specpi 0.13.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.16.0 - 2026-09-05
+
+- Enable experimental read-only delegation by default at the first session start of each Pi process, including TUI, RPC, print and JSON modes. Startup preflights the host without launching workers or model inference; selective review/scout admission, Guard checks, source restrictions and resource ceilings remain unchanged.
+- Keep `/delegate off` and safety revocations effective through reloads and session switches. `/delegate on` explicitly re-enables dispatch; restarting Pi reapplies the on default. Invalid settings, unsupported providers and locked, unready or ambiguous Guard policies still block activation.
+- Update delegation guidance and release references, and add startup/default-on regression coverage alongside real-Pi lifecycle checks. Restart Pi after updating SpecPi to load the changed delegation runtime.
+
+## 0.15.0 - 2026-09-05
+
+- Add **SpecPi Chat 0.3.1**, a separately packaged VS Code sidebar with streamed Pi replies, safe Markdown, expanded thinking and collapsed tool output by default, model/thinking controls, exact approvals, and a compact composer. It reuses the user's Pi configuration without managing credentials or installing the harness.
+- Add searchable extension-owned history, rename and reversible archive, and independent live conversations. Switching chats or folders preserves background work, approvals, drafts, attachments, usage, and view position. Stop/Disconnect target the selected conversation; parallel chats share workspace files rather than isolated worktrees.
+- Add validated file/image attachment, screenshot paste/drop, bounded inline images, workspace code links and image previews, explicit queued-image recovery, visible transcript search/copy/export, usage/cost reporting, and native Git diff review. Branching and earlier-prompt editing preserve the source conversation and never undo code files or automatically send restored drafts.
+- Start Command Guard in Guard mode in RPC without an unreadable startup selector; retain explicit `/guard` choices after readiness. Route task handoffs, challenge reports, and wishlist reports through RPC-capable dialogs, and disclose terminal-only display controls.
+- Wait for legacy Pi startup fallbacks without approving early dialogs. Reset interrupted-run state on reconnect and never restore accepted prompts after a later refresh failure.
+- Show installed Codex Usage and pi-usage (including Anthropic) reports in Chat's compact, expandable Limits row, separate from conversation tokens/cost. Reuse bounded Pi status events without provider queries, credential/cache reads, or changes to the default package list.
+- Scope Chat's Pi-state filename restrictions to Pi/Chat storage so ordinary authentication, session, and history source files remain usable; retain global credential/key protection and canonical-path checks.
+- Fix composer `/model` selection, read-only usage during active work, and stale Stop cleanup errors after reconnect. Align README and Pages installation examples with the separately versioned Chat artifact.
+- Add dependency-free local VSIX packaging, isolated real-Pi and native VS Code tests, rendered Chat checks in CI, and editor-extension syntax/source-inventory coverage. No npm/Marketplace publication or automatic editor installation is included.
+
+## 0.14.0 - 2026-09-05
+
+- Raise delegation's default job timeout from 2 to 10 minutes, including the provider adapter. Add `/delegate timeout <minutes>` (1–60) and `reset` with an atomic, backed-up preference across restarts. Batch timeouts scale with the job window; call quotas, original follow-up deadlines and settling ownership remain unchanged. Restart Pi after updating the delegation runtime.
+- Support platform aliases in the selected Pi agent-directory path while rejecting links inside preference state. Bound encoded backups separately so every accepted settings file can be saved repeatedly.
+- Keep `.mts` declarations on LF checkouts and validate Pages permissions with either LF or CRLF input so release checks remain portable on Windows.
+- Run timeout persistence fixtures across release platforms, isolate the package help probe, and verify that settings survive failed updates and every managed delegation file is removed on uninstall.
+
 ## 0.13.0 - 2026-09-05
 
 - Add bounded, best-effort sanitized browser exceptions, console errors, failed requests, and HTTP error diagnostics with explicit cursor/loss/clear semantics and ephemeral retention.

package/NPM_RELEASE.md

@@ -22,6 +22,8 @@ Verify the registry bytes and metadata immediately, then configure trusted publi
 
 1. Select a version that has never appeared on npm. npm versions are immutable.
 2. Update `package.json`, `CHANGELOG.md`, `README.md`, `site/index.html`, `site/wiki/index.html`, `site/single-agent/index.html`, and the delegation guide to the same version. Keep historical changelog entries intact and remove stale unreleased-status wording.
+   If Chat changes are included, increment its independent version in `vscode/package.json` and `vscode/CHANGELOG.md`, and align the VSIX filenames and feature descriptions in the root README, extension README, and Pages guides. Build it with `npm --prefix vscode run package`, run `npm --prefix vscode run test:render` and the isolated `npm --prefix vscode run test:vsix`, and inspect the VSIX allowlist. The editor extension is not part of the npm tarball; creating this local artifact does not publish it or authorize a Marketplace release.
+
 3. For a stable release, add a dated changelog heading. Use a prerelease version when the package should not receive the `latest` dist-tag.
 4. Install the pinned development tools without lifecycle scripts or peers:
 

package/README.md

@@ -24,13 +24,19 @@ SpecPi adds task contracts, workflow controls, and a local improvement loop to P
 
 Collection is disabled until explicitly enabled. Reports are sanitized, bounded, deduplicated by task, and never uploaded. Later evidence can reopen an item for review, but never restarts implementation automatically.
 
-Version `0.13.0` adds browser diagnostics, keyboard and native dropdown interactions, bounded condition waits, scoped TypeScript checking, and repeatable rendered-site tests. Experimental delegation, task cards, verification receipts and human outcome assessments remain part of the single-agent workflow. See the [release notes](CHANGELOG.md) for the change list.
+Version `0.16.0` enables bounded read-only delegation by default at Pi startup. One agent still owns edits and verification; worker use remains selective. SpecPi Chat, browser checks, and the human-selected improvement workflow remain available. See the [release notes](CHANGELOG.md) for the change list.
 
-## Optional delegation
+## SpecPi Chat for VS Code
+
+The `vscode/` source contains **SpecPi Chat 0.3.2**, a separately packaged native sidebar with streamed replies, tool results, file and image attachments, model/thinking controls, Pi approvals, and searchable workspace conversation history. Rename or archive chats, switch between independent live conversations, branch or edit an earlier prompt, search and export visible messages, inspect usage, and review changes through VS Code's native diff tools. Switching chats preserves background work, approvals, drafts, and attachments. Connected conversations share workspace files; use separate worktrees for isolated writers. Opening the sidebar does not start Pi.
+
+From a repository checkout, build a local VSIX with `npm --prefix vscode run package`, then install `.specpi-test/vscode/specpi-chat-0.3.2.vsix` through **Extensions: Install from VSIX…**. See the [extension guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) for prerequisites, image/provider limits, commands, privacy, and testing. Pi owns provider authentication and tool execution. Stop and Disconnect affect the selected conversation only; branching does not undo code changes. The extension is separate from the SpecPi npm package and has not been published to a marketplace.
+
+## Selective delegation
 
 One agent owns edits and verifies results. Experimental delegation adds up to two read-only Pi workers: `review` checks a frozen artifact; `scout` answers a focused question using selected sources. Workers cannot write, run shell commands, browse the web, or delegate further.
 
-Delegation is **off by default**. In Pi, use `/delegate on` to enable it, `/delegate status` to inspect work, and `/delegate off` to revoke it. Research informed the design; SpecPi quality, speed, and cost gains remain unmeasured.
+Delegation is **on by default at Pi startup**, subject to compatibility, settings, and Guard checks. Startup does not launch workers or model inference. Use `/delegate status` to inspect work and limits, `/delegate off` to revoke it, and `/delegate on` to re-enable it. Off and safety revocations survive reloads and session switches; restarting Pi reapplies the on default. Research informed the design; SpecPi quality, speed, and cost gains remain unmeasured.
 
 See [setup and limits](docs/delegation/README.md) or [how the research shaped the architecture](https://tannermidd.github.io/SpecPi/single-agent/).
 
