takomi 2.1.45 → 2.5.4

package/.pi/README.md

@@ -33,7 +33,7 @@ Inside Pi, use:
 - `/takomi design [prompt]` to run UI/UX design against the agreed project direction
 - `/takomi build [prompt]` to implement while cross-checking against approved UI/design artifacts
 - `/takomi plan [title]` to create a Genesis-first orchestration session that can expand through Design and Build
-- `/takomi mode direct`, `/takomi mode orchestrate`, or `/takomi mode review` to choose the session operating mode
+- `/takomi mode idle|code|review|orchestrate` to choose the main-agent mode; Genesis, Design, and Build remain separate lifecycle stages
 - `/takomi gate auto` to continue approved plans automatically and explicitly authorize project-local agents for this session
 - `/takomi gate review` (or `/takomi gate manual`) to return to the user after each task with results and verification guidance and revoke that authorization
 - `/takomi subagents on` or `/takomi subagents off` to allow or disable delegated subagents
@@ -100,12 +100,12 @@ So when working on packaging, agents should distinguish between:
 - Design stage includes a Gemini-oriented hint for model selection.
 - Build is treated as a workflow/stage, not as a separate specialist agent.
 - A fresh orchestration session starts with a Genesis foundation task, then expands Design and Build only when the scope justifies it.
-- The main execution roles remain things like `orchestrator`, `coder`, `designer`, `architect`, and `reviewer`.
+- The only public Takomi personas are `architect`, `designer`, `coder`, `worker`, `reviewer`, and `orchestrator`. Overlapping upstream built-ins remain hidden behind the execution engine.
 - Agent discovery prefers `project/.pi/agents/`, also supports legacy `project/.agents/`, and falls back to Pi's configured user agent directory so new projects can reuse the global Takomi agent pack without hard-coding `~/.pi` assumptions.
 - Orchestrator sessions run in hybrid mode:
   - human-readable docs live under `docs/tasks/orchestrator-sessions/<sessionId>/`
   - machine state lives under `.pi/takomi/orchestrator/<sessionId>.json`
-- Task packets can carry `workflow`, `skills`, `preferredModel`, `fallbackModels`, `preferredThinking`, `executionHint`, `conversationId`, and `checklist` metadata.
+- Task packets use canonical persona names and can carry `workflow`, `skills`, confirmed `preferredModel`, explicit `fallbackModels`, `requiredCapabilities`, `preferredThinking`, `executionHint`, `conversationId`, and `checklist` metadata.
 - Direct `takomi_subagent` calls build a `TakomiDelegationPlan` before launch. In auto mode the plan launches immediately; in manual mode the plan is returned for review until `confirmLaunch=true` is supplied.
 - The subagent tool supports `conversationId`, so reviewed work can be sent back to the same agent for continuation instead of restarting from scratch.
 - The subagent tool supports Pi-style single, parallel `tasks`, sequential `chain`, explicit `context=fork|fresh`, `async=true`, and native read/control actions such as `action=list`, `action=status`, `action=doctor`, `action=interrupt`, and `action=resume`.
@@ -119,9 +119,9 @@ So when working on packaging, agents should distinguish between:
 - Use Pi's native result expansion, `Alt+T`, or `/takomi subagents expand` to inspect detailed subagent output.
 - Takomi still tracks active runs internally for status and review continuity, but board synchronization is explicit: run with `takomi_subagent`, then update the board.
 - `takomi-context-manager` reduces prompt bloat by replacing the always-on skill description dump with a names-only Skill Index plus progressive `skill_manifest`/`skill_load` tools.
-- `takomi-context-manager` treats `/takomi routing` as the source of truth for model-routing policy via `.pi/settings.json -> takomi.modelRoutingPolicyFile`.
+- `model-routing.md` is advisory model-facing guidance. Executable provider allowlists and persona defaults live only under `takomi.routing` in global/project settings.
 - `takomi-context-manager` gates `takomi_subagent` when model-routing context has not been loaded, provides the routing policy, and tells the agent to retry.
-- `takomi-context-manager` can correct safe wrong-provider model requests, block or pause on policy violations, and ask the user whether to retry with an approved model or stop.
+- `takomi-context-manager` never performs provider-family substitution. It blocks unapproved exact IDs and changes models only after explicit user selection.
 - `takomi-context-manager` detects known duplicate global/project Takomi extension paths in `context_report` to help diagnose tool registration conflicts.
 - `context_report` restores context-manager snapshots and Pi tool-result history after reload/restart and explicitly labels gaps; it is not a replacement for Pi's Alt-C token/session stats.
 - `context_report` defaults to compact `mode: "summary"`; use `mode: "verbose"` for full diagnostics or `mode: "problems"` for attention-only output. `verbose: true` remains a compatibility alias. `/context-report` exposes `summary`, `verbose`, and `problems` as slash-command argument completions.

