takomi 2.1.43 → 2.1.45

package/.pi/extensions/oauth-router/report-ui.ts

@@ -0,0 +1,205 @@
+import { truncateToWidth, wrapTextWithAnsi, type Component } from "@earendil-works/pi-tui";
+
+export const ROUTER_REPORT_WIDGET_KEY = "oauth-router-report";
+export const ROUTER_REPORT_DISMISS_HINT = "Dismiss: /router-clear";
+
+type RouterTheme = {
+  fg(color: "accent" | "success" | "warning" | "error" | "muted" | "dim", text: string): string;
+  bold(text: string): string;
+};
+
+const SENSITIVE_VALUE_KEYS = new Set([
+  "access_token", "access-token", "accesstoken",
+  "refresh_token", "refresh-token", "refreshtoken",
+  "id_token", "id-token", "idtoken",
+  "auth_token", "auth-token", "authtoken",
+  "api_key", "api-key", "apikey",
+  "authorization",
+  "client_secret", "client-secret", "clientsecret",
+  "password", "secret", "code",
+]);
+const SENSITIVE_QUERY_KEYS = [...SENSITIVE_VALUE_KEYS, "token", "key"];
+const SENSITIVE_QUERY_VALUE = new RegExp(`([?&#](?:${SENSITIVE_QUERY_KEYS.join("|")})=)[^&#\\s"']*`, "gi");
+
+function isKeyCharacter(value: string | undefined): boolean {
+  return Boolean(value && /[A-Za-z0-9_-]/.test(value));
+}
+
+function skipWhitespace(text: string, start: number): number {
+  let index = start;
+  while (/\s/.test(text[index] ?? "")) index += 1;
+  return index;
+}
+
+function quotedEnd(text: string, start: number): number | undefined {
+  const quote = text[start];
+  for (let index = start + 1; index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+      continue;
+    }
+    if (text[index] === quote) return index + 1;
+  }
+  return undefined;
+}
+
+type SensitiveAssignment = { key: string; valueStart: number };
+
+/**
+ * Locate a complete assignment key rather than using a word-boundary regex.
+ * Underscores and hyphens are key characters, so `zipcode`, `account_code`,
+ * and `authorization_status` cannot be mistaken for sensitive keys.
+ */
+function sensitiveAssignmentAt(text: string, start: number): SensitiveAssignment | undefined {
+  if (isKeyCharacter(text[start - 1])) return undefined;
+
+  let key: string;
+  let afterKey: number;
+  if (text[start] === '"' || text[start] === "'") {
+    const end = quotedEnd(text, start);
+    if (!end) return undefined;
+    key = text.slice(start + 1, end - 1);
+    afterKey = end;
+  } else {
+    if (!isKeyCharacter(text[start])) return undefined;
+    afterKey = start;
+    while (isKeyCharacter(text[afterKey])) afterKey += 1;
+    key = text.slice(start, afterKey);
+  }
+
+  if (!SENSITIVE_VALUE_KEYS.has(key.toLowerCase())) return undefined;
+  const delimiter = skipWhitespace(text, afterKey);
+  if (text[delimiter] !== ":" && text[delimiter] !== "=") return undefined;
+  return { key: key.toLowerCase(), valueStart: skipWhitespace(text, delimiter + 1) };
+}
+
+function redactSensitiveAssignments(text: string): string {
+  let output = "";
+  let cursor = 0;
+
+  for (let start = 0; start < text.length; start += 1) {
+    const assignment = sensitiveAssignmentAt(text, start);
+    if (!assignment || assignment.valueStart >= text.length) continue;
+
+    const valueStart = assignment.valueStart;
+    const quote = text[valueStart];
+    if (quote === '"' || quote === "'") {
+      const valueEnd = quotedEnd(text, valueStart);
+      if (!valueEnd) continue;
+      output += `${text.slice(cursor, valueStart + 1)}[redacted]${quote}`;
+      cursor = valueEnd;
+      start = valueEnd - 1;
+      continue;
+    }
+
+    let valueEnd = valueStart;
+    if (assignment.key === "authorization") {
+      while (valueEnd < text.length && text[valueEnd] !== "|" && text[valueEnd] !== "\r" && text[valueEnd] !== "\n") valueEnd += 1;
+      while (valueEnd > valueStart && /\s/.test(text[valueEnd - 1])) valueEnd -= 1;
+    } else {
+      while (valueEnd < text.length && !/[\s|,;"'&#]/.test(text[valueEnd])) valueEnd += 1;
+    }
+    if (valueEnd === valueStart) continue;
+
+    output += `${text.slice(cursor, valueStart)}[redacted]`;
+    cursor = valueEnd;
+    start = valueEnd - 1;
+  }
+
+  return output + text.slice(cursor);
+}
+
+/**
+ * Remove terminal controls and credentials from presentation only. Router data
+ * remains untouched; this boundary exists because labels and upstream errors
+ * can originate outside the extension.
+ */