@@ -55,14 +61,14 @@ specpi doctor
 Pin the reusable CLI when installing a reviewed release, or inspect its plan without retaining a global CLI installation:
 
 ```bash
-npm install --global specpi@0.13.0
-npx --package specpi@0.13.0 specpi plan
+npm install --global specpi@0.16.0
+npx --package specpi@0.16.0 specpi plan
 ```
 
 For a source-audited installation, clone the exact release:
 
 ```bash
-git clone --branch v0.13.0 --depth 1 https://github.com/TannerMidd/SpecPi.git
+git clone --branch v0.16.0 --depth 1 https://github.com/TannerMidd/SpecPi.git
 cd SpecPi
 ./specpi plan
 ./specpi install
@@ -167,7 +173,7 @@ Use `/task clear` before recording an unrelated task. Within a session, repeated
 
 Use `/experiment start` when an independent review or trial justifies a separate worktree. Open the reported path in another Pi session. SpecPi does not launch an agent, copy dirty base changes, commit, merge, or touch remotes.
 
-SpecPi keeps one writer per working directory. Its experimental delegation adds bounded read-only Pi sessions. A parent determines what context a child receives and verifies what returns, so either handoff can omit a material constraint. Parallel writers also introduce conflicting assumptions and increase review work.
+SpecPi's default workflow uses one writer per working directory. Its experimental delegation adds bounded read-only Pi sessions. SpecPi Chat also supports independent conversations that you start explicitly; connected chats can continue concurrently in the same workspace. They share workspace files rather than receiving separate worktrees. A parent determines what context a delegated child receives and verifies what returns, so either handoff can omit a material constraint. Parallel writers also introduce conflicting assumptions and increase review work.
 
 ## Improvement loop
 

package/SECURITY_MODEL.md

@@ -6,19 +6,19 @@ This document describes SpecPi's architecture-level security assumptions, enforc
 
 ### Experimental native delegation
 
-Delegation is a native extension discovered through the ordinary Pi package and SpecPi lifecycle. Start `pi` normally; workers remain disabled and the model-facing schema absent until human activation. It adds no launcher, separate host process, service or trust override. Parent Pi retains normal resource discovery, trust decisions and proxy policy. Delegation checks required public SDK capabilities, not exact version identifiers. Missing session/runtime/settings/thinking APIs prevent activation; session construction and every request still enforce the tool, model and resource policy. API presence is not proof of every future SDK behavior or a passing integration receipt. Normal installation's minimum Pi version and 0.84.4 bootstrap pin are separate contracts.
+Delegation is a native extension discovered through the ordinary Pi package and SpecPi lifecycle. Start `pi` normally; delegation is enabled by default at the first session start of each Pi process, including TUI, RPC, print and JSON modes, after settings, host and Guard checks. Startup launches no workers or model inference, but Pi-owned authentication/OAuth preparation may occur. The model-facing schema is present only while dispatch is enabled. It adds no launcher, separate host process, service or trust override. Parent Pi retains normal resource discovery, trust decisions and proxy policy. Delegation checks required public SDK capabilities, not exact version identifiers. Missing session/runtime/settings/thinking APIs prevent activation; session construction and every request still enforce the tool, model and resource policy. API presence is not proof of every future SDK behavior or a passing integration receipt. Normal installation's minimum Pi version and 0.84.4 bootstrap pin are separate contracts.
 
 Each worker is an SDK `createAgentSession` instance with in-memory session storage. Pi owns its model/tool loop. A fresh Pi `ModelRuntime` uses standard authentication, environment and `models.json` resolution. Child transport and thinking budgets come from configured global settings; project settings are not loaded. Parent model/thinking are explicit with Pi's supported-level clamping. SpecPi does not extract credentials, copy authentication state or inspect private runtime fields. Preflight rejects runtime-only authentication, selected extension-registered provider overrides, model-specific headers, startup proxy configuration and mismatched safe model descriptors because those routes cannot be faithfully reconstructed. These rejections leave parent configuration unchanged.
 
 This is not full parent inference parity: parent request hooks, ephemeral runtime settings and session affinity are not automatically inherited. Keep delegation disabled if those inherited controls are required for every request. Children load no ambient extensions, skills, AGENTS files or parent transcript. Their only tools are selected-source list/read/literal-search; shell, write, arbitrary plugin, live-web and nested delegation tools are absent. Trusted parent extensions remain privileged in the same process. This is an application boundary, not an OS sandbox against malicious extensions.
 
-Human `/delegate on` activates the displayed experimental calls/time policy. Admission supports only frozen `review` and bounded `scout` analysis. Each job receives its assigned requirement IDs and fixed global constraints. Review needs inline context or selected files; scouts need selected files. A declared parallel benefit requires useful parent work. Structural checks reject unsupported mode/benefit combinations and duplicate normalized questions; they do not prove semantic independence or improved outcomes. Command Guard still intercepts the parent tool; Strict approval binds its capability summary to the exact call and policy generation. Guard, task, scope, model, session and branch changes revoke old generations; normal leaf advancement does not. Model requests cannot enable delegation, change models, raise ceilings or grant tools. Parent acceptance does not mint human authorization, actual verification or wishlist selection.
+The startup default activates the documented experimental calls/time policy. Human `/delegate off` revokes it and `/delegate on` re-enables it. Off and safety revocations survive reloads and session switches; restarting Pi reapplies the on default. No on/off preference is persisted. Admission supports only frozen `review` and bounded `scout` analysis. Each job receives its assigned requirement IDs and fixed global constraints. Review needs inline context or selected files; scouts need selected files. A declared parallel benefit requires useful parent work. Structural checks reject unsupported mode/benefit combinations and duplicate normalized questions; they do not prove semantic independence or improved outcomes. Command Guard still intercepts the parent tool; Strict approval binds its capability summary to the exact call and policy generation. Guard, task, scope, model, session and branch changes revoke old generations; normal leaf advancement does not. Model requests cannot enable delegation, change models, raise ceilings or grant tools. Parent acceptance does not mint human authorization, actual verification or wishlist selection.
 
-Command Guard is optional for delegation. Human activation works when Guard is absent or Off; read-only snapshot tools, admission policy and resource limits are enforced by delegation itself. An installed Guard's Strict approvals and explicit locks still apply. A responder with an unready policy, or multiple responders, blocks activation with a specific error. Guard installation, removal or mode changes invalidate the enabled generation before further worker calls.
+Command Guard is optional for delegation. Activation works when Guard is absent or Off; read-only snapshot tools, admission policy and resource limits are enforced by delegation itself. An installed Guard's Strict approvals and explicit locks still apply. A responder with an unready policy, or multiple responders, blocks activation with a specific error. Guard installation, removal or mode changes invalidate the enabled generation before further worker calls.
 
 Guard responders reattach on each session startup, including reuse of an extension instance. Invalid commands, declined confirmations and no-op mode requests do not revoke delegation. Accepted changes and critical locks do; an asynchronous confirmation must still match the active Guard generation before it can commit.
 
-The human activation choice follows subsequent parent provider/model and thinking selections. A selection revokes old generations and preflights the new host before automatically resuming dispatch; unsupported selections pause without falling back to the previous model. No job is automatically retried and no quota or settling slot is reset. New model generations invalidate old Strict approval fingerprints. Concurrent setup is bound to the latest selection and extension instance; completion cannot undo explicit off, Guard revocation or session/task/scope changes. Status distinguishes the requested on/off choice from whether dispatch is ready.
+The default or human activation choice follows subsequent parent provider/model and thinking selections. A selection revokes old generations and preflights the new host before automatically resuming dispatch; unsupported selections pause without falling back to the previous model. No job is automatically retried and no quota or settling slot is reset. New model generations invalidate old Strict approval fingerprints. Concurrent setup is bound to the latest selection and extension instance; completion cannot undo explicit off, Guard revocation or session/task/scope changes. Status distinguishes the requested on/off choice from whether dispatch is ready.
 
 The broker reads only explicitly selected, bounded regular text files under the fixed canonical working root captured for the Pi process, with private-path, traversal, symlink/junction, hardlink, binary and size checks. Restart Pi to change this root or load a new delegation runtime version. It rechecks source identity/content and validates evidence line ranges. Each job sees only its selected IDs. These checks assume a trusted local filesystem: portable Node APIs do not establish an atomic OS snapshot against hostile filesystem races, and filenames cannot reveal secrets embedded in ordinary source files. No live web adapter is included.
 
@@ -30,6 +30,10 @@ Incremental stream checks count recognized delta bytes and bound event structure
 
 The same controller and bounded idempotency journal remain in memory for the Pi process lifetime, including `/reload`, session switches and off/on. Successful spending and final-disposition receipts are retained (at most 20 under the fixed ceilings); cancellation and nonfinal assessments have a separate 128-entry oldest-first cache. Failures reserve no keys. Cache churn cannot evict spending receipts, reset quotas or disable cancellation. Limits are two active workers, four batches and 32 SDK invocations per process; two jobs and 8 invocations per batch; four invocations per logical job including follow-up. Invalidation does not reset these counters or release settling work. Completed reports retain their source bindings after the deadline, but child sessions are released at the deadline and later follow-up is rejected. These numeric limits are engineering choices, not empirical optima.
 
+Logical jobs default to 10 minutes and batches to 20 minutes. Human `/delegate timeout <minutes>` persists a whole-minute value from 1–60 while delegation is off; the batch window is twice the job window. Queue and follow-up time count from admission. SDK request timeouts and adapter abort timers use the remaining job window, with a 60-minute ceiling. Changes revoke old policy bindings, never extend old jobs or reset quotas/settling slots, and are absent from the model-facing schema. The effective time policy is included in Guard fingerprints and packet digests. Longer windows also allow longer in-memory input/child retention; they do not add calls, retries or billing guarantees.
+
+Only the numeric timeout preference is persisted under `<agent-dir>/specpi/delegation/settings.json`; its previous content and SHA-256 are backed up in `settings.json.bak`. The human-selected agent directory is canonicalized once, including platform aliases; owned SpecPi subdirectories and preference files still reject links. Reads reject malformed/nonregular settings and are bounded to 4 KiB; the encoded backup has a separate 32 KiB bound. Saves use exclusive staging and atomic promotion. Invalid settings block activation. This store does not read Pi authentication, settings or sessions. The process loads it once; manual or other-process edits require restart, and concurrent saves are last-writer-wins. As with snapshots, this is a trusted-local-filesystem contract, not protection against hostile filesystem races. User-owned preferences survive uninstall. Requested file/directory modes are 0600/0700; Windows relies on profile ACLs.
+
 Shared snapshot text is destroyed once no job can continue; failed attempts retain original expiry cleanup. Packet/job-input references are dropped after owned workers settle. Metadata and digests remain for completed receipt freshness. Starting the next accepted batch retires previous reports; invalidation retires old generations after settlement. Retired batch objects are pruned, leaving only bounded state summaries and idempotency/usage counters. Replay cannot restore their reports, inputs, sessions or allowances. JavaScript strings, provider buffers and values already returned to Pi cannot be securely erased.
 
 Selected context reaches the configured provider; normal parent tool results may be retained by Pi. Child sessions use memory only, with no child session database, raw metrics journal, credential copy, automatic resume or policy learning, or secure memory-erasure guarantee. See the [implemented protocol](docs/delegation/protocol.md) for states and receipts. SDK integration and synthetic-provider fixtures concern the runtime contract; their existence does not establish full parent inference parity or measured outcome gains.
@@ -152,6 +156,32 @@ The GitHub Pages workflow publishes the checked-in `site/` directory. Its deploy
 
 Repository checks, smoke tests, checksums, closed capability validators, and browser comparisons provide evidence for documented behavior. They reduce regression risk but do not prove the absence of vulnerabilities or establish cryptographic provenance for dependencies and releases.
 
+## SpecPi Chat editor integration
+
