v0.25.0

Added

• Tern-native UI: when omp runs inside Tern with the Tern Surface Protocol (TSP) live (TUI.nativeRendering, detected at session_start through a probe widget factory; PI_TUI_NATIVE=0 opts out, there is no config key), every pi-verdict surface is also described as a native node tree and the ANSI rows stay byte-identical everywhere else (pi, other terminals, tests). Ask and grant dialogs become a floating medium pi-verdict.ask dialog titled with the question: an origin badge (Classifier, Rule, Reason, or the failure label) next to the reason, a Protected path badge, the code view, a meter pair for the jev probabilities and confidence (text line without meter support), the explanation card, a rule separating the context from the question, and radio cards for the choices (the host theme's radio glyphs, ◉ / ○ by default, filled and accent-colored when chosen, with a one-line explanation under each label; click selects, double-click confirms). A Reason for No field (Clarification in the grant dialog) appears under the card only while No is selected; the button bar holds Details and Explain… on the left and Decline / Confirm on the right, and Decline forwards the typed reason while No is selected (a plain decline otherwise). Pointer events take the same paths as keys, and Explain is still never offered for protected-path asks (PP-6, PP-9). /automode, /verdict and /automode-setup menus become a Tern prefs sheet (scope as a segmented row, pages as navigation, number steppers for percent rows, an Apply action for confirm rows, two-step removals); the /rule progress panel, the classifier status row, the omp footer (badges and styled spans, same facts as the ANSI footer) and the transcript verdict label are native nodes; and the project trust prompt, the verdict_settings confirmation, the /grants list and revoke confirmations, the /rule review and the root-rule review each use the presentation that suits them, with the host ui.select / ui.confirm as the unchanged fallback: confirmations (settings change, grant revoke, /verdict-debug steps) are small dialogs whose choices are buttons, the two rule reviews are medium dialogs with buttons, and the project trust prompt, the /grants list and the /verdict-debug picker are omp's picker sheet (a radio list in a medium dialog on hosts without picker); the trust prompt uses the cards layout with Trust this project / Not now / Never rows that each carry a one-line detail and the config path in the subtitle, so its text is drawn in Tern's sans face. Free-form text, md, card, kv and code nodes are monospace in every dialog unless they carry a Tern role, so the prose of the other dialogs (reasons, notes, radio labels and details, rule rationales, the explanation card) is tagged with Tern's own omp.advisor.note role (omp.plan.body for the explanation md), which draws it in the sans face; a Tern release that renames a role only turns that text back to monospace. Native nodes carry the same text as the ANSI surfaces and no more (PP-6). The ui.custom calls for the ask dialog, the menus and the choice screens pass { overlay: true } only while TSP is live; medium dialogs add overlayOptions.width: "60%", which omp maps to an undeclared md that floats at every pane width, where a declared md or lg fills panes narrower than 100 columns.
• /verdict-debug [all|<screen>] (always registered, but refuses with a notification unless debug is on — --auto-mode-debug or PI_AUTO_MODE_DEBUG=1 — checked when the command runs): previews every pi-verdict screen with fixed sample data through the same code path the real call sites use (native in a live Tern surface, ANSI or the host select/confirm elsewhere). Screens: trust, ask (jev meter, "don't ask again" row, Explain with a canned answer), ask-protected (no Explain, PP-6), ask-rule, grant, settings-change, grants, grant-revoke, rule-review, root-rule-review, prefs (one in-memory MenuController covering every row kind), progress (the /rule panel stepped by hand), footer (7 variants), status (3 rows) and label (4 variants, shown in a temporary widget, never as a transcript message). A bare call opens a picker (all or one screen, returning to it after each); footer, status and label variants advance through a Next/Done step screen and the real footer is restored afterwards. Nothing is written (no config, trust store, grants, session overrides or transcript entries) and no model is called; results are reported with ctx.ui.notify. openRuleProgress gained an optional step hook (Next button / Enter) that only this command passes; /rule and /automode-setup are unchanged. Internal extractions with no behavior change: grantLine, publishFooter, showStatusRow.