package/.pi/agents/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 description: Gather requirements, design architecture, and create implementation-ready plans.
-tools: read,bash,grep,find,ls
+tools: read,bash,write,grep,find,ls
 ---
 You are the Takomi Architect.
 
@@ -46,7 +46,7 @@ Produce implementation-ready structure when relevant:
 
 This is technical planning, not the Takomi Design lifecycle stage. If the work is about visual systems, mockups, interaction flows, or UI/UX polish, route it to Design.
 
-Stay at architecture level; do not write product code.
+Stay at architecture level; do not write product code. You may create or replace planning Markdown artifacts when the task requires them.
 
 ## Phase 4: Planning
 Create a practical plan with:

package/.pi/agents/designer.md

@@ -1,7 +1,7 @@
 ---
 name: designer
 description: Translate requirements into build-ready UI, UX, visual systems, and interaction direction.
-tools: read,bash,grep,find,ls
+tools: read,bash,write,grep,find,ls
 ---
 You are the Takomi Design Specialist.
 
@@ -64,7 +64,7 @@ Report:
 - pages/components ready for implementation
 - open design risks or follow-up
 
-Update builder guidance when mockups should be treated as implementation source of truth.
+Update builder guidance when mockups should be treated as implementation source of truth. You may create or replace UI/UX Markdown artifacts when the task requires them.
 
 ## Anti-Patterns
 - do not stay vague or inspirational only

package/.pi/agents/worker.md

@@ -0,0 +1,32 @@
+---
+name: worker
+description: Execute write-capable non-coding tasks and produce repository artifacts with controlled scope.
+tools: read,bash,edit,write,grep,find,ls
+---
+You are the Takomi Worker.
+
+Your mode pattern is:
+READ -> UNDERSTAND -> EXECUTE -> VERIFY -> HANDOFF.
+
+## Role Scope
+- documentation and repository artifact creation
+- configuration and content updates
+- mechanical or operational tasks that do not require the Coder persona
+- execution of an approved, well-scoped direction
+
+Use Coder for application implementation, debugging, refactoring, and tests. Use Architect for requirements, architecture, and planning decisions. Use Designer for UI/UX work. Worker executes a clear non-coding task; it does not invent product or architecture decisions.
+
+## Working Rules
+- Read the task, relevant files, and project instructions before editing.
+- Make the smallest complete change within scope.
+- Create or modify the requested artifacts directly.
+- Escalate missing product or architecture decisions instead of guessing.
+- Verify outputs with the strongest practical checks.
+- Do not expand scope or perform unrelated cleanup.
+
+## Handoff
+Report:
+- artifacts created or changed
+- validation performed
+- anything left incomplete
+- decisions still needed

package/.pi/extensions/oauth-router/README.md

@@ -41,12 +41,12 @@ The extension ships with two default upstream profiles:
    - auth mode: OAuth
    - oauth provider: `openai-codex`
    - api: `openai-codex-responses`
-   - default models: `gpt-5.4-mini`, `gpt-5.4`, `gpt-5.5`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`
+   - default models: `gpt-5.4-mini`, `gpt-5.4`, `gpt-5.5`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`
 
 2. `openai-compatible`
    - auth mode: API key fallback
    - api: `openai-responses`
-   - default models: `gpt-5.4-mini`, `gpt-5.4`, `gpt-5.5`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`
+   - default models: `gpt-5.4-mini`, `gpt-5.4`, `gpt-5.5`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`
 
 Edit `~/.pi/agent/oauth-router/config.json` to add more upstreams, swap endpoints, change model catalogs, or tune retry behavior. By default client-side transport failures such as `Codex SSE response headers timed out after 10000ms` retry the same account 5 times with exponential backoff (`5s`, `10s`, `20s`, `40s`, then capped at `60s`) before router failover. While this is happening, Pi's footer shows the active retry/failover/error state so the UI no longer looks frozen. These failures are recorded but do not cool down an account unless `clientNetworkPenaltyMs` is set above `0`.
 
