feat(pi): patch prompt layout spacer

.sops.yaml

@@ -7,7 +7,6 @@ keys:
   - &admin age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
   # Generated on the machine it names.
   - &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
-  - &pikachu age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
 
 creation_rules:
   # Material belonging to one machine.
@@ -19,16 +18,9 @@ creation_rules:
           - *admin
           - *neogaia
 
-  - path_regex: secrets/pikachu\.yaml$
-    key_groups:
-      - age:
-          - *admin
-          - *pikachu
-
   # Material common to every machine, so it is stored once rather than per host.
   - path_regex: secrets/shared\.yaml$
     key_groups:
       - age:
           - *admin
           - *neogaia
-          - *pikachu

AGENTS.md

@@ -18,10 +18,6 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
 
 ## Gotchas
 
-- Subagent completion delivery is non-blocking through immediate spawn, milestone notifications, retained terminal entries, and `subagent_list` or `subagent_result` retrieval.
-  `subagent_wait` intentionally blocks the parent tool call until its condition or timeout, so do not use it merely to keep background work alive during an interactive workflow.
-- Nixvim's flake input following the root nixpkgs source does not make its Home Manager module reuse the host's `pkgs` instance.
-  Keep `programs.nixvim.nixpkgs.useGlobalPackages = true` so Nixvim uses the shared package set without warning that its source default was affected.
 - This host has no `python` or `python3` command on its ordinary `PATH`.
   For ad hoc Python, use Nix explicitly, such as `nix shell nixpkgs#python3 -c python3 <script>`.
 - ADR bodies are immutable records of decisions as they were made, while frontmatter is mutable.
@@ -87,8 +83,3 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
 - Pi's tool discovery checks `~/.pi/agent/bin` before `PATH`, and downloaded generic Linux binaries there can be unusable on NixOS with the stub-ld error.
   This flake patches Pi to validate local tool binaries before selecting them, so it falls back to usable `fd`/`rg` from `PATH` instead.
   Stale unpatched launchers are the remaining failure mode for broken `@` autocomplete.
-- Nix flake evaluation ignores untracked files in this checkout.
-  Keep a new auto-loaded module staged or committed until it is removed, otherwise `nix flake check` and `nixos-rebuild --flake` evaluate without it and report its options as missing.
-- The current Steam desktop client is an XWayland application.
-  Its CEF windows do not support Ozone and Steam composites them into an SDL surface with X11 extensions, so SDL Wayland selectors do not make the visible client native Wayland.
-  Keep fractional scaling sharp with Hyprland's `xwayland.force_zero_scaling` and Steam's own `STEAM_FORCE_DESKTOPUI_SCALING` instead.

base.nix

@@ -59,10 +59,7 @@ in
     users.users.${user.name} = {
       isNormalUser = true;
       description = user.description;
-      extraGroups = [
-        "wheel"
-        "storage"
-      ];
+      extraGroups = [ "wheel" ];
     };
 
     # The shared write group.

flake.lock

@@ -562,11 +562,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785695024,
-        "narHash": "sha256-DLLk6X5zu3cRT50p18uHVdwjGVtiS0t/661M34q02zU=",
+        "lastModified": 1785622772,
+        "narHash": "sha256-0mOr+Jxerr4SU1ksLoSkztYlZ9P/nMB6RlgWygoCHWc=",
         "ref": "refs/heads/main",
-        "rev": "9b2a6bcd583d7d6bf7e5377c3632f601692df209",
-        "revCount": 54,
+        "rev": "40b16b87963b085817bfb82c26eef7d0408fa8a5",
+        "revCount": 52,
         "type": "git",
         "url": "https://git.alexion.dev/alexion/skills"
       },

flake.nix

@@ -100,11 +100,7 @@
 
       # `nix flake check` builds each host's toplevel.
       checks.x86_64-linux = lib.mapAttrs (
-        name: host:
-        if host.config.warnings == [] then
-          host.config.system.build.toplevel
-        else
-          throw "Host ${name} has evaluation warnings:\n${lib.concatStringsSep "\n" host.config.warnings}"
+        _name: host: host.config.system.build.toplevel
       ) self.nixosConfigurations;
     };
 }

hosts/neogaia/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   inputs,
   pkgs,
   ...
@@ -38,6 +39,9 @@
   modules.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
   modules.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
 
+  # A machine the operator works from, so it admits the workstation keys alone.
+  modules.ssh.authorizedKeys = config.modules.ssh.workstationKeys;
+
   modules.toolkit.enable = true;
 
   # The walking-skeleton guest, enabled like any module: proves the guest path
@@ -64,12 +68,9 @@
   modules.agents.herdr.enable = true;
   modules.agents.tools.gitea-axi.enable = true;
   modules.agents.pi.enable = true;
-  modules.agents.pi.subagents.maxConcurrent = 8;
-  modules.agents.pi.subagents.recentTerminalTtlMs = 15 * 60 * 1000;
 
   modules.desktop.enable = true;
   modules.desktop.obsidian.enable = true;
-  modules.desktop.steam.enable = true;
 
   time.timeZone = "America/New_York";
   i18n.defaultLocale = "en_GB.UTF-8";

hosts/pikachu/default.nix

@@ -1,54 +0,0 @@
-{ pkgs, ... }:
-# pikachu — AZW ME Pro server.
-# Disk layout is in ./disk.nix.
-# `fileSystems` for the root disk are derived from it.
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./disk.nix
-  ];
-
-  system.stateVersion = "26.05";
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  hardware.cpu.intel.updateMicrocode = true;
-  hardware.enableRedistributableFirmware = true;
-
-  zramSwap.enable = true;
-
-  systemd.network = {
-    enable = true;
-    networks."10-uplink" = {
-      matchConfig.MACAddress = "78:55:36:07:af:49";
-      networkConfig.DHCP = "yes";
-      linkConfig.RequiredForOnline = "routable";
-    };
-  };
-  networking.useDHCP = false;
-
-  boot.zfs.forceImportRoot = false;
-
-  modules.zfs = {
-    enable = true;
-    hostId = "2346edbd";
-    pools.pikachu = { };
-  };
-
-  modules.ssh.enable = true;
-  modules.ssh.hostKeys.sopsFile = ../../secrets/pikachu.yaml;
-  modules.ssh.userKey.sopsFile = ../../secrets/pikachu.yaml;
-
-  modules.git.enable = true;
-  modules.toolkit.enable = true;
-
-  environment.systemPackages = with pkgs; [
-    pciutils
-    smartmontools
-    usbutils
-  ];
-
-  time.timeZone = "America/New_York";
-  i18n.defaultLocale = "en_GB.UTF-8";
-}

hosts/pikachu/disk.nix

@@ -1,32 +0,0 @@
-{ ... }:
-# pikachu's install layout for disko: one NVMe boot disk with an EFI system partition and ext4 root.
-# The existing 8 TB ZFS mirror is imported by name and is never declared here.
-{
-  disko.devices.disk.main = {
-    type = "disk";
-    device = "/dev/nvme0n1";
-    content = {
-      type = "gpt";
-      partitions = {
-        ESP = {
-          size = "2G";
-          type = "EF00";
-          content = {
-            type = "filesystem";
-            format = "vfat";
-            mountpoint = "/boot";
-            mountOptions = [ "umask=0077" ];
-          };
-        };
-        root = {
-          size = "100%";
-          content = {
-            type = "filesystem";
-            format = "ext4";
-            mountpoint = "/";
-          };
-        };
-      };
-    };
-  };
-}

hosts/pikachu/hardware-configuration.nix

@@ -1,18 +0,0 @@
-{ lib, modulesPath, ... }:
-# Hardware detected from the Proxmox inventory for this machine.
-# disko derives the root disk filesystems, none declared here.
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "ahci"
-    "nvme"
-    "sd_mod"
-    "xhci_pci"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/pikachu/ssh_host_ed25519_key.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu

hosts/pikachu/ssh_host_rsa_key.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu

modules/agents/pi/extensions/subagents/config.test.ts

@@ -115,10 +115,9 @@ test("named spawn resolves overrides, frontmatter, config, and defaults", () =>
   const config = loadConfig(cwd, true, diag, agentDir);
   const agents = loadAgents(cwd, true, diag, agentDir);
 
-  const resolved = resolveSpawn({ agent: "review", prompt: "check this", label: "Review migration", thinking: "low" }, config, agents);
+  const resolved = resolveSpawn({ agent: "review", prompt: "check this", thinking: "low" }, config, agents);
 
   assert.equal(resolved.prompt, "check this");
-  assert.equal(resolved.label, "Review migration");
   assert.equal(resolved.context, "independent");
   assert.equal(resolved.model, "inherit");
   assert.equal(resolved.thinking, "low");

modules/agents/pi/extensions/subagents/index.ts

@@ -4,7 +4,6 @@ import { loadAgents } from "./agents.ts";
 import { loadConfig, resolveSpawn, type Diagnostics } from "./config.ts";
 import { SubprocessRpcRunner } from "./runner.ts";
 import { Supervisor } from "./supervisor.ts";
-import { milestoneNotification } from "./status.ts";
 import type { SpawnRequest, SubagentStatus } from "./types.ts";
 import { widget } from "./ui.ts";
 
@@ -24,11 +23,7 @@ export default function subagents(pi: ExtensionAPI) {
     supervisor = new Supervisor(new SubprocessRpcRunner(), cwd, {
       maxConcurrent: config.maxConcurrent,
       recentTerminalTtlMs: config.recentTerminalTtlMs,
-      onMilestone: (status, event) => {
-        pi.appendEntry("subagent_milestone", { event, status });
-        const notification = milestoneNotification(status, event);
-        if (notification) ctx.ui?.notify?.(notification.message, notification.level);
-      },
+      onMilestone: (status, event) => pi.appendEntry("subagent_milestone", { event, status }),
       onChange: (statuses) => {
         lastStatuses = statuses;
         updateUi(ctx, config.ui.enabled);
@@ -56,7 +51,6 @@ export default function subagents(pi: ExtensionAPI) {
     description: "Start one ad hoc independent subagent and return immediately with its child id",
     parameters: Type.Object({
       prompt: Type.String({ description: "Prompt for the delegated subagent" }),
-      label: Type.Optional(Type.String({ description: "Human-readable label for this work item" })),
       agent: Type.Optional(Type.String({ description: "Named agent definition to use" })),
       context: Type.Optional(Type.Union([Type.Literal("independent"), Type.Literal("fork")])),
       model: Type.Optional(Type.String({ description: "Optional model selector for the child" })),
@@ -65,7 +59,7 @@ export default function subagents(pi: ExtensionAPI) {
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       const accepted = getSupervisor(ctx).spawn(resolve(ctx, params as SpawnRequest));
-      ctx.ui?.notify?.(`Started subagent ${accepted.label}`, "info");
+      ctx.ui?.notify?.(`Started subagent ${accepted.id}`, "info");
       return textResult(accepted);
     },
   });
@@ -78,7 +72,6 @@ export default function subagents(pi: ExtensionAPI) {
       subagents: Type.Array(
         Type.Object({
           prompt: Type.String({ description: "Prompt for the delegated subagent" }),
-          label: Type.Optional(Type.String({ description: "Human-readable label for this work item" })),
           agent: Type.Optional(Type.String({ description: "Named agent definition to use" })),
           context: Type.Optional(Type.Union([Type.Literal("independent"), Type.Literal("fork")])),
           model: Type.Optional(Type.String({ description: "Optional model selector for the child" })),
@@ -106,7 +99,7 @@ export default function subagents(pi: ExtensionAPI) {
   pi.registerTool({
     name: "subagent_list",
     label: "List subagents",
-    description: "List active and terminal subagents for this parent session until terminal entries are cleared",
+    description: "List active and recent subagents for this parent session",
     parameters: Type.Object({}),
     async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
       return textResult(getSupervisor(ctx).list());
@@ -167,25 +160,11 @@ export default function subagents(pi: ExtensionAPI) {
     },
   });
 
-  pi.registerTool({
-    name: "subagent_clear",
-    label: "Clear terminal subagents",
-    description: "Remove terminal subagents from the current-session visible work set. Omitting ids clears all terminal children",
-    parameters: Type.Object({
-      ids: Type.Optional(Type.Array(Type.String({ description: "Subagent id returned by subagent_spawn or subagent_batch" }))),
-    }),
-    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-      const input = params as { ids?: unknown };
-      const ids = Array.isArray(input.ids) ? input.ids.map(String) : undefined;
-      return textResult({ cleared: getSupervisor(ctx).clearTerminal(ids) });
-    },
-  });
-
   pi.registerCommand("subagent-spawn", {
     description: "Start an ad hoc independent subagent",
     handler: async (args, ctx) => {
       const accepted = getSupervisor(ctx).spawn(resolve(ctx, parseSpawnArgs(args)));
-      ctx.ui.notify(`Started subagent ${accepted.label}`, "info");
+      ctx.ui.notify(`Started subagent ${accepted.id}`, "info");
     },
   });
 
@@ -208,14 +187,6 @@ export default function subagents(pi: ExtensionAPI) {
     },
   });
 
