v1.17.0

New features

• Detailed classifier decisions now use schema-constrained internal tool calls. Supported providers enforce the schema during generation, and pi-automode validates each result locally. This reduces fail-closed blocks from malformed decision JSON. (#50)
• New permission recipes explain safe configurations for Bash commands, working-directory changes, command chains, redirects, and classifier guidance. Thanks to @georgesleen for the idea! (#46)

Fixed

• Classifier context checks now estimate each request stage in tokens. Large project contexts no longer block small actions that fit. (#37)
• Block responses now state that the tool did not run. They also stop the agent from claiming success or relying on blocked effects. Thanks for the report, @jviel! (#38)
• Classifier context checks now reserve the correct OMP 18 Anthropic reasoning budgets under Pi and OMP. (#51)
• Classifier calls with explicit reasoning now use Pi 0.86's normalized streaming API. Older Pi versions and OMP 18 keep their compatibility paths. Development dependencies now target Pi 0.86. (#52)
• Bash allow rules now route unresolved argument expansions and active pathname expansions to classifier review. Static quoted, escaped, and ANSI-C glob literals remain eligible for deterministic allows. (#54)
• Invalid classifierModel values no longer reach classifier resolution. Diagnostics identify malformed values and preserve valid lower-precedence settings. (#55)
• Diagnostics now identify malformed permissions.deny patterns by configuration source and list index. Deny matching remains fail-closed. (#56)
• Cancelled tool calls now update counters, denial history, persisted state, UI state, and decision logs without unnecessary classifier work. (#57)
• The status indicator now includes a space between the AM prefix and its symbol.

Full changelog: v1.16.0...v1.17.0