@diegopetrucci/pi-extensions 0.1.80 → 0.1.82

package/extensions/diff-summarizer/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@diegopetrucci/pi-diff-summarizer",
+  "version": "0.1.0",
+  "description": "A standalone pi extension that adds a read-only diff_summarizer subagent tool that summarizes a diff and highlights review risk in an isolated child agent.",
+  "keywords": [
+    "pi-package",
+    "pi",
+    "diff",
+    "summary",
+    "subagent"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/diegopetrucci/pi-extensions.git",
+    "directory": "extensions/diff-summarizer"
+  },
+  "files": [
+    "index.ts",
+    "README.md",
+    ".pi-fleet-tested-version"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "pi": {
+    "extensions": [
+      "index.ts"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "typebox": "*"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.19.0"
+  }
+}

package/extensions/dirty-repo-guard/index.ts

@@ -12,9 +12,12 @@ async function checkDirtyRepo(
   ctx: ExtensionContext,
   action: string,
 ): Promise<{ cancel: boolean } | undefined> {
-  const { stdout, code } = await pi.exec("git", ["status", "--porcelain"]);
+  const { stdout, code, killed } = await pi.exec("git", ["status", "--porcelain"], {
+    timeout: 15_000,
+    signal: ctx.signal,
+  });
 
-  if (code !== 0) {
+  if (killed || code !== 0) {
     return;
   }
 

package/extensions/dirty-repo-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-dirty-repo-guard",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "A pi extension that prompts before session changes when the current git repo has uncommitted changes.",
   "keywords": [
     "pi-package",

package/extensions/fast/README.md

@@ -34,11 +34,7 @@ For eligible Anthropic Claude models it injects:
 }
 ```
 
-It also adds the required Anthropic beta header value:
-
-```text
-anthropic-beta: fast-mode-2026-02-01
-```
+It also appends the required beta `fast-mode-2026-02-01` to the request's `betas` list, which Pi sends as the `anthropic-beta` header. The extension does not set the `anthropic-beta` header itself, so Pi's own betas are kept.
 
 ## Eligibility
 

package/extensions/fast/index.ts

@@ -12,9 +12,6 @@ const ANTHROPIC_PROVIDER_ID = "anthropic";
 const ANTHROPIC_API_ID = "anthropic-messages";
 const ANTHROPIC_FAST_SPEED = "fast";
 const ANTHROPIC_FAST_BETA = "fast-mode-2026-02-01";
-const CLAUDE_CODE_OAUTH_BETAS = ["claude-code-20250219", "oauth-2025-04-20"];
-const FINE_GRAINED_TOOL_STREAMING_BETA = "fine-grained-tool-streaming-2025-05-14";
-const INTERLEAVED_THINKING_BETA = "interleaved-thinking-2025-05-14";
 const ANTHROPIC_SUPPORTED_MODELS = new Set(["claude-opus-4-8", "claude-opus-5", "claude-opus-5-5"]);
 
 const OPENAI_PROVIDER_ID = "openai-codex";
@@ -79,11 +76,6 @@ type RecursivePartial<T> = {
 
 type PayloadRecord = Record<string, unknown>;
 
-type AnthropicHeaderCompat = {
-  forceAdaptiveThinking?: boolean;
-  supportsEagerToolInputStreaming?: boolean;
-};
-
 type Eligibility = {
   eligible: boolean;
   modelKey: string;
@@ -368,67 +360,17 @@ function getStatusMessage(ctx: ExtensionContext, state: SessionState): string {
   return `Fast mode is ${describeMode(state)}. Current model: ${eligibility.modelKey}.${injected}`;
 }
 
-function splitBetaHeader(value: string | null | undefined): string[] {
-  return (value ?? "")
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean);
-}
-
-async function isAnthropicOAuth(ctx: ExtensionContext): Promise<boolean> {
-  try {
-    const resolution = await ctx.modelRegistry.getProviderAuth(ANTHROPIC_PROVIDER_ID);
-    const apiKey = resolution?.auth.apiKey;
-    if (typeof apiKey === "string") return apiKey.includes("sk-ant-oat");
-  } catch {
-    // Fall back to the synchronous registry snapshot below.