+The optional `vscode/` extension is distributed separately from the SpecPi npm installation. It runs in the VS Code workspace extension host and requires a trusted filesystem workspace before launching Pi or collecting file context. Only application-level settings choose executable paths; the launcher resolves native executables or known adjacent Pi JavaScript entry points and never executes a shell command string. Pi runs in the explicitly selected workspace with its normal installed extensions and provider configuration. VS Code trust does not replace Pi project trust, and the extension does not pass a flag to bypass Pi's trust decisions or Command Guard.
+
+The sidebar uses Pi's documented JSONL RPC protocol. Pi owns provider authentication and tool execution; the extension does not read, copy, or manage authentication files. RPC model metadata is projected to display fields. Approvals and selection/input/editor requests are displayed as text and require an exact response for the requesting conversation's active request. Switching the displayed conversation preserves outstanding requests; background requests appear as needing input and never receive automatic approval. Stop, disconnect, runtime session transitions, and expiry cancel the affected conversation's requests. Expired or wrong-conversation responses cannot authorize later requests. In RPC, Command Guard starts in Guard mode without an initial selection dialog because Pi cannot read dialog responses until its startup handlers return; explicit `/guard` commands remain available after startup. Unsupported terminal-only components are disclosed rather than treated as functional editor controls.
+
+Chat allows up to 90 seconds for an initial read-only RPC readiness probe before sending normal requests. This accommodates the 30-second startup fallback in older installed Guard versions without extending later request deadlines. Dialogs arriving before readiness receive cancellation only, never an approval or mode selection; the sidebar explains the limitation and retains a notice after connection. An extension with an unbounded startup dialog can still prevent readiness. Chat times out with recovery guidance instead of bypassing that extension or changing the user's installed harness.
+
+The webview loads only packaged scripts/styles under a strict content security policy, forbids network resources, and renders model/tool/file text without interpreting embedded HTML. Images use validated data URLs under `img-src data:`; remote image URLs are never fetched by the webview. HTTP(S) links, including external image links, require a human click and pass through VS Code's external-link API. Clicked code references use a separate host action: paths are parsed, checked against the selected workspace, canonicalized, and restricted to regular non-sensitive files before VS Code opens the file and reveals a clamped line/range. Clicked workspace Markdown image references use the same path boundary and the image validator before a preview is returned. Arbitrary command and URI handlers are not executed. Raw paths preserve literal percent signs; Markdown link destinations and explicit local file URLs are decoded once before filesystem validation.
+
+Text/code context requires an explicit file/selection action, is size-bounded, rejects binary and known sensitive paths, and checks canonical workspace containment. Workspace file suggestions enumerate a bounded set of names; choosing a suggestion invokes the same attachment validation before reading contents. Dropped workspace URIs are validated independently of their browser representation. Native image selection, clipboard images, and dropped image files are explicit attachment actions and may supply images from outside the selected workspace; filesystem image sources still require ordinary files and pass sensitive-path checks. Pi-state names such as `auth`, `trust`, `sessions`, `missions`, and `history` are reserved inside `.pi`, Chat-owned storage, and the configured Pi agent directory (including its canonical target), not arbitrary source directories. Global credential/key patterns remain blocked, including `auth.json`. Relative `PI_CODING_AGENT_DIR` overrides retain conservative name blocking because they resolve in the child workspace; use an absolute path or `~/…` to obtain directory-scoped filtering. These filename checks and format validators are not content-based secret detectors. Manually typed messages, ordinary files, and images may contain sensitive content, and the extension does not promise image metadata removal. Prompts and attachments are sent to the provider selected in Pi when the user sends them.
+
+Image content is checked for supported PNG, JPEG, GIF, or WebP structure, declared MIME agreement, dimensions, and bounded base64 size. Each image is limited to 5 MiB, 16,384 pixels per side, and 40 million pixels. A prompt permits eight mixed attachments and 20 MiB of image bytes. The display retains at most 32 images / 20 MiB and reports omitted content; this is separate from Pi's persisted history. RPC records and buffered writes have independent 64 MiB caps. Recognized oversized history responses with a matching pending request are drained without accumulating the remaining bytes, then rejected without terminating Pi. The sidebar reports omitted history and remains usable; other oversized protocol records terminate the connection. A large historical transcript can exceed the RPC cap even when its original prompts were individually valid. Media caches remain in memory, are referenced by opaque identifiers while streaming, and are released as content is no longer retained. No remote image fetch, image processing service, or new image dependency is introduced. Pi/provider image limits and behavior remain upstream contracts.
+
+Connection teardown resets transient run bookkeeping without discarding displayed partial text. An accepted prompt is never restored because a later status refresh failed, and the Refresh status action performs read-only RPC queries instead of replaying work. RPC request IDs correlate replies; they do not make retries idempotent. A lost connection before acknowledgement leaves the prompt outcome uncertain.
+
+Image prompts require a model advertising image input. Rejection retains the unsent draft and attachments. Image-bearing slash commands are rejected because Pi extension commands can acknowledge execution without consuming image arguments. Stop clears queued work before aborting. Pi's queue-clear response contains text only, so Chat retains bounded in-memory image snapshots for its accepted queued submissions and restores them only after an exact, unambiguous match and an explicit user action. It does not attach discarded or unmatched images to a later prompt, automatically resend recovered work, or treat a missing acknowledgement as proof of failure.
+
+Pi persists chats, including sent image blocks, in a workspace-specific directory under the extension's VS Code storage. A bounded atomic catalog stores only identifiers, titles, timestamps, archive flags, and paths of conversations created there. It never scans or opens terminal Pi history or writes transcripts to VS Code settings, logs, telemetry, or persistent webview state. Each conversation's live projection, draft, and attachment snapshots stay in memory with per-conversation bounds. Resume is limited to catalogued regular files inside the owned session directory. Renaming and reversible archiving change catalog metadata without opening transcripts; archiving neither deletes files nor stops a live process. Uninstalling the extension does not promise secure deletion of VS Code storage. POSIX permissions are requested where supported; Windows relies on the profile's ACLs. As elsewhere in SpecPi, local filesystem races, a compromised extension host, an untrusted Pi executable, or same-user tampering are outside the isolation guarantee.
+
+Conversation edits select entries from the active Pi tree, revalidate the selection before mutation, and fork before the chosen user prompt. Exact original text and validated image blocks are captured before forking because Pi's fork response returns text only. The original conversation is retained, restored drafts require another send action, and conversation forks/clones do not restore or checkpoint workspace files. Actions are scoped to the active workspace, connection, and session revision. Export opens an unsaved Markdown document and Copy Conversation writes the visible Markdown to the OS clipboard only on explicit request. Both omit image bytes and represent images as placeholders; they do not reconstruct truncated or hidden history. Usage displays report Pi measurements, preserving unavailable values rather than inventing totals. The separate provider Limits row projects bounded strings from the known Codex Usage and pi-usage status keys, strips terminal/control sequences, and inserts text only. It does not parse numeric quotas, combine budgets with conversation cost, read provider credentials or usage-cache files, or add provider requests. Reports stay with their live connection and are cleared on disconnect, exit, and reconnect; refreshing and cache age remain upstream plugin responsibilities. Opening the details has no RPC or provider side effect. Existing `/usage` notifications and exact confirmation dialogs continue through the normal UI protocol; no automatic reset consumption or terminal-footer emulation is added.
+
+Native change review reads VS Code's Git API, validates selected workspace paths, and opens the corresponding working-tree or staged view through the built-in diff/editor actions. It does not execute a shell command, stage, commit, discard, or restore files. Git integration availability and the filesystem race boundary still apply. The sidebar coordinator keeps independent Pi connections for explicitly opened conversations. Switching conversations or folders only changes the selected view. Stop and Disconnect target the selected process; extension-host shutdown stops all owned processes. User-initiated parallel conversations share their workspace files and are not isolated worktrees. Branching uses Pi's pre-runtime `--fork` to copy into a new owned session before extensions can write, then performs any active-branch or prompt selection there; the original process and session remain unchanged.
+
+The extension introduces no network server, telemetry, runtime package dependency, or automatic model request when a view opens. Pi itself may contact its configured services when connected. Tests use synthetic homes, agent directories, providers, workspaces and profiles, plus an installed VS Code extension host; they do not access the user's live Pi credentials or conversations. Live provider availability and billing are outside the offline test evidence.
+
 ## Supply-chain assumptions
 
 SpecPi pins reviewed executable package versions and the browser dependency graph. These controls improve repeatability and make version changes reviewable. They do not prove that a registry, publisher account, package artifact, downloaded browser, GitHub Action tag, or invoking host is uncompromised. Releases are not described as reproducible or cryptographically signed unless a future release adds and documents those mechanisms.

package/THIRD_PARTY.md

@@ -1,5 +1,11 @@
 # Third-party components
 
+SpecPi Chat is a separate VS Code extension built with the public VS Code Webview View API and Pi `0.84.4`'s documented RPC protocol. VS Code and the installed Pi runtime retain their upstream licenses; neither is bundled in the VSIX. The extension and its ZIP/VSIX packager use Node built-ins and first-party source only, with no added runtime or development dependency. Its tests reuse the repository's pinned Playwright and Pi packages. Provider authentication, requests, billing, and normal Pi background behavior remain owned by the configured Pi runtime.
+
+Chat's provider Limits row recognizes the public RPC `setStatus` presentation contracts of `@llblab/pi-codex-usage` **0.9.3** (`aa-codex-usage`) and `@sreetej510/pi-usage` **0.9.9** (`provider-usage`). Public source was checked at commits `1a97ee5560c5d7dd3b99ce34e2dcfe456592f8a0` and `9dee3b590f736c723011e3bc3717b3f0d6e8072b`, respectively. Tests reproduce their status/notification contracts through synthetic local Pi RPC, not live accounts or upstream provider requests. Text retains each plugin's quota semantics rather than converting or aggregating measurements. Neither plugin is bundled in the VSIX; this compatibility change does not install pi-usage or change SpecPi's existing package pins. Plugins retain ownership of authentication, caching, refresh/backoff, and explicit reset-consumption confirmation.
+
+Chat uses Pi's image content blocks, conversation tree/fork/clone operations, and session statistics, plus the installed VS Code Git extension's public API for diff review. Version 0.3.0 retains a separate Pi process for each connected conversation and uses Pi's `--fork <session>` CLI option to copy branch history before runtime extensions initialize; the original live session remains untouched. Image container validation and base64 framing are first-party code; display uses VS Code's embedded browser image decoders. No image codec, provider SDK, export package, or remote image service is added. Local acceptance of PNG, JPEG, GIF, or WebP does not establish that every configured provider accepts the same formats or animation behavior. RPC records and buffered writes are capped at 64 MiB; image prompts and rendered media have separate, smaller limits documented in the extension guide.
+
 Delegation loads `clampThinkingLevel` from the Pi SDK when exported there, otherwise
 from the public `@earendil-works/pi-ai/compat` subpath declared in Pi's
 [package exports](https://github.com/earendil-works/pi/blob/main/packages/ai/package.json).

package/docs/delegation/README.md

@@ -1,6 +1,6 @@
 # Bounded delegation
 
-Status: experimental in SpecPi 0.13.0. Disabled by default.
+Status: experimental in SpecPi 0.16.0. Enabled by default at Pi startup.
 The package remains `specpi`; no separate npm package or background service is required.
 
 SpecPi keeps one agent responsible for changes and acceptance. This extension adds
@@ -62,12 +62,16 @@ those inherited controls for every request must keep delegation disabled. Receip
 bind supported model and source descriptors; they cannot certify an unchanged remote
 service or every configuration change behind a stable provider identity.
 
-## Enable deliberately
+## Control delegation
 
-In the interactive session:
+The first session start of each Pi process enables delegation after settings, host and
+Guard checks, in TUI, RPC, print and JSON modes. Startup does not launch workers or
+model inference. Preflight may perform Pi-owned authentication/OAuth preparation.
+Use one agent for small or sequential work; delegate only a justified independent question.
+
+In an interactive session:
 
