specpi 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.15.0 - 2026-09-05
+
+- Add **SpecPi Chat 0.3.1**, a separately packaged VS Code sidebar with streamed Pi replies, safe Markdown, expanded thinking and collapsed tool output by default, model/thinking controls, exact approvals, and a compact composer. It reuses the user's Pi configuration without managing credentials or installing the harness.
+- Add searchable extension-owned history, rename and reversible archive, and independent live conversations. Switching chats or folders preserves background work, approvals, drafts, attachments, usage, and view position. Stop/Disconnect target the selected conversation; parallel chats share workspace files rather than isolated worktrees.
+- Add validated file/image attachment, screenshot paste/drop, bounded inline images, workspace code links and image previews, explicit queued-image recovery, visible transcript search/copy/export, usage/cost reporting, and native Git diff review. Branching and earlier-prompt editing preserve the source conversation and never undo code files or automatically send restored drafts.
+- Start Command Guard in Guard mode in RPC without an unreadable startup selector; retain explicit `/guard` choices after readiness. Route task handoffs, challenge reports, and wishlist reports through RPC-capable dialogs, and disclose terminal-only display controls.
+- Wait for legacy Pi startup fallbacks without approving early dialogs. Reset interrupted-run state on reconnect and never restore accepted prompts after a later refresh failure.
+- Show installed Codex Usage and pi-usage (including Anthropic) reports in Chat's compact, expandable Limits row, separate from conversation tokens/cost. Reuse bounded Pi status events without provider queries, credential/cache reads, or changes to the default package list.
+- Scope Chat's Pi-state filename restrictions to Pi/Chat storage so ordinary authentication, session, and history source files remain usable; retain global credential/key protection and canonical-path checks.
+- Fix composer `/model` selection, read-only usage during active work, and stale Stop cleanup errors after reconnect. Align README and Pages installation examples with the separately versioned Chat artifact.
+- Add dependency-free local VSIX packaging, isolated real-Pi and native VS Code tests, rendered Chat checks in CI, and editor-extension syntax/source-inventory coverage. No npm/Marketplace publication or automatic editor installation is included.
+
+## 0.14.0 - 2026-09-05
+
+- Raise delegation's default job timeout from 2 to 10 minutes, including the provider adapter. Add `/delegate timeout <minutes>` (1–60) and `reset` with an atomic, backed-up preference across restarts. Batch timeouts scale with the job window; call quotas, original follow-up deadlines and settling ownership remain unchanged. Restart Pi after updating the delegation runtime.
+- Support platform aliases in the selected Pi agent-directory path while rejecting links inside preference state. Bound encoded backups separately so every accepted settings file can be saved repeatedly.
+- Keep `.mts` declarations on LF checkouts and validate Pages permissions with either LF or CRLF input so release checks remain portable on Windows.
+- Run timeout persistence fixtures across release platforms, isolate the package help probe, and verify that settings survive failed updates and every managed delegation file is removed on uninstall.
+
 ## 0.13.0 - 2026-09-05
 
 - Add bounded, best-effort sanitized browser exceptions, console errors, failed requests, and HTTP error diagnostics with explicit cursor/loss/clear semantics and ephemeral retention.

package/NPM_RELEASE.md

@@ -22,6 +22,8 @@ Verify the registry bytes and metadata immediately, then configure trusted publi
 
 1. Select a version that has never appeared on npm. npm versions are immutable.
 2. Update `package.json`, `CHANGELOG.md`, `README.md`, `site/index.html`, `site/wiki/index.html`, `site/single-agent/index.html`, and the delegation guide to the same version. Keep historical changelog entries intact and remove stale unreleased-status wording.
+   If Chat changes are included, increment its independent version in `vscode/package.json` and `vscode/CHANGELOG.md`, and align the VSIX filenames and feature descriptions in the root README, extension README, and Pages guides. Build it with `npm --prefix vscode run package`, run `npm --prefix vscode run test:render` and the isolated `npm --prefix vscode run test:vsix`, and inspect the VSIX allowlist. The editor extension is not part of the npm tarball; creating this local artifact does not publish it or authorize a Marketplace release.
+
 3. For a stable release, add a dated changelog heading. Use a prerelease version when the package should not receive the `latest` dist-tag.
 4. Install the pinned development tools without lifecycle scripts or peers:
 

package/README.md

@@ -24,7 +24,13 @@ SpecPi adds task contracts, workflow controls, and a local improvement loop to P
 
 Collection is disabled until explicitly enabled. Reports are sanitized, bounded, deduplicated by task, and never uploaded. Later evidence can reopen an item for review, but never restarts implementation automatically.
 
-Version `0.13.0` adds browser diagnostics, keyboard and native dropdown interactions, bounded condition waits, scoped TypeScript checking, and repeatable rendered-site tests. Experimental delegation, task cards, verification receipts and human outcome assessments remain part of the single-agent workflow. See the [release notes](CHANGELOG.md) for the change list.
+Version `0.15.0` adds the separately packaged SpecPi Chat sidebar and RPC-compatible Guard startup and report dialogs. The terminal harness, optional read-only delegation, browser checks, and human-selected improvement workflow remain available. See the [release notes](CHANGELOG.md) for the change list.
+
+## SpecPi Chat for VS Code
+
+The `vscode/` source contains **SpecPi Chat 0.3.1**, a separately packaged native sidebar with streamed replies, tool results, file and image attachments, model/thinking controls, Pi approvals, and searchable workspace conversation history. Rename or archive chats, switch between independent live conversations, branch or edit an earlier prompt, search and export visible messages, inspect usage, and review changes through VS Code's native diff tools. Switching chats preserves background work, approvals, drafts, and attachments. Connected conversations share workspace files; use separate worktrees for isolated writers. Opening the sidebar does not start Pi.
+
+From a repository checkout, build a local VSIX with `npm --prefix vscode run package`, then install `.specpi-test/vscode/specpi-chat-0.3.1.vsix` through **Extensions: Install from VSIX…**. See the [extension guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) for prerequisites, image/provider limits, commands, privacy, and testing. Pi owns provider authentication and tool execution. Stop and Disconnect affect the selected conversation only; branching does not undo code changes. The extension is separate from the SpecPi npm package and has not been published to a marketplace.
 
 ## Optional delegation
 
@@ -55,14 +61,14 @@ specpi doctor
 Pin the reusable CLI when installing a reviewed release, or inspect its plan without retaining a global CLI installation:
 
 ```bash
-npm install --global specpi@0.13.0
-npx --package specpi@0.13.0 specpi plan
+npm install --global specpi@0.15.0
+npx --package specpi@0.15.0 specpi plan
 ```
 
 For a source-audited installation, clone the exact release:
 
 ```bash
-git clone --branch v0.13.0 --depth 1 https://github.com/TannerMidd/SpecPi.git
+git clone --branch v0.15.0 --depth 1 https://github.com/TannerMidd/SpecPi.git
 cd SpecPi
 ./specpi plan
 ./specpi install
@@ -167,7 +173,7 @@ Use `/task clear` before recording an unrelated task. Within a session, repeated
 
 Use `/experiment start` when an independent review or trial justifies a separate worktree. Open the reported path in another Pi session. SpecPi does not launch an agent, copy dirty base changes, commit, merge, or touch remotes.