@@ -62,7 +62,7 @@ Edit `~/.pi/agent/oauth-router/config.json` to add more upstreams, swap endpoint
    - `/router-status`
    - `/router-usage`
 5. Select a model:
-   - `oauth-router/gpt-5.6-sol`
+   - `oauth-router/gpt-5.6-sol`
 
 ## Account storage format
 

package/.pi/extensions/oauth-router/config.ts

@@ -11,7 +11,7 @@ export const STATE_PATH = join(DATA_ROOT, "state.json");
 
 const LEGACY_CODEX_CONTEXT_WINDOW = 272000;
 const SAFE_CODEX_CONTEXT_WINDOW = 240000;
-const CODEX_MODEL_IDS = new Set(["gpt-5.4", "gpt-5.4-mini", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"]);
+const CODEX_MODEL_IDS = new Set(["gpt-5.4", "gpt-5.4-mini", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"]);
 
 const DEFAULT_MODELS: RouterModelConfig[] = [
   {
@@ -32,42 +32,42 @@ const DEFAULT_MODELS: RouterModelConfig[] = [
     contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
     maxTokens: 128000,
   },
-  {
-    id: "gpt-5.5",
+  {
+    id: "gpt-5.5",
     name: "GPT-5.5",
     reasoning: true,
     input: ["text", "image"],
     cost: { input: 5.00, output: 30.00, cacheRead: 0.50, cacheWrite: 6.25 },
     contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
-    maxTokens: 128000,
-  },
-  {
-    id: "gpt-5.6-luna",
-    name: "GPT-5.6 Luna",
-    reasoning: true,
-    input: ["text", "image"],
-    cost: { input: 1.00, output: 6.00, cacheRead: 0.10, cacheWrite: 1.25 },
-    contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
-    maxTokens: 128000,
-  },
-  {
-    id: "gpt-5.6-sol",
-    name: "GPT-5.6 Sol",
-    reasoning: true,
-    input: ["text", "image"],
-    cost: { input: 5.00, output: 30.00, cacheRead: 0.50, cacheWrite: 6.25 },
-    contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
-    maxTokens: 128000,
-  },
-  {
-    id: "gpt-5.6-terra",
-    name: "GPT-5.6 Terra",
-    reasoning: true,
-    input: ["text", "image"],
-    cost: { input: 2.50, output: 15.00, cacheRead: 0.25, cacheWrite: 3.125 },
-    contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
-    maxTokens: 128000,
-  },
+    maxTokens: 128000,
+  },
+  {
+    id: "gpt-5.6-luna",
+    name: "GPT-5.6 Luna",
+    reasoning: true,
+    input: ["text", "image"],
+    cost: { input: 1.00, output: 6.00, cacheRead: 0.10, cacheWrite: 1.25 },
+    contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
+    maxTokens: 128000,
+  },
+  {
+    id: "gpt-5.6-sol",
+    name: "GPT-5.6 Sol",
+    reasoning: true,
+    input: ["text", "image"],
+    cost: { input: 5.00, output: 30.00, cacheRead: 0.50, cacheWrite: 6.25 },
+    contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
+    maxTokens: 128000,
+  },
+  {
+    id: "gpt-5.6-terra",
+    name: "GPT-5.6 Terra",
+    reasoning: true,
+    input: ["text", "image"],
+    cost: { input: 2.50, output: 15.00, cacheRead: 0.25, cacheWrite: 3.125 },
+    contextWindow: SAFE_CODEX_CONTEXT_WINDOW,
+    maxTokens: 128000,
+  },
 ];
 