 ```text
-/delegate on
 /delegate status
 /delegate limits
 /delegate cancel <batchId>
@@ -93,9 +97,12 @@ it does not retain or display live child reasoning. RPC and print mode keep the
 structured tool responses and do not mount terminal widgets. The UI uses Pi's public
 [widget and tool-rendering APIs](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md).
 
-`on` grants the displayed experimental calls/time envelope. There is no model-call
-permission toggle in the model-facing tool. `limits` is read-only; the shipped ceilings
-cannot be raised by prompts. Turning delegation off, changing guard policy, switching
+The startup default enables the documented experimental calls/time envelope. Use
+`/delegate off` to revoke it and `/delegate on` to explicitly re-enable it. Off and
+safety revocations survive `/reload` and session switches; restarting Pi reapplies the
+on default. No on/off preference is written to disk. There is no model-call
+permission toggle in the model-facing tool. `limits` is read-only; prompts cannot
+change timeouts or raise other ceilings. Turning delegation off, changing guard policy, switching
 sessions or models, navigating branches, and changing task/scope bindings revoke the
 current generation. Off/on, `/reload` and session switches do not reset the Pi process's
 counters or free requests that are still settling. The same in-memory controller remains
@@ -108,7 +115,7 @@ unsettled slots and consumed quotas, and checks the new host before resuming dis
 Old jobs are not retried. An unsupported selection pauses delegation with a reason;
 selecting a compatible model resumes it automatically. `/delegate off` remains off
 through later model changes. Guard, task/scope and session lifecycle changes still
-revoke activation. Status separates the user's `requested` choice from `enabled`
+revoke activation. Status separates the default or human `requested` choice from `enabled`
 dispatch, with `updating` and `pauseReason` for model setup.
 
 While delegation is off, its tool is removed from the parent's active tool list.
@@ -123,6 +130,42 @@ the error identifies that state. `/delegate status` reports the observed Guard s
 Worker tool restrictions and resource limits are enforced independently of Guard. A worker result
 cannot authorize a write, a commit, a deployment, or an improvement.
 