 
-SpecPi keeps one writer per working directory. Its experimental delegation adds bounded read-only Pi sessions. A parent determines what context a child receives and verifies what returns, so either handoff can omit a material constraint. Parallel writers also introduce conflicting assumptions and increase review work.
+SpecPi's default workflow uses one writer per working directory. Its experimental delegation adds bounded read-only Pi sessions. SpecPi Chat also supports independent conversations that you start explicitly; connected chats can continue concurrently in the same workspace. They share workspace files rather than receiving separate worktrees. A parent determines what context a delegated child receives and verifies what returns, so either handoff can omit a material constraint. Parallel writers also introduce conflicting assumptions and increase review work.
 
 ## Improvement loop
 

package/SECURITY_MODEL.md

@@ -30,6 +30,10 @@ Incremental stream checks count recognized delta bytes and bound event structure
 
 The same controller and bounded idempotency journal remain in memory for the Pi process lifetime, including `/reload`, session switches and off/on. Successful spending and final-disposition receipts are retained (at most 20 under the fixed ceilings); cancellation and nonfinal assessments have a separate 128-entry oldest-first cache. Failures reserve no keys. Cache churn cannot evict spending receipts, reset quotas or disable cancellation. Limits are two active workers, four batches and 32 SDK invocations per process; two jobs and 8 invocations per batch; four invocations per logical job including follow-up. Invalidation does not reset these counters or release settling work. Completed reports retain their source bindings after the deadline, but child sessions are released at the deadline and later follow-up is rejected. These numeric limits are engineering choices, not empirical optima.
 
+Logical jobs default to 10 minutes and batches to 20 minutes. Human `/delegate timeout <minutes>` persists a whole-minute value from 1–60 while delegation is off; the batch window is twice the job window. Queue and follow-up time count from admission. SDK request timeouts and adapter abort timers use the remaining job window, with a 60-minute ceiling. Changes revoke old policy bindings, never extend old jobs or reset quotas/settling slots, and are absent from the model-facing schema. The effective time policy is included in Guard fingerprints and packet digests. Longer windows also allow longer in-memory input/child retention; they do not add calls, retries or billing guarantees.
+
+Only the numeric timeout preference is persisted under `<agent-dir>/specpi/delegation/settings.json`; its previous content and SHA-256 are backed up in `settings.json.bak`. The human-selected agent directory is canonicalized once, including platform aliases; owned SpecPi subdirectories and preference files still reject links. Reads reject malformed/nonregular settings and are bounded to 4 KiB; the encoded backup has a separate 32 KiB bound. Saves use exclusive staging and atomic promotion. Invalid settings block activation. This store does not read Pi authentication, settings or sessions. The process loads it once; manual or other-process edits require restart, and concurrent saves are last-writer-wins. As with snapshots, this is a trusted-local-filesystem contract, not protection against hostile filesystem races. User-owned preferences survive uninstall. Requested file/directory modes are 0600/0700; Windows relies on profile ACLs.
+
 Shared snapshot text is destroyed once no job can continue; failed attempts retain original expiry cleanup. Packet/job-input references are dropped after owned workers settle. Metadata and digests remain for completed receipt freshness. Starting the next accepted batch retires previous reports; invalidation retires old generations after settlement. Retired batch objects are pruned, leaving only bounded state summaries and idempotency/usage counters. Replay cannot restore their reports, inputs, sessions or allowances. JavaScript strings, provider buffers and values already returned to Pi cannot be securely erased.
 
 Selected context reaches the configured provider; normal parent tool results may be retained by Pi. Child sessions use memory only, with no child session database, raw metrics journal, credential copy, automatic resume or policy learning, or secure memory-erasure guarantee. See the [implemented protocol](docs/delegation/protocol.md) for states and receipts. SDK integration and synthetic-provider fixtures concern the runtime contract; their existence does not establish full parent inference parity or measured outcome gains.
@@ -152,6 +156,32 @@ The GitHub Pages workflow publishes the checked-in `site/` directory. Its deploy
 
 Repository checks, smoke tests, checksums, closed capability validators, and browser comparisons provide evidence for documented behavior. They reduce regression risk but do not prove the absence of vulnerabilities or establish cryptographic provenance for dependencies and releases.
 
+## SpecPi Chat editor integration
+
+The optional `vscode/` extension is distributed separately from the SpecPi npm installation. It runs in the VS Code workspace extension host and requires a trusted filesystem workspace before launching Pi or collecting file context. Only application-level settings choose executable paths; the launcher resolves native executables or known adjacent Pi JavaScript entry points and never executes a shell command string. Pi runs in the explicitly selected workspace with its normal installed extensions and provider configuration. VS Code trust does not replace Pi project trust, and the extension does not pass a flag to bypass Pi's trust decisions or Command Guard.
+
+The sidebar uses Pi's documented JSONL RPC protocol. Pi owns provider authentication and tool execution; the extension does not read, copy, or manage authentication files. RPC model metadata is projected to display fields. Approvals and selection/input/editor requests are displayed as text and require an exact response for the requesting conversation's active request. Switching the displayed conversation preserves outstanding requests; background requests appear as needing input and never receive automatic approval. Stop, disconnect, runtime session transitions, and expiry cancel the affected conversation's requests. Expired or wrong-conversation responses cannot authorize later requests. In RPC, Command Guard starts in Guard mode without an initial selection dialog because Pi cannot read dialog responses until its startup handlers return; explicit `/guard` commands remain available after startup. Unsupported terminal-only components are disclosed rather than treated as functional editor controls.
+
+Chat allows up to 90 seconds for an initial read-only RPC readiness probe before sending normal requests. This accommodates the 30-second startup fallback in older installed Guard versions without extending later request deadlines. Dialogs arriving before readiness receive cancellation only, never an approval or mode selection; the sidebar explains the limitation and retains a notice after connection. An extension with an unbounded startup dialog can still prevent readiness. Chat times out with recovery guidance instead of bypassing that extension or changing the user's installed harness.
+
+The webview loads only packaged scripts/styles under a strict content security policy, forbids network resources, and renders model/tool/file text without interpreting embedded HTML. Images use validated data URLs under `img-src data:`; remote image URLs are never fetched by the webview. HTTP(S) links, including external image links, require a human click and pass through VS Code's external-link API. Clicked code references use a separate host action: paths are parsed, checked against the selected workspace, canonicalized, and restricted to regular non-sensitive files before VS Code opens the file and reveals a clamped line/range. Clicked workspace Markdown image references use the same path boundary and the image validator before a preview is returned. Arbitrary command and URI handlers are not executed. Raw paths preserve literal percent signs; Markdown link destinations and explicit local file URLs are decoded once before filesystem validation.