+export function sanitizeReportText(value: unknown): string {
+  let text = String(value ?? "")
+    .replace(/\x1b(?:\][^\x07]*(?:\x07|\x1b\\)|\[[0-?]*[ -/]*[@-~]|[PX^_][^\x1b]*(?:\x1b\\))/g, "")
+    .replace(/[\x00-\x1f\x7f-\x9f]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+
+  // Bearer credentials can occur outside a key/value field. Assignment
+  // parsing below handles every quoted/bare sensitive-key combination and
+  // keeps Authorization's multi-word field value intact while redacting it.
+  text = text
+    .replace(/\b(Bearer\s+)(?:"[^"]*"|'[^']*'|[^\s,;|"']+)/gi, "$1[redacted]")
+    .replace(SENSITIVE_QUERY_VALUE, "$1[redacted]");
+  text = redactSensitiveAssignments(text)
+    .replace(/\b(sk-[A-Za-z0-9_-]{8,}|(?:eyJ[A-Za-z0-9_-]+\.){2}[A-Za-z0-9_-]+)\b/gi, "[redacted]");
+
+  return text;
+}
+
+/** Return the RPC-compatible report representation without terminal controls. */
+export function createRouterReportLines(text: string): string[] {
+  return text.split(/\r?\n/).map(sanitizeReportText);
+}
+
+function fitQuotaBar(line: string, width: number): string {
+  const match = /\[([█░]+)\]/.exec(line);
+  if (!match) return line;
+  const source = match[1];
+  const targetWidth = width <= 45 ? 8 : width <= 70 ? 12 : 18;
+  if (source.length <= targetWidth) return line;
+  const filled = [...source].filter((cell) => cell === "█").length;
+  const targetFilled = Math.round((filled / source.length) * targetWidth);
+  return `${line.slice(0, match.index)}[${"█".repeat(targetFilled)}${"░".repeat(targetWidth - targetFilled)}]${line.slice(match.index + match[0].length)}`;
+}
+
+function styleLine(theme: RouterTheme, line: string): string {
+  if (line === ROUTER_REPORT_DISMISS_HINT) return theme.fg("accent", theme.bold(line));
+  if (line.startsWith("# ")) return theme.fg("accent", theme.bold(line.slice(2)));
+  if (line.startsWith("## ")) return theme.fg("accent", theme.bold(line.slice(3)));
+
+  // State words must win over incidental success counters or a prior healthy
+  // status. In particular, an explicitly disabled account is never success.
+  if (/\b(auth=invalid|auth invalid|invalid)\b/i.test(line)) return theme.fg("error", line);
+  if (/\b(degraded|cooldown|penalty)\b/i.test(line)) return theme.fg("warning", line);
+  if (/\b(enabled\s*=\s*false|disabled|inactive)\b/i.test(line)) return theme.fg("muted", line);
+  if (/^Provider:\s*/.test(line)) return theme.fg("accent", line);
+  if (/^Local:\s*/.test(line)) return theme.fg("muted", line);
+
+  const quota = /(\d+)% left/.exec(line);
+  if (quota) {
+    const remaining = Number(quota[1]);
+    return theme.fg(remaining <= 20 ? "error" : remaining <= 50 ? "warning" : "success", line);
+  }
+  if (/\b(healthy|enabled|ok)\b/i.test(line) && !/\b(unhealthy|not healthy)\b/i.test(line)) return theme.fg("success", line);
+  if (/\b(failures?|429s?|error)\b/i.test(line)) return theme.fg("warning", line);
+  if (/^(Raw:|Usage:|Aliases:|Valid values:|Compact account list|Provider bars show)/.test(line)) return theme.fg("muted", line);
+  if (/^(note:|headers:|claimKeys:|endpoint:|tokenExpires=)/.test(line)) return theme.fg("dim", line);
+  return line;
+}
+
+class RouterReportComponent implements Component {
+  constructor(private readonly lines: string[], private readonly theme: RouterTheme) {}
+
+  invalidate() {
+    // Rendering is derived solely from the report snapshot and current width.
+  }
+
+  render(width: number): string[] {
+    const usableWidth = Math.max(1, width);
+    const rendered: string[] = [];
+    for (const line of this.lines) {
+      if (!line) {
+        rendered.push("");
+        continue;
+      }
+      const styled = styleLine(this.theme, fitQuotaBar(line, usableWidth));
+      const wrapped = wrapTextWithAnsi(styled, usableWidth);
+      rendered.push(...(wrapped.length ? wrapped.map((part) => truncateToWidth(part, usableWidth)) : [""]));
+    }
+    return rendered;
+  }
+}
+
+export function createRouterReportWidget(text: string) {
+  // Snapshot and sanitize now as well as at render time so replacement has no
+  // mutable dependency and no stale report can reappear on a later lifecycle event.
+  const safeLines = createRouterReportLines(text);
+  return (_tui: unknown, theme: RouterTheme): Component => new RouterReportComponent(safeLines, theme);
+}