-  pi.registerCommand("subagent-clear", {
-    description: "Clear terminal subagent records. Pass ids to clear selected terminal records only",
-    handler: async (args, ctx) => {
-      const ids = args.trim().split(/\s+/u).filter(Boolean);
-      ctx.ui.notify(JSON.stringify({ cleared: getSupervisor(ctx).clearTerminal(ids.length > 0 ? ids : undefined) }, null, 2), "info");
-    },
-  });
-
   pi.registerCommand("subagent-status", {
     description: "Show a subagent status by id",
     handler: async (args, ctx) => {
@@ -279,7 +250,6 @@ function parseSpawnArgs(args: string): SpawnRequest {
     const flag = parts.shift();
     const value = parts.shift();
     if (flag === "--agent") request.agent = value;
-    else if (flag === "--label") request.label = value;
     else if (flag === "--context" && (value === "independent" || value === "fork")) request.context = value;
     else if (flag === "--tools") request.tools = value;
     else if (flag === "--model") request.model = value;

modules/agents/pi/extensions/subagents/runner.test.ts

@@ -26,55 +26,6 @@ function events(): RunnerEvents {
   };
 }
 
-test("child RPC process forwards structured activity before collecting the final result", async (t) => {
-  const running: unknown[] = [];
-  const completed: Array<{ result: string; stopReason?: string }> = [];
-  const fakeChild = new EventEmitter() as EventEmitter & {
-    stdout: FakeStream;
-    stderr: FakeStream;
-    stdin: FakeStream;
-    killed: boolean;
-    pid?: number;
-    kill(signal?: NodeJS.Signals): boolean;
-  };
-  fakeChild.stdout = new FakeStream();
-  fakeChild.stderr = new FakeStream();
-  fakeChild.stdin = new FakeStream();
-  fakeChild.killed = false;
-  fakeChild.kill = () => {
-    fakeChild.killed = true;
-    return true;
-  };
-  t.mock.method(fakeChild.stdin, "write", (chunk, callback?: (error?: Error | null) => void) => {
-    const request = JSON.parse(String(chunk)) as { id: string; type: string };
-    callback?.();
-    if (request.type === "get_last_assistant_text") {
-      queueMicrotask(() => {
-        fakeChild.stdout.emit("data", `${JSON.stringify({ id: request.id, type: "response", success: true, data: { text: "final answer" } })}\n`);
-      });
-    }
-    return true;
-  });
-  t.mock.method(childProcess, "spawn", () => fakeChild as unknown as childProcess.ChildProcessWithoutNullStreams);
-
-  const { SubprocessRpcRunner } = await import("./runner.ts");
-  const runner = new SubprocessRpcRunner();
-  await runner.start("child-1", { prompt: "work", label: "Review migration" }, "/tmp", {
-    ...events(),
-    running: (event) => running.push(event),
-    completed: (result, stopReason) => completed.push({ result, stopReason }),
-  });
-
-  const firstActivity = { type: "message_start", role: "assistant", message: { id: "msg-1" } };
-  const secondActivity = { type: "tool_execution_start", tool: "read", input: { path: "runner.ts" } };
-  const settledActivity = { type: "agent_settled" };
-  fakeChild.stdout.emit("data", `${JSON.stringify(firstActivity)}\n${JSON.stringify(secondActivity)}\n${JSON.stringify(settledActivity)}\n`);
-  await new Promise((resolve) => setImmediate(resolve));
-
-  assert.deepEqual(running, [firstActivity, secondActivity, settledActivity]);
-  assert.deepEqual(completed, [{ result: "final answer", stopReason: "agent_settled" }]);
-});
-
 test("child RPC process disables discovery while explicitly loading subagents extension", async (t) => {
   const calls: Array<{ command: string; args: string[] }> = [];
   const fakeChild = new EventEmitter() as EventEmitter & {
@@ -100,18 +51,14 @@ test("child RPC process disables discovery while explicitly loading subagents ex
 
   const { SubprocessRpcRunner } = await import("./runner.ts");
   const runner = new SubprocessRpcRunner();
-  await runner.start("child-1", { prompt: "work", label: "Review migration" }, "/tmp", events());
+  await runner.start("child-1", { prompt: "work" }, "/tmp", events());
 
   assert.equal(spawn.mock.callCount(), 1);
   const args = calls[0].args;
   const noExtensionsIndex = args.indexOf("--no-extensions");
   const extensionIndex = args.indexOf("--extension");
 
-  const nameIndex = args.indexOf("--name");
-
   assert.notEqual(noExtensionsIndex, -1, "child args keep automatic extension discovery disabled");
-  assert.notEqual(nameIndex, -1, "child args include a process name");
-  assert.equal(args[nameIndex + 1], "subagent Review migration");
   assert.notEqual(extensionIndex, -1, "child args explicitly load the subagents extension entry");
   assert.equal(args[extensionIndex + 1], fileURLToPath(new URL("./index.ts", import.meta.url)));
   assert.ok(noExtensionsIndex < extensionIndex);

modules/agents/pi/extensions/subagents/runner.ts

@@ -89,17 +89,16 @@ class RpcChildHandle implements ChildHandle {
     }
 
     if (payload.type === "agent_started") {
-      this.events.running(payload as Record<string, unknown>);
+      this.events.running("agent_started");
       return;
     }
 
     if (payload.type === "agent_settled") {
-      this.events.running(payload as Record<string, unknown>);
       this.finish().catch((error) => this.fail(error instanceof Error ? error.message : String(error)));
       return;
     }
 
-    if (payload.type) this.events.running(payload as Record<string, unknown>);
+    if (payload.type) this.events.running(payload.type);
   }
 
   private async finish() {
@@ -158,7 +157,7 @@ class RpcChildHandle implements ChildHandle {
 
 export class SubprocessRpcRunner implements ChildRunner {
   async start(id: string, request: SpawnRequest, cwd: string, events: RunnerEvents): Promise<ChildHandle> {
-    const args = [process.argv[1], "--mode", "rpc", "--no-extensions", "--extension", subagentsExtensionPath(), "--name", `subagent ${request.label ?? id}`, ...contextArgs(request), ...toolArgs(request), ...modelArgs(request)];
+    const args = [process.argv[1], "--mode", "rpc", "--no-extensions", "--extension", subagentsExtensionPath(), "--name", `subagent ${id}`, ...contextArgs(request), ...toolArgs(request), ...modelArgs(request)];
     const child = spawn(process.execPath, args, {
       cwd,
       env: childEnvironment(),

modules/agents/pi/extensions/subagents/status.ts

@@ -1,5 +1,4 @@
-import { SUBAGENT_STATES, SUBAGENT_TERMINAL_STATES } from "./types.ts";
-import type { ChildRecord, SpawnAccepted, SubagentResult, SubagentState, SubagentStatus } from "./types.ts";
+import type { ChildRecord, SpawnAccepted, SubagentResult, SubagentStatus } from "./types.ts";
 
 export function toAccepted(status: SubagentStatus): SpawnAccepted {
   return {
@@ -13,20 +12,14 @@ export function toAccepted(status: SubagentStatus): SpawnAccepted {
 }
 
 export function cloneStatus(status: SubagentStatus): SubagentStatus {
-  return {
-    ...status,
-    currentActivity: status.currentActivity ? { ...status.currentActivity } : undefined,
-    activityHistory: status.activityHistory.map((event) => ({ ...event })),
-    elapsedMs: elapsedMs(status),
-  };
+  return { ...status, elapsedMs: elapsedMs(status) };
 }
 
 export function cloneResult(record: ChildRecord): SubagentResult {
   const status = cloneStatus(record.status);
-  const terminal = isTerminalState(status.state);
+  const terminal = ["completed", "failed", "cancelled", "timed_out", "orphaned"].includes(status.state);
   return {
     id: status.id,
-    label: status.label,
     state: status.state,
     running: !terminal,
     resultAvailable: status.resultAvailable,
@@ -37,19 +30,6 @@ export function cloneResult(record: ChildRecord): SubagentResult {
   };
 }
 
-export function isTerminalState(state: SubagentState): boolean {
-  return (SUBAGENT_TERMINAL_STATES as readonly string[]).includes(state);
-}
-
-export function milestoneNotification(status: SubagentStatus, event: string): { message: string; level: "info" | "error" } | undefined {
-  if (!isSubagentState(event) || !isTerminalState(event)) return undefined;
-  return { message: `Subagent ${status.label} ${event}`, level: event === "completed" ? "info" : "error" };
-}
-
-export function isSubagentState(value: string): value is SubagentState {
-  return (SUBAGENT_STATES as readonly string[]).includes(value);
-}
-
 export function elapsedMs(status: Pick<SubagentStatus, "startedAt" | "completedAt">): number {
   const start = Date.parse(status.startedAt);
   const end = status.completedAt ? Date.parse(status.completedAt) : Date.now();

modules/agents/pi/extensions/subagents/supervisor.test.ts

@@ -1,9 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { milestoneNotification } from "./status.ts";
 import { Supervisor } from "./supervisor.ts";
 import type { ChildHandle, ChildRunner, RunnerEvents, SpawnRequest } from "./types.ts";
-import { widget } from "./ui.ts";
 
 class FakeHandle implements ChildHandle {
   cancelCalls = 0;
@@ -73,89 +71,6 @@ test("runtime timeout reaches timed_out", async () => {
   assert.equal(runner.starts[0].handle.cancelCalls, 1);
 });
 
-test("activity exposes ordered transcript events while status and list keep only summaries", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp");
-  const accepted = await spawnStarted(supervisor);
-
-  runner.starts[0].events.running({ type: "message_started", role: "assistant" });
-  runner.starts[0].events.running({
-    type: "message_delta",
-    role: "assistant",
-    assistantMessageEvent: { type: "content_delta", delta: "private transcript body" },
-  });
-  runner.starts[0].events.running({ type: "tool_started", tool: "read", input: { path: "secret-notes.md" } });
-  runner.starts[0].events.running({ type: "tool_completed", tool: "read", output: "secret file contents" });
-
-  type ActivityStatus = ReturnType<Supervisor["status"]> & {
-    activityHistory: Array<{ type: string; summary: string }>;
-    currentActivity: { summary: string };
-  };
-  const activity = supervisor.activity(accepted.id);
-  const status = supervisor.status(accepted.id) as ActivityStatus;
-  const listed = supervisor.list().find((item) => item.id === accepted.id) as ActivityStatus | undefined;
-
-  assert.deepEqual(
-    activity.map((event) => event.type),
-    ["queued", "starting", "prompt accepted", "message_started", "message_delta", "tool_started", "tool_completed"],
-  );
-  assert.deepEqual(activity[4], {
-    type: "message_delta",
-    summary: "assistant message content_delta",
-    at: activity[4].at,
-    role: "assistant",
-    tool: undefined,
-    phase: "content_delta",
-    text: "private transcript body",
-    input: undefined,
-    output: undefined,
-    error: undefined,
-    payload: {
-      type: "message_delta",
-      role: "assistant",
-      assistantMessageEvent: { type: "content_delta", delta: "private transcript body" },
-    },
-  });
-  assert.deepEqual(activity[5], {
-    type: "tool_started",
-    summary: "read secret-notes.md",
-    at: activity[5].at,
-    role: undefined,
-    tool: "read",
-    phase: "started",
-    text: undefined,
-    input: { path: "secret-notes.md" },
-    output: undefined,
-    error: undefined,
-    payload: { type: "tool_started", tool: "read", input: { path: "secret-notes.md" } },
-  });
-  assert.equal(activity[6].output, "secret file contents");
-
-  assert.ok(Array.isArray(status.activityHistory), "status should expose structured activityHistory");
-  assert.deepEqual(status.activityHistory.map((event) => event.type), activity.map((event) => event.type));
-  assert.deepEqual(status.activityHistory.map((event) => event.summary), activity.map((event) => event.summary));
-  assert.equal(status.currentActivity.summary, "read");
-  assert.equal(listed?.currentActivity.summary, "read");
-  assert.doesNotMatch(JSON.stringify(status), /private transcript body|secret file contents/u);
-  assert.doesNotMatch(JSON.stringify(listed), /private transcript body|secret file contents/u);
-});
-
-test("status activity history keeps only the 100 most recent summaries", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp");
-  const accepted = await spawnStarted(supervisor);
-
-  for (let index = 0; index < 150; index += 1) {
-    runner.starts[0].events.running(`tick ${index}`);
-  }
-
-  const history = supervisor.status(accepted.id).activityHistory;
-
-  assert.equal(history.length, 100);
-  assert.equal(history[0].summary, "tick 50");
-  assert.equal(history[99].summary, "tick 149");
-});
-
 test("process failure reaches failed with diagnostics", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp");
@@ -195,77 +110,6 @@ test("completed children ignore later cancel", async () => {
   assert.equal(runner.starts[0].handle.cancelCalls, 0);
 });
 
-test("explicit labels are reused across accepted status list and result surfaces", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp");
-  const label = "Review risky migration";
-
-  const accepted = supervisor.spawn({ prompt: "inspect the migration plan", label } as SpawnRequest & { label: string });
-  await sleep(0);
-  runner.starts[0].events.completed("done", "agent_settled");
-
-  assert.deepEqual(
-    {
-      accepted: accepted.label,
-      status: supervisor.status(accepted.id).label,
-      list: supervisor.list().find((status) => status.id === accepted.id)?.label,
-      result: (supervisor.result(accepted.id) as { label?: string }).label,
-    },
-    {
-      accepted: label,
-      status: label,
-      list: label,
-      result: label,
-    },
-  );
-});
-
-test("ad hoc fallback labels are prompt-derived and reused by widget and result surfaces", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp");
-  const prompt = "  Audit\n\tguest enablement plan  ";
-  const label = "Audit guest enablement plan";
-
-  const accepted = supervisor.spawn({ prompt });
-  await sleep(0);
-  runner.starts[0].events.completed("done", "agent_settled");
-  const statuses = supervisor.list();
-  const inspectorLines = widget(statuses, true)().render(240);
-
-  assert.deepEqual(
-    {
-      accepted: accepted.label,
-      childRequest: runner.starts[0].request.label,
-      status: supervisor.status(accepted.id).label,
-      list: statuses.find((status) => status.id === accepted.id)?.label,
-      result: supervisor.result(accepted.id).label,
-    },
-    {
-      accepted: label,
-      childRequest: label,
-      status: label,
-      list: label,
-      result: label,
-    },
-  );
-  assert.ok(inspectorLines.some((line) => line.includes(`completed 0s ${label} result: available`)), inspectorLines.join("\n"));
-  assert.doesNotMatch(accepted.label, /^ad-hoc sg-/u);
-});
-
-test("milestone notifications use the stored label", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp");
-  const accepted = supervisor.spawn({ prompt: "work", label: "Review migration" });
-  await sleep(0);
-  runner.starts[0].events.completed("done", "agent_settled");
-
-  assert.deepEqual(milestoneNotification(supervisor.status(accepted.id), "completed"), {
-    message: "Subagent Review migration completed",
-    level: "info",
-  });
-  assert.equal(milestoneNotification(supervisor.status(accepted.id), "running"), undefined);
-});
-
 test("shutdown clears recent terminal expiry timer", async () => {
   const runner = new FakeRunner();
   let changes = 0;
@@ -284,22 +128,17 @@ test("shutdown clears recent terminal expiry timer", async () => {
   assert.equal(changes, afterShutdown);
 });
 