+## Configure the timeout
+
+The default is **10 minutes per logical job** (previously 2 minutes). In Pi:
+
+```text
+/delegate off
+/delegate timeout 15
+/delegate on
+```
+
+`/delegate timeout` shows the current value; `/delegate timeout reset` saves the
+10-minute default. Tab completion suggests common values. Use whole minutes from
+**1 to 60**; there is no unlimited setting. The batch deadline is twice the job
+timeout (20 minutes by default), so it does not truncate the configured job window.
+Both deadlines start at batch admission and include queue and follow-up time; a
+follow-up never gets a fresh timeout. Provider requests use the remaining job window,
+not a separate two-minute cap. Provider-side limits may still end requests sooner.
+
+Changes require delegation to be off, including when model setup is pending or paused.
+They apply to this process and future Pi starts; they cannot extend old jobs, reset
+call quotas or free requests still settling. `/delegate on`, `status`, `limits` and
+Strict Guard policy summaries display the effective timeout. Only the human command
+can configure it; the model-facing tool has no timeout-setting operation.
+
+The preference is stored in `<agent-dir>/specpi/delegation/settings.json`, where
+`<agent-dir>` is `PI_CODING_AGENT_DIR` or `~/.pi/agent`. It contains only
+`{"schema":1,"timeoutMinutes":15}`. Saves atomically replace this file and keep the
+previous contents plus their SHA-256 in `settings.json.bak`. No Pi settings,
+authentication, sessions or history are read or changed by this preference store.
+The human-selected agent directory is resolved once, supporting platform path aliases.
+Preference files and SpecPi subdirectories must not be links. Malformed, oversized or
+unreadable settings block activation rather than silently using another timeout. Repair them manually
+and restart Pi. Manual edits and changes from another Pi process take effect on
+restart; `/reload` preserves the current process policy and counters. The preference
+survives uninstall as user-owned configuration.
+
 ## Admit a specific purpose
 
 | Mode     | Required structure                                                                                                                    | Context and tools                                                                         |
@@ -165,7 +208,7 @@ and counters. [Protocol and executable examples](protocol.md) define the exact f
 | Batches / jobs            | 4 batches per Pi process; one unresolved batch; 2 jobs per batch             |
 | SDK model invocations     | 32 per Pi process, 8 per batch; 4 per logical job including follow-up        |
 | Follow-ups / retries      | 1 changed-input follow-up per job; provider and session retries disabled     |
-| Time                      | 120 seconds per logical job; 300 seconds per batch, including follow-up time |
+| Time                      | 10 minutes per job by default (human configurable 1–60); batch twice that; queue/follow-up included |
 | Packet / child context    | 256 KiB, checked before dispatch                                             |
 | Selected sources          | 200 files and 8 MiB per batch                                                |
 | Tools                     | 12 calls and 64 KiB total returned JSON per logical job                      |

package/docs/delegation/design.md

@@ -2,7 +2,7 @@
 
 Status: archived target architecture, not the implemented runtime contract.
 
-The experimental implementation is part of `specpi` and is disabled by default.
+The experimental implementation is part of `specpi` and is enabled by default at Pi startup.
 Read the [implemented guide](README.md) and [calls/time protocol](protocol.md) for
 supported commands, tested API compatibility, limits and trust assumptions. This
 document preserves the original broader proposal, including unimplemented live-web,

package/docs/delegation/protocol.md

@@ -4,8 +4,12 @@ This is the implemented in-process API. It has no HTTP listener, daemon, child p
 or child session store. The broader [target protocol](design-protocol.md) remains a
 proposal; its stronger transport/attempt/cost gates are not supplied by this version.
 
-The extension loads through normal `pi` package discovery and remains disabled until
-the human runs `/delegate on`. Compatibility is checked through required public SDK
+The extension loads through normal `pi` package discovery and enables delegation at
+the first session start of each Pi process, including noninteractive modes. Startup
+preflights the host but launches no workers or model inference; Pi-owned authentication
+preparation may occur. `/delegate off` and safety revocations survive reloads and session
+switches; `/delegate on` re-enables it, and restarting Pi reapplies the on default.
+Compatibility is checked through required public SDK
 capabilities; there is no exact-version allowlist. Missing APIs prevent activation and
 are named in the error. The runtime also verifies the created session's thinking,
 tools and streaming interface. Tested versions are evidence, not an activation gate.
@@ -18,7 +22,7 @@ overrides, model-specific headers, startup proxy configuration and safe model-de
 mismatches fail preflight. Parent request hooks,
 ephemeral runtime settings, session affinity and ambient resources are not inherited.
 
-Command Guard is optional. Absent and Off states permit human activation; an installed
+Command Guard is optional. Absent and Off states permit activation; an installed
 Guard's Strict approvals and explicit locks remain enforced. Unready or duplicate
 Guard responders prevent activation with a specific error. Guard state changes revoke
 the current delegation generation. Snapshot tools and resource limits are enforced
@@ -36,9 +40,22 @@ data are rejected. The host creates identities and receipts; workers cannot supp
 The protocol identifier `bounded-pi-sessions-v1` and inference contract
 `pi-agent-session-v1` describe the host implementation, not model-selected options.
 
+## Human timeout preference
+
+Logical jobs default to 10 minutes; batches default to 20 minutes. Human
+`/delegate timeout <minutes>` saves a whole-minute value from 1 to 60 while delegation
+is off; `timeout reset` saves 10. The batch window is twice the job window.
+Deadlines start at admission and include queue and the single follow-up. Provider
+request timeouts and the adapter abort timer honor the remaining job window, capped
+at 60 minutes. Settings changes invalidate old policy bindings without resetting
+quotas or settling slots. No tool operation or packet field can change the timeout.
+See the [configuration guide](README.md#configure-the-timeout) for persistence and
+recovery. Status limits, packet digests and Guard fingerprints bind the effective
+policy rather than assuming the shipped default.
+
 ## Submit a batch
 
