@herbertgao/pi-extensions 2026.8.13 → 2026.8.14

package/README.md

@@ -10,7 +10,7 @@ pi install npm:@herbertgao/pi-extensions
 
 Requires Node.js 24 or newer.
 
-The package bundles 4 active `@herbertgao/*` child packages—`pi-cc-extensions`, `resume-from`, `pi-stash`, and `pi-subagents`—plus the following upstream packages under their original names:
+The package bundles 3 active `@herbertgao/*` child packages—`pi-cc-extensions`, `resume-from`, and `pi-subagents`—plus the following upstream packages under their original names:
 
 - `@dietrichgebert/ponytail@4.9.0`
 - `@juicesharp/rpiv-ask-user-question@2.7.1`
@@ -21,20 +21,22 @@ The package bundles 4 active `@herbertgao/*` child packages—`pi-cc-extensions`
 - `@tifan/pi-handoff@2.0.1`
 - `@tifan/pi-inline-skills@1.0.5`
 - `@tifan/pi-mermaid-open@0.2.0`
-- `@tifan/pi-preferred-thinking@1.0.0`
+- `@tifan/pi-preferred-thinking@1.0.1`
 - `@tifan/pi-recap@0.4.5`
 - `@tifan/pi-rename@0.5.1`
 - `@tifan/pi-titlebar-spinner@0.1.3`
-- `pi-mcp-adapter@2.29.0`
+- `pi-mcp-adapter@2.30.0`
 - `pi-footer@0.5.1`
 - `pi-lens@4.1.2`
-- `pi-web-access@0.25.0`
+- `pi-web-access@0.26.0`
 - `remote-pi@0.7.0`
-- `@czottmann/pi-automode@1.13.0`
+- `@czottmann/pi-automode@1.14.0`
 
 Pi loads their extensions and skills through `node_modules/` paths inside one package root. The upstream companions are pinned and bundled, not forked or renamed.
 
-`@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `pi-lens@4.1.2` improves delayed LSP diagnostics, stale-result cleanup, process cleanup, and snapshot completeness. `pi-automode@1.13.0` parses shell commands before applying policy and migrates legacy configuration safely. `pi-web-access@0.25.0` adds opt-in proxy and cloud-auth providers plus GitHub-aware fetching and a Defuddle extraction fallback.
+`@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `pi-lens@4.1.2` improves delayed LSP diagnostics, stale-result cleanup, process cleanup, and snapshot completeness. `pi-automode@1.14.0` bounds classifier streams and permits only validated temporary-directory subtrees. `pi-web-access@0.26.0` adds explicit XCrawl search plus safer query and extraction fallbacks. Preferred Thinking 1.0.1 preserves an explicit subagent `--thinking` choice.
+
+`pi-stash` is no longer bundled: `/btw` already preserves the main editor draft while handling side questions outside the main conversation. Prior `@herbertgao/pi-stash` releases remain available but are no longer maintained here.
 
 If `pi-footer` was installed separately before upgrading to an aggregate release that includes it, remove the standalone source shown by `pi list` so only the bundled copy loads. For the pinned standalone install used while preparing this integration:
 

package/node_modules/@czottmann/pi-automode/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project are documented in this file.
 
+## [Unreleased]
+
+## [1.14.0] - 2026-08-27
+
+## Bug fixes
+
+- **Classifier stream timeout** — Apply `classifierTimeoutMs` to the full response stream. Provider behavior cannot keep classifier calls pending after the deadline. Parent cancellation remains active. Reject values above the Node.js timer limit. (#30)
+- **OS temp-directory deletes** — Stop hard-denying recursive-delete subtrees under `os.tmpdir()` and `/tmp`. On macOS these resolve into `/private/tmp` and `/private/var/folders`, which matched the `/private` system root and blocked every temp cleanup. Deleting a temp root itself stays blocked. (#31)
+- **Validated temp-root declarations** — Derive the exempt temp roots only from launcher-declared values that stay safe: reject values such as `/`, empty strings, aliases of `HOME`, `/`, or a system root, and ancestors of `HOME`. Without validation, a malformed `TMPDIR` could disable deterministic denials for protected targets, and a broad `permissions.allow` rule could then allow the action without classifier review. Recompute candidates when the effective tmpdir changes. (#31)
+
 ## [1.13.0] - 2026-08-25
 
 ## New features
@@ -35,5 +45,7 @@ All notable changes to this project are documented in this file.
 - **Project config trust gate** — Ignore `.pi/automode.local.json` and `.pi/automode.json` until Pi trusts the project. Apply the trust gate during startup and config reloads. (#16)
 - **In-memory observability logs** — Write logs to an extension-owned directory (`~/.pi/agent/extensions/pi-automode/logs/`) instead of the launching project directory. Thanks, @HerbertGao! (#13)
 