-test("batch spawn returns explicit labels on accepted child requests and statuses while preserving failures", async () => {
+test("batch spawn returns accepted ids and per-entry failures", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp");
 
-  const result = supervisor.spawnBatch([
-    { prompt: "one", label: "Review docs" },
-    { prompt: "" },
-    { prompt: "two", label: "Check tests" },
-  ]);
+  const result = supervisor.spawnBatch([{ prompt: "one" }, { prompt: "" }, { prompt: "two" }]);
   await sleep(0);
 
-  assert.deepEqual(result.accepted.map((accepted) => accepted.label), ["Review docs", "Check tests"]);
+  assert.equal(result.accepted.length, 2);
   assert.equal(result.failed.length, 1);
   assert.equal(result.failed[0].index, 1);
-  assert.deepEqual(runner.starts.map((start) => start.request.label), ["Review docs", "Check tests"]);
-  assert.deepEqual(result.accepted.map((accepted) => supervisor.status(accepted.id).label), ["Review docs", "Check tests"]);
+  assert.equal(runner.starts.length, 2);
 });
 
 test("maxConcurrent preserves queued records", async () => {
@@ -319,60 +158,58 @@ test("maxConcurrent preserves queued records", async () => {
   assert.equal(runner.starts.length, 2);
 });
 
-test("clearTerminal returns only removed terminal ids", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp");
-  const first = await spawnStarted(supervisor, "one");
-  const second = await spawnStarted(supervisor, "two");
-  const running = await spawnStarted(supervisor, "three");
-
-  runner.starts[0].events.completed("one done", "agent_settled");
-  runner.starts[1].events.completed("two done", "agent_settled");
-
-  assert.deepEqual(supervisor.clearTerminal(), [first.id, second.id]);
-  assert.throws(() => supervisor.status(first.id), /unknown subagent id/);
-  assert.throws(() => supervisor.status(second.id), /unknown subagent id/);
-  assert.equal(supervisor.status(running.id).state, "running");
-});
-
-test("terminal records expire after ttl while active children remain", async () => {
+test("recent terminal statuses expire from list by ttl", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp", { recentTerminalTtlMs: 5 });
-  const completed = await spawnStarted(supervisor, "one");
-  const failed = await spawnStarted(supervisor, "two");
-  const running = await spawnStarted(supervisor, "three");
+  const accepted = await spawnStarted(supervisor);
 
-  runner.starts[0].events.completed("one done", "agent_settled");
-  runner.starts[1].events.failed("two failed");
+  runner.starts[0].events.completed("done", "agent_settled");
+  assert.equal(supervisor.list().some((status) => status.id === accepted.id), true);
 
-  assert.equal(supervisor.result(completed.id).result, "one done");
-  assert.equal(supervisor.result(failed.id).error, "two failed");
-  assert.equal(supervisor.status(running.id).state, "running");
+  await sleep(10);
 
-  await sleep(20);
-
-  const listedIds = supervisor.list().map((status) => status.id);
-  assert.equal(listedIds.includes(completed.id), false);
-  assert.equal(listedIds.includes(failed.id), false);
-  assert.equal(listedIds.includes(running.id), true);
-  assert.throws(() => supervisor.status(completed.id), /unknown subagent id/);
-  assert.throws(() => supervisor.status(failed.id), /unknown subagent id/);
-  assert.throws(() => supervisor.result(completed.id), /unknown subagent id/);
-  assert.throws(() => supervisor.result(failed.id), /unknown subagent id/);
-  assert.equal(supervisor.status(running.id).state, "running");
+  assert.equal(supervisor.list().some((status) => status.id === accepted.id), false);
+  assert.equal(supervisor.result(accepted.id).result, "done");
 });
 
-test("zero recent terminal ttl does not hide terminal statuses", async () => {
+test("recent terminal ttl does not hide active statuses", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp", { recentTerminalTtlMs: 0 });
+  const accepted = await spawnStarted(supervisor);
+
+  assert.equal(supervisor.list().some((status) => status.id === accepted.id), true);
+});
+
+test("zero recent terminal ttl hides terminal statuses immediately", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp", { recentTerminalTtlMs: 0 });
   const accepted = await spawnStarted(supervisor);
 
   runner.starts[0].events.completed("done", "agent_settled");
 
-  assert.equal(supervisor.list().some((status) => status.id === accepted.id), true);
+  assert.equal(supervisor.list().some((status) => status.id === accepted.id), false);
   assert.equal(supervisor.result(accepted.id).result, "done");
 });
 
+test("recent terminal ttl emits a change when an entry expires", async () => {
+  const runner = new FakeRunner();
+  let changes = 0;
+  const supervisor = new Supervisor(runner, "/tmp", {
+    recentTerminalTtlMs: 5,
+    onChange: () => {
+      changes += 1;
+    },
+  });
+  await spawnStarted(supervisor);
+  const beforeComplete = changes;
+
+  runner.starts[0].events.completed("done", "agent_settled");
+  await sleep(15);
+
+  assert.ok(changes > beforeComplete + 1);
+  assert.equal(supervisor.list().length, 0);
+});
+
 test("wait blocks until multiple subagents are terminal", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp");

modules/agents/pi/extensions/subagents/supervisor.ts

@@ -3,7 +3,6 @@ import type {
   ChildRecord,
   ChildRunner,
   ContextMode,
-  RunnerActivity,
   RunnerEvents,
   SpawnAccepted,
   SpawnRequest,
@@ -12,7 +11,7 @@ import type {
   SubagentWaitMode,
   SubagentWaitResult,
 } from "./types.ts";
-import { cloneResult, cloneStatus, isTerminalState, toAccepted } from "./status.ts";
+import { cloneResult, cloneStatus, toAccepted } from "./status.ts";
 
 interface RunningChild {
   record: ChildRecord;
@@ -20,7 +19,6 @@ interface RunningChild {
   handle?: ChildHandle;
   startTimer?: ReturnType<typeof setTimeout>;
   runTimer?: ReturnType<typeof setTimeout>;
-  expiryTimer?: ReturnType<typeof setTimeout>;
 }
 
 interface SupervisorOptions {
@@ -45,13 +43,12 @@ const DEFAULT_TIMEOUTS = {
   runMs: 0,
 };
 
-const MAX_ACTIVITY_HISTORY = 100;
-
 export class Supervisor {
   private nextChild = 0;
   private readonly children = new Map<string, RunningChild>();
   private readonly queue: RunningChild[] = [];
   private readonly waiters = new Set<() => void>();
+  private recentTerminalTimer?: ReturnType<typeof setTimeout>;
 
   constructor(
     private readonly runner: ChildRunner,
@@ -81,7 +78,9 @@ export class Supervisor {
     const active = statuses.filter((status) => !isTerminal(status.state));
     const terminal = statuses
       .filter((status) => isTerminal(status.state))
-      .sort((a, b) => Date.parse(b.completedAt ?? b.startedAt) - Date.parse(a.completedAt ?? a.startedAt));
+      .filter((status) => this.isRecentTerminal(status))
+      .sort((a, b) => Date.parse(b.completedAt ?? b.startedAt) - Date.parse(a.completedAt ?? a.startedAt))
+      .slice(0, this.options.recentTerminalLimit ?? 10);
     return [...active, ...terminal];
   }
 
@@ -93,21 +92,6 @@ export class Supervisor {
     return cloneResult(this.require(id).record);
   }
 
-  clearTerminal(ids?: string[]): string[] {
-    const selectedIds = ids ? [...new Set(ids.map((id) => id.trim()).filter(Boolean))] : undefined;
-    if (selectedIds) for (const id of selectedIds) this.require(id);
-    const cleared: string[] = [];
-    for (const [id, child] of this.children) {
-      if (selectedIds && !selectedIds.includes(id)) continue;
-      if (!isTerminal(child.record.status.state)) continue;
-      this.clearTimer(child, "expiryTimer");
-      cleared.push(id);
-      this.children.delete(id);
-    }
-    if (cleared.length > 0) this.emitChange();
-    return cleared;
-  }
-
   async wait(
     ids: string[],
     options: { timeoutMs?: number; signal?: AbortSignal; mode?: SubagentWaitMode } = {},
@@ -153,6 +137,7 @@ export class Supervisor {
   }
 
   async shutdown(): Promise<void> {
+    this.clearRecentTerminalTimer();
     await Promise.allSettled(
       [...this.children.values()].map(async (child) => {
         if (!isTerminal(child.record.status.state)) {
@@ -161,7 +146,7 @@ export class Supervisor {
         }
       }),
     );
-    for (const child of this.children.values()) this.clearTimer(child, "expiryTimer");
+    this.clearRecentTerminalTimer();
   }
 
   private createChild(request: SpawnRequest): SpawnAccepted {
@@ -172,7 +157,7 @@ export class Supervisor {
     const now = new Date().toISOString();
     const status: SubagentStatus = {
       id,
-      label: deriveLabel(request, id),
+      label: request.agent ?? `ad-hoc ${id}`,
       agent: request.agent,
       adHoc: !request.agent,
       context: this.resolveContext(request.context),
@@ -185,11 +170,9 @@ export class Supervisor {
       elapsedMs: 0,
       lastEvent: "queued",
       lastEventAt: now,
-      currentActivity: { type: "queued", summary: "queued", at: now },
-      activityHistory: [{ type: "queued", summary: "queued", at: now }],
       resultAvailable: false,
     };
-    const child: RunningChild = { record: { status, activityEvents: [{ type: "queued", summary: "queued", at: now }] }, request: { ...request, prompt, label: status.label, context: status.context, tools: status.tools } };
+    const child: RunningChild = { record: { status }, request: { ...request, prompt, context: status.context, tools: status.tools } };
     this.children.set(id, child);
     this.emitMilestone(child, "accepted");
     this.queue.push(child);
@@ -250,13 +233,9 @@ export class Supervisor {
         record.status.completedAt = now;
         record.status.lastEvent = "completed";
         record.status.lastEventAt = now;
-        this.recordActivity(record, "completed", now);
         record.status.stopReason = stopReason;
         record.status.resultAvailable = true;
-        if (child) {
-          this.armTerminalExpiry(child);
-          this.emitMilestone(child, "completed");
-        }
+        if (child) this.emitMilestone(child, "completed");
         this.pumpQueue();
       },
       failed: (error) => this.fail(record, error),
@@ -272,13 +251,9 @@ export class Supervisor {
     record.status.completedAt = now;
     record.status.lastEvent = "failed";
     record.status.lastEventAt = now;
-    this.recordActivity(record, "failed", now);
     record.status.error = error;
     record.status.stopReason = "failed";
-    if (child) {
-      this.armTerminalExpiry(child);
-      this.emitMilestone(child, "failed");
-    }
+    if (child) this.emitMilestone(child, "failed");
     this.pumpQueue();
   }
 
@@ -290,9 +265,7 @@ export class Supervisor {
     child.record.status.completedAt = now;
     child.record.status.lastEvent = state;
     child.record.status.lastEventAt = now;
-    this.recordActivity(child.record, state, now);
     child.record.status.stopReason = reason;
-    this.armTerminalExpiry(child);
     this.emitMilestone(child, state);
   }
 
@@ -319,26 +292,12 @@ export class Supervisor {
     this.pumpQueue();
   }
 
-  private armTerminalExpiry(child: RunningChild) {
-    const ttl = this.options.recentTerminalTtlMs;
-    if (ttl === undefined || ttl <= 0) return;
-    this.clearTimer(child, "expiryTimer");
-    child.expiryTimer = setTimeout(() => {
-      child.expiryTimer = undefined;
-      const id = child.record.status.id;
-      if (this.children.get(id) !== child || !isTerminal(child.record.status.state)) return;
-      this.children.delete(id);
-      this.emitChange();
-    }, ttl);
-    child.expiryTimer.unref?.();
-  }
-
   private clearTimers(child: RunningChild) {
     this.clearTimer(child, "startTimer");
     this.clearTimer(child, "runTimer");
   }
 
-  private clearTimer(child: RunningChild, key: "startTimer" | "runTimer" | "expiryTimer") {
+  private clearTimer(child: RunningChild, key: "startTimer" | "runTimer") {
     const timer = child[key];
     if (!timer) return;
     clearTimeout(timer);
@@ -349,33 +308,15 @@ export class Supervisor {
     return [...this.children.values()].find((child) => child.record === record);
   }
 
-  activity(id: string) {
-    return this.require(id).record.activityEvents.map((event) => ({ ...event }));
-  }
-
-  private setState(status: SubagentStatus, state: SubagentStatus["state"], event: RunnerActivity) {
+  private setState(status: SubagentStatus, state: SubagentStatus["state"], event: string) {
     if (isTerminal(status.state)) return;
-    const record = this.require(status.id).record;
     const now = new Date().toISOString();
-    const activity = this.recordActivity(record, event, now);
     status.state = state;
-    status.lastEvent = activity.type;
+    status.lastEvent = event;
     status.lastEventAt = now;
     this.emitChange();
   }
 
-  private recordActivity(record: ChildRecord, event: RunnerActivity, at: string) {
-    const activity = normalizeActivity(event, at);
-    record.activityEvents.push(activity);
-    const summary = summarizeActivity(activity);
-    record.status.currentActivity = summary;
-    record.status.activityHistory.push(summary);
-    if (record.status.activityHistory.length > MAX_ACTIVITY_HISTORY) {
-      record.status.activityHistory.splice(0, record.status.activityHistory.length - MAX_ACTIVITY_HISTORY);
-    }
-    return activity;
-  }
-
   private require(id: string): RunningChild {
     const child = this.children.get(id);
     if (!child) throw new Error(`unknown subagent id: ${id}`);
@@ -404,6 +345,39 @@ export class Supervisor {
   private emitChange() {
     this.options.onChange?.(this.list());
     for (const waiter of this.waiters) waiter();
+    this.scheduleRecentTerminalExpiry();
+  }
+
+  private scheduleRecentTerminalExpiry() {
+    this.clearRecentTerminalTimer();
+    const ttl = this.options.recentTerminalTtlMs;
+    if (ttl === undefined || ttl <= 0) return;
+    const now = Date.now();
+    const nextExpiryMs = [...this.children.values()]
+      .map((child) => child.record.status)
+      .filter((status) => isTerminal(status.state))
+      .map((status) => Date.parse(status.completedAt ?? status.startedAt))
+      .filter((completed) => Number.isFinite(completed))
+      .map((completed) => completed + ttl - now)
+      .filter((remaining) => remaining > 0)
+      .sort((a, b) => a - b)[0];
+    if (nextExpiryMs === undefined) return;
+    this.recentTerminalTimer = setTimeout(() => this.emitChange(), nextExpiryMs + 1);
+  }
+
+  private clearRecentTerminalTimer() {
+    if (!this.recentTerminalTimer) return;
+    clearTimeout(this.recentTerminalTimer);
+    this.recentTerminalTimer = undefined;
+  }
+
+  private isRecentTerminal(status: SubagentStatus): boolean {
+    const ttl = this.options.recentTerminalTtlMs;
+    if (ttl === undefined) return true;
+    if (ttl <= 0) return false;
+    const completed = Date.parse(status.completedAt ?? status.startedAt);
+    if (!Number.isFinite(completed)) return true;
+    return Date.now() - completed <= ttl;
   }
 
   private waitReady(ids: string[], mode: SubagentWaitMode): boolean {
@@ -444,115 +418,6 @@ export class Supervisor {
   }
 }
 