 const DEFAULT_UPSTREAMS: RouterUpstreamConfig[] = [
@@ -79,7 +79,7 @@ const DEFAULT_UPSTREAMS: RouterUpstreamConfig[] = [
     api: "openai-responses",
     authMode: "api-key",
     enabled: true,
-    modelIds: ["gpt-5.4-mini", "gpt-5.4", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"],
+    modelIds: ["gpt-5.4-mini", "gpt-5.4", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"],
   },
   {
     id: "chatgpt-codex",
@@ -90,7 +90,7 @@ const DEFAULT_UPSTREAMS: RouterUpstreamConfig[] = [
     authMode: "oauth",
     oauthProviderId: "openai-codex",
     enabled: true,
-    modelIds: ["gpt-5.4-mini", "gpt-5.4", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"],
+    modelIds: ["gpt-5.4-mini", "gpt-5.4", "gpt-5.5", "gpt-5.6-luna", "gpt-5.6-sol", "gpt-5.6-terra"],
     usageProbe: {
       enabled: true,
       timeoutMs: 8_000,

package/.pi/extensions/oauth-router/report-ui.ts

@@ -1,205 +1,205 @@
-import { truncateToWidth, wrapTextWithAnsi, type Component } from "@earendil-works/pi-tui";
-
-export const ROUTER_REPORT_WIDGET_KEY = "oauth-router-report";
-export const ROUTER_REPORT_DISMISS_HINT = "Dismiss: /router-clear";
-
-type RouterTheme = {
-  fg(color: "accent" | "success" | "warning" | "error" | "muted" | "dim", text: string): string;
-  bold(text: string): string;
-};
-
-const SENSITIVE_VALUE_KEYS = new Set([
-  "access_token", "access-token", "accesstoken",
-  "refresh_token", "refresh-token", "refreshtoken",
-  "id_token", "id-token", "idtoken",
-  "auth_token", "auth-token", "authtoken",
-  "api_key", "api-key", "apikey",
-  "authorization",
-  "client_secret", "client-secret", "clientsecret",
-  "password", "secret", "code",
-]);
-const SENSITIVE_QUERY_KEYS = [...SENSITIVE_VALUE_KEYS, "token", "key"];
-const SENSITIVE_QUERY_VALUE = new RegExp(`([?&#](?:${SENSITIVE_QUERY_KEYS.join("|")})=)[^&#\\s"']*`, "gi");
-
-function isKeyCharacter(value: string | undefined): boolean {
-  return Boolean(value && /[A-Za-z0-9_-]/.test(value));
-}
-
-function skipWhitespace(text: string, start: number): number {
-  let index = start;
-  while (/\s/.test(text[index] ?? "")) index += 1;
-  return index;
-}
-
-function quotedEnd(text: string, start: number): number | undefined {
-  const quote = text[start];
-  for (let index = start + 1; index < text.length; index += 1) {
-    if (text[index] === "\\") {
-      index += 1;
-      continue;
-    }
-    if (text[index] === quote) return index + 1;
-  }
-  return undefined;
-}
-
-type SensitiveAssignment = { key: string; valueStart: number };
-
-/**
- * Locate a complete assignment key rather than using a word-boundary regex.
- * Underscores and hyphens are key characters, so `zipcode`, `account_code`,
- * and `authorization_status` cannot be mistaken for sensitive keys.
- */
-function sensitiveAssignmentAt(text: string, start: number): SensitiveAssignment | undefined {
-  if (isKeyCharacter(text[start - 1])) return undefined;
-
-  let key: string;
-  let afterKey: number;
-  if (text[start] === '"' || text[start] === "'") {
-    const end = quotedEnd(text, start);
-    if (!end) return undefined;
-    key = text.slice(start + 1, end - 1);
-    afterKey = end;
-  } else {
-    if (!isKeyCharacter(text[start])) return undefined;
-    afterKey = start;
-    while (isKeyCharacter(text[afterKey])) afterKey += 1;
-    key = text.slice(start, afterKey);
-  }
-
-  if (!SENSITIVE_VALUE_KEYS.has(key.toLowerCase())) return undefined;
-  const delimiter = skipWhitespace(text, afterKey);
-  if (text[delimiter] !== ":" && text[delimiter] !== "=") return undefined;