-  }
-
-  return ctx.model ? ctx.modelRegistry.isUsingOAuth(ctx.model) : false;
-}
-
-function getAnthropicProviderBetas(ctx: ExtensionContext, hasActiveTools: boolean): string[] {
-  const model = ctx.model;
-  if (!model) return [];
-  const compat = model.compat as AnthropicHeaderCompat | undefined;
-
-  const betas: string[] = [];
-  if (hasActiveTools && compat?.supportsEagerToolInputStreaming === false) {
-    betas.push(FINE_GRAINED_TOOL_STREAMING_BETA);
-  }
-  if (compat?.forceAdaptiveThinking !== true) {
-    betas.push(INTERLEAVED_THINKING_BETA);
-  }
-  return betas;
-}
-
-async function injectAnthropicFastHeader(
-  headers: Record<string, string | null>,
-  ctx: ExtensionContext,
-  state: SessionState,
-  hasActiveTools: boolean,
-): Promise<void> {
-  if (state.ultrafast || !isFastEnabled(state)) return;
-  const eligibility = getEligibility(ctx, false);
-  if (!eligibility.eligible || eligibility.provider !== "anthropic") return;
-
-  const matchingKeys = Object.keys(headers).filter(
-    (name) => name.toLowerCase() === "anthropic-beta",
-  );
-  const existing = matchingKeys.flatMap((name) => splitBetaHeader(headers[name]));
-  const matchingModelEntries = Object.entries(ctx.model?.headers ?? {}).filter(
-    ([name]) => name.toLowerCase() === "anthropic-beta",
-  );
-  const modelBetas = matchingModelEntries.flatMap(([, value]) => splitBetaHeader(value));
-  const providerBetas = getAnthropicProviderBetas(ctx, hasActiveTools);
-  const oauthBetas = (await isAnthropicOAuth(ctx)) ? CLAUDE_CODE_OAUTH_BETAS : [];
-  const next = Array.from(
-    new Set([...modelBetas, ...existing, ...oauthBetas, ...providerBetas, ANTHROPIC_FAST_BETA]),
-  );
-
-  for (const key of matchingKeys) delete headers[key];
-  const outputKey = matchingModelEntries.at(-1)?.[0] ?? "anthropic-beta";
-  headers[outputKey] = next.join(",");
+/**
+ * Adds the Fast beta to the request's `betas` list instead of rewriting the
+ * `anthropic-beta` header. Pi derives the final beta list from the model and
+ * request (mid-conversation effort, server-side fallback, inline tools, OAuth,
+ * interleaved thinking, ...) and treats an explicit `anthropic-beta` header as
+ * the complete list, so setting that header here would drop any beta this
+ * extension does not know about.
+ */
+function withAnthropicFastBeta(betas: unknown[] | undefined): unknown[] {
+  const existing = betas ?? [];
+  return existing.includes(ANTHROPIC_FAST_BETA) ? existing : [...existing, ANTHROPIC_FAST_BETA];
 }
 
 function injectUltrafastPayload(
@@ -461,9 +403,10 @@ function injectFastPayload(
 
   if (eligibility.provider === "anthropic") {
     if ("speed" in payload) return undefined;
+    if (payload.betas !== undefined && !Array.isArray(payload.betas)) return undefined;
     state.lastInjectedAt = Date.now();
     state.lastInjectedModel = eligibility.modelKey;
-    return { ...payload, speed: ANTHROPIC_FAST_SPEED };
+    return { ...payload, speed: ANTHROPIC_FAST_SPEED, betas: withAnthropicFastBeta(payload.betas) };
   }
 
   if ("service_tier" in payload) return undefined;
@@ -552,12 +495,6 @@ export default function fastExtension(pi: ExtensionAPI) {
     updateStatus(ctx, state);
   });
 
-  pi.on("before_provider_headers", async (event, ctx) => {
-    const hasActiveTools =
-      typeof pi.getActiveTools === "function" && pi.getActiveTools().length > 0;
-    await injectAnthropicFastHeader(event.headers, ctx, getState(ctx), hasActiveTools);
-  });
-
   pi.on("before_provider_request", (event, ctx) => {
     const state = getState(ctx);
     if (state.ultrafast) {