+
+Text/code context requires an explicit file/selection action, is size-bounded, rejects binary and known sensitive paths, and checks canonical workspace containment. Workspace file suggestions enumerate a bounded set of names; choosing a suggestion invokes the same attachment validation before reading contents. Dropped workspace URIs are validated independently of their browser representation. Native image selection, clipboard images, and dropped image files are explicit attachment actions and may supply images from outside the selected workspace; filesystem image sources still require ordinary files and pass sensitive-path checks. Pi-state names such as `auth`, `trust`, `sessions`, `missions`, and `history` are reserved inside `.pi`, Chat-owned storage, and the configured Pi agent directory (including its canonical target), not arbitrary source directories. Global credential/key patterns remain blocked, including `auth.json`. Relative `PI_CODING_AGENT_DIR` overrides retain conservative name blocking because they resolve in the child workspace; use an absolute path or `~/…` to obtain directory-scoped filtering. These filename checks and format validators are not content-based secret detectors. Manually typed messages, ordinary files, and images may contain sensitive content, and the extension does not promise image metadata removal. Prompts and attachments are sent to the provider selected in Pi when the user sends them.
+
+Image content is checked for supported PNG, JPEG, GIF, or WebP structure, declared MIME agreement, dimensions, and bounded base64 size. Each image is limited to 5 MiB, 16,384 pixels per side, and 40 million pixels. A prompt permits eight mixed attachments and 20 MiB of image bytes. The display retains at most 32 images / 20 MiB and reports omitted content; this is separate from Pi's persisted history. RPC records and buffered writes have independent 64 MiB caps. Recognized oversized history responses with a matching pending request are drained without accumulating the remaining bytes, then rejected without terminating Pi. The sidebar reports omitted history and remains usable; other oversized protocol records terminate the connection. A large historical transcript can exceed the RPC cap even when its original prompts were individually valid. Media caches remain in memory, are referenced by opaque identifiers while streaming, and are released as content is no longer retained. No remote image fetch, image processing service, or new image dependency is introduced. Pi/provider image limits and behavior remain upstream contracts.
+
+Connection teardown resets transient run bookkeeping without discarding displayed partial text. An accepted prompt is never restored because a later status refresh failed, and the Refresh status action performs read-only RPC queries instead of replaying work. RPC request IDs correlate replies; they do not make retries idempotent. A lost connection before acknowledgement leaves the prompt outcome uncertain.
+
+Image prompts require a model advertising image input. Rejection retains the unsent draft and attachments. Image-bearing slash commands are rejected because Pi extension commands can acknowledge execution without consuming image arguments. Stop clears queued work before aborting. Pi's queue-clear response contains text only, so Chat retains bounded in-memory image snapshots for its accepted queued submissions and restores them only after an exact, unambiguous match and an explicit user action. It does not attach discarded or unmatched images to a later prompt, automatically resend recovered work, or treat a missing acknowledgement as proof of failure.
+
+Pi persists chats, including sent image blocks, in a workspace-specific directory under the extension's VS Code storage. A bounded atomic catalog stores only identifiers, titles, timestamps, archive flags, and paths of conversations created there. It never scans or opens terminal Pi history or writes transcripts to VS Code settings, logs, telemetry, or persistent webview state. Each conversation's live projection, draft, and attachment snapshots stay in memory with per-conversation bounds. Resume is limited to catalogued regular files inside the owned session directory. Renaming and reversible archiving change catalog metadata without opening transcripts; archiving neither deletes files nor stops a live process. Uninstalling the extension does not promise secure deletion of VS Code storage. POSIX permissions are requested where supported; Windows relies on the profile's ACLs. As elsewhere in SpecPi, local filesystem races, a compromised extension host, an untrusted Pi executable, or same-user tampering are outside the isolation guarantee.
+
+Conversation edits select entries from the active Pi tree, revalidate the selection before mutation, and fork before the chosen user prompt. Exact original text and validated image blocks are captured before forking because Pi's fork response returns text only. The original conversation is retained, restored drafts require another send action, and conversation forks/clones do not restore or checkpoint workspace files. Actions are scoped to the active workspace, connection, and session revision. Export opens an unsaved Markdown document and Copy Conversation writes the visible Markdown to the OS clipboard only on explicit request. Both omit image bytes and represent images as placeholders; they do not reconstruct truncated or hidden history. Usage displays report Pi measurements, preserving unavailable values rather than inventing totals. The separate provider Limits row projects bounded strings from the known Codex Usage and pi-usage status keys, strips terminal/control sequences, and inserts text only. It does not parse numeric quotas, combine budgets with conversation cost, read provider credentials or usage-cache files, or add provider requests. Reports stay with their live connection and are cleared on disconnect, exit, and reconnect; refreshing and cache age remain upstream plugin responsibilities. Opening the details has no RPC or provider side effect. Existing `/usage` notifications and exact confirmation dialogs continue through the normal UI protocol; no automatic reset consumption or terminal-footer emulation is added.
+
+Native change review reads VS Code's Git API, validates selected workspace paths, and opens the corresponding working-tree or staged view through the built-in diff/editor actions. It does not execute a shell command, stage, commit, discard, or restore files. Git integration availability and the filesystem race boundary still apply. The sidebar coordinator keeps independent Pi connections for explicitly opened conversations. Switching conversations or folders only changes the selected view. Stop and Disconnect target the selected process; extension-host shutdown stops all owned processes. User-initiated parallel conversations share their workspace files and are not isolated worktrees. Branching uses Pi's pre-runtime `--fork` to copy into a new owned session before extensions can write, then performs any active-branch or prompt selection there; the original process and session remain unchanged.
+
+The extension introduces no network server, telemetry, runtime package dependency, or automatic model request when a view opens. Pi itself may contact its configured services when connected. Tests use synthetic homes, agent directories, providers, workspaces and profiles, plus an installed VS Code extension host; they do not access the user's live Pi credentials or conversations. Live provider availability and billing are outside the offline test evidence.
+
 ## Supply-chain assumptions
 
 SpecPi pins reviewed executable package versions and the browser dependency graph. These controls improve repeatability and make version changes reviewable. They do not prove that a registry, publisher account, package artifact, downloaded browser, GitHub Action tag, or invoking host is uncompromised. Releases are not described as reproducible or cryptographically signed unless a future release adds and documents those mechanisms.

package/THIRD_PARTY.md

@@ -1,5 +1,11 @@
 # Third-party components
 
+SpecPi Chat is a separate VS Code extension built with the public VS Code Webview View API and Pi `0.84.4`'s documented RPC protocol. VS Code and the installed Pi runtime retain their upstream licenses; neither is bundled in the VSIX. The extension and its ZIP/VSIX packager use Node built-ins and first-party source only, with no added runtime or development dependency. Its tests reuse the repository's pinned Playwright and Pi packages. Provider authentication, requests, billing, and normal Pi background behavior remain owned by the configured Pi runtime.