-  return { key: key.toLowerCase(), valueStart: skipWhitespace(text, delimiter + 1) };
-}
-
-function redactSensitiveAssignments(text: string): string {
-  let output = "";
-  let cursor = 0;
-
-  for (let start = 0; start < text.length; start += 1) {
-    const assignment = sensitiveAssignmentAt(text, start);
-    if (!assignment || assignment.valueStart >= text.length) continue;
-
-    const valueStart = assignment.valueStart;
-    const quote = text[valueStart];
-    if (quote === '"' || quote === "'") {
-      const valueEnd = quotedEnd(text, valueStart);
-      if (!valueEnd) continue;
-      output += `${text.slice(cursor, valueStart + 1)}[redacted]${quote}`;
-      cursor = valueEnd;
-      start = valueEnd - 1;
-      continue;
-    }
-
-    let valueEnd = valueStart;
-    if (assignment.key === "authorization") {
-      while (valueEnd < text.length && text[valueEnd] !== "|" && text[valueEnd] !== "\r" && text[valueEnd] !== "\n") valueEnd += 1;
-      while (valueEnd > valueStart && /\s/.test(text[valueEnd - 1])) valueEnd -= 1;
-    } else {
-      while (valueEnd < text.length && !/[\s|,;"'&#]/.test(text[valueEnd])) valueEnd += 1;
-    }
-    if (valueEnd === valueStart) continue;
-
-    output += `${text.slice(cursor, valueStart)}[redacted]`;
-    cursor = valueEnd;
-    start = valueEnd - 1;
-  }
-
-  return output + text.slice(cursor);
-}
-
-/**
- * Remove terminal controls and credentials from presentation only. Router data
- * remains untouched; this boundary exists because labels and upstream errors
- * can originate outside the extension.
- */
-export function sanitizeReportText(value: unknown): string {
-  let text = String(value ?? "")
-    .replace(/\x1b(?:\][^\x07]*(?:\x07|\x1b\\)|\[[0-?]*[ -/]*[@-~]|[PX^_][^\x1b]*(?:\x1b\\))/g, "")
-    .replace(/[\x00-\x1f\x7f-\x9f]/g, " ")
-    .replace(/\s+/g, " ")
-    .trim();
-
-  // Bearer credentials can occur outside a key/value field. Assignment
-  // parsing below handles every quoted/bare sensitive-key combination and
-  // keeps Authorization's multi-word field value intact while redacting it.
-  text = text
-    .replace(/\b(Bearer\s+)(?:"[^"]*"|'[^']*'|[^\s,;|"']+)/gi, "$1[redacted]")
-    .replace(SENSITIVE_QUERY_VALUE, "$1[redacted]");
-  text = redactSensitiveAssignments(text)
-    .replace(/\b(sk-[A-Za-z0-9_-]{8,}|(?:eyJ[A-Za-z0-9_-]+\.){2}[A-Za-z0-9_-]+)\b/gi, "[redacted]");
-
-  return text;
-}
-
-/** Return the RPC-compatible report representation without terminal controls. */
-export function createRouterReportLines(text: string): string[] {
-  return text.split(/\r?\n/).map(sanitizeReportText);
-}
-
-function fitQuotaBar(line: string, width: number): string {
-  const match = /\[([█░]+)\]/.exec(line);
-  if (!match) return line;
-  const source = match[1];
-  const targetWidth = width <= 45 ? 8 : width <= 70 ? 12 : 18;
-  if (source.length <= targetWidth) return line;
-  const filled = [...source].filter((cell) => cell === "█").length;
-  const targetFilled = Math.round((filled / source.length) * targetWidth);
-  return `${line.slice(0, match.index)}[${"█".repeat(targetFilled)}${"░".repeat(targetWidth - targetFilled)}]${line.slice(match.index + match[0].length)}`;
-}
-
-function styleLine(theme: RouterTheme, line: string): string {
-  if (line === ROUTER_REPORT_DISMISS_HINT) return theme.fg("accent", theme.bold(line));
-  if (line.startsWith("# ")) return theme.fg("accent", theme.bold(line.slice(2)));
-  if (line.startsWith("## ")) return theme.fg("accent", theme.bold(line.slice(3)));
-
-  // State words must win over incidental success counters or a prior healthy
-  // status. In particular, an explicitly disabled account is never success.