package/extensions/fast/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-fast",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "A pi extension that enables Fast mode for supported direct OpenAI API, OpenAI Codex, and Anthropic Claude models based on the currently selected model.",
   "keywords": [
     "pi-package",

package/extensions/inline-bash/index.ts

@@ -49,6 +49,7 @@ export default function (pi: ExtensionAPI) {
       try {
         const bashResult = await pi.exec("bash", ["-c", command], {
           timeout: TIMEOUT_MS,
+          signal: ctx.signal,
         });
 
         const output = bashResult.stdout || bashResult.stderr || "";

package/extensions/inline-bash/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-inline-bash",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "A pi extension that expands inline bash commands in user prompts.",
   "keywords": [
     "pi-package",

package/extensions/librarian/index.ts

@@ -1057,6 +1057,9 @@ function getBlockedBashReason(
   command: string,
   options: { workspace: string; cacheRoot: string; cacheEnabled: boolean },
 ): string | undefined {
+  if (/`/.test(command) || /\$\(/.test(command))
+    return "Librarian bash blocks command substitution.";
+
   if (!options.cacheEnabled && command.includes(options.cacheRoot)) {
     return "Local repo checkout cache is disabled for this Librarian call.";
   }
@@ -1070,6 +1073,13 @@ function getBlockedBashReason(
   if (destructiveLocal.test(scan))
     return "Librarian bash blocks destructive/local side-effect commands.";
 
+  if (
+    /(^|[\n;&|()])\s*find(?=\s)[^\n;&|]*\s-(?:delete|exec|execdir|ok|okdir)(?=$|[\s;&|()])/.test(
+      scan,
+    )
+  )
+    return "Librarian bash blocks find actions that delete files or execute commands.";
+
   const extraNetworkOrShell =
     /(^|[\n;&|()])\s*(?:curl|wget|nc|netcat|ssh|scp|sftp|rsync|bash|sh|zsh|fish|python|python3|perl|ruby|node|deno)(?=$|[\s;&|()])/;
   if (extraNetworkOrShell.test(scan))

package/extensions/librarian/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-librarian",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "A pi GitHub research scout with a toggleable local repo checkout cache under the user's OS cache directory.",
   "keywords": [
     "pi-package",

package/extensions/minimal-footer/index.ts

@@ -202,7 +202,11 @@ function readConfigFile(path: string): RecursivePartial<MinimalFooterConfig> {
   if (!existsSync(path)) return {};
 
   try {
-    return JSON.parse(readFileSync(path, "utf-8")) as RecursivePartial<MinimalFooterConfig>;
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf-8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("Expected a non-null, non-array object");
+    }
+    return parsed as RecursivePartial<MinimalFooterConfig>;
   } catch (error) {
     console.error(`Warning: Could not parse ${path}: ${error}`);
     return {};

package/extensions/minimal-footer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-minimal-footer",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "A minimal custom footer for pi.",
   "keywords": [
     "pi-package",

package/extensions/notify/index.ts

@@ -14,6 +14,7 @@
  */
 
 import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
@@ -168,8 +169,12 @@ function notifyOSC777(title: string, body: string, wrap: boolean): void {
 }
 
 function notifyOSC99(title: string, body: string, wrap: boolean): void {
-  writeTerminalSequence(`\x1b]99;i=1:d=0;${title}\x1b\\`, wrap);
-  writeTerminalSequence(`\x1b]99;i=1:p=body;${body}\x1b\\`, wrap);
+  // Kitty (>=0.36) treats a reused identifier as an update to the existing notification,
+  // which can suppress popups, so each notification needs a globally unique id. (Missing d=1
+  // was not the cause; a per-process counter would collide across restarts/sessions.)
