big cli/tui gaps project

2026-07-05T22:23:49Z

Load extensions via unified policy, entry/activate, rocks and paths

2026-07-01T21:37:04Z

Replace the split [tools]/[extensions] config sections and the two-stage load gate with a single model: - [extensions] is now one policy resolved across all layers. Rules from every layer are kept (not clobbered) and resolved by last-match-wins after sorting by (layer, glob specificity, deny-last), so a base layer can carve one name out of an otherwise-denied group and a higher layer's broad rule still wins. Default is allow; whitelist via deny=["**"]. - Registration is deferred: a source returns an entry {name, activate} (or a list, or the sugar tool table), is always eval'd side-effect-free, and only permitted names get activate()d. Identity is the declared name, not the filename. Collapses the old pre/post-load two-stage gate. - The loader runs two passes (eval -> shadow -> filter -> activate) with precedence project>user>base and, within a layer, rocks

ponytail simplifications to panto cli and lua extensiosn

2026-06-23T16:53:26Z

models.dev list validation against actual provider's /models

2026-06-16T02:52:24Z

model registry sync via models.dev

2026-06-15T22:15:10Z

auth: flatten [auth.] config + ${...} substitution

2026-06-15T21:08:32Z

Collapse the auth schema: infer `type` from keys, replace key/key_env_var with a single `key` (resolved via substitution), flatten the exchange to flat `exchange_*` keys, and drop the auth-level headers tables in favor of reusing the provider's `extra_headers` on the auth HTTP calls. Add `${sibling}` and `${env:VAR}` substitution over auth values (GitHub Enterprise = set `domain`). Restore api_key-empty → provider-drop. Update default config, docs, and tests.

auth: CLI auth manager + `panto auth` subcommands

2026-06-15T21:08:32Z

Add src/auth_manager.zig (turn-time resolution: load→login→refresh→exchange→ build credential, patch live config) and `panto auth status|login|logout` subcommands with a line-based device-code presenter. Add config_file.loadFromString.

libpanto API fixes

2026-06-11T15:23:28Z

- FSJSONLStore: don't require `cwd`, instead panto CLI provides it in the session metadata - Lua: expose the `SessionStore` interface and the `FSJSONLStore` and `NullStore` implementations - C: use idiomatic `const char *` for incoming strings - C: expose the `FSJSONLStore` and `NullStore` implementations

Migrate panto CLI onto the public.zig surface

2026-06-07T17:42:41Z

Move the CLI off the internal libpanto module namespaces onto the curated public API: data-type aliases (Config family, Message/MessageRole/ effectiveSystemBlocks, Event, Pricing/PricingRegistry, the session seam, FileSystemJSONLStore, ContentBlockType), process lifecycle (panto.init/ deinit), and ResultParts.fromText/fromTextOwned/deinit in place of the freestanding textResult/ownedTextResult/freeResultParts. The CLI remains on two flagged internal namespaces, panto.agent and panto.conversation: it is a deep embedder that drives the loop below the curated Agent/Conversation facades (system-prompt seeding through the agent, compaction_system_prompt, the open_stream_fn test seam, standalone Conversation values, compactAndPersist). These stay re-exported from public.zig as a documented deep-embedder escape hatch; trimming the transitional block removed every other internal re-export.

R2: redesign session store with wire-format identity

2026-06-07T17:35:49Z

Replace the single-session SessionManager seam with a directory-backed catalog. session_manager.zig -> file_system_jsonl_store.zig; the old machinery becomes internal SessionFile, and a new FileSystemJSONLStore implements the redesigned SessionStore vtable (create/list/resolve/latest/ load/appendMessages) minting Session/SessionInfo handles. Session logs now record wire-format provider identity ({api_style, base_url, model, reasoning}) instead of a single provider string or CLI aliases; no api_key material is ever stored. Disk* content types renamed Stored*; the rich audit-oriented write record is PersistentMessage (in-memory Message + WireIdentity + provenance). Agent.init now takes a Session; persist_provider/persist_model display strings deleted (banner stays alias-based, resume picks default model). Message.metadata round-trips. Dangling-prompt recovery dropped. CLI migrated to the catalog store for run/resume/list. Clean break, no version bump (old logs wiped).

pantograph.git/src/subcommand.zig, branch main