package/.pi/extensions/oauth-router/scripts/vibe-verify.py

@@ -21,7 +21,7 @@ REQUIRED = [
     ROOT / "types.ts",
     ROOT / "README.md",
 ]
-EXPECTED_MODELS = ["oauth-router", "gpt-5.4-mini", "gpt-5.4", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"]
+EXPECTED_MODELS = ["oauth-router", "gpt-5.4-mini", "gpt-5.4", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"]
 PI_CANDIDATES = [
     os.environ.get("PI_BIN"),
     shutil.which("pi"),
@@ -77,12 +77,12 @@ def main() -> int:
             failed = True
         else:
             print("[ OK ] `pi --list-models` executed")
-            for token in EXPECTED_MODELS:
-                if token not in output:
+            for token in EXPECTED_MODELS:
+                if token not in output:
                     print(f"[FAIL] model token not found in list output: {token}")
                     failed = True
-                else:
-                    print(f"[ OK ] model token present: {token}")
+                else:
+                    print(f"[ OK ] model token present: {token}")
     except Exception as exc:
         print(f"[FAIL] unable to execute `pi --list-models`: {exc}")
         failed = True

package/.pi/extensions/takomi-context-manager/diagnostics-tools.ts

@@ -2,9 +2,10 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { AutocompleteItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import type { ContextManagerState } from "./state";
-import { renderReport, type ContextReportMode } from "./diagnostics";
+import { contextReportPresentation, renderReport, type ContextReportMode } from "./diagnostics";
 import { discoverSkillsFromFilesystem, mergeSkills } from "./skill-registry";
 import { persistReportSnapshot, restoreReportFromSession } from "./session-state";
+import { renderCompactCard, renderExpandedMarkdown, renderToolCall, resultText, sanitizePresentation } from "./tool-renderers";
 