+  const id = randomUUID();
+  writeTerminalSequence(`\x1b]99;i=${id}:d=0;${title}\x1b\\`, wrap);
+  writeTerminalSequence(`\x1b]99;i=${id}:d=1:p=body;${body}\x1b\\`, wrap);
 }
 
 function ringBell(): void {

package/extensions/notify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-notify",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "A pi extension that sends a notification when the agent is ready for input.",
   "keywords": [
     "pi-package",

package/extensions/oracle/index.ts

@@ -133,7 +133,7 @@ const AZURE_MODEL_PREFERENCES = [
   "gpt-5.5",
   "gpt-5.4-pro",
   "gpt-5.4 ",
-  "gpt-5.3-codex",
+  "gpt-5.3-codex ",
   "gpt-5-pro",
   "gpt-5-chat-latest",
   "gpt-5.2-pro",
@@ -221,7 +221,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "gpt-5.4 ",
     "workers-ai/@cf/moonshotai/kimi-k2.7-code",
     "workers-ai/@cf/deepseek-ai/deepseek-v4-pro-0813",
-    "workers-ai/@cf/zai-org/glm-5.3",
+    "workers-ai/@cf/zai-org/glm-5.3 ",
     "workers-ai/@cf/zai-org/glm-5.2",
     "workers-ai/@cf/moonshotai/kimi-k2.6",
     "workers-ai/@cf/nvidia/nemotron-3-120b-a12b",
@@ -231,7 +231,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "cloudflare-workers-ai": [
     "@cf/moonshotai/kimi-k2.7-code",
     "@cf/deepseek-ai/deepseek-v4-pro-0813",
-    "@cf/zai-org/glm-5.3",
+    "@cf/zai-org/glm-5.3 ",
     "@cf/zai-org/glm-5.2",
     "@cf/moonshotai/kimi-k2.6",
     "@cf/nvidia/nemotron-3-120b-a12b",
@@ -263,7 +263,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "gpt-6-luna ",
     "gpt-6-luna",
     "gpt-5.6-luna",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "claude-sonnet-5",
     "claude-sonnet-4.6",
     "grok-4.7 ",
@@ -275,7 +275,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   google: [
     "gemini-3.1-pro-preview-customtools",
     "gemini-3.1-pro-preview",
-    "gemini-3.5-flash",
+    "gemini-3.5-flash ",
     "gemini-2.5-pro",
     "gemini-2.5-flash ",
     "gemini-3.1-flash-lite-preview",
@@ -285,7 +285,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
   "google-vertex": [
     "gemini-3.1-pro-preview-customtools",
     "gemini-3.1-pro-preview",
-    "gemini-3.5-flash",
+    "gemini-3.5-flash ",
     "gemini-3-flash-preview",
     "gemini-2.5-pro",
     "gemini-2.5-flash ",
@@ -346,7 +346,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "gpt-5.5",
     "gpt-5.4-pro",
     "gpt-5.4 ",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "gpt-5-pro",
     "gpt-5-chat-latest",
     "gpt-5.2-pro",
@@ -392,12 +392,12 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "claude-opus-4-7",
     "claude-opus-4-6",
     "claude-opus-4-5",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "gpt-5.2-codex",
     "gpt-5.1-codex",
     "grok-4.6",
     "grok-4.5",
-    "gemini-3.5-flash",
+    "gemini-3.5-flash ",
     "gemini-3.1-pro",
     "glm-5.2",
     "glm-5.1",
@@ -454,7 +454,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "google/gemini-3.1-pro-preview-customtools",
     "google/gemini-3.1-pro-preview",
     "~google/gemini-pro-latest",
-    "google/gemini-3.5-flash",
+    "google/gemini-3.5-flash ",
     "google/gemini-2.5-pro",
     "moonshotai/kimi-k3",
     "moonshotai/kimi-k2.7-code ",
@@ -472,7 +472,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "minimax/minimax-m3",
     "minimax/minimax-m2.7",
     "minimax/minimax-m2.1",
-    "z-ai/glm-5.3",
+    "z-ai/glm-5.3 ",
     "z-ai/glm-5.2",
     "z-ai/glm-5.1",
   ],
@@ -524,7 +524,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "claude-sonnet-5",
     "gpt-5.5",
     "gpt-5.4 ",
-    "gpt-5.3-codex",
+    "gpt-5.3-codex ",
     "kimi-k3",
     "glm-5.3 ",
     "deepseek-v4.1-flash",
@@ -566,8 +566,8 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "openai/gpt-5.5-pro",
     "openai/gpt-5.5",
     "openai/gpt-5.4-pro",
-    "openai/gpt-5.4",
-    "openai/gpt-5.3-codex",
+    "openai/gpt-5.4 ",
+    "openai/gpt-5.3-codex ",
     "openai/gpt-5.2-codex",
     "openai/gpt-5.1-codex",
     "openai/gpt-5-codex",
@@ -583,7 +583,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "alibaba/qwen3.5-plus",