+
+Chat's provider Limits row recognizes the public RPC `setStatus` presentation contracts of `@llblab/pi-codex-usage` **0.9.3** (`aa-codex-usage`) and `@sreetej510/pi-usage` **0.9.9** (`provider-usage`). Public source was checked at commits `1a97ee5560c5d7dd3b99ce34e2dcfe456592f8a0` and `9dee3b590f736c723011e3bc3717b3f0d6e8072b`, respectively. Tests reproduce their status/notification contracts through synthetic local Pi RPC, not live accounts or upstream provider requests. Text retains each plugin's quota semantics rather than converting or aggregating measurements. Neither plugin is bundled in the VSIX; this compatibility change does not install pi-usage or change SpecPi's existing package pins. Plugins retain ownership of authentication, caching, refresh/backoff, and explicit reset-consumption confirmation.
+
+Chat uses Pi's image content blocks, conversation tree/fork/clone operations, and session statistics, plus the installed VS Code Git extension's public API for diff review. Version 0.3.0 retains a separate Pi process for each connected conversation and uses Pi's `--fork <session>` CLI option to copy branch history before runtime extensions initialize; the original live session remains untouched. Image container validation and base64 framing are first-party code; display uses VS Code's embedded browser image decoders. No image codec, provider SDK, export package, or remote image service is added. Local acceptance of PNG, JPEG, GIF, or WebP does not establish that every configured provider accepts the same formats or animation behavior. RPC records and buffered writes are capped at 64 MiB; image prompts and rendered media have separate, smaller limits documented in the extension guide.
+
 Delegation loads `clampThinkingLevel` from the Pi SDK when exported there, otherwise
 from the public `@earendil-works/pi-ai/compat` subpath declared in Pi's
 [package exports](https://github.com/earendil-works/pi/blob/main/packages/ai/package.json).

package/docs/delegation/README.md

@@ -1,6 +1,6 @@
 # Bounded delegation
 
-Status: experimental in SpecPi 0.13.0. Disabled by default.
+Status: experimental in SpecPi 0.15.0. Disabled by default.
 The package remains `specpi`; no separate npm package or background service is required.
 
 SpecPi keeps one agent responsible for changes and acceptance. This extension adds
@@ -94,8 +94,8 @@ structured tool responses and do not mount terminal widgets. The UI uses Pi's pu
 [widget and tool-rendering APIs](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md).
 
 `on` grants the displayed experimental calls/time envelope. There is no model-call
-permission toggle in the model-facing tool. `limits` is read-only; the shipped ceilings
-cannot be raised by prompts. Turning delegation off, changing guard policy, switching
+permission toggle in the model-facing tool. `limits` is read-only; prompts cannot
+change timeouts or raise other ceilings. Turning delegation off, changing guard policy, switching
 sessions or models, navigating branches, and changing task/scope bindings revoke the
 current generation. Off/on, `/reload` and session switches do not reset the Pi process's
 counters or free requests that are still settling. The same in-memory controller remains
@@ -123,6 +123,42 @@ the error identifies that state. `/delegate status` reports the observed Guard s
 Worker tool restrictions and resource limits are enforced independently of Guard. A worker result
 cannot authorize a write, a commit, a deployment, or an improvement.
 
+## Configure the timeout
+
+The default is **10 minutes per logical job** (previously 2 minutes). In Pi:
+
+```text
+/delegate off
+/delegate timeout 15
+/delegate on
+```
+
+`/delegate timeout` shows the current value; `/delegate timeout reset` saves the
+10-minute default. Tab completion suggests common values. Use whole minutes from
+**1 to 60**; there is no unlimited setting. The batch deadline is twice the job
+timeout (20 minutes by default), so it does not truncate the configured job window.
+Both deadlines start at batch admission and include queue and follow-up time; a
+follow-up never gets a fresh timeout. Provider requests use the remaining job window,
+not a separate two-minute cap. Provider-side limits may still end requests sooner.
+
+Changes require delegation to be off, including when model setup is pending or paused.
+They apply to this process and future Pi starts; they cannot extend old jobs, reset
+call quotas or free requests still settling. `/delegate on`, `status`, `limits` and
+Strict Guard policy summaries display the effective timeout. Only the human command
+can configure it; the model-facing tool has no timeout-setting operation.
+
+The preference is stored in `<agent-dir>/specpi/delegation/settings.json`, where
+`<agent-dir>` is `PI_CODING_AGENT_DIR` or `~/.pi/agent`. It contains only
+`{"schema":1,"timeoutMinutes":15}`. Saves atomically replace this file and keep the
+previous contents plus their SHA-256 in `settings.json.bak`. No Pi settings,
+authentication, sessions or history are read or changed by this preference store.
+The human-selected agent directory is resolved once, supporting platform path aliases.
+Preference files and SpecPi subdirectories must not be links. Malformed, oversized or
+unreadable settings block activation rather than silently using another timeout. Repair them manually
+and restart Pi. Manual edits and changes from another Pi process take effect on
+restart; `/reload` preserves the current process policy and counters. The preference
+survives uninstall as user-owned configuration.
+
 ## Admit a specific purpose
 
 | Mode     | Required structure                                                                                                                    | Context and tools                                                                         |
@@ -165,7 +201,7 @@ and counters. [Protocol and executable examples](protocol.md) define the exact f
 | Batches / jobs            | 4 batches per Pi process; one unresolved batch; 2 jobs per batch             |
 | SDK model invocations     | 32 per Pi process, 8 per batch; 4 per logical job including follow-up        |
 | Follow-ups / retries      | 1 changed-input follow-up per job; provider and session retries disabled     |
-| Time                      | 120 seconds per logical job; 300 seconds per batch, including follow-up time |
+| Time                      | 10 minutes per job by default (human configurable 1–60); batch twice that; queue/follow-up included |
 | Packet / child context    | 256 KiB, checked before dispatch                                             |
 | Selected sources          | 200 files and 8 MiB per batch                                                |
 | Tools                     | 12 calls and 64 KiB total returned JSON per logical job                      |

package/docs/delegation/protocol.md

@@ -36,6 +36,19 @@ data are rejected. The host creates identities and receipts; workers cannot supp
 The protocol identifier `bounded-pi-sessions-v1` and inference contract
 `pi-agent-session-v1` describe the host implementation, not model-selected options.
 
+## Human timeout preference
+
+Logical jobs default to 10 minutes; batches default to 20 minutes. Human
+`/delegate timeout <minutes>` saves a whole-minute value from 1 to 60 while delegation
+is off; `timeout reset` saves 10. The batch window is twice the job window.