+[Unreleased]: https://github.com/czottmann/pi-automode/compare/v1.14.0...HEAD
+[1.14.0]: https://github.com/czottmann/pi-automode/compare/v1.13.0...v1.14.0
 [1.13.0]: https://github.com/czottmann/pi-automode/compare/v1.12.0...v1.13.0
 [1.12.0]: https://github.com/czottmann/pi-automode/compare/v1.11.0...v1.12.0

package/node_modules/@czottmann/pi-automode/README.md

@@ -101,7 +101,7 @@ The extension blocks these before any allow or classifier decision:
 - SSH `authorized_keys` writes
 - cron, launch agent, and system service persistence
 - TLS/certificate/auth weakening patterns
-- root, home, and system-path destructive deletes
+- root, home, and system-path destructive deletes. Subtrees of validated launcher-declared temp directories are treated as disposable. Declared roots that alias `HOME`, `/`, or a system root, or that contain `HOME`, are rejected instead.
 - edits to `.pi/automode*`, `.pi` auto-mode files, and this extension's safety-control files
 
 After these checks, pi-automode applies `permissions.allow`. Protected `write` and `edit` targets continue to the classifier.

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/classifier.ts

@@ -155,6 +155,55 @@ export type ClassifierCompletionPlan = {
   reasoningLevel?: Exclude<EffectiveClassifierReasoningLevel, "off">;
 };
 
+async function completeClassifierAttempt(
+  completeFn: ClassifierCompletionFn,
+  model: Model<any>,
+  prompt: Parameters<ClassifierCompletionFn>[1],
+  parentSignal: AbortSignal | undefined,
+  options: Omit<Parameters<ClassifierCompletionFn>[2], "signal">,
+): Promise<AssistantMessage> {
+  if (options.timeoutMs === undefined) {
+    return completeFn(model, prompt, {
+      ...options,
+      ...(parentSignal === undefined ? {} : { signal: parentSignal }),
+    });
+  }
+
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parentSignal?.reason);
+  if (parentSignal?.aborted) onParentAbort();
+  else parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      const reason = controller.signal.reason;
+      reject(reason instanceof Error ? reason : new Error("Classifier request aborted."));
+    };
+    if (controller.signal.aborted) onAbort();
+    else controller.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  const timer = setTimeout(() => {
+    controller.abort(
+      new Error(`Classifier request timed out after ${options.timeoutMs} ms.`),
+    );
+  }, options.timeoutMs);
+
+  try {
+    return await Promise.race([
+      completeFn(model, prompt, {
+        ...options,
+        signal: controller.signal,
+      }),
+      aborted,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) controller.signal.removeEventListener("abort", onAbort);
+    parentSignal?.removeEventListener("abort", onParentAbort);
+  }
+}
+
 /**
  * Run normalized Pi AI completion through the provider in Pi's runtime registry.
  * This temporary bridge is only valid until Pi exposes
@@ -435,14 +484,15 @@ export async function classifyWithRetry(
     const started = Date.now();
     let response: AssistantMessage;
     try {
-      response = await completeFn(
+      response = await completeClassifierAttempt(
+        completeFn,
         classifier.model,
         prompt,
+        signal,
         {
           apiKey: classifier.apiKey,
           headers: classifier.headers,
           env: classifier.env,
-          signal,
           maxTokens,
           ...(temperature === undefined ? {} : { temperature }),
           ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
@@ -505,7 +555,8 @@ export async function classifyInStages(
   const fastStarted = Date.now();
   let fastResponse: AssistantMessage;
   try {
-    fastResponse = await completeFn(
+    fastResponse = await completeClassifierAttempt(
+      completeFn,
       classifier.model,
       {
         systemPrompt: prompt.systemPrompt,
@@ -515,11 +566,11 @@ export async function classifyInStages(
           stageMessage(CLASSIFIER_FAST_INSTRUCTION),
         ],
       },
+      signal,
       {
         apiKey: classifier.apiKey,
         headers: classifier.headers,
         env: classifier.env,
-        signal,
         // Reasoning and OpenAI-compatible models may consume hidden reasoning,
         // control, and EOS tokens before emitting the required visible digit.
         maxTokens: options.fastClassifierMaxTokens ??