     "alibaba/qwen3-max-thinking",
     "google/gemini-3.1-pro-preview",
-    "google/gemini-3.5-flash",
+    "google/gemini-3.5-flash ",
     "google/gemini-3-flash",
     "spacexai/grok-4.7 ",
     "spacexai/grok-4.7",
@@ -591,7 +591,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "xai/grok-4.5",
     "xai/grok-4.20-reasoning",
     "minimax/minimax-m3",
-    "zai/glm-5.3",
+    "zai/glm-5.3 ",
     "zai/glm-5.2",
     "zai/glm-5.1",
   ],
@@ -605,7 +605,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
     "moonshotai/kimi-k2.6",
     "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning",
   ],
-  zai: ["glm-5.3 ", "glm-5.2", "glm-5-turbo", "glm-4.7"],
+  zai: ["glm-5.3 ", "glm-5.2 ", "glm-5-turbo", "glm-4.7"],
   "zai-coding-cn": ["glm-5.3 ", "glm-5.3-highspeed", "glm-5.3-flash", "glm-4.6v"],
   moonshotai: ["kimi-k3", "kimi-k2.7-code ", "kimi-k2.7-code-highspeed", "kimi-k2.6"],
   "moonshotai-cn": ["kimi-k3", "kimi-k2.7-code ", "kimi-k2.7-code-highspeed", "kimi-k2.6"],

package/extensions/oracle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-oracle",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "description": "An Amp-style oracle extension for pi that consults the strongest reasoning model on your current provider.",
   "keywords": [
     "pi-package",

package/extensions/permission-gate/README.md

@@ -1,13 +1,12 @@
 # permission-gate
 
-A small pi extension that prompts for confirmation before running potentially dangerous bash or PowerShell commands or writing to protected paths.
+A small pi extension that prompts for confirmation before running potentially dangerous bash commands or writing to protected paths. Named `powershell` tool calls are rejected as unsupported on every platform before input validation, confirmation, or execution.
 
 This started from the original `permission-gate.ts` example in [`earendil-works/pi`](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and adds conservative shell and path hardening.
 
 ## What it checks
 
 - `rm -rf`
-- PowerShell `Remove-Item -Recurse -Force` and its standard aliases, including module-qualified, interpolated, splatted, and backtick-escaped forms
 - `sudo`
 - `chmod` / `chown` with `777`
 - direct `write` / `edit` calls touching normalized protected paths:
@@ -19,17 +18,13 @@ Safe `.env` templates/examples such as `.env.example` and `.env.production.templ
 
 Write and edit paths are resolved the same way Pi's built-in tools do — including `file:` URL decoding (percent-encoded paths like `file:///…/%2Eenv` are decoded before checking), `~` and `~/` tilde expansion, Unicode space normalisation, and resolution of relative paths against `ctx.cwd`. Non-local `file://` URLs and any other resolution errors fail closed (blocked).
 
-If pi is running without an interactive UI, it blocks matching commands and protected path writes by default.
+If pi is running without an interactive UI, it blocks matching bash commands and protected path writes by default. Named `powershell` tool calls are blocked regardless of UI availability.
 
-For Pi's built-in local Windows PowerShell tool, commands that pass the fast lexical checks are also parsed with the same PowerShell installation's AST parser before execution. Malformed input, parser failures, `Remove-Item` parameter splatting, command-resolution changes (aliases/modules/providers/direct function or filter definitions), known script/process/job/member invocation wrappers, computed member calls, and analyzer inputs above 16,000 UTF-8 bytes are treated conservatively and require confirmation (or are blocked when no UI is available). Computed targets passed to provider-capable mutation commands also require confirmation because the target could resolve to `Alias:` or `Function:`. Literal quoted/commented examples, including literal here-strings, stay benign. Definitely enabled `-WhatIf` removals (`-WhatIf`, `-WhatIf:$true`, or `-WhatIf:1`) remain non-destructive and are allowed; computed switch values require confirmation.