+Deadlines start at admission and include queue and the single follow-up. Provider
+request timeouts and the adapter abort timer honor the remaining job window, capped
+at 60 minutes. Settings changes invalidate old policy bindings without resetting
+quotas or settling slots. No tool operation or packet field can change the timeout.
+See the [configuration guide](README.md#configure-the-timeout) for persistence and
+recovery. Status limits, packet digests and Guard fingerprints bind the effective
+policy rather than assuming the shipped default.
+
 ## Submit a batch
 
 After the human runs `/delegate on`, the parent calls the `delegate` tool:

package/extensions/command-guard/index.ts

@@ -229,7 +229,10 @@ export default function registerCommandGuard(
         const startupGeneration = state.generation;
         try {
             subscribeGuardState();
-            const choice = ctx.hasUI ? await startupChoice(ctx, startupTimeoutMs) : undefined;
+            // Pi RPC binds session_start before it starts reading UI responses.
+            // Begin guarded without a startup dialog; /guard remains available
+            // for explicit changes once the RPC client is connected.
+            const choice = ctx.hasUI && ctx.mode !== "rpc" ? await startupChoice(ctx, startupTimeoutMs) : undefined;
             if (state.generation !== startupGeneration) {
                 return;
             }

package/extensions/delegation/core.mjs

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { createSnapshot } from "./snapshot.mjs";
-import { LIMITS, digest, validateOperation } from "./protocol.mjs";
+import { LIMITS, digest, timeoutLimits, validateOperation } from "./protocol.mjs";
 import { runWorker } from "./worker.mjs";
 import { DelegationError, publicErrorMessage } from "./errors.mjs";
 
@@ -17,7 +17,7 @@ export function createDelegationController({
     worker = runWorker,
     getGuard = () => "absent",
 }) {
-    const policy = Object.freeze(
+    let policy = Object.freeze(
         Object.fromEntries(
             Object.entries(LIMITS).map(([key, maximum]) => {
                 const value = limits[key] ?? maximum;
@@ -707,6 +707,17 @@ export function createDelegationController({
         status,
         presentation,
         invalidate,
+        // Human command only; never exposed through execute() or the model schema.
+        setTimeoutMinutes(minutes) {
+            const times = timeoutLimits(minutes);
+            if (enabled) {
+                throw new DelegationError("Turn delegation off before changing its timeout: /delegate off");
+            }
+
+            invalidate("timeout policy changed");
+            policy = Object.freeze({ ...policy, ...times });
+            changed();
+        },
         enable() {
             const host = getHost();
             const guard = getGuard();

package/extensions/delegation/extension.mjs

@@ -1,8 +1,11 @@
 import { DelegationError, publicErrorMessage } from "./errors.mjs";
 import { randomUUID } from "node:crypto";
 import { createDelegationController } from "./core.mjs";
+import { DEFAULT_TIMEOUT_MINUTES, timeoutLimits } from "./protocol.mjs";
 import { createLivePanel, createToolRenderers, readableLimits, readableStatus } from "./presentation.mjs";
 
+const USAGE = "Usage: /delegate [on|off|status|limits|timeout [<minutes>|reset]|cancel <batchId>]";
+
 const integer = { type: "integer", minimum: 0 };
 const string = { type: "string" };
 const strings = { type: "array", items: string };
@@ -92,7 +95,7 @@ export const DELEGATE_SCHEMA = {
 /** The native entry supplies a preflighted Pi child-session host for the active context. */
 export function createDelegationExtension(
     getHost,
-    { root = process.cwd(), controllerOptions = {}, prepareContext = () => {}, presentation } = {},
+    { root = process.cwd(), controllerOptions = {}, prepareContext = () => {}, presentation, timeoutStore } = {},
 ) {
     let currentPi;
     let currentContext;
@@ -130,6 +133,14 @@ export function createDelegationExtension(
         getGuard,
         onChange: updatePresentation,
     });
+    let timeoutLoaded = !timeoutStore;
+    const loadTimeout = () => {
+        if (!timeoutLoaded) {
+            controller.setTimeoutMinutes(timeoutStore.load());
+            timeoutLoaded = true;
+        }
+    };
+
     const panel = presentation ? createLivePanel(() => controller.presentation(), presentation) : undefined;
 
     const status = () => ({
@@ -335,6 +346,7 @@ export function createDelegationExtension(
             panel?.bind(ctx);
             invalidate("session started or resources reloaded");
             try {
+                loadTimeout();
                 prepareContext(ctx, true);
             } catch (error) {
                 pauseReason = publicErrorMessage(error);
@@ -368,9 +380,22 @@ export function createDelegationExtension(
             }
         });
         pi.registerCommand("delegate", {
-            description: "Enable bounded read-only delegation or inspect its session limits",
+            description: "Enable read-only delegation, inspect limits, or save timeout <minutes> (1–60; reset: 10)",
             getArgumentCompletions: (prefix) =>
-                ["on", "off", "status", "limits", "cancel"]
+                [
+                    "on",
+                    "off",
+                    "status",
+                    "limits",
+                    "timeout",
+                    "timeout 5",
+                    "timeout 10",
+                    "timeout 15",
+                    "timeout 30",
+                    "timeout 60",
+                    "timeout reset",
+                    "cancel",
+                ]
                     .filter((value) => value.startsWith(prefix.trim()))
                     .map((value) => ({ value, label: value })),
             handler: async (args, ctx) => {
@@ -383,8 +408,8 @@ export function createDelegationExtension(
                 currentContext = ctx;
                 const [action = "status", id, extra] = args.trim().split(/\s+/u).filter(Boolean);
                 try {
-                    if (extra || (id && action !== "cancel")) {
-                        throw new DelegationError("Usage: /delegate [on|off|status|limits|cancel <batchId>]");
+                    if (extra || (id && !["cancel", "timeout"].includes(action))) {
+                        throw new DelegationError(USAGE);
                     }
 
                     if (action === "on") {
@@ -392,6 +417,7 @@ export function createDelegationExtension(
                             throw new DelegationError("Delegation activation requires a human interactive command");
                         }
 
+                        loadTimeout();
                         requested = true;
                         requestedGuard = getGuard();
                         await refreshSelection(ctx);
@@ -408,7 +434,38 @@ export function createDelegationExtension(
 
                         syncActiveTool(true);
                         ctx.ui.notify(