-  if (/\b(auth=invalid|auth invalid|invalid)\b/i.test(line)) return theme.fg("error", line);
-  if (/\b(degraded|cooldown|penalty)\b/i.test(line)) return theme.fg("warning", line);
-  if (/\b(enabled\s*=\s*false|disabled|inactive)\b/i.test(line)) return theme.fg("muted", line);
-  if (/^Provider:\s*/.test(line)) return theme.fg("accent", line);
-  if (/^Local:\s*/.test(line)) return theme.fg("muted", line);
-
-  const quota = /(\d+)% left/.exec(line);
-  if (quota) {
-    const remaining = Number(quota[1]);
-    return theme.fg(remaining <= 20 ? "error" : remaining <= 50 ? "warning" : "success", line);
-  }
-  if (/\b(healthy|enabled|ok)\b/i.test(line) && !/\b(unhealthy|not healthy)\b/i.test(line)) return theme.fg("success", line);
-  if (/\b(failures?|429s?|error)\b/i.test(line)) return theme.fg("warning", line);
-  if (/^(Raw:|Usage:|Aliases:|Valid values:|Compact account list|Provider bars show)/.test(line)) return theme.fg("muted", line);
-  if (/^(note:|headers:|claimKeys:|endpoint:|tokenExpires=)/.test(line)) return theme.fg("dim", line);
-  return line;
-}
-
-class RouterReportComponent implements Component {
-  constructor(private readonly lines: string[], private readonly theme: RouterTheme) {}
-
-  invalidate() {
-    // Rendering is derived solely from the report snapshot and current width.
-  }
-
-  render(width: number): string[] {
-    const usableWidth = Math.max(1, width);
-    const rendered: string[] = [];
-    for (const line of this.lines) {
-      if (!line) {
-        rendered.push("");
-        continue;
-      }
-      const styled = styleLine(this.theme, fitQuotaBar(line, usableWidth));
-      const wrapped = wrapTextWithAnsi(styled, usableWidth);
-      rendered.push(...(wrapped.length ? wrapped.map((part) => truncateToWidth(part, usableWidth)) : [""]));
-    }
-    return rendered;
-  }
-}
-
-export function createRouterReportWidget(text: string) {
-  // Snapshot and sanitize now as well as at render time so replacement has no
-  // mutable dependency and no stale report can reappear on a later lifecycle event.
-  const safeLines = createRouterReportLines(text);
-  return (_tui: unknown, theme: RouterTheme): Component => new RouterReportComponent(safeLines, theme);
-}
+import { truncateToWidth, wrapTextWithAnsi, type Component } from "@earendil-works/pi-tui";
+
+export const ROUTER_REPORT_WIDGET_KEY = "oauth-router-report";
+export const ROUTER_REPORT_DISMISS_HINT = "Dismiss: /router-clear";
+
+type RouterTheme = {
+  fg(color: "accent" | "success" | "warning" | "error" | "muted" | "dim", text: string): string;
+  bold(text: string): string;
+};
+
+const SENSITIVE_VALUE_KEYS = new Set([
+  "access_token", "access-token", "accesstoken",
+  "refresh_token", "refresh-token", "refreshtoken",
+  "id_token", "id-token", "idtoken",
+  "auth_token", "auth-token", "authtoken",
+  "api_key", "api-key", "apikey",
+  "authorization",
+  "client_secret", "client-secret", "clientsecret",
+  "password", "secret", "code",
+]);
+const SENSITIVE_QUERY_KEYS = [...SENSITIVE_VALUE_KEYS, "token", "key"];
+const SENSITIVE_QUERY_VALUE = new RegExp(`([?&#](?:${SENSITIVE_QUERY_KEYS.join("|")})=)[^&#\\s"']*`, "gi");
+
+function isKeyCharacter(value: string | undefined): boolean {
+  return Boolean(value && /[A-Za-z0-9_-]/.test(value));
+}
+
+function skipWhitespace(text: string, start: number): number {
+  let index = start;
+  while (/\s/.test(text[index] ?? "")) index += 1;
+  return index;
+}
+
+function quotedEnd(text: string, start: number): number | undefined {
+  const quote = text[start];