-After the human runs `/delegate on`, the parent calls the `delegate` tool:
+When delegation is enabled, the parent calls the `delegate` tool:
 
 ```json
 {
@@ -235,7 +252,7 @@ maximum. These are experiment limits, not research-derived optimal values.
 Human off/on, task changes,
 branch navigation, model selection, guard changes and reloads revoke old generations;
 they do not create a new resource allowance. Normal parent turns do not revoke a job.
-Model and thinking selections retain the human's activation choice. The extension
+Model and thinking selections retain the default or human activation choice. The extension
 preflights the latest selected host and resumes dispatch automatically, without
 replaying old jobs. Unsupported selections pause dispatch and report `pauseReason`;
 a compatible selection resumes it. Status exposes `requested`, `updating` and

package/extensions/command-guard/index.ts

@@ -229,7 +229,10 @@ export default function registerCommandGuard(
         const startupGeneration = state.generation;
         try {
             subscribeGuardState();
-            const choice = ctx.hasUI ? await startupChoice(ctx, startupTimeoutMs) : undefined;
+            // Pi RPC binds session_start before it starts reading UI responses.
+            // Begin guarded without a startup dialog; /guard remains available
+            // for explicit changes once the RPC client is connected.
+            const choice = ctx.hasUI && ctx.mode !== "rpc" ? await startupChoice(ctx, startupTimeoutMs) : undefined;
             if (state.generation !== startupGeneration) {
                 return;
             }

package/extensions/delegation/core.mjs

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { createSnapshot } from "./snapshot.mjs";
-import { LIMITS, digest, validateOperation } from "./protocol.mjs";
+import { LIMITS, digest, timeoutLimits, validateOperation } from "./protocol.mjs";
 import { runWorker } from "./worker.mjs";
 import { DelegationError, publicErrorMessage } from "./errors.mjs";
 
@@ -17,7 +17,7 @@ export function createDelegationController({
     worker = runWorker,
     getGuard = () => "absent",
 }) {
-    const policy = Object.freeze(
+    let policy = Object.freeze(
         Object.fromEntries(
             Object.entries(LIMITS).map(([key, maximum]) => {
                 const value = limits[key] ?? maximum;
@@ -707,6 +707,17 @@ export function createDelegationController({
         status,
         presentation,
         invalidate,
+        // Human command only; never exposed through execute() or the model schema.
+        setTimeoutMinutes(minutes) {
+            const times = timeoutLimits(minutes);
+            if (enabled) {
+                throw new DelegationError("Turn delegation off before changing its timeout: /delegate off");
+            }
+
+            invalidate("timeout policy changed");
+            policy = Object.freeze({ ...policy, ...times });
+            changed();
+        },
         enable() {
             const host = getHost();
             const guard = getGuard();

package/extensions/delegation/extension.mjs

@@ -1,8 +1,11 @@
 import { DelegationError, publicErrorMessage } from "./errors.mjs";
 import { randomUUID } from "node:crypto";
 import { createDelegationController } from "./core.mjs";
+import { DEFAULT_TIMEOUT_MINUTES, timeoutLimits } from "./protocol.mjs";
 import { createLivePanel, createToolRenderers, readableLimits, readableStatus } from "./presentation.mjs";
 
+const USAGE = "Usage: /delegate [on|off|status|limits|timeout [<minutes>|reset]|cancel <batchId>]";
+
 const integer = { type: "integer", minimum: 0 };
 const string = { type: "string" };
 const strings = { type: "array", items: string };
@@ -92,7 +95,7 @@ export const DELEGATE_SCHEMA = {
 /** The native entry supplies a preflighted Pi child-session host for the active context. */
 export function createDelegationExtension(
     getHost,
-    { root = process.cwd(), controllerOptions = {}, prepareContext = () => {}, presentation } = {},
+    { root = process.cwd(), controllerOptions = {}, prepareContext = () => {}, presentation, timeoutStore } = {},
 ) {
     let currentPi;
     let currentContext;
@@ -101,6 +104,7 @@ export function createDelegationExtension(
     let detach = () => {};
 
     let requested = false;
+    let startupActivation = true;
     let requestedGuard;
     let boundHost;
     let pending;
@@ -130,6 +134,14 @@ export function createDelegationExtension(
         getGuard,
         onChange: updatePresentation,
     });
+    let timeoutLoaded = !timeoutStore;
+    const loadTimeout = () => {
+        if (!timeoutLoaded) {
+            controller.setTimeoutMinutes(timeoutStore.load());
+            timeoutLoaded = true;
+        }
+    };
+
     const panel = presentation ? createLivePanel(() => controller.presentation(), presentation) : undefined;
 
     const status = () => ({
@@ -155,7 +167,11 @@ export function createDelegationExtension(
         panel?.update();
     }
 
-    function invalidate(reason) {
+    function invalidate(reason, preserveStartupDefault = false) {
+        if (!preserveStartupDefault) {
+            startupActivation = false;
+        }
+
         requested = false;
         pending = undefined;
         boundHost = undefined;
@@ -186,7 +202,7 @@ export function createDelegationExtension(
         const isBound = () => issuedEpoch === bindingEpoch;
         toolsReady = false;
         prepareContext(undefined, true);
-        invalidate("runtime factory rebound");
+        invalidate("runtime factory rebound", true);
         currentPi = pi;
         currentContext = undefined;
         const refreshSelection = async (ctx) => {
@@ -325,7 +341,7 @@ export function createDelegationExtension(
             });
         }
 
-        pi.on("session_start", (_event, ctx) => {
+        pi.on("session_start", async (_event, ctx) => {
             if (!isBound()) {
                 return;
             }
@@ -333,12 +349,27 @@ export function createDelegationExtension(
             currentContext = ctx;
             toolsReady = true;
             panel?.bind(ctx);
-            invalidate("session started or resources reloaded");
+            invalidate("session started or resources reloaded", true);
             try {
+                loadTimeout();
                 prepareContext(ctx, true);
+                // Consume the default only after synchronous preparation, which
+                // may revoke it. Off and safety events cancel it even before startup.
+                const activate = startupActivation;
+                startupActivation = false;
+                if (activate && isBound()) {
+                    requested = true;
+                    requestedGuard = getGuard();
+                    await refreshSelection(ctx);
+                    if (isBound() && requested && pauseReason) {
+                        ctx.ui.notify(`Delegation paused: ${pauseReason}`, "warning");
+                    }
+                }
             } catch (error) {
                 pauseReason = publicErrorMessage(error);
                 ctx.ui.notify(`Delegation unavailable: ${pauseReason}`, "warning");
+            } finally {
+                startupActivation = false;
             }
         });
         pi.on("session_shutdown", () => {
@@ -368,9 +399,23 @@ export function createDelegationExtension(
             }
         });
         pi.registerCommand("delegate", {
-            description: "Enable bounded read-only delegation or inspect its session limits",
+            description:
+                "Control read-only delegation (on at Pi startup), inspect limits, or save timeout <minutes> (1–60; reset: 10)",
             getArgumentCompletions: (prefix) =>
-                ["on", "off", "status", "limits", "cancel"]
+                [
+                    "on",
+                    "off",
+                    "status",
+                    "limits",
+                    "timeout",
+                    "timeout 5",
+                    "timeout 10",
+                    "timeout 15",
+                    "timeout 30",
+                    "timeout 60",
+                    "timeout reset",
+                    "cancel",
+                ]
                     .filter((value) => value.startsWith(prefix.trim()))
                     .map((value) => ({ value, label: value })),
             handler: async (args, ctx) => {
@@ -383,8 +428,8 @@ export function createDelegationExtension(
                 currentContext = ctx;
                 const [action = "status", id, extra] = args.trim().split(/\s+/u).filter(Boolean);
                 try {
-                    if (extra || (id && action !== "cancel")) {
-                        throw new DelegationError("Usage: /delegate [on|off|status|limits|cancel <batchId>]");
+                    if (extra || (id && !["cancel", "timeout"].includes(action))) {
+                        throw new DelegationError(USAGE);
                     }
 
                     if (action === "on") {
@@ -392,6 +437,7 @@ export function createDelegationExtension(
                             throw new DelegationError("Delegation activation requires a human interactive command");
                         }
 
+                        loadTimeout();
                         requested = true;
                         requestedGuard = getGuard();
                         await refreshSelection(ctx);
@@ -408,7 +454,38 @@ export function createDelegationExtension(
 
                         syncActiveTool(true);
                         ctx.ui.notify(
-                            `Delegation enabled: Pi child sessions for review and scout, ${state.model.provider}/${state.model.id}, thinking ${state.model.thinkingLevel ?? "Pi configured"}. At most 2 workers, 4 batches and 32 SDK inference calls per Pi process; 120 seconds per job. Workers see only supplied text and selected snapshots. Pi owns configured authentication; temporary parent provider/auth overrides and parent hooks are not inherited. No shell, edits, recursion, automatic retries or compaction. /delegate off cancels workers; SDK requests still settling retain their slots. These limits do not guarantee remote termination or a billing cap.`,
+                            `Delegation enabled: Pi child sessions for review and scout, ${state.model.provider}/${state.model.id}, thinking ${state.model.thinkingLevel ?? "Pi configured"}. At most 2 workers, 4 batches and 32 SDK inference calls per Pi process; ${state.limits.jobMs / 60_000} minutes per job, ${state.limits.batchMs / 60_000} minutes per batch. Configure with /delegate timeout <minutes> while off (saved across restarts). Workers see only supplied text and selected snapshots. Pi owns configured authentication; temporary parent provider/auth overrides and parent hooks are not inherited. No shell, edits, recursion, automatic retries or compaction. /delegate off cancels workers; SDK requests still settling retain their slots. These limits do not guarantee remote termination or a billing cap.`,