-function deriveLabel(request: SpawnRequest, id: string): string {
-  const explicit = normalizeLabel(request.label);
-  if (explicit) return explicit;
-  const agent = normalizeLabel(request.agent);
-  if (agent) return agent;
-  return promptLabel(request.prompt) ?? `ad-hoc ${id}`;
-}
-
-function promptLabel(prompt: string): string | undefined {
-  const normalized = normalizeLabel(prompt);
-  if (!normalized) return undefined;
-  return truncateLabel(normalized);
-}
-
-function normalizeLabel(value: unknown): string | undefined {
-  if (typeof value !== "string") return undefined;
-  const normalized = value.replace(/\s+/gu, " ").trim();
-  return normalized || undefined;
-}
-
-function truncateLabel(label: string): string {
-  const maxLength = 80;
-  if (label.length <= maxLength) return label;
-  return `${label.slice(0, maxLength - 1).trimEnd()}…`;
-}
-
 function isTerminal(state: SubagentStatus["state"]): boolean {
-  return isTerminalState(state);
-}
-
-function normalizeActivity(event: RunnerActivity, at: string) {
-  if (typeof event === "string") return { type: event, summary: event, at };
-  const type = typeof event.type === "string" ? event.type : "activity";
-  const role = typeof event.role === "string" ? event.role : undefined;
-  const tool = toolFromActivity(event);
-  const phase = typeof event.phase === "string" ? event.phase : phaseFromType(type, event);
-  const text = textFromActivity(event);
-  const input = inputFromActivity(event);
-  const output = "output" in event ? event.output : "result" in event ? event.result : "partialResult" in event ? event.partialResult : undefined;
-  const error = typeof event.error === "string" ? event.error : undefined;
-  return { type, summary: summaryFor({ type, role, tool, phase, input, output, error }), at, role, tool, phase, text, input, output, error, payload: { ...event } };
-}
-
-function summarizeActivity(activity: ReturnType<typeof normalizeActivity>) {
-  const { type, summary, at, role, tool, phase } = activity;
-  return { type, summary, at, role, tool, phase };
-}
-
-function toolFromActivity(event: Record<string, unknown>): string | undefined {
-  for (const key of ["tool", "toolName", "name"]) {
-    const value = event[key];
-    if (typeof value === "string") return value;
-  }
-  return undefined;
-}
-
-function phaseFromType(type: string, event: Record<string, unknown>): string | undefined {
-  const assistantEvent = event.assistantMessageEvent;
-  if (assistantEvent && typeof assistantEvent === "object" && !Array.isArray(assistantEvent)) {
-    const assistantType = (assistantEvent as { type?: unknown }).type;
-    if (typeof assistantType === "string") return assistantType;
-  }
-  if (type.endsWith("_start")) return "started";
-  if (type.endsWith("_started")) return "started";
-  if (type.endsWith("_update")) return "update";
-  if (type.endsWith("_delta")) return "delta";
-  if (type.endsWith("_end")) return "completed";
-  if (type.endsWith("_completed")) return "completed";
-  if (type.endsWith("_failed")) return "failed";
-  return undefined;
-}
-
-function textFromActivity(event: Record<string, unknown>): string | undefined {
-  for (const key of ["text", "body", "content", "delta"]) {
-    const value = event[key];
-    if (typeof value === "string") return value;
-  }
-  const assistantEvent = event.assistantMessageEvent;
-  if (assistantEvent && typeof assistantEvent === "object" && !Array.isArray(assistantEvent)) {
-    for (const key of ["delta", "content"]) {
-      const value = (assistantEvent as Record<string, unknown>)[key];
-      if (typeof value === "string") return value;
-    }
-  }
-  return undefined;
-}
-
-function inputFromActivity(event: Record<string, unknown>): unknown {
-  if ("input" in event) return event.input;
-  if ("args" in event) return event.args;
-  return undefined;
-}
-
-function summaryFor(activity: { type: string; role?: string; tool?: string; phase?: string; input?: unknown; output?: unknown; error?: string }): string {
-  if (activity.error) return `${activity.tool ?? activity.type} failed: ${activity.error}`;
-  if (activity.tool) return `${activity.tool}${inputHint(activity.input)}`;
-  if (activity.type.startsWith("message")) return `${activity.role ?? "assistant"} message${activity.phase ? ` ${activity.phase}` : ""}`;
-  return activity.type;
-}
-
-function inputHint(input: unknown): string {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return "";
-  const path = (input as { path?: unknown }).path;
-  if (typeof path === "string" && path.trim()) return ` ${path.trim()}`;
-  const command = (input as { command?: unknown }).command;
-  if (typeof command === "string" && command.trim()) return ` ${truncateActivityHint(command.trim())}`;
-  return "";
-}
-
-function truncateActivityHint(value: string): string {
-  return value.length <= 80 ? value : `${value.slice(0, 79).trimEnd()}…`;
+  return ["completed", "failed", "cancelled", "timed_out", "orphaned"].includes(state);
 }

modules/agents/pi/extensions/subagents/types.ts

@@ -1,9 +1,15 @@
 export type ContextMode = "independent" | "fork";
 
-export const SUBAGENT_STATES = ["queued", "starting", "running", "settling", "completed", "failed", "cancelled", "timed_out", "orphaned"] as const;
-export const SUBAGENT_TERMINAL_STATES = ["completed", "failed", "cancelled", "timed_out", "orphaned"] as const;
-
-export type SubagentState = (typeof SUBAGENT_STATES)[number];
+export type SubagentState =
+  | "queued"
+  | "starting"
+  | "running"
+  | "settling"
+  | "completed"
+  | "failed"
+  | "cancelled"
+  | "timed_out"
+  | "orphaned";
 
 export interface ToolProfile {
   activeTools: string[] | null;
@@ -11,7 +17,6 @@ export interface ToolProfile {
 
 export interface SpawnRequest {
   prompt: string;
-  label?: string;
   context?: ContextMode;
   agent?: string;
   model?: string;
@@ -31,27 +36,6 @@ export interface SpawnAccepted {
   hint: string;
 }
 
-export interface SubagentActivitySummary {
-  type: string;
-  summary: string;
-  at: string;
-  role?: string;
-  tool?: string;
-  phase?: string;
-}
-
-export interface SubagentActivityEvent extends SubagentActivitySummary {
-  text?: string;
-  input?: unknown;
-  output?: unknown;
-  error?: string;
-  payload?: Record<string, unknown>;
-}
-
-export interface SubagentCurrentActivity extends SubagentActivitySummary {}
-
-export type RunnerActivity = string | Record<string, unknown>;
-
 export interface SubagentStatus {
   id: string;
   label: string;
@@ -68,8 +52,6 @@ export interface SubagentStatus {
   elapsedMs: number;
   lastEvent?: string;
   lastEventAt?: string;
-  currentActivity?: SubagentCurrentActivity;
-  activityHistory: SubagentActivitySummary[];
   stopReason?: string;
   resultAvailable: boolean;
   childSession?: string;
@@ -78,7 +60,6 @@ export interface SubagentStatus {
 
 export interface SubagentResult {
   id: string;
-  label: string;
   state: SubagentState;
   running: boolean;
   resultAvailable: boolean;
@@ -102,13 +83,12 @@ export interface SubagentWaitResult {
 
 export interface ChildRecord {
   status: SubagentStatus;
-  activityEvents: SubagentActivityEvent[];
   result?: string;
 }
 
 export interface RunnerEvents {
   accepted(childSession?: string): void;
-  running(event: RunnerActivity): void;
+  running(event: string): void;
   settling(): void;
   completed(result: string, stopReason?: string): void;
   failed(error: string): void;

modules/agents/pi/extensions/subagents/ui.test.ts

@@ -1,89 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import type { SubagentState, SubagentStatus } from "./types.ts";
-import { renderInspector, renderSummary, widget } from "./ui.ts";
-
-function status(overrides: Partial<SubagentStatus> & { id: string; label: string; state: SubagentState }): SubagentStatus {
-  return {
-    adHoc: true,
-    context: "independent",
-    cwd: "/tmp",
-    elapsedMs: 0,
-    activityHistory: [],
-    resultAvailable: false,
-    startedAt: "2026-08-01T00:00:00.000Z",
-    tools: "inherit",
-    ...overrides,
-  };
-}
-
-test("compact monitor aggregates visible children by actionable lifecycle group", () => {
-  assert.deepEqual(renderSummary([]), []);
-
-  assert.deepEqual(
-    renderSummary([
-      status({ id: "queued", label: "Queued", state: "queued" }),
-      status({ id: "starting", label: "Starting", state: "starting" }),
-      status({ id: "running", label: "Running", state: "running" }),
-      status({ id: "settling", label: "Settling", state: "settling" }),
-      status({ id: "completed", label: "Completed", state: "completed", resultAvailable: true }),
-      status({ id: "failed", label: "Failed", state: "failed", error: "boom" }),
-      status({ id: "timed-out", label: "Timed out", state: "timed_out" }),
-      status({ id: "cancelled", label: "Cancelled", state: "cancelled" }),
-    ]),
-    ["subagents: queued 1 · running 2 · settling 1 · completed 1 · failed 1 · timed out 1 · cancelled 1"],
-  );
-});
-
-test("expanded monitor shows concise current activity summaries instead of raw event types", () => {
-  const rendered = widget([
-    status({
-      id: "sg-reading",
-      label: "Audit guest enablement plan",
-      state: "running",
-      elapsedMs: 12_000,
-      lastEvent: "message_update",
-      currentActivity: {
-        type: "message_update",
-        summary: "read secret-notes.md",
-        at: "2026-08-01T00:00:12.000Z",
-      },
-    }),
-  ], true)().render(240);
-
-  assert.deepEqual(rendered, ["▶ running   12s Audit guest enablement plan last: read secret-notes.md"]);
-  assert.doesNotMatch(rendered.join("\n"), /message_update|private transcript body/u);
-});
-
-test("expanded monitor renders one truncated row per child with state, elapsed time, and activity marker", () => {
-  const lines = renderInspector([
-    status({
-      id: "sg-running",
-      label: "Audit unusually verbose guest enablement migration plan",
-      state: "running",
-      elapsedMs: 65_000,
-      lastEvent: "message_update",
-    }),
-    status({
-      id: "sg-completed",
-      label: "Summarize review",
-      state: "completed",
-      elapsedMs: 3_600_000,
-      lastEvent: "completed",
-      resultAvailable: true,
-    }),
-    status({ id: "sg-failed", label: "Run risky test", state: "failed", elapsedMs: 2_000, error: "exit 1" }),
-  ]);
-
-  assert.equal(lines.length, 3);
-  assert.match(lines[0], /^▶ running +1m05s +Audit unusually verbose guest enablement migration plan +last: message_update$/u);
-  assert.equal(lines[1], "✓ completed 1h00m00s Summarize review result: available");
-  assert.equal(lines[2], "✗ failed    2s Run risky test error: exit 1");
-
-  const rendered = widget([
-    status({ id: "sg-running", label: "Audit unusually verbose guest enablement migration plan", state: "running", elapsedMs: 65_000, lastEvent: "message_update" }),
-  ], true)().render(32);
-
-  assert.deepEqual(rendered, ["▶ running   1m05s Audit unusual…"]);
-  assert.ok(rendered.every((line) => line.length <= 32));
-});

modules/agents/pi/extensions/subagents/ui.ts

@@ -1,81 +1,28 @@
-import type { SubagentState, SubagentStatus } from "./types.ts";
-
-const COMPACT_GROUPS: Array<{ label: string; states: SubagentState[] }> = [
-  { label: "queued", states: ["queued"] },
-  { label: "running", states: ["starting", "running"] },
-  { label: "settling", states: ["settling"] },
-  { label: "completed", states: ["completed"] },
-  { label: "failed", states: ["failed"] },
-  { label: "timed out", states: ["timed_out"] },
-  { label: "cancelled", states: ["cancelled"] },
-  { label: "orphaned", states: ["orphaned"] },
-];
-
-const STATE_PRESENTATION: Record<SubagentState, { icon: string; label: string }> = {
-  queued: { icon: "…", label: "queued" },
-  starting: { icon: "◌", label: "starting" },
-  running: { icon: "▶", label: "running" },
-  settling: { icon: "◒", label: "settling" },
-  completed: { icon: "✓", label: "completed" },
-  failed: { icon: "✗", label: "failed" },
-  cancelled: { icon: "■", label: "cancelled" },
-  timed_out: { icon: "⏱", label: "timed out" },
-  orphaned: { icon: "?", label: "orphaned" },
-};
+import type { SubagentStatus } from "./types.ts";
 
 export function renderSummary(statuses: SubagentStatus[]): string[] {
-  const groups = COMPACT_GROUPS.map((group) => ({
-    label: group.label,
-    count: statuses.filter((status) => group.states.includes(status.state)).length,
-  })).filter((group) => group.count > 0);
-
-  if (groups.length === 0) return [];
-  return [`subagents: ${groups.map((group) => `${group.label} ${group.count}`).join(" · ")}`];
+  const running = statuses.filter((status) => ["starting", "running", "settling"].includes(status.state)).length;
+  const queued = statuses.filter((status) => status.state === "queued").length;
+  const terminal = statuses.filter((status) => ["completed", "failed", "cancelled", "timed_out", "orphaned"].includes(status.state)).length;
+  if (running === 0 && queued === 0 && terminal === 0) return [];
+  return [`subagents: ${running} running · ${queued} queued · ${terminal} recent`];
 }
 