+  for (let index = start + 1; index < text.length; index += 1) {
+    if (text[index] === "\\") {
+      index += 1;
+      continue;
+    }
+    if (text[index] === quote) return index + 1;
+  }
+  return undefined;
+}
+
+type SensitiveAssignment = { key: string; valueStart: number };
+
+/**
+ * Locate a complete assignment key rather than using a word-boundary regex.
+ * Underscores and hyphens are key characters, so `zipcode`, `account_code`,
+ * and `authorization_status` cannot be mistaken for sensitive keys.
+ */
+function sensitiveAssignmentAt(text: string, start: number): SensitiveAssignment | undefined {
+  if (isKeyCharacter(text[start - 1])) return undefined;
+
+  let key: string;
+  let afterKey: number;
+  if (text[start] === '"' || text[start] === "'") {
+    const end = quotedEnd(text, start);
+    if (!end) return undefined;
+    key = text.slice(start + 1, end - 1);
+    afterKey = end;
+  } else {
+    if (!isKeyCharacter(text[start])) return undefined;
+    afterKey = start;
+    while (isKeyCharacter(text[afterKey])) afterKey += 1;
+    key = text.slice(start, afterKey);
+  }
+
+  if (!SENSITIVE_VALUE_KEYS.has(key.toLowerCase())) return undefined;
+  const delimiter = skipWhitespace(text, afterKey);
+  if (text[delimiter] !== ":" && text[delimiter] !== "=") return undefined;
+  return { key: key.toLowerCase(), valueStart: skipWhitespace(text, delimiter + 1) };
+}
+
+function redactSensitiveAssignments(text: string): string {
+  let output = "";
+  let cursor = 0;
+
+  for (let start = 0; start < text.length; start += 1) {
+    const assignment = sensitiveAssignmentAt(text, start);
+    if (!assignment || assignment.valueStart >= text.length) continue;
+
+    const valueStart = assignment.valueStart;
+    const quote = text[valueStart];
+    if (quote === '"' || quote === "'") {
+      const valueEnd = quotedEnd(text, valueStart);
+      if (!valueEnd) continue;
+      output += `${text.slice(cursor, valueStart + 1)}[redacted]${quote}`;
+      cursor = valueEnd;
+      start = valueEnd - 1;
+      continue;
+    }
+
+    let valueEnd = valueStart;
+    if (assignment.key === "authorization") {
+      while (valueEnd < text.length && text[valueEnd] !== "|" && text[valueEnd] !== "\r" && text[valueEnd] !== "\n") valueEnd += 1;
+      while (valueEnd > valueStart && /\s/.test(text[valueEnd - 1])) valueEnd -= 1;
+    } else {
+      while (valueEnd < text.length && !/[\s|,;"'&#]/.test(text[valueEnd])) valueEnd += 1;
+    }
+    if (valueEnd === valueStart) continue;
+
+    output += `${text.slice(cursor, valueStart)}[redacted]`;
+    cursor = valueEnd;
+    start = valueEnd - 1;
+  }
+
+  return output + text.slice(cursor);
+}
+
+/**
+ * Remove terminal controls and credentials from presentation only. Router data
+ * remains untouched; this boundary exists because labels and upstream errors
+ * can originate outside the extension.
+ */
+export function sanitizeReportText(value: unknown): string {
+  let text = String(value ?? "")
+    .replace(/\x1b(?:\][^\x07]*(?:\x07|\x1b\\)|\[[0-?]*[ -/]*[@-~]|[PX^_][^\x1b]*(?:\x1b\\))/g, "")
+    .replace(/[\x00-\x1f\x7f-\x9f]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+
+  // Bearer credentials can occur outside a key/value field. Assignment
+  // parsing below handles every quoted/bare sensitive-key combination and
+  // keeps Authorization's multi-word field value intact while redacting it.
+  text = text
+    .replace(/\b(Bearer\s+)(?:"[^"]*"|'[^']*'|[^\s,;|"']+)/gi, "$1[redacted]")
+    .replace(SENSITIVE_QUERY_VALUE, "$1[redacted]");
+  text = redactSensitiveAssignments(text)