 export function registerDiagnostics(pi: ExtensionAPI, state: ContextManagerState): void {
   pi.registerTool({
@@ -29,7 +30,44 @@ export function registerDiagnostics(pi: ExtensionAPI, state: ContextManagerState
       state.report.toolCalls.contextReport += 1;
       persistReportSnapshot(pi, state, "context_report");
       const mode = (params.verbose ? "verbose" : params.mode ?? "summary") as ContextReportMode;
-      return { content: [{ type: "text", text: renderReport(state, mode) }], details: { ...state.report, mode } };
+      const text = renderReport(state, mode);
+      // Keep model-facing content exactly as requested. Expanded presentation
+      // renders that same mode-specific report rather than silently promoting
+      // summary/problems requests to verbose diagnostics.
+      const presentation = contextReportPresentation(state);
+      return { content: [{ type: "text", text }], details: { ...state.report, mode, presentation } };
+    },
+    renderCall(args, theme) {
+      return renderToolCall("context_report", args.verbose ? "verbose" : args.mode ?? "summary", theme);
+    },
+    renderResult(result, { expanded }, theme) {
+      const details = result.details as {
+        mode?: ContextReportMode;
+        skillCount?: number;
+        loadedByTool?: string[];
+        loadedPolicies?: string[];
+        presentation?: {
+          status?: "success" | "warning" | "error" | "pending";
+          summary?: string;
+          attentionCount?: number;
+        };
+      } | undefined;
+      const presentation = details?.presentation;
+      const text = resultText(result);
+      const status = presentation?.status ?? "pending";
+      const summary = presentation?.summary ?? "Informational";
+      const attentionCount = presentation?.attentionCount ?? 0;
+      const metadata = `${details?.skillCount ?? 0} skills · ${details?.loadedPolicies?.length ?? 0} policies loaded · ${attentionCount} attention items`;
+      if (!expanded) {
+        return renderCompactCard({ status, title: "Context health", summary, metadata }, theme);
+      }
+      return renderExpandedMarkdown({
+        status,
+        title: "Context report",
+        summary,
+        metadata: [metadata, `Requested mode: ${details?.mode ?? "summary"}`],
+        markdown: text,
+      }, theme);
     },
   });
 
@@ -55,7 +93,7 @@ export function registerDiagnostics(pi: ExtensionAPI, state: ContextManagerState
       persistReportSnapshot(pi, state, "context-report-command");
       const requested = args.trim();
       const mode: ContextReportMode = requested === "verbose" || requested === "problems" || requested === "summary" ? requested : "summary";
-      ctx.ui.notify(renderReport(state, mode), "info");
+      ctx.ui.notify(sanitizePresentation(renderReport(state, mode)), "info");
     },
   });
 }

package/.pi/extensions/takomi-context-manager/diagnostics.ts

@@ -139,6 +139,32 @@ function overallStatus(issues: ReportIssue[]): { label: string; next: string; wa
   return { label: "⚠ Attention Required", next: actionable[0].fix, warningCount: actionable.length };
 }
 
+export type ContextReportPresentation = {
+  status: "success" | "warning" | "error" | "pending";
+  summary: string;
+  attentionCount: number;
+};
+
+/** Structured execution metadata shared by context_report renderers. */
+export function contextReportPresentation(state: ContextManagerState): ContextReportPresentation {
+  syncReportLedger(state);
+  const issues = collectIssues(state);
+  const overall = overallStatus(issues);
+  const actionable = issues.filter((issue) => issue.severity !== "info");
+  const status = issues.length === 0
+    ? "success"
+    : actionable.some((issue) => issue.severity === "failed" || issue.severity === "blocked")
+      ? "error"
+      : actionable.length > 0
+        ? "warning"
+        : "pending";
+  return {
+    status,
+    summary: overall.label.replace(/^[^\w]+\s*/, ""),
+    attentionCount: overall.warningCount,
+  };
+}
+
 function promptRewriteState(state: ContextManagerState): string {
   const rewrite = state.report.promptRewrite;
   if (!rewrite.attempted) return "Not run yet";