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/config.ts

@@ -22,6 +22,7 @@ import {
   DEFAULT_MAX_USER_TRANSCRIPT_TOKENS,
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
+  MAX_CLASSIFIER_TIMEOUT_MS,
   PI_GLOBAL_SETTINGS,
   PI_LEGACY_GLOBAL_SETTINGS,
   PI_PROJECT_LOCAL_SETTINGS,
@@ -324,10 +325,11 @@ export function validateSettingsFile(
       if (
         hasOwn(autoMode, "classifierTimeoutMs") &&
         (!Number.isInteger(autoMode.classifierTimeoutMs) ||
-          (autoMode.classifierTimeoutMs as number) < 1000)
+          (autoMode.classifierTimeoutMs as number) < 1000 ||
+          (autoMode.classifierTimeoutMs as number) > MAX_CLASSIFIER_TIMEOUT_MS)
       ) {
         diagnostics.push(
-          `${source}: autoMode.classifierTimeoutMs must be an integer of at least 1000`,
+          `${source}: autoMode.classifierTimeoutMs must be an integer from 1000 through ${MAX_CLASSIFIER_TIMEOUT_MS}`,
         );
       }
       if (
@@ -591,7 +593,9 @@ function validFastClassifierBudget(value: unknown): value is number {
 }
 
 function validClassifierTimeout(value: unknown): value is number {
-  return Number.isInteger(value) && Number(value) >= 1000;
+  return Number.isInteger(value) &&
+    Number(value) >= 1000 &&
+    Number(value) <= MAX_CLASSIFIER_TIMEOUT_MS;
 }
 
 function applyAutoModeScalars(

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/constants.ts

@@ -61,6 +61,8 @@ export const DENIAL_HISTORY_LIMIT = 12;
 
 /** Per-request timeout for classifier completions (fast and detailed stages). */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20_000;
+/** Largest timeout that Node can represent without reducing it to 1 ms. */
+export const MAX_CLASSIFIER_TIMEOUT_MS = 2_147_483_647;
 
 /** Built-in trusted environment. Users extend this with `$defaults`. */
 export const DEFAULT_ENVIRONMENT = [

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/hard-deny.ts

@@ -1,4 +1,5 @@
 import { statSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import {
   analyzeBash,
@@ -77,9 +78,115 @@ function matchesPathRoot(path: string, root: string): boolean {
   return isSameExistingPath(path.slice(0, root.length), root);
 }
 