-                            `Delegation enabled: Pi child sessions for review and scout, ${state.model.provider}/${state.model.id}, thinking ${state.model.thinkingLevel ?? "Pi configured"}. At most 2 workers, 4 batches and 32 SDK inference calls per Pi process; 120 seconds per job. Workers see only supplied text and selected snapshots. Pi owns configured authentication; temporary parent provider/auth overrides and parent hooks are not inherited. No shell, edits, recursion, automatic retries or compaction. /delegate off cancels workers; SDK requests still settling retain their slots. These limits do not guarantee remote termination or a billing cap.`,
+                            `Delegation enabled: Pi child sessions for review and scout, ${state.model.provider}/${state.model.id}, thinking ${state.model.thinkingLevel ?? "Pi configured"}. At most 2 workers, 4 batches and 32 SDK inference calls per Pi process; ${state.limits.jobMs / 60_000} minutes per job, ${state.limits.batchMs / 60_000} minutes per batch. Configure with /delegate timeout <minutes> while off (saved across restarts). Workers see only supplied text and selected snapshots. Pi owns configured authentication; temporary parent provider/auth overrides and parent hooks are not inherited. No shell, edits, recursion, automatic retries or compaction. /delegate off cancels workers; SDK requests still settling retain their slots. These limits do not guarantee remote termination or a billing cap.`,
+                            "info",
+                        );
+                    } else if (action === "timeout") {
+                        if (id) {
+                            if (!ctx.hasUI) {
+                                throw new DelegationError("Timeout changes require a human interactive command");
+                            }
+
+                            if (requested || pending || controller.status().enabled) {
+                                throw new DelegationError(
+                                    "Turn delegation off before changing its timeout: /delegate off",
+                                );
+                            }
+
+                            const minutes =
+                                id === "reset" ? DEFAULT_TIMEOUT_MINUTES : /^\d+$/u.test(id) ? Number(id) : NaN;
+                            timeoutLimits(minutes);
+                            if (!timeoutStore) {
+                                throw new DelegationError("Persistent delegation settings are unavailable");
+                            }
+
+                            timeoutStore.save(minutes);
+                            controller.setTimeoutMinutes(minutes);
+                            timeoutLoaded = true;
+                        } else {
+                            loadTimeout();
+                        }
+
+                        const limits = controller.status().limits;
+                        ctx.ui.notify(
+                            `Delegation timeout: ${limits.jobMs / 60_000} minutes per job; ${limits.batchMs / 60_000} minutes per batch, including queue and follow-up time. ${id ? "Saved for this process and future Pi starts. " : ""}Use /delegate timeout <minutes> (1–60) or /delegate timeout reset (10). Changes require /delegate off; call budgets do not reset.`,
                             "info",
                         );
                     } else if (action === "off") {
@@ -428,7 +485,7 @@ export function createDelegationExtension(
                         const state = status();
                         ctx.ui.notify(action === "limits" ? readableLimits(state) : readableStatus(state), "info");
                     } else {
-                        throw new DelegationError("Usage: /delegate [on|off|status|limits|cancel <batchId>]");
+                        throw new DelegationError(USAGE);
                     }
                 } catch (error) {
                     ctx.ui.notify(publicErrorMessage(error), "error");

package/extensions/delegation/managed-files.mjs

@@ -4,6 +4,7 @@ export const DELEGATION_MANAGED_FILES = Object.freeze([
     "extension.mjs",
     "core.mjs",
     "protocol.mjs",
+    "settings.mjs",
     "provider.mjs",
     "snapshot.mjs",
     "worker.mjs",

package/extensions/delegation/native.mjs

@@ -4,9 +4,10 @@ import { randomUUID } from "node:crypto";
 import { createDelegationExtension } from "./extension.mjs";
 import { createNativePiHost, getPiSessionCompatibilityError } from "./provider.mjs";
 import { DelegationError } from "./errors.mjs";
+import { createTimeoutStore } from "./settings.mjs";
 
 const stateKey = Symbol.for("specpi.delegation.native.v1");
-const revision = 7;
+const revision = 8;
 
 export async function withPiCompatibility(sdk, loadCompatibility) {
     if (typeof sdk.clampThinkingLevel === "function") {
@@ -121,7 +122,12 @@ function createState(root, sdk, presentation) {
         }
     };
 
-    const extensionFactory = createDelegationExtension(() => host, { root, prepareContext, presentation });
+    const extensionFactory = createDelegationExtension(() => host, {
+        root,
+        prepareContext,
+        presentation,
+        timeoutStore: createTimeoutStore(),
+    });
     const factory = (pi) => {
         getThinkingLevel = () => pi.getThinkingLevel();
         extensionFactory(pi);

package/extensions/delegation/presentation.mjs

@@ -145,6 +145,7 @@ export function readableStatus(state) {
         `Delegation ${mode} · ${state.active}/${state.limits.concurrency} workers active`,
         `Process budget: ${state.sessionCalls}/${state.limits.sessionCalls} model calls · ${state.sessionBatches}/${state.limits.sessionBatches} batches used`,
         `Command Guard: ${plain(state.guard)}`,
+        `Timeout: ${state.limits.jobMs / 60_000} minutes per job · ${state.limits.batchMs / 60_000} minutes per batch (/delegate timeout)`,
     ];
     if (state.model) {
         lines.push(
@@ -176,7 +177,7 @@ export function readableLimits(state) {
         return `  ${label}: ${value}${unit}`;
     });
 
-    return `${readableStatus(state)}\nFixed limits:\n${limits.join("\n")}\nBudgets do not reset on off/on or reload. Cancellation is best effort; no billing cap.`;
+    return `${readableStatus(state)}\nEffective limits:\n${limits.join("\n")}\nBudgets do not reset on off/on or reload. Cancellation is best effort; no billing cap.`;
 }
 
 export function createToolRenderers({ truncateToWidth, wrapTextWithAnsi }) {

package/extensions/delegation/protocol.mjs

@@ -1,6 +1,18 @@
 import { DelegationError } from "./errors.mjs";
 import { createHash } from "node:crypto";
 
+export const DEFAULT_TIMEOUT_MINUTES = 10;
+export const MAX_TIMEOUT_MINUTES = 60;
+export const MAX_JOB_MS = MAX_TIMEOUT_MINUTES * 60_000;
+
+export function timeoutLimits(minutes) {
+    if (!Number.isSafeInteger(minutes) || minutes < 1 || minutes > MAX_TIMEOUT_MINUTES) {
+        throw new DelegationError(`Delegation timeout must be a whole number from 1 to ${MAX_TIMEOUT_MINUTES} minutes`);
+    }
+
+    return { jobMs: minutes * 60_000, batchMs: minutes * 120_000 };
+}
+
 export const LIMITS = Object.freeze({
     concurrency: 2,