Changed

• verdict_settings confirmation dialog (ST-2): the Tern-native dialog is now md wide (was sm), and the before/after values are parsed content instead of pretty-printed JSON, in the native body, the ANSI rows and the host confirm fallback alike: a list shows one • <entry> line per entry, an object one <key>: <value> line per key, (empty) and (not set) mark empty and absent values. New exports settingValueLines; settingsChangeScreen takes before/after values instead of beforeText/afterText.
• Native Tern surfaces: the remaining monospace text of the dialogs and widgets is now sans (omp.advisor.note via tnProse; new tnHeading uses Tern's omp.sheet.head role for short headings). Ask/grant dialog: the code header, the verdict/confidence meter labels (a shared 10ch minimum width so both meters start at the same x) and the meter-less fallback line; the explanation card's head moves into its body as a sans heading. Settings-change dialog: Scope/Key/Action are prose rows with muted labels instead of a kv grid, and Before/After are sans headings above the monospace JSON. /rule review: the Matches … and Stopped by an earlier layer … section heads are sans headings, the command lines stay monospace. Classifier status row, omp footer and transcript verdict label: model, counts and tool name are sans next to the badges. Commands, code, paths and JSON stay monospace; the ANSI render() output and the text carried by the native nodes are unchanged (PP-6).
• Permission grant dialog (GR-2): the body is now structured instead of three equal-weight prose lines. The ANSI rows keep their text, but the lifetime sentence no longer ends in Mode: <mode>. (the mode never affected a grant's lifetime). The Tern-native body drops the generic Reason badge and shows a Request heading with the request text, a Protected path/Protected paths heading with a muted access label (read/write/full) and the monospace path per entry, a Danger rule/Danger rules heading with the monospace rule id and its reason, and the lifetime sentence as a muted footnote; ask dialogs keep their origin badge. ApproveDialogSpec.extraLines is replaced by the structured scope (GrantScope), with grantScopeLines producing the plain lines for the ANSI body and the confirm() fallback.
• /grants revoke confirmation (GR-6): the Tern-native dialog is now md wide (was sm) and reuses the grant dialog's structured sections (Request, Protected path(s) with access label and monospace path, Danger rule(s) with id and reason; new shared grantScopeNodes). "Revoke all" shows one card per grant headed by its id with the same sections; the buttons read Revoke <id> / Revoke all <n> and Keep (was Revoke / Cancel; the cancel choice id is now keep). The host confirm fallback text and the ANSI lines are unchanged. grantRevokeScreen now takes (grants, all, ruleReason) instead of (title, detailLines).
• Native Tern dialogs: the content of the ask/grant dialog and of every button or list choice screen (trust prompt, settings change, /grants revoke, rule reviews, debug steps) is inset from the overlay frame by tnFramed: a spacer above and below and an empty minimum-width spacer on each side of the content (TSP has no padding prop, an overlay role does not pad, and a head-less card draws a ring, so none of those is used). Pickers and the prefs sheet are drawn by Tern and are unchanged; the ANSI rows are unchanged.
• /rule review dialog (Tern-native): the buttons fit one row (Save…, Edit, Amend…, Cancel); Save… opens a native scope picker (new role pi-verdict.rule-save, ruleSaveScreen, exported RULE_SAVE_CHOICE) listing Session only / Project / Global with the target path as detail, and Escape or Back returns to the review. Each match and shadowed row shows the tool name as a muted badge followed by the command as inline code cut to one line with … (Tern shows the full text on hover), so a 1000-character call no longer grows the dialog. The root-rule review (/automode-setup) gets the same short buttons (Save, Edit, Regenerate…, Discard) and moves the save target out of the button into a muted Saves to <scope> · <file> body line. ruleReviewScreen/rootRuleReviewScreen take options: { id, short? }[] (and saveTo for the root rule); the host select fallback and the ANSI lines keep the long option strings. /verdict-debug gains the rule-save screen and its rule-review sample includes a long call.
• Native Tern verdict label (PR-7): the pi-verdict.label row no longer lets the jev probability meter grow to the full row width (Tern's bar meter is flex: 1 1 60px); both meters carry max: { w: "22ch" } (LABEL_METER_MAX_W), and a second compact accent meter conf <n>% now follows the probability meter in the same row, showing the jev confidence already stored in the label. The ANSI label and the model-visible label text are unchanged.

Fixed

• --auto-mode-debug had no effect: the flag was read once while the extension factory loaded, but pi/omp apply CLI flag values only after loading, so only PI_AUTO_MODE_DEBUG=1 worked. The flag and the env var are now read each time debug output is decided (allow notifications, shadow-cache annotations, second-model allow notices).