+                            "info",
+                        );
+                    } else if (action === "timeout") {
+                        if (id) {
+                            if (!ctx.hasUI) {
+                                throw new DelegationError("Timeout changes require a human interactive command");
+                            }
+
+                            if (requested || pending || controller.status().enabled) {
+                                throw new DelegationError(
+                                    "Turn delegation off before changing its timeout: /delegate off",
+                                );
+                            }
+
+                            const minutes =
+                                id === "reset" ? DEFAULT_TIMEOUT_MINUTES : /^\d+$/u.test(id) ? Number(id) : NaN;
+                            timeoutLimits(minutes);
+                            if (!timeoutStore) {
+                                throw new DelegationError("Persistent delegation settings are unavailable");
+                            }
+
+                            timeoutStore.save(minutes);
+                            controller.setTimeoutMinutes(minutes);
+                            timeoutLoaded = true;
+                        } else {
+                            loadTimeout();
+                        }
+
+                        const limits = controller.status().limits;
+                        ctx.ui.notify(
+                            `Delegation timeout: ${limits.jobMs / 60_000} minutes per job; ${limits.batchMs / 60_000} minutes per batch, including queue and follow-up time. ${id ? "Saved for this process and future Pi starts. " : ""}Use /delegate timeout <minutes> (1–60) or /delegate timeout reset (10). Changes require /delegate off; call budgets do not reset.`,
                             "info",
                         );
                     } else if (action === "off") {
@@ -428,7 +505,7 @@ export function createDelegationExtension(
                         const state = status();
                         ctx.ui.notify(action === "limits" ? readableLimits(state) : readableStatus(state), "info");
                     } else {
-                        throw new DelegationError("Usage: /delegate [on|off|status|limits|cancel <batchId>]");
+                        throw new DelegationError(USAGE);
                     }
                 } catch (error) {
                     ctx.ui.notify(publicErrorMessage(error), "error");
@@ -439,7 +516,7 @@ export function createDelegationExtension(
             name: "delegate",
             label: "Delegate",
             description:
-                "Delegate an independent frozen review or substantial selected-source analysis to a real Pi child session. Only after human /delegate on. review: check artifacts against assigned requirements in fresh context; scout: answer a distinct evidence question over selected sources. Prefer one worker and parent-only execution for small, sequential or routine work. No shell, edits or live web. run returns immediately; collect waits for advisory evidence, then resolve findings after verification. One changed-input follow_up shares the original budget/deadline. Never grants permission or proves task completion.",
+                "Delegate an independent frozen review or substantial selected-source analysis to a real Pi child session. Enabled by default at Pi startup; respect /delegate off and safety revocations. review: check artifacts against assigned requirements in fresh context; scout: answer a distinct evidence question over selected sources. Prefer one worker and parent-only execution for small, sequential or routine work. No shell, edits or live web. run returns immediately; collect waits for advisory evidence, then resolve findings after verification. One changed-input follow_up shares the original budget/deadline. Never grants permission or proves task completion.",
             parameters: DELEGATE_SCHEMA,
             ...(presentation ? createToolRenderers(presentation) : {}),
             execute: async (_id, input, signal, _update, ctx) => {

package/extensions/delegation/managed-files.mjs

@@ -4,6 +4,7 @@ export const DELEGATION_MANAGED_FILES = Object.freeze([
     "extension.mjs",
     "core.mjs",
     "protocol.mjs",
+    "settings.mjs",
     "provider.mjs",
     "snapshot.mjs",
     "worker.mjs",

package/extensions/delegation/native.mjs

@@ -4,9 +4,10 @@ import { randomUUID } from "node:crypto";
 import { createDelegationExtension } from "./extension.mjs";
 import { createNativePiHost, getPiSessionCompatibilityError } from "./provider.mjs";
 import { DelegationError } from "./errors.mjs";
+import { createTimeoutStore } from "./settings.mjs";
 
 const stateKey = Symbol.for("specpi.delegation.native.v1");
-const revision = 7;
+const revision = 9;
 
 export async function withPiCompatibility(sdk, loadCompatibility) {
     if (typeof sdk.clampThinkingLevel === "function") {
@@ -121,7 +122,12 @@ function createState(root, sdk, presentation) {
         }
     };
 
-    const extensionFactory = createDelegationExtension(() => host, { root, prepareContext, presentation });
+    const extensionFactory = createDelegationExtension(() => host, {
+        root,
+        prepareContext,
+        presentation,
+        timeoutStore: createTimeoutStore(),
+    });
     const factory = (pi) => {
         getThinkingLevel = () => pi.getThinkingLevel();
         extensionFactory(pi);

package/extensions/delegation/presentation.mjs

@@ -145,6 +145,7 @@ export function readableStatus(state) {
         `Delegation ${mode} · ${state.active}/${state.limits.concurrency} workers active`,
         `Process budget: ${state.sessionCalls}/${state.limits.sessionCalls} model calls · ${state.sessionBatches}/${state.limits.sessionBatches} batches used`,
         `Command Guard: ${plain(state.guard)}`,
+        `Timeout: ${state.limits.jobMs / 60_000} minutes per job · ${state.limits.batchMs / 60_000} minutes per batch (/delegate timeout)`,
     ];
     if (state.model) {
         lines.push(
@@ -176,7 +177,7 @@ export function readableLimits(state) {
         return `  ${label}: ${value}${unit}`;
     });
 
-    return `${readableStatus(state)}\nFixed limits:\n${limits.join("\n")}\nBudgets do not reset on off/on or reload. Cancellation is best effort; no billing cap.`;
+    return `${readableStatus(state)}\nEffective limits:\n${limits.join("\n")}\nBudgets do not reset on off/on or reload. Cancellation is best effort; no billing cap.`;
 }
 
 export function createToolRenderers({ truncateToWidth, wrapTextWithAnsi }) {

package/extensions/delegation/protocol.mjs

@@ -1,6 +1,18 @@
 import { DelegationError } from "./errors.mjs";
 import { createHash } from "node:crypto";
 
+export const DEFAULT_TIMEOUT_MINUTES = 10;
+export const MAX_TIMEOUT_MINUTES = 60;
+export const MAX_JOB_MS = MAX_TIMEOUT_MINUTES * 60_000;
+
+export function timeoutLimits(minutes) {
+    if (!Number.isSafeInteger(minutes) || minutes < 1 || minutes > MAX_TIMEOUT_MINUTES) {
+        throw new DelegationError(`Delegation timeout must be a whole number from 1 to ${MAX_TIMEOUT_MINUTES} minutes`);
+    }
+
+    return { jobMs: minutes * 60_000, batchMs: minutes * 120_000 };
+}
+
 export const LIMITS = Object.freeze({
     concurrency: 2,
     sessionBatches: 4,
@@ -8,8 +20,7 @@ export const LIMITS = Object.freeze({
     batchJobs: 2,
     batchCalls: 8,
     jobCalls: 4,
-    jobMs: 120_000,
-    batchMs: 300_000,
+    ...timeoutLimits(DEFAULT_TIMEOUT_MINUTES),
     contextBytes: 256 * 1024,
     retainedResponseBytes: 256 * 1024,
     toolBytes: 64 * 1024,

package/extensions/delegation/provider.mjs

@@ -1,4 +1,5 @@
 import { DelegationError } from "./errors.mjs";
+import { MAX_JOB_MS } from "./protocol.mjs";
 
 const MAX_CONTEXT_BYTES = 256 * 1024;
 const MAX_OUTPUT_TOKENS = 8192;
@@ -513,7 +514,7 @@ export function createNativePiHost(ctx, { id, isCurrent, sdk, thinkingLevel } =
                         ),
                         maxTokens: Math.min(MAX_OUTPUT_TOKENS, childModel.maxTokens, run.controls.limits.outputTokens),
                         maxRetries: 0,
-                        timeoutMs: Math.max(1, Math.min(120_000, run.controls.deadline - Date.now())),
+                        timeoutMs: Math.max(1, Math.min(MAX_JOB_MS, run.controls.deadline - Date.now())),
                         onPayload: async (payload, providerModel) => {
                             assertRun();
                             const result = (await options.onPayload?.(payload, providerModel)) ?? payload;
@@ -637,7 +638,7 @@ export function createNativePiHost(ctx, { id, isCurrent, sdk, thinkingLevel } =
                     active = run;
                     const cancel = () => fail(new DelegationError("Delegation session was cancelled or expired"));
                     controls.signal.addEventListener("abort", cancel, { once: true });
-                    const timer = setTimeout(cancel, Math.max(1, Math.min(120_000, controls.deadline - Date.now())));
+                    const timer = setTimeout(cancel, Math.max(1, Math.min(MAX_JOB_MS, controls.deadline - Date.now())));
                     timer.unref?.();
                     try {
                         assertRun();

package/extensions/delegation/settings.mjs

@@ -0,0 +1,140 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { DEFAULT_TIMEOUT_MINUTES, timeoutLimits } from "./protocol.mjs";
+import { DelegationError } from "./errors.mjs";
+
+const MAX_SETTINGS_BYTES = 4096;
+const MAX_BACKUP_BYTES = 32 * 1024;
+
+function regularFile(file, maxBytes = MAX_SETTINGS_BYTES) {
+    const stat = fs.lstatSync(file, { throwIfNoEntry: false });
+    if (stat && (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > maxBytes)) {
+        throw new Error("Unsupported settings file");
+    }
+
+    return stat;
+}
+
+function directory(dir, create = false) {
+    const parent = path.dirname(dir);
+    if (parent !== dir) {
+        directory(parent, create);
+    }
+
+    let stat = fs.lstatSync(dir, { throwIfNoEntry: false });
+    if (!stat && create) {
+        fs.mkdirSync(dir, { mode: 0o700 });
+        stat = fs.lstatSync(dir);
+    }
+
+    if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) {
+        throw new Error("Unsupported settings directory");
+    }
+}
+
+// Resolve the human-selected agent root, including platform aliases, once.
+// Missing descendants stay non-mutating on load and are checked before creation.
+function canonicalAgentDirectory(dir) {
+    if (fs.lstatSync(dir, { throwIfNoEntry: false })) {
+        const resolved = fs.realpathSync.native(dir);
+        if (!fs.statSync(resolved).isDirectory()) {