 export function renderInspector(statuses: SubagentStatus[]): string[] {
-  return statuses.map((status) => renderStatusRow(status));
+  const lines = renderSummary(statuses);
+  for (const status of statuses) {
+    lines.push(
+      `${status.id} ${status.label} ${status.context} ${status.state} ${Math.round(status.elapsedMs / 1000)}s ${status.model ?? "inherit"} ${status.tools} ${status.lastEvent ?? "none"} result:${status.resultAvailable ? "yes" : "no"}`,
+    );
+  }
+  return lines;
 }
 
 export function widget(statuses: SubagentStatus[], expanded: boolean) {
   return () => ({
     invalidate() {},
     render(width: number) {
-      return (expanded ? renderInspector(statuses) : renderSummary(statuses)).map((line) => truncateLine(line, width));
+      return (expanded ? renderInspector(statuses) : renderSummary(statuses)).map((line) => (line.length > width ? line.slice(0, Math.max(0, width - 1)) : line));
     },
   });
 }
-
-function renderStatusRow(status: SubagentStatus): string {
-  const presentation = STATE_PRESENTATION[status.state];
-  const marker = statusMarker(status);
-  return `${presentation.icon} ${presentation.label.padEnd(9)} ${formatDuration(status.elapsedMs)} ${status.label}${marker ? ` ${marker}` : ""}`;
-}
-
-function statusMarker(status: SubagentStatus): string | undefined {
-  if (status.error) return `error: ${status.error}`;
-  if (status.resultAvailable) return "result: available";
-  if (status.currentActivity) return `last: ${status.currentActivity.summary}`;
-  if (status.lastEvent) return `last: ${status.lastEvent}`;
-  if (status.state === "queued") return "waiting";
-  if (status.state === "settling") return "settling";
-  return undefined;
-}
-
-function formatDuration(elapsedMs: number): string {
-  const totalSeconds = Math.max(0, Math.round(elapsedMs / 1000));
-  const hours = Math.floor(totalSeconds / 3600);
-  const minutes = Math.floor((totalSeconds % 3600) / 60);
-  const seconds = totalSeconds % 60;
-
-  if (hours > 0) return `${hours}h${String(minutes).padStart(2, "0")}m${String(seconds).padStart(2, "0")}s`;
-  if (minutes > 0) return `${minutes}m${String(seconds).padStart(2, "0")}s`;
-  return `${seconds}s`;
-}
-
-function truncateLine(line: string, width: number): string {
-  if (width <= 0) return "";
-  if (line.length <= width) return line;
-  if (width === 1) return "…";
-  return `${line.slice(0, width - 1)}…`;
-}

modules/agents/pi/patches/pi-flex-spacer.patch

@@ -32,7 +32,7 @@ diff --git a/packages/coding-agent/src/core/settings-manager.ts b/packages/codin
 diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/packages/coding-agent/src/modes/interactive/interactive-mode.ts
 --- a/packages/coding-agent/src/modes/interactive/interactive-mode.ts	2026-08-01 18:41:36.963495957 -0400
 +++ b/packages/coding-agent/src/modes/interactive/interactive-mode.ts	2026-08-01 18:43:04.876341236 -0400
-@@ -210,6 +210,47 @@
+@@ -210,6 +210,45 @@
  	return code !== undefined && DEAD_TERMINAL_ERROR_CODES.has(code);
  }
  
@@ -56,9 +56,7 @@ diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/p
 +	private renderGroup(children: Component[], width: number): string[] {
 +		const lines: string[] = [];
 +		for (const child of children) {
-+			for (const line of child.render(width)) {
-+				lines.push(line);
-+			}
++			lines.push(...child.render(width));
 +		}
 +		return lines;
 +	}
@@ -80,7 +78,7 @@ diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/p
  const ANTHROPIC_SUBSCRIPTION_AUTH_WARNING =
  	"Anthropic subscription auth is active. Third-party harness usage draws from extra usage and is billed per token, not your Claude plan limits. Manage extra usage at https://claude.ai/settings/usage. Disable this warning in /settings.";
  
-@@ -335,6 +376,7 @@
+@@ -335,6 +374,7 @@
  	private fdPath: string | undefined;
  	private editorContainer: Container;
  	private footer: FooterComponent;
@@ -88,7 +86,7 @@ diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/p
  	private footerDataProvider: FooterDataProvider;
  	// Stored so the same manager can be injected into custom editors, selectors, and extension UI.
  	private keybindings: KeybindingsManager;
-@@ -477,7 +519,9 @@
+@@ -477,7 +517,9 @@
  		this.editorContainer = new Container();
  		this.editorContainer.addChild(this.editor as Component);
  		this.footerDataProvider = new FooterDataProvider(this.sessionManager.getCwd());
@@ -98,7 +96,7 @@ diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/p
  		this.footer.setAutoCompactEnabled(this.session.autoCompactionEnabled);
  
  		// Load hide thinking block setting
-@@ -704,19 +748,25 @@
+@@ -704,19 +746,25 @@
  			console.log(theme.fg("dim", `Model scope: ${modelList}${cycleHint}`));
  		}
  
@@ -136,7 +134,7 @@ diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/p
  		this.ui.setFocus(this.editor);
  
  		this.setupKeyHandlers();
-@@ -2033,25 +2083,25 @@
+@@ -2033,25 +2081,25 @@
  			| ((tui: TUI, thm: Theme, footerData: ReadonlyFooterDataProvider) => Component & { dispose?(): void })
  			| undefined,
  	): void {

modules/agents/pi/pi.nix

@@ -11,40 +11,6 @@ let
   cfg = config.modules.agents.pi;
   user = config.user.name;
   piDir = "${config.users.users.${user}.home}/.pi/agent";
-  reservedToolProfiles = [
-    "none"
-    "read-only"
-    "read-only-with-safe-bash"
-    "full-tools"
-  ];
-  subagentsConfig =
-    lib.optionalAttrs (cfg.subagents.defaultContext != null) {
-      defaultContext = cfg.subagents.defaultContext;
-    }
-    // lib.optionalAttrs (cfg.subagents.defaultTools != null) {
-      defaultTools = cfg.subagents.defaultTools;
-    }
-    // lib.optionalAttrs (cfg.subagents.maxConcurrent != null) {
-      maxConcurrent = cfg.subagents.maxConcurrent;
-    }
-    // lib.optionalAttrs (cfg.subagents.recentTerminalTtlMs != null) {
-      recentTerminalTtlMs = cfg.subagents.recentTerminalTtlMs;
-    }
-    // lib.optionalAttrs (
-      cfg.subagents.ui.enabled != null || cfg.subagents.ui.defaultExpanded != null
-    ) {
-      ui =
-        lib.optionalAttrs (cfg.subagents.ui.enabled != null) {
-          enabled = cfg.subagents.ui.enabled;
-        }
-        // lib.optionalAttrs (cfg.subagents.ui.defaultExpanded != null) {
-          defaultExpanded = cfg.subagents.ui.defaultExpanded;
-        };
-    }
-    // lib.optionalAttrs (cfg.subagents.toolProfiles != { }) {
-      toolProfiles = cfg.subagents.toolProfiles;
-    };
-  subagentsJson = (pkgs.formats.json { }).generate "pi-subagents.json" subagentsConfig;
   patchedPi = pkgs.pi-coding-agent.overrideAttrs (old: {
     patches = (old.patches or [ ]) ++ [
       ./patches/pi-flex-spacer.patch
@@ -73,112 +39,10 @@ let
   };
 in
 {
-  options.modules.agents.pi = {
-    enable = lib.mkEnableOption ''
-      Pi, a terminal coding agent, configured via home-manager'';
-
-    subagents = {
-      defaultContext = lib.mkOption {
-        type = lib.types.nullOr (lib.types.enum [
-          "independent"
-          "fork"
-        ]);
-        default = null;
-        description = ''
-          Default context mode for subagents.
-          Left null, the extension keeps its in-code default.
-        '';
-      };
-
-      defaultTools = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        example = "read-only-with-safe-bash";
-        description = ''
-          Default tool profile for subagents.
-          Left null, the extension keeps its in-code default.
-        '';
-      };
-
-      maxConcurrent = lib.mkOption {
-        type = lib.types.nullOr lib.types.ints.positive;
-        default = null;
-        example = 4;
-        description = ''
-          Maximum number of child processes allowed to run concurrently.
-          Left null, the extension keeps its in-code default.
-        '';
-      };
-
-      recentTerminalTtlMs = lib.mkOption {
-        type = lib.types.nullOr lib.types.ints.unsigned;
-        default = null;
-        example = 600000;
-        description = ''
-          Milliseconds to retain terminal subagents in the recent work set.
-          Zero disables time-based retention.
-          Left null, the extension keeps its in-code default.
-        '';
-      };
-
-      ui = {
-        enabled = lib.mkOption {
-          type = lib.types.nullOr lib.types.bool;
-          default = null;
-          description = ''
-            Whether the extension renders its built-in subagent monitor.
-            Left null, the extension keeps its in-code default.
-          '';
-        };
-
-        defaultExpanded = lib.mkOption {
-          type = lib.types.nullOr lib.types.bool;
-          default = null;
-          description = ''
-            Whether the built-in subagent monitor starts expanded.
-            Left null, the extension keeps its in-code default.
-          '';
-        };
-      };
-
-      toolProfiles = lib.mkOption {
-        type = lib.types.attrsOf (
-          lib.types.submodule {
-            options.activeTools = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              description = "Pi tools made available to a child using this profile.";
-            };
-          }
-        );
-        default = { };
-        example = {
-          review = {
-            activeTools = [
-              "read"
-              "grep"
-              "find"
-              "ls"
-            ];
-          };
-        };
-        description = ''
-          Custom named tool profiles for subagents.
-          The extension's reserved built-in profile names cannot be redefined.
-        '';
-      };
-    };
-  };
+  options.modules.agents.pi.enable = lib.mkEnableOption ''
+    Pi, a terminal coding agent, configured via home-manager'';
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = lib.intersectLists reservedToolProfiles (
-          builtins.attrNames cfg.subagents.toolProfiles
-        ) == [ ];
-        message = "modules.agents.pi.subagents.toolProfiles may not redefine the reserved profiles: ${lib.concatStringsSep ", " reservedToolProfiles}.";
-      }
-    ];
-
     home-manager.users.${user} = {
       programs.pi-coding-agent = {
         enable = true;
@@ -194,29 +58,21 @@ in
         };
       };
 
-      home.file =
-        {
-          # The first declarative rollout replaces the interactive settings file.
-          # Login state stays in auth.json, which this module does not manage.
-          "${piDir}/settings.json".force = true;
+      home.file = {
+        # The first declarative rollout replaces the interactive settings file.
+        # Login state stays in auth.json, which this module does not manage.
+        "${piDir}/settings.json".force = true;
 
-          "${piDir}/extensions" = {
-            source = piExtensions;
-            recursive = true;
-          };
-
-          "${piDir}/prompts" = {
-            source = ./prompts;
-            recursive = true;
-          };
-        }
-        // lib.optionalAttrs (subagentsConfig != { }) {
-          # Declaring any global override makes Nix the owner of the runtime file.
-          "${piDir}/subagents.json" = {
-            source = subagentsJson;
-            force = true;
-          };
+        "${piDir}/extensions" = {
+          source = piExtensions;
+          recursive = true;
         };
+
+        "${piDir}/prompts" = {
+          source = ./prompts;
+          recursive = true;
+        };
+      };
     };
   };
 }