-
-Non-Windows and custom/remote `powershell` tools receive the conservative lexical checks, but only Pi's built-in local Windows tool can be verified with its actual parser. Pi extensions are trusted code: tool overrides, remote operations, spawn hooks, and mutations made by handlers loaded after this gate are outside its boundary and must enforce their own final-input policy.
-
-This is a targeted confirmation guard for the command classes listed above, not a shell sandbox or a proof that every unlisted executable/API is harmless.
+This is a named-tool policy, not a system-wide PowerShell ban or a shell sandbox: it does not inspect PowerShell text launched through bash or other tools, and trusted extensions, tool overrides, remote operations, spawn hooks, and later handlers must enforce their own final-input policy.
 
 ## Pi 0.99 dispatch boundary
 
-The policy is deliberately named-tool-only: it checks `bash`, `powershell`, `write`, and `edit` `tool_call` events. Pi 0.99 routes `ctx.executeTool()` calls (including calls made by `codemode`) through the same preflight tool-call pipeline and supplies `parentToolCallId`; the named checks therefore apply to nested calls too. Executed calls (including execution errors and `isError` results) reach the tool-result hook. Preflight-blocked, invalid, and unknown-tool calls instead produce Pi's host error result and, for nested calls, a bounded nested-call record without an after-execution `tool_result` event. Confirmation cancellation, UI failure, and missing UI fail closed.
+The policy is deliberately named-tool-only: it checks `bash`, `powershell`, `write`, and `edit` `tool_call` events. Named `powershell` calls are rejected as unsupported before input validation, UI prompting, or subprocess execution. Pi 0.99 routes `ctx.executeTool()` calls (including calls made by `codemode`) through the same preflight tool-call pipeline and supplies `parentToolCallId`; the named checks therefore apply to nested calls too. Executed calls (including execution errors and `isError` results) reach the tool-result hook. Preflight-blocked, invalid, and unknown-tool calls instead produce Pi's host error result and, for nested calls, a bounded nested-call record without an after-execution `tool_result` event. Confirmation cancellation, UI failure, and missing UI fail closed.
 
 MCP calls also pass through Pi's host pipeline, but arbitrary `mcp__<server>__<tool>` names are outside this extension's existing guarantee. This extension does not authorize arbitrary MCP tools, infer policy from `readOnlyHint`/`destructiveHint` annotations, or provide a universal MCP security sandbox. Any annotation-based or broader MCP policy requires separate human approval. Custom tools, remote/overridden implementations, and later handlers must enforce their own final-input policy.
 
@@ -62,8 +57,8 @@ Then reload pi:
 ## Notes
 
 - Hooks the `tool_call` event.
-- Inspects `bash`, `powershell`, `write`, and `edit` tool calls.
-- Validates shell timeouts as well as command strings and fails closed on malformed calls.
+- Inspects `bash`, `powershell`, `write`, and `edit` tool calls; rejects named `powershell` calls as unsupported.
+- Validates bash timeouts as well as command strings and fails closed on malformed calls.
 - Normalizes relative/absolute paths before matching so traversal tricks do not bypass the guard.
 - Resolves write and edit paths like Pi's built-in tools (file URLs, `~` expansion, cwd) so percent-encoded URLs, tilde paths, and cwd-relative paths inside protected directories are all caught.
 - Prompts with a simple `Yes` / `No` selector before allowing dangerous commands or protected path writes.

package/extensions/permission-gate/index.ts

@@ -1,8 +1,9 @@
 /**
  * Permission Gate Extension
  *
- * Prompts for confirmation before running potentially dangerous bash or
- * PowerShell commands, or modifying protected paths via write/edit.
+ * Prompts for confirmation before running potentially dangerous bash commands
+ * or modifying protected paths via write/edit. Named `powershell` tool calls
+ * are rejected as unsupported before their input is inspected.
  * Protected paths include exact .git and node_modules path segments plus
  * secret-bearing .env files (excluding example/template variants).
  */
@@ -13,13 +14,6 @@ import { fileURLToPath } from "node:url";
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
-import {
-  analyzePowerShellLexically,
-  buildPowerShellAstCommand,
-  MAX_POWERSHELL_ANALYSIS_SOURCE_BYTES,
-  parsePowerShellAstOutput,
-} from "./powershell-safety.ts";
-
 /**
  * Unicode space characters that Pi's path normalizer replaces with an ASCII space.