+            throw new Error("Unsupported agent directory");
+        }
+
+        return resolved;
+    }
+
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+        throw new Error("Agent directory root is unavailable");
+    }
+
+    return path.join(canonicalAgentDirectory(parent), path.basename(dir));
+}
+
+function atomicWrite(file, content, maxBytes = MAX_SETTINGS_BYTES) {
+    regularFile(file, maxBytes);
+    if (Buffer.byteLength(content, "utf8") > maxBytes) {
+        throw new Error("Settings write exceeds its bound");
+    }
+
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { flag: "wx", mode: 0o600 });
+        fs.renameSync(temporary, file);
+    } finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+
+/** Own preference only; never reads Pi settings, credentials or session state. */
+export function createTimeoutStore(
+    agentDir = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent"),
+) {
+    const requestedAgentDir = path.resolve(agentDir);
+    let resolvedAgentDir;
+    const location = () => {
+        resolvedAgentDir ??= canonicalAgentDirectory(requestedAgentDir);
+        const dir = path.join(resolvedAgentDir, "specpi", "delegation");
+
+        return { dir, file: path.join(dir, "settings.json") };
+    };
+
+    const read = () => {
+        const { dir, file } = location();
+        directory(dir);
+        if (!regularFile(file)) {
+            return undefined;
+        }
+
+        const content = fs.readFileSync(file, "utf8");
+        const settings = JSON.parse(content);
+        if (
+            !settings ||
+            settings.schema !== 1 ||
+            Object.keys(settings).length !== 2 ||
+            !Object.hasOwn(settings, "timeoutMinutes")
+        ) {
+            throw new Error("Invalid settings schema");
+        }
+
+        timeoutLimits(settings.timeoutMinutes);
+
+        return { content, minutes: settings.timeoutMinutes };
+    };
+
+    return {
+        load() {
+            try {
+                return read()?.minutes ?? DEFAULT_TIMEOUT_MINUTES;
+            } catch {
+                throw new DelegationError(
+                    "Cannot read delegation settings. Check <agent-dir>/specpi/delegation/settings.json (schema 1, timeoutMinutes: integer 1–60) and its permissions; restart Pi after repairing it.",
+                );
+            }
+        },
+        save(minutes) {
+            timeoutLimits(minutes);
+            try {
+                const previous = read();
+                const { dir, file } = location();
+                directory(dir, true);
+                if (previous) {
+                    atomicWrite(
+                        `${file}.bak`,
+                        `${JSON.stringify({ sha256: createHash("sha256").update(previous.content).digest("hex"), content: previous.content })}\n`,
+                        MAX_BACKUP_BYTES,
+                    );
+                }
+
+                atomicWrite(file, `${JSON.stringify({ schema: 1, timeoutMinutes: minutes })}\n`);
+            } catch {
+                throw new DelegationError(
+                    "Cannot save delegation settings. Check <agent-dir>/specpi/delegation/settings.json and its permissions; the active timeout is unchanged.",
+                );
+            }
+        },
+    };
+}

package/extensions/spec.ts

@@ -634,6 +634,15 @@ export default function (pi: ExtensionAPI) {
             return matches.length > 0 ? matches.map((value) => ({ value, label: value })) : null;
         },
         handler: async (args, ctx) => {
+            if (ctx.mode === "rpc") {
+                ctx.ui.notify(
+                    "/spec controls the interactive terminal interface. SpecPi Chat manages its own response and tool display.",
+                    "info",
+                );
+
+                return;
+            }
+
             lastContext = ctx;
             const action = args.trim().toLowerCase();
             if (!action) {

package/extensions/tool-wishlist/index.ts

@@ -685,7 +685,13 @@ export default function toolWishlist(pi: ExtensionAPI) {
                 reportPath,
                 truncated: display.truncated,
             });
-        } else if ((ctx.mode === "tui" || ctx.mode === undefined) && typeof ctx.ui.editor === "function") {
+        }
+
+        if (
+            (ctx.mode === "rpc" || !supportsReportEntries) &&
+            (ctx.mode === "rpc" || ctx.mode === "tui" || ctx.mode === undefined) &&
+            typeof ctx.ui.editor === "function"
+        ) {
             await ctx.ui.editor(
                 "SpecPi Wishlist (view only; changes are ignored)",
                 `${content}\n\n---\nReport: ${displayPath}`,

package/extensions/tool-wishlist/verification.mjs

@@ -25,6 +25,7 @@ export const SOURCE_DIRECTORIES = Object.freeze([
     "templates",
     "tests",
     "themes",
+    "vscode",
 ]);
 
 export const SOURCE_ROOT_FILES = Object.freeze([

package/extensions/workflow-controls/index.ts

@@ -1113,7 +1113,7 @@ export default function workflowControls(pi: ExtensionAPI) {
                         createdAt: new Date().toISOString(),
                     };
                     pi.appendEntry(TASK_HANDOFF_ENTRY, data);
-                    if (!supportsEntryRenderer && typeof ctx.ui.editor === "function") {
+                    if ((ctx.mode === "rpc" || !supportsEntryRenderer) && typeof ctx.ui.editor === "function") {
                         await ctx.ui.editor("Task handoff (view only)", markdown);
                     }
 
@@ -1738,7 +1738,7 @@ export default function workflowControls(pi: ExtensionAPI) {
 
                 if (!latestChallenge) {
                     ctx.ui.notify("No completed challenge exists on this session branch.", "info");
-                } else if (supportsEntryRenderer) {
+                } else if (supportsEntryRenderer && ctx.mode !== "rpc") {
                     pi.appendEntry(CHALLENGE_ENTRY, { ...latestChallenge, kind: "display" });
                 } else if (typeof ctx.ui.editor === "function") {
                     await ctx.ui.editor("Completion challenge (view only)", latestChallenge.markdown ?? "Unavailable");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specpi",
-  "version": "0.13.0",
+  "version": "0.16.0",
   "description": "An explicit, privacy-conscious, self-improving harness for the Pi coding agent",
   "author": "Tanner Middleton",
   "repository": {

package/scripts/check-package.mjs

@@ -367,6 +367,28 @@ function assertInstalledLifecycle(packageRoot, binPath, temporaryRoot, baseEnv)
     runCli(["install", ...lifecycleFlags]);
     runCli(["doctor"], { timeout: 300_000 });
 
+    const privateEvidence = new Map([
+        [path.join(agentDir, "specpi", "delegation", "settings.json"), '{"schema":1,"timeoutMinutes":15}\n'],
+        [
+            path.join(agentDir, "specpi", "delegation", "settings.json.bak"),
+            `${JSON.stringify({
+                content: '{"schema":1,"timeoutMinutes":10}\n',
+                sha256: createHash("sha256").update('{"schema":1,"timeoutMinutes":10}\n').digest("hex"),
+            })}\n`,
+        ],
+        [path.join(agentDir, "specpi", "wishlist", "observations.jsonl"), '{"private":true}\n'],
+        [
+            path.join(agentDir, "specpi", "wishlist", "decisions.jsonl"),
+            '{"action":"retire","journal":{"schema":1,"evidence":["private proof"],"gates":["npm run check"],"version":"0.10.0"}}\n',
+        ],
+        [path.join(agentDir, "specpi", "experiments", "registry.json"), '{"private":true}\n'],
+        [path.join(agentDir, "specpi", "experiments", "patches", "package-smoke.patch"), "private patch\n"],
+    ]);
+    for (const [file, content] of privateEvidence) {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, content, { mode: 0o600 });
+    }
+
     const guardDirectory = path.join(agentDir, "extensions", "command-guard");
     const driftedGuardPath = path.join(guardDirectory, "index.ts");
     fs.appendFileSync(driftedGuardPath, "\n// package-check rollback drift\n");
@@ -386,20 +408,6 @@ function assertInstalledLifecycle(packageRoot, binPath, temporaryRoot, baseEnv)
         "failed update did not restore the complete managed tree",
     );
 
-    const privateEvidence = new Map([
-        [path.join(agentDir, "specpi", "wishlist", "observations.jsonl"), '{"private":true}\n'],
-        [
-            path.join(agentDir, "specpi", "wishlist", "decisions.jsonl"),
-            '{"action":"retire","journal":{"schema":1,"evidence":["private proof"],"gates":["npm run check"],"version":"0.10.0"}}\n',
-        ],
-        [path.join(agentDir, "specpi", "experiments", "registry.json"), '{"private":true}\n'],
-        [path.join(agentDir, "specpi", "experiments", "patches", "package-smoke.patch"), "private patch\n"],
-    ]);
-    for (const [file, content] of privateEvidence) {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, content, { mode: 0o600 });
-    }
-
     runCli(["update", ...lifecycleFlags, "--force"]);
     runCli(["doctor"], { timeout: 300_000 });
     runCli(["uninstall", "--yes"]);
@@ -409,11 +417,14 @@ function assertInstalledLifecycle(packageRoot, binPath, temporaryRoot, baseEnv)
         false,
         "uninstall left a managed extension behind",
     );
-    assert.equal(
-        fs.existsSync(path.join(agentDir, "extensions", "delegation", "index.ts")),
-        false,
-        "uninstall left native delegation installed",
-    );
+    for (const file of DELEGATION_MANAGED_FILES) {
+        assert.equal(
+            fs.existsSync(path.join(agentDir, "extensions", "delegation", file)),
+            false,
+            `uninstall left a managed delegation file: ${file}`,
+        );
+    }
+
     for (const [file, expected] of privateEvidence) {
         assert.equal(fs.existsSync(file), true, `uninstall removed private SpecPi evidence: ${file}`);
         assert.equal(fs.readFileSync(file, "utf8"), expected, `uninstall changed private SpecPi evidence: ${file}`);
@@ -460,7 +471,12 @@ try {
     assert.ok(fs.existsSync(tarball), "the reported npm tarball does not exist");
     assertArtifactMatchesManifest(tarball, packResult);
 
-    const installEnv = { ...process.env, npm_config_audit: "false", npm_config_fund: "false" };
+    const installEnv = {
+        ...process.env,
+        PI_CODING_AGENT_DIR: path.join(temporaryRoot, "install-agent"),
+        npm_config_audit: "false",
+        npm_config_fund: "false",
+    };
     runNpm(
         [
             "install",

package/scripts/check-syntax.mjs

@@ -26,6 +26,11 @@ export function syntaxFiles(root) {
         visit(path.join(root, directory));
     }
 
+    // The separately distributed editor extension is absent from the npm artifact.
+    if (fs.existsSync(path.join(root, "vscode"))) {
+        visit(path.join(root, "vscode"));
+    }
+
     return files.sort();
 }