package/.pi/extensions/takomi-context-manager/index.ts

@@ -1,7 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { loadConfig, DEFAULT_CONFIG } from "./config";
 import { createState } from "./state";
-import { collectSkillsFromOptions, collectSkillsFromXml, discoverSkillsFromFilesystem, mergeSkills } from "./skill-registry";
+import { collectSkillsFromOptions, collectSkillsFromXml, discoverSkillsFromFilesystem, enrichSkillsWithInstallerTaxonomy, mergeSkills } from "./skill-registry";
 import { discoverPolicies } from "./policy-registry";
 import { findCandidates } from "./context-router";
 import { rewritePrompt } from "./prompt-rewriter";
@@ -18,6 +18,7 @@ import type { ContextManagerConfig } from "./types";
 export default function takomiContextManager(pi: ExtensionAPI) {
   const state = createState();
   let config: ContextManagerConfig = DEFAULT_CONFIG;
+  let duplicateExtensionWarnings: Array<{ toolName: string; paths: string[] }> = [];
 
   registerSkillTools(pi, state);
   registerPolicyTools(pi, state);
@@ -27,21 +28,31 @@ export default function takomiContextManager(pi: ExtensionAPI) {
 
   pi.on("session_start", async (_event, ctx) => {
     config = await loadConfig(ctx.cwd);
-    state.policies = await discoverPolicies(ctx.cwd, config);
-    state.skills = mergeSkills(await discoverSkillsFromFilesystem(ctx.cwd));
+    [state.policies, duplicateExtensionWarnings] = await Promise.all([
+      discoverPolicies(ctx.cwd, config),
+      detectDuplicateTakomiExtensions(ctx.cwd),
+    ]);
+
+    // Pi already discovers skills while building systemPromptOptions. Rewalking
+    // every global/project skill tree here made startup block on thousands of
+    // filesystem calls, then repeated the same work before the first request.
+    // Keep filesystem discovery lazy for direct skill-tool calls and as a
+    // compatibility fallback when Pi supplies no skill metadata.
+    state.skills = new Map();
     state.report.cwd = ctx.cwd;
-    state.report.skillCount = state.skills.size;
+    state.report.skillCount = 0;
     restoreReportFromSession(state, ctx);
   });
 
   pi.on("before_agent_start", async (event, ctx) => {
-    config = await loadConfig(ctx.cwd);
-    state.policies = await discoverPolicies(ctx.cwd, config);
-    const duplicateExtensionWarnings = await detectDuplicateTakomiExtensions(ctx.cwd);
     const optionSkills = collectSkillsFromOptions(event.systemPromptOptions);
     const xmlSkills = collectSkillsFromXml(event.systemPrompt);
-    const filesystemSkills = await discoverSkillsFromFilesystem(ctx.cwd);
-    state.skills = mergeSkills([...filesystemSkills, ...optionSkills, ...xmlSkills]);
+    const suppliedSkills = [...optionSkills, ...xmlSkills];
+    const enrichedSuppliedSkills = await enrichSkillsWithInstallerTaxonomy(suppliedSkills);
+    const filesystemSkills = suppliedSkills.length === 0
+      ? await discoverSkillsFromFilesystem(ctx.cwd)
+      : [];
+    state.skills = mergeSkills([...filesystemSkills, ...enrichedSuppliedSkills]);
 
     const candidates = findCandidates(event.prompt, state.skills, config);
     const rewrite = rewritePrompt(event.systemPrompt, state.skills, candidates, config);

package/.pi/extensions/takomi-context-manager/model-policy-gate.ts

@@ -7,6 +7,7 @@ import { recordBlocked } from "./state";
 import { resolveTakomiRoutingPolicy } from "../takomi-runtime/routing-policy";
 import { approvedModelEquivalent, isTakomiModelApproved } from "../takomi-runtime/model-routing-defaults";
 import { persistReportSnapshot } from "./session-state";
+import { sanitizePresentation } from "./tool-renderers";
 
 type Settings = {
   takomi?: { modelRoutingPolicyFile?: string };
@@ -162,18 +163,40 @@ type RecoveryChoice =
   | { action: "retry"; model: string }
   | { action: "stop" };
 