     sessionBatches: 4,
@@ -8,8 +20,7 @@ export const LIMITS = Object.freeze({
     batchJobs: 2,
     batchCalls: 8,
     jobCalls: 4,
-    jobMs: 120_000,
-    batchMs: 300_000,
+    ...timeoutLimits(DEFAULT_TIMEOUT_MINUTES),
     contextBytes: 256 * 1024,
     retainedResponseBytes: 256 * 1024,
     toolBytes: 64 * 1024,

package/extensions/delegation/provider.mjs

@@ -1,4 +1,5 @@
 import { DelegationError } from "./errors.mjs";
+import { MAX_JOB_MS } from "./protocol.mjs";
 
 const MAX_CONTEXT_BYTES = 256 * 1024;
 const MAX_OUTPUT_TOKENS = 8192;
@@ -513,7 +514,7 @@ export function createNativePiHost(ctx, { id, isCurrent, sdk, thinkingLevel } =
                         ),
                         maxTokens: Math.min(MAX_OUTPUT_TOKENS, childModel.maxTokens, run.controls.limits.outputTokens),
                         maxRetries: 0,
-                        timeoutMs: Math.max(1, Math.min(120_000, run.controls.deadline - Date.now())),
+                        timeoutMs: Math.max(1, Math.min(MAX_JOB_MS, run.controls.deadline - Date.now())),
                         onPayload: async (payload, providerModel) => {
                             assertRun();
                             const result = (await options.onPayload?.(payload, providerModel)) ?? payload;
@@ -637,7 +638,7 @@ export function createNativePiHost(ctx, { id, isCurrent, sdk, thinkingLevel } =
                     active = run;
                     const cancel = () => fail(new DelegationError("Delegation session was cancelled or expired"));
                     controls.signal.addEventListener("abort", cancel, { once: true });
-                    const timer = setTimeout(cancel, Math.max(1, Math.min(120_000, controls.deadline - Date.now())));
+                    const timer = setTimeout(cancel, Math.max(1, Math.min(MAX_JOB_MS, controls.deadline - Date.now())));
                     timer.unref?.();
                     try {
                         assertRun();

package/extensions/delegation/settings.mjs

@@ -0,0 +1,140 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { DEFAULT_TIMEOUT_MINUTES, timeoutLimits } from "./protocol.mjs";
+import { DelegationError } from "./errors.mjs";
+
+const MAX_SETTINGS_BYTES = 4096;
+const MAX_BACKUP_BYTES = 32 * 1024;
+
+function regularFile(file, maxBytes = MAX_SETTINGS_BYTES) {
+    const stat = fs.lstatSync(file, { throwIfNoEntry: false });
+    if (stat && (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > maxBytes)) {
+        throw new Error("Unsupported settings file");
+    }
+
+    return stat;
+}
+
+function directory(dir, create = false) {
+    const parent = path.dirname(dir);
+    if (parent !== dir) {
+        directory(parent, create);
+    }
+
+    let stat = fs.lstatSync(dir, { throwIfNoEntry: false });
+    if (!stat && create) {
+        fs.mkdirSync(dir, { mode: 0o700 });
+        stat = fs.lstatSync(dir);
+    }
+
+    if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) {
+        throw new Error("Unsupported settings directory");
+    }
+}
+
+// Resolve the human-selected agent root, including platform aliases, once.
+// Missing descendants stay non-mutating on load and are checked before creation.
+function canonicalAgentDirectory(dir) {
+    if (fs.lstatSync(dir, { throwIfNoEntry: false })) {
+        const resolved = fs.realpathSync.native(dir);
+        if (!fs.statSync(resolved).isDirectory()) {
+            throw new Error("Unsupported agent directory");
+        }
+
+        return resolved;
+    }
+
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+        throw new Error("Agent directory root is unavailable");
+    }
+
+    return path.join(canonicalAgentDirectory(parent), path.basename(dir));
+}
+
+function atomicWrite(file, content, maxBytes = MAX_SETTINGS_BYTES) {
+    regularFile(file, maxBytes);
+    if (Buffer.byteLength(content, "utf8") > maxBytes) {
+        throw new Error("Settings write exceeds its bound");
+    }
+
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { flag: "wx", mode: 0o600 });
+        fs.renameSync(temporary, file);
+    } finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+
+/** Own preference only; never reads Pi settings, credentials or session state. */
+export function createTimeoutStore(
+    agentDir = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent"),
+) {
+    const requestedAgentDir = path.resolve(agentDir);
+    let resolvedAgentDir;
+    const location = () => {
+        resolvedAgentDir ??= canonicalAgentDirectory(requestedAgentDir);
+        const dir = path.join(resolvedAgentDir, "specpi", "delegation");
+
+        return { dir, file: path.join(dir, "settings.json") };
+    };
+
+    const read = () => {
+        const { dir, file } = location();
+        directory(dir);
+        if (!regularFile(file)) {
+            return undefined;
+        }
+
+        const content = fs.readFileSync(file, "utf8");
+        const settings = JSON.parse(content);
+        if (
+            !settings ||
+            settings.schema !== 1 ||
+            Object.keys(settings).length !== 2 ||
+            !Object.hasOwn(settings, "timeoutMinutes")
+        ) {
+            throw new Error("Invalid settings schema");
+        }
+
+        timeoutLimits(settings.timeoutMinutes);
+
+        return { content, minutes: settings.timeoutMinutes };
+    };
+
+    return {
+        load() {
+            try {
+                return read()?.minutes ?? DEFAULT_TIMEOUT_MINUTES;
+            } catch {
+                throw new DelegationError(
+                    "Cannot read delegation settings. Check <agent-dir>/specpi/delegation/settings.json (schema 1, timeoutMinutes: integer 1–60) and its permissions; restart Pi after repairing it.",
+                );
+            }
+        },
+        save(minutes) {
+            timeoutLimits(minutes);
+            try {
+                const previous = read();
+                const { dir, file } = location();
+                directory(dir, true);
+                if (previous) {
+                    atomicWrite(
+                        `${file}.bak`,
+                        `${JSON.stringify({ sha256: createHash("sha256").update(previous.content).digest("hex"), content: previous.content })}\n`,
+                        MAX_BACKUP_BYTES,
+                    );
+                }
+
+                atomicWrite(file, `${JSON.stringify({ schema: 1, timeoutMinutes: minutes })}\n`);
+            } catch {
+                throw new DelegationError(
+                    "Cannot save delegation settings. Check <agent-dir>/specpi/delegation/settings.json and its permissions; the active timeout is unchanged.",
+                );
+            }
+        },
+    };
+}

package/extensions/spec.ts

@@ -634,6 +634,15 @@ export default function (pi: ExtensionAPI) {
             return matches.length > 0 ? matches.map((value) => ({ value, label: value })) : null;
         },
         handler: async (args, ctx) => {
+            if (ctx.mode === "rpc") {
+                ctx.ui.notify(
+                    "/spec controls the interactive terminal interface. SpecPi Chat manages its own response and tool display.",