+/**
+ * Top-level directories whose deletion or wholesale modification is a
+ * system-wide event. Shared between candidate validation and path
+ * classification; do not inline copies.
+ */
+const SYSTEM_ROOTS: ReadonlyArray<string> = [
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib64",
+  "/Library",
+  "/private",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/sys",
+  "/System",
+  "/usr",
+  "/var",
+];
+
+/**
+ * Normalize a proposed temp-root value into a comparable absolute path.
+ * Returns undefined for values that cannot denote a subdirectory: the
+ * empty string, `/`, and slash-only artifacts.
+ */
+function normalizeRootCandidate(value: string): string | undefined {
+  const stripped = value.replace(/\/+$/, "");
+  // An empty stripped value must not fall through to `resolve()`, which
+  // would silently turn `/` into the process working directory.
+  if (!stripped) return undefined;
+  const normalized = resolve(stripped);
+  if (normalized === "/") return undefined;
+  return normalized;
+}
+
+/**
+ * True when a candidate temp root would weaken the deterministic deny tiers:
+ * it aliases (exact, case-folded, or dev/inode) `HOME`, `/`, or any system
+ * root, or it is a proper ancestor of the canonical home directory.
+ *
+ * Dev/inode identity covers symlinked spellings of existing directories;
+ * string comparison alone handles candidates that do not exist yet. See
+ * issue #31: without these guards, `TMPDIR=/` reduced every absolute path
+ * below an empty-string prefix match, and `TMPDIR=/private` made
+ * `/private/etc/**` disposable.
+ */
+function conflictsWithProtectedRoots(candidate: string, home: string): boolean {
+  if (candidate === "/") return true;
+  for (const protectedRoot of ["/", home, ...SYSTEM_ROOTS]) {
+    const canonical = resolve(protectedRoot);
+    if (
+      candidate === canonical ||
+      candidate.toLowerCase() === canonical.toLowerCase()
+    ) {
+      return true;
+    }
+    if (isSameExistingPath(candidate, canonical)) return true;
+  }
+  const homeCanonical = resolvePathForPolicy(home) ?? resolve(home);
+  return homeCanonical.toLowerCase().startsWith(`${candidate.toLowerCase()}/`);
+}
+
+let cachedTempRoots: ReadonlyArray<string> | undefined;
+let cachedTmpdirValue: string | undefined;
+
+/**
+ * Validated launcher-declared temp-dir roots whose subtrees are treated as
+ * disposable by `isRootHomeOrSystemPath`: the platform tmpdir, plus `/tmp` on
+ * macOS where it exists independently of `os.tmpdir()`. Each root appears in
+ * canonical and resolved spelling because callers pass symlink-resolved
+ * policy paths (`/tmp` → `/private/tmp` on macOS) and unresolved fallbacks
+ * alike. Values from `os.tmpdir()` are not trusted blindly; see
+ * `conflictsWithProtectedRoots`. The roots themselves are never exempt:
+ * deleting one is a system-wide delete.
+ *
+ * The memoization keys on the effective `os.tmpdir()` return value so tests
+ * can mutate `TMPDIR`, `TMP`, or `TEMP` between calls.
+ */
+export function tempRootCandidates(): ReadonlyArray<string> {
+  const currentTmpdir = tmpdir();
+  if (cachedTempRoots && cachedTmpdirValue === currentTmpdir) {
+    return cachedTempRoots;
+  }
+  cachedTmpdirValue = currentTmpdir;
+  cachedTempRoots = (() => {
+    const roots = new Set<string>();
+    const consider = (value: string) => {
+      const candidate = normalizeRootCandidate(value);
+      if (!candidate || conflictsWithProtectedRoots(candidate, HOME)) return;
+      roots.add(candidate);
+      const resolved = resolvePathForPolicy(candidate);
+      if (resolved) roots.add(resolved);
+    };
+    consider(currentTmpdir);
+    if (process.platform === "darwin") consider("/tmp");
+    return [...roots];
+  })();
+  return cachedTempRoots;
+}
+
 /**
  * True for `/`, the user's home root, or a top-level system root such as
- * `/etc`, `/usr`, or `/var`. Excludes the home *subtree*.
+ * `/etc`, `/usr`, or `/var`. Excludes the home *subtree* and the subtrees of
+ * platform temp directories (`os.tmpdir()` and `/tmp` on macOS).
  *
  * On some distros (e.g. Fedora Silverblue) HOME lives under `/var`, which is
  * in `systemRoots`. Without the subtree exemption, `path.startsWith("/var/")`
@@ -87,32 +194,36 @@ function matchesPathRoot(path: string, root: string): boolean {
  * `rm -rf ~/...`. HOME itself is still matched below, so `rm -rf ~` stays
  * blocked. `home` is a parameter so this can be unit-tested with a synthetic
  * `/var/home/...` value.
+ *
+ * The temp exemption mirrors the home one and covers cleanup of directories
+ * created with `mktemp`, `os.tmpdir()`, or plain `/tmp` paths. On macOS these
+ * resolve into `/private/tmp` or `/private/var/folders`, which used to match
+ * the `/private` system root and hard-deny every temp cleanup. Deleting a
+ * temp root itself still returns true; `tempRoots` is injectable for tests.
+ *
+ * Protection order matters (issue #31): exact `/`, the exact home root, and
+ * system roots win over every exemption. Injected `tempRoots` values are
+ * validated per call so hostile or malformed candidates cannot weaken the
+ * deterministic tiers.
  */
-export function isRootHomeOrSystemPath(path: string, home: string): boolean {
-  const systemRoots = [
-    "/bin",
-    "/boot",
-    "/dev",
-    "/etc",
-    "/home",
-    "/lib",
-    "/lib64",
-    "/Library",
-    "/private",
-    "/proc",
-    "/root",
-    "/run",
-    "/sbin",
-    "/sys",
-    "/System",
-    "/usr",
-    "/var",
-  ];
+export function isRootHomeOrSystemPath(
+  path: string,
+  home: string,
+  tempRoots: ReadonlyArray<string> = tempRootCandidates(),
+): boolean {
+  if (path === "/") return true;
+  if (path === home || isSameExistingPath(path, home)) return true;
   if (matchesPathRoot(path, home) && path.length > home.length) return false;
+  for (const root of tempRoots) {
+    const candidate = normalizeRootCandidate(root);
+    if (!candidate || conflictsWithProtectedRoots(candidate, home)) continue;
+    if (!matchesPathRoot(path, candidate)) continue;
+    // Subtree: disposable. Exact match: the temp root stays protected.
+    return path.length > candidate.length ? false : true;
+  }
   return (
-    path === "/" ||
     matchesPathRoot(path, home) ||
-    systemRoots.some((root) => matchesPathRoot(path, root))
+    SYSTEM_ROOTS.some((root) => matchesPathRoot(path, root))
   );
 }
 

package/node_modules/@czottmann/pi-automode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@czottmann/pi-automode",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Claude Code-style auto mode guardrail for pi.",
   "repository": {
     "url": "https://github.com/czottmann/pi-automode"