+type RecoveryOptions = {
+  options: string[];
+  retryModels: Map<string, string>;
+};
+
+/**
+ * Keep policy model IDs raw for selection and mutation, while passing only
+ * presentation-safe labels to the terminal UI. Disambiguate labels that become
+ * identical after sanitization so a selected label still maps to one raw ID.
+ */
+function recoveryOptions(approved: string[]): RecoveryOptions {
+  const retryModels = new Map<string, string>();
+  const options: string[] = [];
+  for (const model of approved) {
+    const baseLabel = `Retry with ${sanitizePresentation(model)}`;
+    let label = baseLabel;
+    let duplicate = 2;
+    while (retryModels.has(label)) label = `${baseLabel} (${duplicate++})`;
+    retryModels.set(label, model);
+    options.push(label);
+  }
+  options.push("Stop and let me send a new prompt");
+  return { options, retryModels };
+}
+
 async function askForInvalidModelRecovery(ctx: { ui: { select(title: string, options: string[]): Promise<string | undefined>; notify(message: string, level?: string): void }; abort?: () => void }, requested: string, approved: string[]): Promise<RecoveryChoice> {
   if (approved.length === 0) return { action: "stop" };
-  const options = [
-    ...approved.map((model) => `Retry with ${model}`),
-    "Stop and let me send a new prompt",
-  ];
+  const recovery = recoveryOptions(approved);
   const choice = await ctx.ui.select(
-    `takomi_subagent requested a model outside your routing policy: ${requested}`,
-    options,
+    sanitizePresentation(`takomi_subagent requested a model outside your routing policy: ${requested}`),
+    recovery.options,
   );
-  if (choice?.startsWith("Retry with ")) return { action: "retry", model: choice.replace("Retry with ", "") };
-  return { action: "stop" };
+  const model = choice ? recovery.retryModels.get(choice) : undefined;
+  return model ? { action: "retry", model } : { action: "stop" };
 }
 
 export function installModelPolicyGate(pi: ExtensionAPI, state: ContextManagerState): void {
@@ -221,7 +244,8 @@ export function installModelPolicyGate(pi: ExtensionAPI, state: ContextManagerSt
         timestamp,
       })));
       persistReportSnapshot(pi, state, "model-policy-correction");
-      ctx.ui.notify(`Takomi context manager corrected subagent model routing:\n- ${corrections.map((correction) => `${correction.from} -> ${correction.to}${correction.recovery ? ` (${correction.recovery})` : ""}`).join("\n- ")}\n\nBe careful to follow /takomi routing policy next time.`, "warning");
+      const notification = `Takomi context manager corrected subagent model routing:\n- ${corrections.map((correction) => `${sanitizePresentation(correction.from)} -> ${sanitizePresentation(correction.to)}${correction.recovery ? ` (${sanitizePresentation(correction.recovery)})` : ""}`).join("\n- ")}\n\nBe careful to follow /takomi routing policy next time.`;
+      ctx.ui.notify(notification, "warning");
     }
   });
 
@@ -231,12 +255,9 @@ export function installModelPolicyGate(pi: ExtensionAPI, state: ContextManagerSt
     if (!isModelFailure(content)) return;
 
     const snapshot = await loadSnapshot(ctx.cwd);
-    const options = [
-      ...snapshot.approvedModels.map((model) => `Retry with ${model}`),
-      "Stop and let me send a new prompt",
-    ];
-    const choice = await ctx.ui.select("Takomi subagent model/provider failure. How do you want to continue?", options);
-    const retryModel = choice?.startsWith("Retry with ") ? choice.replace("Retry with ", "") : undefined;
+    const recovery = recoveryOptions(snapshot.approvedModels);
+    const choice = await ctx.ui.select("Takomi subagent model/provider failure. How do you want to continue?", recovery.options);
+    const retryModel = choice ? recovery.retryModels.get(choice) : undefined;
     const stopped = !retryModel;
     const guidance = [
       "Takomi subagent failed with a model/provider-related error.",