modules/agents/pi/tests/autocomplete-bottom-alignment.test.sh

@@ -0,0 +1,240 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(git rev-parse --show-toplevel)
+cd "$repo_root"
+
+pi_package=$(nix build --no-link --print-out-paths .#nixosConfigurations.neogaia.config.home-manager.users.alexion.programs.pi-coding-agent.package)
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+cat > "$tmpdir/autocomplete-bottom-alignment.mjs" <<'JS'
+import assert from "node:assert/strict";
+import { pathToFileURL } from "node:url";
+
+const piPackage = process.env.PI_PACKAGE;
+const tuiModuleUrl = pathToFileURL(
+	`${piPackage}/lib/node_modules/pi-monorepo/node_modules/@earendil-works/pi-tui/dist/index.js`,
+).href;
+const settingsModuleUrl = pathToFileURL(
+	`${piPackage}/lib/node_modules/pi-monorepo/dist/core/settings-manager.js`,
+).href;
+const { Editor, TUI } = await import(tuiModuleUrl);
+const { SettingsManager } = await import(settingsModuleUrl);
+
+if (process.env.PI_CLEAR_ON_SHRINK !== "0") {
+	assert.equal(SettingsManager.inMemory().getClearOnShrink(), true, "interactive sessions should enable shrink clearing by default");
+}
+
+class VirtualTerminal {
+	constructor(columns, rows) {
+		this._columns = columns;
+		this._rows = rows;
+		this.cursorRow = 0;
+		this.cursorCol = 0;
+		this.screen = Array.from({ length: rows }, () => Array(columns).fill(" "));
+	}
+
+	start(onInput, onResize) {
+		this.inputHandler = onInput;
+		this.resizeHandler = onResize;
+	}
+
+	async drainInput() {}
+	stop() {}
+	write(data) { this.applyOutput(data); }
+	get columns() { return this._columns; }
+	get rows() { return this._rows; }
+	get kittyProtocolActive() { return false; }
+	moveBy(lines) { this.moveCursor(lines, 0); }
+	hideCursor() {}
+	showCursor() {}
+	clearLine() { this.clearLineFromCursor(); }
+	setTitle() {}
+	setProgress() {}
+	sendInput(data) { this.inputHandler?.(data); }
+
+	async waitForRender() {
+		await new Promise((resolve) => process.nextTick(resolve));
+		await new Promise((resolve) => setTimeout(resolve, 30));
+	}
+
+	getViewport() {
+		return this.screen.map((line) => line.join(""));
+	}
+
+	applyOutput(data) {
+		for (let i = 0; i < data.length; i += 1) {
+			const char = data[i];
+			if (char === "\x1b") {
+				i = this.consumeEscape(data, i);
+			} else if (char === "\r") {
+				this.cursorCol = 0;
+			} else if (char === "\n") {
+				this.newline();
+			} else if (char >= " ") {
+				this.putChar(char);
+			}
+		}
+	}
+
+	consumeEscape(data, index) {
+		const next = data[index + 1];
+		if (next === "[") {
+			let end = index + 2;
+			while (end < data.length && !/[A-Za-z]/.test(data[end])) end += 1;
+			if (end < data.length) this.applyCsi(data.slice(index + 2, end), data[end]);
+			return end;
+		}
+		if (next === "]" || next === "_") {
+			const end = data.indexOf("\x07", index + 2);
+			return end === -1 ? data.length - 1 : end;
+		}
+		return index + 1;
+	}
+
+	applyCsi(params, command) {
+		const cleanParams = params.replace(/^\?/, "");
+		const values = cleanParams.length === 0 ? [] : cleanParams.split(";").map((value) => Number(value) || 0);
+		const first = values[0] || 1;
+		if (command === "A") this.moveCursor(-first, 0);
+		else if (command === "B") this.moveCursor(first, 0);
+		else if (command === "G") this.cursorCol = this.clamp(first - 1, 0, this.columns - 1);
+		else if (command === "H") {
+			this.cursorRow = this.clamp((values[0] || 1) - 1, 0, this.rows - 1);
+			this.cursorCol = this.clamp((values[1] || 1) - 1, 0, this.columns - 1);
+		} else if (command === "K") {
+			if (values[0] === 2) this.screen[this.cursorRow].fill(" ");
+			else this.clearLineFromCursor();
+		} else if (command === "J") {
+			if (values[0] === 2 || values[0] === 3) this.clearScreen();
+			else this.clearFromCursor();
+		}
+	}
+
+	putChar(char) {
+		this.screen[this.cursorRow][this.cursorCol] = char;
+		if (this.cursorCol < this.columns - 1) this.cursorCol += 1;
+	}
+
+	newline() {
+		if (this.cursorRow === this.rows - 1) {
+			this.screen.shift();
+			this.screen.push(Array(this.columns).fill(" "));
+		} else {
+			this.cursorRow += 1;
+		}
+	}
+
+	moveCursor(rowDelta, colDelta) {
+		this.cursorRow = this.clamp(this.cursorRow + rowDelta, 0, this.rows - 1);
+		this.cursorCol = this.clamp(this.cursorCol + colDelta, 0, this.columns - 1);
+	}
+
+	clearLineFromCursor() {
+		this.screen[this.cursorRow].fill(" ", this.cursorCol);
+	}
+
+	clearFromCursor() {
+		this.clearLineFromCursor();
+		for (let row = this.cursorRow + 1; row < this.rows; row += 1) {
+			this.screen[row].fill(" ");
+		}
+	}
+
+	clearScreen() {
+		for (const line of this.screen) line.fill(" ");
+		this.cursorRow = 0;
+		this.cursorCol = 0;
+	}
+
+	clamp(value, min, max) {
+		return Math.max(min, Math.min(max, value));
+	}
+}
+
+class Lines {
+	constructor(lines) { this.lines = lines; }
+	render() { return this.lines; }
+	invalidate() {}
+}
+
+class BottomLayout {
+	constructor(tui, flowChildren, pinnedChildren) {
+		this.tui = tui;
+		this.flowChildren = flowChildren;
+		this.pinnedChildren = pinnedChildren;
+	}
+
+	invalidate() {}
+
+	render(width) {
+		const flowLines = this.flowChildren.flatMap((child) => child.render(width));
+		const pinnedLines = this.pinnedChildren.flatMap((child) => child.render(width));
+		const spacerRows = Math.max(0, this.tui.terminal.rows - flowLines.length - pinnedLines.length);
+		return [...flowLines, ...Array.from({ length: spacerRows }, () => ""), ...pinnedLines];
+	}
+}
+
+const plain = (value) => value;
+const theme = {
+	borderColor: plain,
+	selectList: {
+		selectedPrefix: plain,
+		selectedText: plain,
+		description: plain,
+		scrollInfo: plain,
+		noMatch: plain,
+	},
+};
+const provider = {
+	triggerCharacters: ["/"],
+	async getSuggestions() {
+		return {
+			prefix: "/",
+			items: Array.from({ length: 8 }, (_, index) => ({
+				value: `cmd${index}`,
+				label: `/cmd${index}`,
+				description: `description ${index}`,
+			})),
+		};
+	},
+	applyCompletion(_lines, _line, _col, item) {
+		return { lines: [item.value], cursorLine: 0, cursorCol: item.value.length };
+	},
+};
+
+async function waitUntil(predicate, description) {
+	const deadline = Date.now() + 1000;
+	while (Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, 10));
+		if (predicate()) return;
+	}
+	assert.fail(`timed out waiting for ${description}`);
+}
+
+const terminal = new VirtualTerminal(50, 10);
+const tui = new TUI(terminal);
+const editor = new Editor(tui, theme, { autocompleteMaxVisible: 5 });
+editor.setAutocompleteProvider(provider);
+tui.addChild(new BottomLayout(tui, [new Lines(["chat"])], [editor, new Lines(["footer"])]));
+tui.setFocus(editor);
+tui.start();
+await terminal.waitForRender();
+terminal.sendInput("/");
+await waitUntil(() => editor.autocompleteState !== null, "autocomplete to open");
+await waitUntil(() => tui.previousLines.length === 11, "open autocomplete render");
+await terminal.waitForRender();
+terminal.sendInput("\x1b");
+await waitUntil(() => editor.autocompleteState === null, "autocomplete to close");
+await waitUntil(() => tui.previousLines.length === 10, "closed autocomplete render");
+await terminal.waitForRender();
+
+const viewport = terminal.getViewport();
+tui.stop();
+const trimmed = viewport.map((line) => line.trimEnd());
+assert.equal(trimmed.at(-1), "footer", `footer should return to the bottom row after autocomplete closes\n${trimmed.map((line, index) => `${index}: ${JSON.stringify(line)}`).join("\n")}`);
+assert.equal(trimmed[0], "chat", `chat line should be visible at the top of the bottom-aligned layout\n${trimmed.map((line, index) => `${index}: ${JSON.stringify(line)}`).join("\n")}`);
+JS
+
+PI_PACKAGE="$pi_package" nix shell nixpkgs#nodejs_22 -c node "$tmpdir/autocomplete-bottom-alignment.mjs"

modules/desktop/hyprland/hyprland.nix

@@ -112,10 +112,6 @@ in
           blur.enabled = cfg.blur;
         };
 
-        # XWayland clients render at the panel's native resolution instead of
-        # being raster-scaled by the compositor at the fractional monitor scale.
-        xwayland.force_zero_scaling = true;
-
         animations = {
           enabled = true;
           bezier = [ "ease, 0.25, 0.1, 0.25, 1.0" ];

modules/desktop/steam.nix

@@ -1,24 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-# Steam game launcher and runtime integration.
-let
-  cfg = config.modules.desktop.steam;
-in
-{
-  options.modules.desktop.steam.enable = lib.mkEnableOption "Steam game launcher";
-
-  config = lib.mkIf cfg.enable {
-    programs.steam = {
-      enable = true;
-      package = pkgs.steam.override {
-        extraEnv.STEAM_FORCE_DESKTOPUI_SCALING = "1.5";
-      };
-    };
-
-    hardware.steam-hardware.enable = true;
-  };
-}

modules/desktop/theming.nix

@@ -32,9 +32,6 @@ in
 
       image = wallpaper;
 
-      # Regreet is not enabled, so its styling target stays off.
-      targets.regreet.enable = false;
-
       cursor = {
         package = pkgs.bibata-cursors;
         # Solid white with a dark outline, so it stays easy to spot against the

modules/desktop/waybar.nix

@@ -83,7 +83,6 @@ in
             "class<chromium.*>" = g "f268";
             "class<[Cc]ode>" = g "f121";
             "class<obsidian>" = g "f02d";
-            "class<[Ss]team>" = g "f1b6";
           };
         };
 

modules/fish/fish.nix

@@ -52,9 +52,9 @@ in
         ];
 
         shellAliases = {
-          ls = "eza -alg --color=always --group-directories-first --icons=always";
+          ls = "eza -al --color=always --group-directories-first --icons=always";
           la = "eza -a --color=always --group-directories-first --icons=always";
-          ll = "eza -lg --color=always --group-directories-first --icons=always";
+          ll = "eza -l --color=always --group-directories-first --icons=always";
           lt = "eza -aT -I '.git' --color=always --group-directories-first --icons=always";
           "l." = "eza -a | grep -e '^\\.'";
         };

modules/nvim/nvim.nix

@@ -19,7 +19,6 @@ in
     home-manager.users.${user} = hm: {
       programs.nixvim = {
         enable = true;
-        nixpkgs.useGlobalPackages = true;
 
         extraPackages = with pkgs; [
           git # neogit and gitsigns shell out to git

modules/ssh.nix

@@ -8,298 +8,119 @@ let
   cfg = config.modules.ssh;
   user = config.user.name;
 
-  inherit (lib)
-    concatLists
-    concatStringsSep
-    elem
-    filter
-    genAttrs
-    hasAttr
-    imap0
-    listToAttrs
-    mapAttrs
-    mapAttrsToList
-    mkIf
-    mkMerge
-    mkOption
-    nameValuePair
-    optional
-    optionalAttrs
-    types
-    unique
-    ;
-
   hostKeySecret = type: "ssh-host-${type}-key";
   userKeySecret = "ssh-user-ed25519-key";
 
-  targetType = types.submodule (
-    { name, ... }:
-    {
-      options = {
-        hostName = mkOption {
-          type = types.str;
-          default = name;
-          description = ''
-            The network address OpenSSH connects to for this target.
-          '';
-        };
-
-        user = mkOption {
-          type = types.str;
-          default = config.user.name;
-          description = ''
-            The remote login name OpenSSH uses for this target.
-          '';
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 22;
-          description = ''
-            The TCP port OpenSSH uses for this target.
-          '';
-        };
-
-        aliases = mkOption {
-          type = types.listOf types.str;
-          default = [ name ];
-          description = ''
-            Host patterns written into the generated OpenSSH client block.
-          '';
-        };
-
-        clientKey = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = ''
-            The public key this target offers when it connects outward.
-            Other machines admit this key according to the host groups below.
-          '';
-        };
-
-        hostKeys = mkOption {
-          type = types.listOf types.str;
-          default = [ ];
-          description = ''
-            The public keys this target presents when it accepts inbound SSH.
-            These keys generate system-wide known-host entries.
-          '';
-        };
-      };
-    }
-  );
-
-  keyWithoutComment = key: concatStringsSep " " (lib.take 2 (lib.splitString " " key));
-
-  targetNamesIn = names: filter (name: hasAttr name cfg.targets) names;
-
-  workstationNames = targetNamesIn cfg.hosts.workstations;
-  serverNames = targetNamesIn cfg.hosts.servers;
-
-  clientKeysFor = names: filter (key: key != null) (map (name: cfg.targets.${name}.clientKey) names);
-
-  currentHost = config.networking.hostName;
-  isServer = elem currentHost cfg.hosts.servers;
-  isWorkstation = elem currentHost cfg.hosts.workstations;
-
-  defaultAuthorizedKeys = lib.flatten (
-    clientKeysFor workstationNames
-    ++ optional isServer (clientKeysFor serverNames)
-  );
-
-  outboundTargetNames =
-    let
-      groupTargets =
-        if isServer then
-          [ "gitea" ] ++ cfg.hosts.servers
-        else if isWorkstation then
-          [ "gitea" ] ++ cfg.hosts.servers ++ cfg.hosts.workstations
-        else
-          [ "gitea" ];
-    in
-    filter (name: name != currentHost) (targetNamesIn groupTargets);
-
-  sshSettingsFor = name:
-    let
-      target = cfg.targets.${name};
-    in
-    {
-      header = "Host ${concatStringsSep " " target.aliases}";
-      HostName = target.hostName;
-      User = target.user;
-    }
-    // optionalAttrs (target.port != 22) { Port = target.port; };
-
-  knownHostNamesFor = target:
-    let
-      names = unique (target.aliases ++ [ target.hostName ]);
-      withPort = name: if target.port == 22 then name else "[${name}]:${toString target.port}";
-    in
-    map withPort names;
-
-  knownHosts = listToAttrs (
-    concatLists (
-      mapAttrsToList (
-        targetName: target:
-        imap0 (i: key:
-          nameValuePair "${targetName}-${toString i}" {
-            hostNames = knownHostNamesFor target;
-            publicKey = keyWithoutComment key;
-          }
-        ) target.hostKeys
-      ) cfg.targets
-    )
-  );
 in
 {
   options.modules.ssh = {
     enable = lib.mkEnableOption "the OpenSSH daemon, with host keys restored from secrets";
 