+                    "info",
+                );
+
+                return;
+            }
+
             lastContext = ctx;
             const action = args.trim().toLowerCase();
             if (!action) {

package/extensions/tool-wishlist/index.ts

@@ -685,7 +685,13 @@ export default function toolWishlist(pi: ExtensionAPI) {
                 reportPath,
                 truncated: display.truncated,
             });
-        } else if ((ctx.mode === "tui" || ctx.mode === undefined) && typeof ctx.ui.editor === "function") {
+        }
+
+        if (
+            (ctx.mode === "rpc" || !supportsReportEntries) &&
+            (ctx.mode === "rpc" || ctx.mode === "tui" || ctx.mode === undefined) &&
+            typeof ctx.ui.editor === "function"
+        ) {
             await ctx.ui.editor(
                 "SpecPi Wishlist (view only; changes are ignored)",
                 `${content}\n\n---\nReport: ${displayPath}`,

package/extensions/tool-wishlist/verification.mjs

@@ -25,6 +25,7 @@ export const SOURCE_DIRECTORIES = Object.freeze([
     "templates",
     "tests",
     "themes",
+    "vscode",
 ]);
 
 export const SOURCE_ROOT_FILES = Object.freeze([

package/extensions/workflow-controls/index.ts

@@ -1113,7 +1113,7 @@ export default function workflowControls(pi: ExtensionAPI) {
                         createdAt: new Date().toISOString(),
                     };
                     pi.appendEntry(TASK_HANDOFF_ENTRY, data);
-                    if (!supportsEntryRenderer && typeof ctx.ui.editor === "function") {
+                    if ((ctx.mode === "rpc" || !supportsEntryRenderer) && typeof ctx.ui.editor === "function") {
                         await ctx.ui.editor("Task handoff (view only)", markdown);
                     }
 
@@ -1738,7 +1738,7 @@ export default function workflowControls(pi: ExtensionAPI) {
 
                 if (!latestChallenge) {
                     ctx.ui.notify("No completed challenge exists on this session branch.", "info");
-                } else if (supportsEntryRenderer) {
+                } else if (supportsEntryRenderer && ctx.mode !== "rpc") {
                     pi.appendEntry(CHALLENGE_ENTRY, { ...latestChallenge, kind: "display" });
                 } else if (typeof ctx.ui.editor === "function") {
                     await ctx.ui.editor("Completion challenge (view only)", latestChallenge.markdown ?? "Unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specpi",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "An explicit, privacy-conscious, self-improving harness for the Pi coding agent",
   "author": "Tanner Middleton",
   "repository": {

package/scripts/check-package.mjs

@@ -367,6 +367,28 @@ function assertInstalledLifecycle(packageRoot, binPath, temporaryRoot, baseEnv)
     runCli(["install", ...lifecycleFlags]);
     runCli(["doctor"], { timeout: 300_000 });
 
+    const privateEvidence = new Map([
+        [path.join(agentDir, "specpi", "delegation", "settings.json"), '{"schema":1,"timeoutMinutes":15}\n'],
+        [
+            path.join(agentDir, "specpi", "delegation", "settings.json.bak"),
+            `${JSON.stringify({
+                content: '{"schema":1,"timeoutMinutes":10}\n',
+                sha256: createHash("sha256").update('{"schema":1,"timeoutMinutes":10}\n').digest("hex"),
+            })}\n`,
+        ],
+        [path.join(agentDir, "specpi", "wishlist", "observations.jsonl"), '{"private":true}\n'],
+        [
+            path.join(agentDir, "specpi", "wishlist", "decisions.jsonl"),
+            '{"action":"retire","journal":{"schema":1,"evidence":["private proof"],"gates":["npm run check"],"version":"0.10.0"}}\n',
+        ],
+        [path.join(agentDir, "specpi", "experiments", "registry.json"), '{"private":true}\n'],
+        [path.join(agentDir, "specpi", "experiments", "patches", "package-smoke.patch"), "private patch\n"],
+    ]);
+    for (const [file, content] of privateEvidence) {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, content, { mode: 0o600 });
+    }
+
     const guardDirectory = path.join(agentDir, "extensions", "command-guard");
     const driftedGuardPath = path.join(guardDirectory, "index.ts");
     fs.appendFileSync(driftedGuardPath, "\n// package-check rollback drift\n");
@@ -386,20 +408,6 @@ function assertInstalledLifecycle(packageRoot, binPath, temporaryRoot, baseEnv)
         "failed update did not restore the complete managed tree",
     );
 
-    const privateEvidence = new Map([
-        [path.join(agentDir, "specpi", "wishlist", "observations.jsonl"), '{"private":true}\n'],
-        [
-            path.join(agentDir, "specpi", "wishlist", "decisions.jsonl"),
-            '{"action":"retire","journal":{"schema":1,"evidence":["private proof"],"gates":["npm run check"],"version":"0.10.0"}}\n',
-        ],
-        [path.join(agentDir, "specpi", "experiments", "registry.json"), '{"private":true}\n'],
-        [path.join(agentDir, "specpi", "experiments", "patches", "package-smoke.patch"), "private patch\n"],
-    ]);
-    for (const [file, content] of privateEvidence) {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, content, { mode: 0o600 });
-    }
-
     runCli(["update", ...lifecycleFlags, "--force"]);
     runCli(["doctor"], { timeout: 300_000 });
     runCli(["uninstall", "--yes"]);
@@ -409,11 +417,14 @@ function assertInstalledLifecycle(packageRoot, binPath, temporaryRoot, baseEnv)
         false,
         "uninstall left a managed extension behind",
     );
-    assert.equal(
-        fs.existsSync(path.join(agentDir, "extensions", "delegation", "index.ts")),
-        false,
-        "uninstall left native delegation installed",
-    );
+    for (const file of DELEGATION_MANAGED_FILES) {
+        assert.equal(
+            fs.existsSync(path.join(agentDir, "extensions", "delegation", file)),
+            false,
+            `uninstall left a managed delegation file: ${file}`,
+        );
+    }
+
     for (const [file, expected] of privateEvidence) {
         assert.equal(fs.existsSync(file), true, `uninstall removed private SpecPi evidence: ${file}`);
         assert.equal(fs.readFileSync(file, "utf8"), expected, `uninstall changed private SpecPi evidence: ${file}`);
@@ -460,7 +471,12 @@ try {
     assert.ok(fs.existsSync(tarball), "the reported npm tarball does not exist");
     assertArtifactMatchesManifest(tarball, packResult);
 
-    const installEnv = { ...process.env, npm_config_audit: "false", npm_config_fund: "false" };
+    const installEnv = {
+        ...process.env,
+        PI_CODING_AGENT_DIR: path.join(temporaryRoot, "install-agent"),
+        npm_config_audit: "false",
+        npm_config_fund: "false",
+    };
     runNpm(
         [
             "install",

package/scripts/check-syntax.mjs

@@ -26,6 +26,11 @@ export function syntaxFiles(root) {
         visit(path.join(root, directory));
     }
 
+    // The separately distributed editor extension is absent from the npm artifact.
+    if (fs.existsSync(path.join(root, "vscode"))) {
+        visit(path.join(root, "vscode"));
+    }
+
     return files.sort();
 }