package/.pi/extensions/takomi-context-manager/policy-tools.ts

@@ -1,42 +1,93 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { Type } from "typebox";
-import type { ContextManagerState } from "./state";
-import { syncReportLedger } from "./state";
-import { renderPolicies, renderPolicyManifest } from "./policy-registry";
-import { persistReportSnapshot, restoreReportFromSession } from "./session-state";
-
-export function registerPolicyTools(pi: ExtensionAPI, state: ContextManagerState): void {
-  pi.registerTool({
-    name: "policy_manifest",
-    label: "Policy Manifest",
-    description: "Return descriptions for available context policy packs without loading full policy content.",
-    promptSnippet: "Show available context policy pack descriptions",
-    parameters: Type.Object({ policies: Type.Optional(Type.Array(Type.String({ description: "Policy name to inspect" }))) }),
-    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-      restoreReportFromSession(state, ctx);
-      state.report.timestamp = new Date().toISOString();
-      state.report.cwd = ctx.cwd;
-      state.report.toolCalls.policyManifest += 1;
-      persistReportSnapshot(pi, state, "policy_manifest");
-      return { content: [{ type: "text", text: renderPolicyManifest(state.policies, params.policies ?? []) }], details: { requested: params.policies ?? [...state.policies.keys()] } };
-    },
-  });
-
-  pi.registerTool({
-    name: "policy_load",
-    label: "Policy Load",
-    description: "Load one or more context policy packs required before sensitive tools such as takomi_subagent.",
-    promptSnippet: "Load policy packs required before sensitive tool calls",
-    parameters: Type.Object({ policies: Type.Array(Type.String({ description: "Policy pack name to load" })) }),
-    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-      restoreReportFromSession(state, ctx);
-      state.report.timestamp = new Date().toISOString();
-      state.report.cwd = ctx.cwd;
-      state.report.toolCalls.policyLoad += 1;
-      const text = renderPolicies(state.policies, state.loadedPolicies, params.policies);
-      syncReportLedger(state);
-      persistReportSnapshot(pi, state, "policy_load");
-      return { content: [{ type: "text", text }], details: { requested: params.policies, loadedPolicies: [...state.loadedPolicies].sort() } };
-    },
-  });
-}
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
+import type { ContextManagerState } from "./state";
+import { syncReportLedger } from "./state";
+import { renderPolicies, renderPolicyManifest } from "./policy-registry";
+import { persistReportSnapshot, restoreReportFromSession } from "./session-state";
+import { renderCompactCard, renderExpandedMarkdown, renderToolCall, resultText } from "./tool-renderers";
+import { normalizeName } from "./skill-registry";
+
+function requestedPolicies(state: ContextManagerState, names: string[] | undefined): string[] {
+  return names?.length ? names : [...state.policies.values()].map((policy) => policy.name).sort((a, b) => a.localeCompare(b, "en"));
+}
+
+function missingPolicies(state: ContextManagerState, names: string[]): string[] {
+  return names.filter((name) => !state.policies.has(normalizeName(name)));
+}
+
+export function registerPolicyTools(pi: ExtensionAPI, state: ContextManagerState): void {
+  pi.registerTool({
+    name: "policy_manifest",
+    label: "Policy Manifest",
+    description: "Return descriptions for available context policy packs without loading full policy content.",
+    promptSnippet: "Show available context policy pack descriptions",
+    parameters: Type.Object({ policies: Type.Optional(Type.Array(Type.String({ description: "Policy name to inspect" }))) }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      restoreReportFromSession(state, ctx);
+      state.report.timestamp = new Date().toISOString();
+      state.report.cwd = ctx.cwd;
+      state.report.toolCalls.policyManifest += 1;
+      persistReportSnapshot(pi, state, "policy_manifest");
