits, commands, and tool calls do not trigger bookkeeping updates while the current task remains active;
+- the model updates only for task-level transitions: verified completion and handoff to the next task, genuine blockers or cancellations, user-requested scope changes, and final reconciliation;
+- status-only inspection tools do not count as substantive progress.
+
+The list remains a coordination aid, not evidence that implementation or verification succeeded.
+
+## Continuity
+
+Every update stores a complete immutable snapshot in Pi custom session entries. State is reconstructed from the active branch on startup, resume, reload, and tree navigation, so branching restores the list that belonged to that point in history.
+
+Active items are injected into model context only when the current snapshot is no longer represented there, including after compaction. Completed and cancelled work is summarized by count in that continuity message so the model does not redo it.
+
+No external task database or writable package file is used.
+
+## Subagents
+
+Pi subagents load this extension with their normal child resources. `task_list` is explicitly allowed under every child capability policy because it changes only the child session's planning state. Each child owns an independent list in its own persistent Pi session; a child does not mutate the parent model's list.
+
+## User interface
+
+Run:
+
+```text
+/tasks
+```
+
+While work is active, a compact widget above the editor shows progress and the current items. A finished list lingers for four seconds so the final checkmark is visible, then clears from the live chrome while remaining available in session history.
+
+`/tasks` opens the full-width interactive dashboard:
+
+- `↑`/`↓` or `j`/`k` — select an item;
+- `space` — advance pending → in progress → completed;
+- `b` — block/unblock;
+- `c` — cancel/restore;
+- `p` — cycle priority;
+- `a` — add;
+- `e` — edit;
+- `d` — delete with confirmation;
+- `h` — hide/show completed and cancelled items;
+- `X` — clear the list with confirmation;
+- `Esc` or `q` — close.
+
+User edits automatically promote the next pending item when no task remains in progress. `/tasks clear` provides the same guarded clear action without opening the dashboard. In print, JSON, or RPC-oriented use, the tool remains fully functional and `/tasks status` falls back to a text summary where a custom terminal dashboard is unavailable.
+
+## Design inputs
+
+The implementation combines the strongest verified patterns from the compared harnesses:
+
+- Pi's branch-aware tool-result/session-entry model and custom TUI surfaces;
+- Codex's concise ordered plan, optional update explanation, and timely status transitions;
+- OpenCode's whole-list replacement and persistent session projection;
+- Grok Build's compact live panel, cancelled state, compaction continuity, and stale-list reminders;
+- DeepSeek Harness's strict input validation, parallel-active policy, and dedicated composer panel;
+- Hermes Agent's stable IDs, read-or-write tool, merge-informed state model, four-state UI, and post-compaction active-list injection;
+- Factory Droid's same-message task/action rule, three-action threshold, real-time completion discipline, stale-plan warning, and compact TodoWrite presentation.
+
+OpenClaw's inspected task/update surfaces do not provide a comparable model-maintained coding-session todo tool, so no incompatible lifecycle was copied from them.
+
+## Validation
+
+From the repository root:
+
+```bash
+bun test extensions/task-list extensions/subagents/context-config.test.ts
+bun x tsc --noEmit
+npm run validate
+```