-    hosts = {
-      servers = mkOption {
-        type = types.listOf types.str;
-        default = [ "pikachu" ];
-        description = ''
-          Hosts that serve durable services.
-          They admit workstation keys and server keys, and they receive aliases for other servers and the forge.
-        '';
-      };
-
-      workstations = mkOption {
-        type = types.listOf types.str;
-        default = [ "neogaia" ];
-        description = ''
-          Hosts the operator works from.
-          Their keys are admitted by every host, and they receive aliases for the whole fleet and the forge.
-        '';
-      };
-    };
-
-    targets = mkOption {
-      type = types.attrsOf targetType;
-      default = {
-        gitea = {
-          hostName = "git.alexion.dev";
-          port = 2022;
-          user = "gitea";
-          aliases = [
-            "gitea"
-            "git.alexion.dev"
-          ];
-        };
-
-        neogaia = {
-          hostName = "10.23.50.146";
-          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia";
-          hostKeys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p neogaia"
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCo2wWUKxyAS4J5TqbWf8glDhJvS5XmdRqFhMeJwG3pOB+4AccZ1T8LU7ZN+RjtRi3j2qXBJvIHuzhtQNtmT59TxocvfobYiqOgJpvVO5K6yD8ZoUJs6ziDkIduI9w9mdRIESoi+dBbVu8n24r61cKDVh+jWX+yjzkOcWcOzqDyQhhkjqblZ1WMAdujEMuEPvif1i2LCxStUaZqRGcx09m/ME2fYcaJrpuxxxvX2+CPJNicoo6Rx9i7ZjAoNuvH+jui4KT62DzlQtQtCl2CFUOM0gCPSa+MbNQ9elfHPvGzEcwOIMo2cuy9KURUkQu+sAgaG8S1PEniDDTecskHtuRdmPZawnQGpIhzo919Q6wUgjT8scK4mmSXRWmGmkMt0GNA2tfj5tDks6r5Q8XsYqtWs4rsOEvfmxVSdM771w+fqDBAil99Jsh0ksPK9+Bwgg8cMDzLLFDn8JA5y2G1HocMMom+u5DYKwPXEKnCILkasB8y24+O3PhSu1EuWw277w6EUEXvU03rCf0Ak/ULjxp9a00EGlloEwSmFI7Aub9XHDr87IdbGInEn+PMqyBYADiN+3h6nE2JO+nMa6i/CHdebmT+T7YJvuTKHD9sjFmQsYaghlq03DZrhHcm4hgUvE1dqGojHrhk/WgA3EWTWtK/+BP0Vy2jXaaz+qAx+EGnhQ== neogaia"
-          ];
-        };
-
-        pikachu = {
-          hostName = "10.23.10.102";
-          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu";
-          hostKeys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu"
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu"
-          ];
-        };
-      };
+    workstationKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia"
+      ];
       description = ''
-        SSH targets known to the fleet.
-        The inventory holds connection details plus public keys used for authorization and host verification.
+        Client public keys of the machines the operator works from.
+
+        Every machine admits these, so any of them reaches the whole fleet.
       '';
     };
 
-    extraAuthorizedKeys = mkOption {
-      type = types.listOf types.str;
+    serverKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       description = ''
-        Additional client public keys admitted by this host.
+        Client public keys of the machines that serve.
+
+        Only other servers admit these, so one that is compromised reaches no
+        machine the operator works from.
       '';
     };
 
-    authorizedKeys = mkOption {
-      type = types.nullOr (types.listOf types.str);
-      default = null;
+    authorizedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = cfg.workstationKeys;
+      defaultText = lib.literalExpression "config.modules.ssh.workstationKeys";
       description = ''
-        Complete override for client public keys admitted by this host.
-        Leave null to derive access from `modules.ssh.hosts` and `modules.ssh.targets`.
+        Client public keys this machine admits for the primary user, drawn from
+        the lists above.
+
+        A machine the operator works from takes the workstation keys. One that
+        serves takes both, so servers reach each other. The default admits the
+        workstation keys, since a machine admitting none is unreachable.
       '';
     };
 
-    extraSettings = mkOption {
-      type = types.attrsOf types.anything;
-      default = { };
-      description = ''
-        Additional OpenSSH client settings merged into the generated Home Manager configuration.
-      '';
-    };
-
-    hostKeys.restore = mkOption {
-      type = types.bool;
+    hostKeys.restore = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
-        Restore the host keys from secrets rather than letting the daemon generate its own.
-        A machine with its own identity keeps its fingerprint across a reimage by restoring committed keys.
-        A guest carries no host identity, so it turns this off and presents a self-generated key instead.
+        Restore the host keys from secrets rather than letting the daemon
+        generate its own.
+
+        A machine with its own identity keeps its fingerprint across a reimage
+        by restoring committed keys. A guest carries no host identity, so it
+        turns this off and presents a self-generated key instead.
       '';
     };
 
-    hostKeys.sopsFile = mkOption {
-      type = types.nullOr types.path;
+    hostKeys.sopsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
-        Encrypted file holding this host's SSH host private keys, one entry per key type, named `ssh-host-<type>-key`.
-        Required when `restore` is on.
+        Encrypted file holding this host's SSH host private keys, one entry per
+        key type, named `ssh-host-<type>-key`. Required when `restore` is on.
+
+        These are the keys the daemon presents to identify itself to connecting
+        clients, not keys used to authenticate anyone to a remote server.
+        Restoring them from secrets rather than generating them keeps the host's
+        fingerprint across a reimage, so every client's `known_hosts` entry
+        stays valid.
       '';
     };
 
-    hostKeys.types = mkOption {
-      type = types.listOf types.str;
+    hostKeys.types = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [
         "ed25519"
         "rsa"
       ];
       description = ''
-        Key types to restore, naming both the entries read from the encrypted file and the algorithms the daemon offers.
+        Key types to restore, naming both the entries read from the encrypted
+        file and the algorithms the daemon offers. Dropping a type a client has
+        already pinned makes the host unrecognisable to it.
       '';
     };
 
-    userKey.sopsFile = mkOption {
-      type = types.nullOr types.path;
+    userKey.sopsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
-        Encrypted file holding this machine's SSH client private key, under the entry `ssh-user-ed25519-key`.
-        Left unset on a machine that authenticates to no remote server, such as a guest.
+        Encrypted file holding this machine's SSH client private key, under the
+        entry `ssh-user-ed25519-key`. Left unset on a machine that authenticates
+        to no remote server, such as a guest.
+
+        This is the key the primary user offers to authenticate to a remote
+        server, not a key the daemon presents to identify this machine.
+        It belongs to this machine alone, so withdrawing its access does not
+        re-key any other.
       '';
     };
   };
 
-  config = mkIf cfg.enable (
-    mkMerge [
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
       {
         services.openssh.enable = true;
 
-        users.users.${user}.openssh.authorizedKeys.keys =
-          if cfg.authorizedKeys != null then
-            cfg.authorizedKeys
-          else
-            defaultAuthorizedKeys ++ cfg.extraAuthorizedKeys;
-
-        programs.ssh.knownHosts = knownHosts;
-
-        home-manager.users.${user}.programs.ssh = {
-          enable = true;
-          enableDefaultConfig = false;
-          settings =
-            mapAttrs (name: _: sshSettingsFor name) (genAttrs outboundTargetNames (name: name))
-            // cfg.extraSettings;
-        };
+        # The primary user is the only account reachable over SSH.
+        users.users.${user}.openssh.authorizedKeys.keys = cfg.authorizedKeys;
       }
 
-      (mkIf cfg.hostKeys.restore {
+      # A machine with its own identity restores its host keys from secrets.
+      (lib.mkIf cfg.hostKeys.restore {
         assertions = [
           {
             assertion = cfg.hostKeys.sopsFile != null;
@@ -307,27 +128,42 @@ in
           }
         ];
 
-        sops.secrets = genAttrs (map hostKeySecret cfg.hostKeys.types) (_: {
+        # The daemon reads its host keys once at startup, so a re-key has to
+        # restart it to take effect.
+        sops.secrets = lib.genAttrs (map hostKeySecret cfg.hostKeys.types) (_: {
           inherit (cfg.hostKeys) sopsFile;
           mode = "0400";
           restartUnits = [ "sshd.service" ];
         });
 
+        # An empty list is what stops the daemon generating keys of its own.
         services.openssh.hostKeys = [ ];
-        services.openssh.extraConfig = concatStringsSep "" (
-          map (type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n") cfg.hostKeys.types
-        );
+        services.openssh.extraConfig = lib.concatMapStrings (
+          type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n"
+        ) cfg.hostKeys.types;
       })
 
-      (mkIf (cfg.userKey.sopsFile != null) {
+      # The client key the primary user offers to remote servers, present only on
+      # a machine that has one.
+      (lib.mkIf (cfg.userKey.sopsFile != null) {
+        # The primary user is the only account that authenticates with this key,
+        # and the mode admits no other.
+        # The client rereads it per connection, so no unit restarts on a re-key.
         sops.secrets.${userKeySecret} = {
           inherit (cfg.userKey) sopsFile;
           mode = "0400";
           owner = user;
         };
 
-        home-manager.users.${user}.programs.ssh.settings."*".IdentityFile =
-          config.sops.secrets.${userKeySecret}.path;
+        # The client reads the decrypted key where it is written, so no copy of it
+        # lives in the user's home to drift from the secret.
+        # Declaring no defaults of home-manager's own leaves every other directive
+        # at the one OpenSSH itself ships.
+        home-manager.users.${user}.programs.ssh = {
+          enable = true;
+          enableDefaultConfig = false;
+          settings."*".IdentityFile = config.sops.secrets.${userKeySecret}.path;
+        };
       })
     ]
   );