+      const requested = requestedPolicies(state, params.policies);
+      const missing = missingPolicies(state, requested);
+      return { content: [{ type: "text", text: renderPolicyManifest(state.policies, params.policies ?? []) }], details: { requested, found: requested.length - missing.length, missing } };
+    },
+    renderCall(args, theme) {
+      return renderToolCall("policy_manifest", args.policies?.length ? `${args.policies.length} requested` : "all policies", theme);
+    },
+    renderResult(result, { expanded }, theme) {
+      const details = result.details as { requested?: string[]; found?: number; missing?: string[] } | undefined;
+      const requested = details?.requested ?? [];
+      const found = details?.found ?? 0;
+      const missing = details?.missing ?? [];
+      const status = missing.length ? "warning" : requested.length ? "success" : "pending";
+      const summary = missing.length ? `${found} available · ${missing.length} unavailable` : requested.length ? `${found} policies available` : "no policies discovered";
+      const metadata = missing.length ? `Missing: ${missing.join(", ")}` : `${requested.length} requested`;
+      if (!expanded) return renderCompactCard({ status, title: "Policy manifest", summary, metadata }, theme);
+      return renderExpandedMarkdown({ status, title: "Policy manifest", summary, metadata: [metadata], markdown: resultText(result) }, theme);
+    },
+  });
+
+  pi.registerTool({
+    name: "policy_load",
+    label: "Policy Load",
+    description: "Load one or more context policy packs required before sensitive tools such as takomi_subagent.",
+    promptSnippet: "Load policy packs required before sensitive tool calls",
+    parameters: Type.Object({ policies: Type.Array(Type.String({ description: "Policy pack name to load" })) }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      restoreReportFromSession(state, ctx);
+      state.report.timestamp = new Date().toISOString();
+      state.report.cwd = ctx.cwd;
+      state.report.toolCalls.policyLoad += 1;
+      const text = renderPolicies(state.policies, state.loadedPolicies, params.policies);
+      syncReportLedger(state);
+      persistReportSnapshot(pi, state, "policy_load");
+      const missing = missingPolicies(state, params.policies);
+      return {
+        content: [{ type: "text", text }],
+        details: {
+          requested: params.policies,
+          loadedPolicies: [...state.loadedPolicies].sort(),
+          loadedCount: params.policies.length - missing.length,
+          missing,
+        },
+      };
+    },
+    renderCall(args, theme) {
+      return renderToolCall("policy_load", `${args.policies.length} requested`, theme);
+    },
+    renderResult(result, { expanded }, theme) {
+      const details = result.details as { requested?: string[]; loadedCount?: number; missing?: string[] } | undefined;
+      const requested = details?.requested ?? [];
+      const loadedCount = details?.loadedCount ?? 0;
+      const missing = details?.missing ?? [];
+      const status = missing.length || requested.length === 0 ? "warning" : "success";
+      const summary = requested.length === 0
+        ? "no policies requested"
+        : missing.length ? `${loadedCount} loaded · ${missing.length} unavailable` : `${loadedCount} policies loaded`;
+      const metadata = missing.length ? `Missing: ${missing.join(", ")}` : `${requested.length} requested`;
+      if (!expanded) return renderCompactCard({ status, title: "Policy load", summary, metadata }, theme);
+      return renderExpandedMarkdown({ status, title: "Policy load", summary, metadata: [metadata], markdown: resultText(result) }, theme);
+    },
+  });
+}

package/.pi/extensions/takomi-context-manager/skill-categories.d.ts

@@ -0,0 +1,11 @@
+export type SkillCategory = {
+  id: string;
+  title: string;
+  color: string;
+  description: string;
+  skills: string[];
+};
+
+export const CORE_SKILLS: string[];
+export const SKILL_CATEGORIES: SkillCategory[];
+export function getSkillCategory(skillName: string): string | undefined;