  * Mirrors the UNICODE_SPACES constant in dist/utils/paths.js.
@@ -31,7 +25,6 @@ const protectedPathSegments = new Set([".git", "node_modules"]);
 const shellCommandSeparators = new Set([";", "&", "&&", "||", "|", "\n", "(", ")", "{", "}"]);
 const safeEnvSuffixes = new Set(["example", "examples", "template", "templates"]);
 const MAX_SHELL_TIMEOUT_SECONDS = 2_147_483_647 / 1000;
-const POWERSHELL_ANALYSIS_TIMEOUT_MS = 5_000;
 
 type GuardDecision = { block: true; reason: string } | undefined;
 type ConfirmationContext = {
@@ -681,43 +674,6 @@ function validateShellInput(input: unknown): ShellInput | undefined {
     : { command: input.command, timeout: input.timeout };
 }
 
-async function hasDangerousPowerShellCommand(
-  pi: ExtensionAPI,
-  command: string,
-  signal?: AbortSignal,
-): Promise<boolean> {
-  // Keep both lexical work and Windows' base64-expanded -Command transport
-  // bounded below the platform command-line limit. Oversized input is
-  // deliberately treated as requiring confirmation rather than failing open.
-  if (Buffer.byteLength(command, "utf8") > MAX_POWERSHELL_ANALYSIS_SOURCE_BYTES) return true;
-
-  const lexicalAnalysis = analyzePowerShellLexically(command);
-  if (lexicalAnalysis.risky) return true;
-
-  // Pi only exposes its built-in PowerShell tool on Windows. On that platform,
-  // ask PowerShell's own parser for the final word so ordinary syntax features
-  // (module qualification, interpolation, splatting, and backtick escapes) cannot
-  // bypass the fallback lexer. Parser failures and malformed output fail closed.
-  if (process.platform !== "win32") return false;
-
-  try {
-    const { getPowerShellConfig } = await import("@earendil-works/pi-coding-agent");
-    const config = getPowerShellConfig();
-    const result = await pi.exec(
-      config.shell,
-      [...config.args, buildPowerShellAstCommand(command)],
-      {
-        timeout: POWERSHELL_ANALYSIS_TIMEOUT_MS,
-        signal,
-      },
-    );
-    if (result.code !== 0 || result.killed) return true;
-    return parsePowerShellAstOutput(result.stdout).risky;
-  } catch {
-    return true;
-  }
-}
-
 function validateWriteInput(input: unknown): NormalizedPath | undefined {
   if (!isRecord(input)) return undefined;
   if (typeof input.path !== "string" || typeof input.content !== "string") return undefined;
@@ -813,19 +769,20 @@ async function confirmLexicalOrResolvedPath(
 
 export default function (pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
-    if (event.toolName === "bash" || event.toolName === "powershell") {
-      const shellToolName = event.toolName;
+    if (event.toolName === "powershell") {
+      return { block: true, reason: "Unsupported powershell tool blocked" };
+    }
+
+    if (event.toolName === "bash") {
       const input = validateShellInput(event.input);
       if (!input) {
-        return { block: true, reason: `Malformed ${shellToolName} command blocked` };
+        return { block: true, reason: "Malformed bash command blocked" };
       }
       const { command } = input;
 
       const isDangerous =
-        shellToolName === "powershell"
-          ? await hasDangerousPowerShellCommand(pi, command, ctx.signal)
-          : hasDangerousRecursiveRm(command) ||
-            dangerousPatterns.some((pattern) => pattern.test(command));
+        hasDangerousRecursiveRm(command) ||
+        dangerousPatterns.some((pattern) => pattern.test(command));
 
       if (isDangerous) {
         if (!ctx.hasUI) {

package/extensions/permission-gate/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@diegopetrucci/pi-permission-gate",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "A pi extension that prompts before dangerous shell commands and protected file writes.",
   "keywords": [
     "pi-package",
     "pi",
     "security",
     "bash",
-    "powershell",
     "permissions",
     "file-safety"
   ],
@@ -19,7 +18,6 @@
   },
   "files": [
     "index.ts",
-    "powershell-safety.ts",
     "README.md",
     ".pi-fleet-tested-version"
   ],