secrets/pikachu.yaml

@@ -1,27 +0,0 @@
-ssh-host-ed25519-key: ENC[AES256_GCM,data:nxj7nMDzeqr0CitIjns9ugFh7Sur0pVpBr8SgWbxQMpIeNvBp+ugmnAxaUq2HRoYCo68uh/YKJZgMCBPSWrEyIhUX0rXmiZFmusrviJSXrYmy+n2XvLPjuv4vPbJEfjudRdXkHPazB3JJbeVRhGgK7y7smhNZlr8lwPGo0Ui0jVqWB4MPQRP6dLKVfV5shIusOqdhg7y2JSkZLYIjOBOJjknCxGmr5+vF2qwpDJQWEyzuJv2QJ48IlU7QyHF76//6xOchteL70/lyXI4gLiGl2fEczx3KKIXE+DNetKVAQxh4QHwzz9JK8qIJMYVry2qFdGGgF8eN7YEJYA60r1pL++1l8Uq++C1Bsc9jCO91ayQb+spXK0uM3G/ZJka7brRQbvcr54MJEyH6+0uBscXw/wMJ1EBX3Np6dumQhKuALnsAIXE89bKJg1wyPwaCy8uMZMcjQhvNkG0FPSBatHz2bB7bnNuNiXyT+scYyN0huE4Ccq7/H3bHWqbipV51YBH/XZKmjDiCwu3i0t5MHmp,iv:9P6Pa3hBe0/jbacjvzV3VGJJ4+OLRarEJEkLMOftqPw=,tag:zA6ewbj2ovP9+2WcAXa9qA==,type:str]
-ssh-host-rsa-key: ENC[AES256_GCM,data:C/xmdAeQlQou4wbP1EBqZ8G5/dRpmGYprj/z1g68WfCO7L+gzIgOryaEhBHugv3USAN8E3Ak4Ry+aUZCzDuIM2OeWdUm2AVT6r5o1RPYFtHSdsJUbKKB+9T3bR9GgFBRyRInSOjQhqR3lYuFLeA1xWhV8UG3Vv1tJwjLV1/JTUQf9j/NcYUr8tqjqD6hB8Fa5IEHPAUviX40R50o+EoiPIkB+qKbGru0Eg7p5K+/6d858nZc2lNgXIFnh72D0hXdWFs1BvcwGaY2WL3i7nJmOBUc3zM3/bYlU9EIscl04V6aUSXmF2sqI13Psa8lApV08MdAyUoFSHlYxlFxqe0IJ3nm0ofbJdwM6oDR6E8yQeU9vpirnYOPI6CWx6Y83LFWAVlhOZQKoLPBbiKImjM8oyoBGiIdqUrIXggoZ1u4F2/SwJtd9MwNr0+UDQWAQsYoAoBfI9LSUvEj52C2RiF28MDw2mEE8zmuHWM96KRUB7E8sGXHJrfBzDC5JuVdwmNCAOgck7ACJnHh8ZbKQYv8iGjbwVU/9z52BIUTLjJrdllSmIGWjVqOSVAUZVl7R3AK/xAaUuNNLaNzR4kk/+lQhPTuOLeFBfWbu3kryfeyJNyuHHtS21tgTcwc/bMYVq8LM8ttPn3b/BLQMl49qlBNmMk4TZ4hzBC5BMW6TgSHJRXZ7eajV8x+TM+aGu34xU0TiIy95XgTdi1ktQ0kAzB94iLTsMVhWpwoOguOlGLPGDKuDlym44T4cFRHySSHy0xlroPD1FPSvlSP7uY++55HsxX/88M8HNtCQ9h2P7jFRBYL+CpYbwgWNqtIWq8/daxCxScKZZ2/sAvFL5Ttqe//wYwNp6F3WbIxOk7yS/Ov+ADOt+RnxB2P11dkWNN7kHscGO7/sBNhDbzyEB8kHdfbEYKAl+OwUUsYqiGzdKF8E8aNa/0AAld3whrVgsUmIbFeoAkvJO6TkiZ3uuJAHdF9L8XfpWLEbu+geb6HG4+Bf5QOxxKVkSihMCimTI5vPGHuXj0/vwMihsMvhcaTmfSh2cZRAQhwIPQamEEeC+vqU2Igwcm57Cg81gMJYORLj+SaZSbCbrUxqElE/1OxUtF1KEh9njXjNK/grKnZbDDfRrhZwm3Nri1yxQxk/haHVoZttwXKo2vsWsYvpaHPJuUoQ0r/Wo8RffH2s04qauphLgWi2BUpfs+nNFBGRu6S92o/dktNQYgVeAGo7fYrM4xQX26fjQcOR7TD5bQIR2HcfHzyfH6A4c8MuInUeuf7kZFOoR1DdUFXYbvNcIgbmB/ScImkP3q18KaH+JRsVJbEEB7X4YOQ6lvHTtk0QVLv50V22BA9naFlpKGMWjq0oT5Gf40c6+opDlQWKrgwISwDvm9QJznvquj1EUlFJwVf0SJBHfeomFITZZMma2no2EIV0s/n9LvaU0b1Aim9EAqxUTgMrryLzE16dqSQKugbsn2jWMy7By3Xf8g0kstbyht5EOUZpThrwthEcGRN3xRHHke6ILckAVqEvl2wMuNMV8sd904pdYUL1wQAHKtg+fRbzu5cMY8itEs6YPsWob+HaD+n2tfHf4ByR1KBZ92nCyAWWjW6jrSDCzYCRsxvMSdsBJz9U4szSExC2qm9kQxGeedOl8/qECRZQQArBQZdavbwECGVUT3LRWQOu6bDyFgzoTzUlRxK05wr+Rpir/NmiGURGCZhmy+J2QnejlK0zOidORZAkzFcuGUPiUDGvJ99y43oSYAEYAI4UMKu42zimdVz50PbD2jpSJS6OmxUKfPfyy6CKC1lmYSB7PVGHzQ2aIw0RVMND9JNcntD5qgS2/g1CFhh9z9QyVtkOqiPICXTRXmVEQ5PW04tyzKBRkiSPoXxpC1zq77QPUAz0ZfeElqppdGyfejRiRl6m5JXJ9Pwl3/pgMEqGs0gpM/+TuT3rrYr6v602wPNq6/1XWpizReVPJZNzMrmxQwiIO285w1kvBlZ1VQnbAUiJR+pZuc9PiegSqEbfdkC8SQaGj+2M9tSDRzDGDE1y8pOLDi8Wczbn313JM+QwYDAXGccXxCEq0d3fVjb26u0ZNq2nn5zDy002aMWro+mrsLlWOf4MoAwvnyxgwEewrBEFIk1n14huFd1YpVomZuY3Y9XX1b1XoiTlhbmlP2HopobgQCD4Gt4zFb9RovNxBib+g4j2N94uoiuXOyBTT1B/HWHr6DnMxNvtHIyMOUPzR+6hwO9ntmdhPh+UZIB2b6FWZWLec55yBewzmvWn44dOdo7Z8Tp4d7vfSamyQDO49LA7Bd0CpDan7lbpw5rD4iejRCqZ/yJHTRyExSrZtcLQsScaorGCPlxHL4MUlRMynkyjPSUDRzqdJs+OnJDfUxJ566z8978rCppuYGRAGCqnoEHN9vcGsncMt9LuyUFlDaNKoOFZlMthvfQnUy47JnrP5u18Ph8qjn6A2Wh6MowsMvM67EBSlx8ZdHJC1iWqlHULW7FKPtcvKnDB/GToOqi2y9+EuMVWpoDJmTTyZFr9fmMlA0mL9tXWWG5h3G4LeLrT+LmRmk5tgL1TUJz5XDRQIQZRXxP+X7yt1bDh5PQK0vyupnWbs8KGDM+/pO8GwkwPnehBmJkkfkA6W2DIWzqRZHstdGmk1vtBqE6yAmwBOuXL+vm0vN86ulN+87LNR3OpCBRyorqundmw82vg/RdPNuA+Zxqg+VErsuTTdJmgZxN1rDU+8AiJPC8ZK7mH74lLYX2Ad86ZDriPcAi7wyYLc1qrSSHFCofb2FuM3/cJXcadSjZ//HxZh6qVOC5FW3b/YnFLZeqUgai6PO5rvzgyXusb2qHK60sEyS6pfw+ybOyZxWAc1TYqFXtOhUje8SW3R4cCG4zyCh5kUjZLiCNoNU2MIvVHjSfe9KAvTO2pcmuDIuVv9CKoko8tgoFqS80UDeP0pn99AmnTMXbhUR7eYjR9qAABF0IJJGUUIR1SbwiJrdEXil1qNcgciBI1epIXc1uBRXhcEnHI8VxVwYxF5wISjfuvp4cqJk03AkZVa4E2yydUATOCtk6fkaxVJIkitQaVgc0tqS4pX+9d35NF/njFHXksT/wMBfVJYmcgfIHJFK46igB/rwwC3PpOM+YNM8aJpLyZbbUB9CEWMtT9P5LqLWFoUaC2brIKG7vrfy2OSNOEWxiEDAzn7kY1+zpOb93J8FURpDNV+K4YUznPr1z2BxEGAKQXXx2PHQpAYYvdane5uWsZWMTsK5qQunX2UHPscr3T0A384pzXNdgnR6OrZfbcIpmvTAjxH9qzQLj49kJQ98czuutJWxgrp9J7abKeIdWGObTra5gA6bJ5kw9FZjW0xiyrOLAok/Vbmen8WCIVxToMJnXR91uuq58GxrcuZFke0NpCfEu3bpdPeKlb+sy0FREiFCpaDUNFFn5DqTNwOiW5KjGw/fG6dqC/NUhH5xdeod4dR1C4NEpYKzbWolUFf+rvFtGrRnQ0VQMXav+fpnBFiRA/ez/7oAzzwNv8Y7s3QpCUSUjsPRGWG/4pDlRSaz7rwkCfRxpkbOmPruYx3fcHigBnvIMLtKAPCx4jE7EsS6BoHNhgCMRyzkdl+MZFLKZ7JgFvgPdNcieFlptax2KaEwBIvhgQ4rimLRCv9cCM1qmmNIGB0UovqZ0Ye8tRG6LteFTgsfb3bNQ5sShaHQiuh2m9JGnI41q8CH2Gn6Mz/ftxn4yDWL/SlkjhtnRLoYvD5ro/Tf4q+exobXC0fbA1sLOnaX3atqHeQWK4Sk9L7zrDbwrJHzgmFD2PUPUhpfg9r1QMtJVkUckhQgyjrrIBfyZ4qqPmpYbH1w7cfE3C/rdprNZFKujYlA0ol8Ok1n0gyRFTeNZvd5EdrQ3D+hIKc0ID7/FmfzIccrI6x+wOE1ePQPzHay2mM8qRcjgTiQOTMaFRYjVy28ovqgixs/bylGvw5VNMGJTIqcu6fC54i3HOBhmnH1Ab/5a7PmwXUbAajw+mKddtrr0wQ7cXRncFnoJtld2AIOs7aD51C1Zkr1UqxliWObCsXJmaQoOpBScHdiKNp1mKQ1Oddu3mj0Su1e4gQR+YAwOyQ1zBU5WvNBbudUmRIsjXDS2Y6XaVN50neQ0DZ5V71259xPyawyVvrdiiUg7HOXgGFGcWbFU+p7MZaq0KE3aXgwCC+/mhFgaKgIVWir5pElNaXLUMDF+1jnblaKyHyAk0HPBgegAphVqWF3Hqp3b15jTSdWsmOugGcCO9hLk2OD99nZzuEVBLbDg0yGISPgzVNFg3+Pqcu8FqmGxLwAWNTRc0+ov7VL5Y4fJoD4QOPj19+nZyvXze/FOYo1Hp+U7PBZDIKVswcdauZG+Z2t2bEd0OxXj1NoazpycIVI/TmiTVyDsK+ijXztNnWXGG24WW1KZ3O5+MmDm7F7RDi1vCOfOOg3Y1yPVprOvltyn1uPo5Q/pPTD1FmAGpJkmdT3+dKkb9N5u6RNvRBEzFY8HCqcvKX1HulpJpz72,iv:vfjzz6U6ey9wGs6Ia3Vd5HaGBvpSq4akp4e3eLC/A3M=,tag:ar1+i09oOEusEuQnr44ASw==,type:str]
-ssh-user-ed25519-key: ENC[AES256_GCM,data:uHZADD2tq8vqlOAOWYniEnj1sl2IUqepf4YvrmRX/0nTksVnoethW6Yb2VNTgu5FsKCxvO65qMZ9KYupDkw/+SCZP2VH4TyhByQSr4SYxrEiNOJLdvmL2VnOWlNNZKaswgBePQR7TBG4mSIiTXCjEAcxeHAhBxLPnwiFxK/Zd6yQhq61x1N+ZtOj0q0QpADP3vioUohdkE5ODoEOUUoQJkYpjdJl2j4PhjCq7yHMEZpeMkqjZhVX5+i8blBu43BM4bKS2tBIJW2IvPV9sHOH8/tsR6p5q0pnpcJAOyOquBSo+eR0egY+liXjSv+Vo/ZDPapl7rKs2SoJ5huUGFbWjxbXY2+t2SYyiVA8lufrVUu94RCwOOJ8UyGYzAGGrChUImVDBsgk/GWwpOvWxcqydF8d6mDdxK9Iek9HtYsS+IKXLrF8GAI9OLB9jKgHVZgyQYSnC146cwCLt99TOFVocE1lfzwpFQTwKvxkep5jBEWiyqRaRUngti0JuF0ih1BWo+LKqxIqq9+V3I39xM8PfTjgHiifnxj4wuhS,iv:32zDKpNPYMiP6Rx7L9TAhxrMwcmphIGni+0jcESoLqg=,tag:YWGE62WQNm2Cer+eG+S5Xg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTTVLWHVaZ1NxbGEzcVBq
-            MmorSkhzQ2hSV01idWE4VXNyNkNvMmpkTHpzCnFDQ0l3a1o1OWhmdE9WTjlob3p4
-            Y3BzMlJmeks4ZllzbEY1MkVqRCtrNjgKLS0tIFVhQXpDRjRUSEViMUhPM0V2RGRt
-            NkRpV05YV2RaTGozTUNNM3U5dmJ3dWsKSzkXmVyPhwN58SjMYYL/YbPoHYtZ9goF
-            VYRLRnfU298/3R/1nLNqTlMk4MYQ6NaGf2jOYTyObGgJVccOHF6wig==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMDBPcHZ3YithYm5sM2Vh
-            NzJUVmpuT1FRdmw1bzI0a2p5NXFlZlRQN25NCmduQ1NKREVZT3Q5d0l4ZC9ZVUFU
-            all2UUZUMjZyaGxGMm5UOEQwcnNKS2sKLS0tIExPZmR5K05WZHRYRHZEeW1PRWhV
-            ZTZzTlhnYURJTDROTFpUTmFKc3ZkeXMKEWUCkVeHEt/Ay0lyAVjsqtLbu+pJOTJ5
-            dyjzy0/9Ui1IIXH36AImO5hiEZcrGePV2qPLLQc7ZLngC1jlJuEKJA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
-    lastmodified: "2026-08-03T01:26:32Z"
-    mac: ENC[AES256_GCM,data:w4i6+dwN/t/SvFTrP/YiapxOY6ecT7+cJ0v/5lYMe4m1vL2w4mJw9ZrxWifcCcTEfaa766Wc1NE+GxGrBZtlORExbtQCa4tg2GuIQCRqTEc5WSqhYrgMb4elWuYe+r3/SlAf1ldNxz+cmLVtbDpSs96bvkGsKdw/i+q9n2URJYE=,iv:MFWgMtIdpn1v0T6FPhTgBMxi+6kzf2ZAnOGaisRT0d0=,tag:qBX32/zUHSPagXU+u8G8tA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.3

secrets/shared.yaml

@@ -3,31 +3,22 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvdGQ0ZnZ2UlVaTFVuRmJI
-            aVZNVjZVNGdiVGVhUTVXN3luU0V1eUZFb0ZRCkVrY3lKRE9GTUEzV0ZjUnk4UHdl
-            QnFMVDhMcGVUTWFQemxrSnNEMStpSEEKLS0tIFFIQndkZHp1NkRmRlB4RXlwdk5C
-            cTJVQW9iMWhaMlk1dUxBK1ZvQTRuV0kKm7/z24q4NcDFlVuxZViDFlJodjRzRqhY
-            7X9LqouIXcGhDgwq0hh+JXRfYCz9LDiUJtOLHR7Lu/oscCBCnk7N6Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVYzZuaERsRjMyaTAwL3Ri
+            b2RhaGZ1aHNOSzVMamVxWkdKb3VKTk9QMmk4CmV0R3hYN3hkMU1tVDJLNkFlT08y
+            SUdUeUZ4d2JwNmdyOWVJcmZNcEtCb1EKLS0tIHhDV1NZWWdDZUNMYjVqYUVlc0ty
+            Y1owUFZPMXBHbDhjVWxTUjZGRk1IUzQK7VENq6TjuOFlon+CJqUxbIJZ9qka78C/
+            LDsgaTD+7zCBPgASwPbF88pH6tdK7bvNLJnznlZdZBL12eOy25BmOQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTOENXYmRRNmVQeUtvOVFy
-            eElWVUhnUnJDTk93aVJCVmpTcHd2aVpKSFhJCk9oUk5ObHNSZHNwSisrSE9JbjRI
-            WVllODlYek1VMDZpMmh3M2JRTU92ZEkKLS0tIFVVNG9RNnlzS0ZvMUM3bVN2Mldo
-            N0MvcXEraDcwUHVxbTJqWGdxTGhOVG8KIhIY9QGbt/eWy9bfST4tEkjLQLylaHRm
-            AwYIwU1Hw6HXR1TX3t0YciI3c8HcWISruY/tBR3xIHIdBlQR5OTaeA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHY0ZXT3lRWS9DMFA1MHhl
+            MDZiWHhEMy9INGtpd1ZOdzh0OFRoUlZDa0hZCkJwTUV4c01YWlE1QjNDd3pRN3F0
+            SGJWWmFTT1NMQktNejVHY1RrRlZJNFEKLS0tIHlRZG9ZV3FrQktSN2tURVV1NmlW
+            UTBZbFlqMmFGZ0VPSlA1dmNMU2Q3TFUKtL2V8t9+Qw5vjXursvCVRatflX8JKXJr
+            VuA8oe0nKpk7wh4fCzcT7RoRKpJY0gPFjIzeTZGVfoAmZIUWMhzRuw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ODgyNjQ1RFMwOGpUaG5U
-            UDNjTENrYzY5UFVTNlRONlBhNmVUUXk2OVd3ClFQUUhFaUM4YmR6dVNlMXRwWUFY
-            ais3L0FyQ1ozWjFMMHhjWmU1NU5JdVUKLS0tIG1tS1NoZjhBb3JRak9XdEpOT3Vy
-            Uk5HdUd6NUsrZWx2Y1lrWGdHRXcxZEUK470gSumRCpgYvIWJcmylw0VTgyV3et/B
-            QkVLBz5x+ShVun27nN3oz8And0qXfwgXojhM3yWnBSUa9CFBsbTOJQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
     lastmodified: "2026-07-20T03:22:00Z"
     mac: ENC[AES256_GCM,data:ei7PKVAIjJ6fGkxqJFc5wdYapq1gElel3fTJ+yKhvWHU+39aKcllG66T3d9FitRztgyt69phykHdKvxDHRUwYeyl1YBzyf1ZpPU5mXJb+hkLtVB1Am7StcP+m7jFqKSmqtYhIT9OxUrH0MJ8qeoU9216otwkhhpPz2hr1s7KYFk=,iv:Pp03KmlinjJiiTZezr0LzzkcHb1a5XWgDpu38jhl9Rk=,tag:HAqFitge+KTCtDE24t8/ig==,type:str]
     unencrypted_suffix: _unencrypted