+    .replace(/\b(sk-[A-Za-z0-9_-]{8,}|(?:eyJ[A-Za-z0-9_-]+\.){2}[A-Za-z0-9_-]+)\b/gi, "[redacted]");
+
+  return text;
+}
+
+/** Return the RPC-compatible report representation without terminal controls. */
+export function createRouterReportLines(text: string): string[] {
+  return text.split(/\r?\n/).map(sanitizeReportText);
+}
+
+function fitQuotaBar(line: string, width: number): string {
+  const match = /\[([█░]+)\]/.exec(line);
+  if (!match) return line;
+  const source = match[1];
+  const targetWidth = width <= 45 ? 8 : width <= 70 ? 12 : 18;
+  if (source.length <= targetWidth) return line;
+  const filled = [...source].filter((cell) => cell === "█").length;
+  const targetFilled = Math.round((filled / source.length) * targetWidth);
+  return `${line.slice(0, match.index)}[${"█".repeat(targetFilled)}${"░".repeat(targetWidth - targetFilled)}]${line.slice(match.index + match[0].length)}`;
+}
+
+function styleLine(theme: RouterTheme, line: string): string {
+  if (line === ROUTER_REPORT_DISMISS_HINT) return theme.fg("accent", theme.bold(line));
+  if (line.startsWith("# ")) return theme.fg("accent", theme.bold(line.slice(2)));
+  if (line.startsWith("## ")) return theme.fg("accent", theme.bold(line.slice(3)));
+
+  // State words must win over incidental success counters or a prior healthy
+  // status. In particular, an explicitly disabled account is never success.
+  if (/\b(auth=invalid|auth invalid|invalid)\b/i.test(line)) return theme.fg("error", line);
+  if (/\b(degraded|cooldown|penalty)\b/i.test(line)) return theme.fg("warning", line);
+  if (/\b(enabled\s*=\s*false|disabled|inactive)\b/i.test(line)) return theme.fg("muted", line);
+  if (/^Provider:\s*/.test(line)) return theme.fg("accent", line);
+  if (/^Local:\s*/.test(line)) return theme.fg("muted", line);
+
+  const quota = /(\d+)% left/.exec(line);
+  if (quota) {
+    const remaining = Number(quota[1]);
+    return theme.fg(remaining <= 20 ? "error" : remaining <= 50 ? "warning" : "success", line);
+  }
+  if (/\b(healthy|enabled|ok)\b/i.test(line) && !/\b(unhealthy|not healthy)\b/i.test(line)) return theme.fg("success", line);
+  if (/\b(failures?|429s?|error)\b/i.test(line)) return theme.fg("warning", line);
+  if (/^(Raw:|Usage:|Aliases:|Valid values:|Compact account list|Provider bars show)/.test(line)) return theme.fg("muted", line);
+  if (/^(note:|headers:|claimKeys:|endpoint:|tokenExpires=)/.test(line)) return theme.fg("dim", line);
+  return line;
+}
+
+class RouterReportComponent implements Component {
+  constructor(private readonly lines: string[], private readonly theme: RouterTheme) {}
+
+  invalidate() {
+    // Rendering is derived solely from the report snapshot and current width.
+  }
+
+  render(width: number): string[] {
+    const usableWidth = Math.max(1, width);
+    const rendered: string[] = [];
+    for (const line of this.lines) {
+      if (!line) {
+        rendered.push("");
+        continue;
+      }
+      const styled = styleLine(this.theme, fitQuotaBar(line, usableWidth));
+      const wrapped = wrapTextWithAnsi(styled, usableWidth);
+      rendered.push(...(wrapped.length ? wrapped.map((part) => truncateToWidth(part, usableWidth)) : [""]));
+    }
+    return rendered;
+  }
+}
+
+export function createRouterReportWidget(text: string) {
+  // Snapshot and sanitize now as well as at render time so replacement has no
+  // mutable dependency and no stale report can reappear on a later lifecycle event.
+  const safeLines = createRouterReportLines(text);
+  return (_tui: unknown, theme: RouterTheme): Component => new RouterReportComponent(safeLines, theme);
+}