package/node_modules/@herbertgao/pi-cc-extensions/README.en.md

@@ -102,5 +102,5 @@ bun run typecheck
 
 ## Credits
 
-- Derived from [`minuque/pi-cc-extensions` v0.8.67](https://github.com/minuque/pi-cc-extensions/releases/tag/v0.8.67) (`bc58504`) under the MIT license.
+- Derived from [`minuque/pi-cc-extensions` v0.8.68](https://github.com/minuque/pi-cc-extensions/releases/tag/v0.8.68) (`1ca144c`) under the MIT license.
 - Rich diffs are adapted from [`MasuRii/pi-tool-display`](https://github.com/MasuRii/pi-tool-display) (MIT). See [`extensions/renderer/tool/diff/ATTRIBUTION.md`](./extensions/renderer/tool/diff/ATTRIBUTION.md).

package/node_modules/@herbertgao/pi-cc-extensions/README.md

@@ -102,5 +102,5 @@ bun run typecheck
 
 ## 致谢
 
-- 基于 MIT 许可的 [`minuque/pi-cc-extensions` v0.8.67](https://github.com/minuque/pi-cc-extensions/releases/tag/v0.8.67)（`bc58504`）衍生维护。
+- 基于 MIT 许可的 [`minuque/pi-cc-extensions` v0.8.68](https://github.com/minuque/pi-cc-extensions/releases/tag/v0.8.68)（`1ca144c`）衍生维护。
 - Rich diff 改编自 [`MasuRii/pi-tool-display`](https://github.com/MasuRii/pi-tool-display)（MIT）；详见 [`extensions/renderer/tool/diff/ATTRIBUTION.md`](./extensions/renderer/tool/diff/ATTRIBUTION.md)。

package/node_modules/@herbertgao/pi-cc-extensions/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@herbertgao/pi-cc-extensions",
-	"version": "0.8.59",
+	"version": "0.8.60",
 	"license": "MIT",
 	"description": "A Pi productivity suite with Claude Code-style UI, context inspection, and agent/session references",
 	"type": "module",
@@ -69,8 +69,8 @@
 	},
 	"x-upstream": {
 		"package": "pi-cc-extensions",
-		"version": "0.8.67",
+		"version": "0.8.68",
 		"repository": "https://github.com/minuque/pi-cc-extensions",
-		"commit": "bc585044e3032f1368560bb289fb4485389ead99"
+		"commit": "1ca144c8fa3f2b391fd76d008f0148e04bad14be"
 	}
 }

package/node_modules/@herbertgao/pi-subagents/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.17.1
+
+### Patch Changes
+
+- [#132](https://github.com/HerbertGao/pi-extensions/pull/132) [`e873d36`](https://github.com/HerbertGao/pi-extensions/commit/e873d36513deb902028faa0bf095641a57cb2ae4) Thanks [@HerbertGao](https://github.com/HerbertGao)! - Review pi-subagents 0.19.0 and adopt readable bounded-result counts while retaining the unsigned worktree-preservation safeguard that upstream still lacks.
+
 ## 0.17.0
 
 ### Minor Changes

package/node_modules/@herbertgao/pi-subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-subagents",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Claude Code-style autonomous subagents for Pi, with HerbertGao-maintained UI extensions.",
   "keywords": [
     "agent",
@@ -69,6 +69,7 @@
   "x-upstream": {
     "package": "@tintinweb/pi-subagents",
     "version": "0.18.2",
+    "reviewedVersion": "0.19.0",
     "repository": "https://github.com/tintinweb/pi-subagents",
     "commit": "ad81024825b315577692b785831262874e66be95"
   }

package/node_modules/@herbertgao/pi-subagents/src/ui/conversation-viewer.ts

@@ -156,8 +156,15 @@ function capResult(text: string): { text: string; elided: number } {
   }
 }
 
+function humanCount(count: number): string {
+  if (count < 1_000) return `${count}`
+  const thousands = count < 999_950
+  const value = thousands ? count / 1_000 : count / 1_000_000
+  return `${value.toFixed(1).replace(/\.0$/, "")}${thousands ? "k" : "M"}`
+}
+
 function truncationNote(elided: number): string {
-  return `... (truncated, ${elided} more character${elided === 1 ? "" : "s"})`
+  return `... (truncated, ${humanCount(elided)} more character${elided === 1 ? "" : "s"})`
 }
 
 export class ConversationViewer implements Component {

package/node_modules/@tifan/pi-preferred-thinking/README.md

@@ -41,7 +41,7 @@ The extension requires `enabledModels` to exist before it can save a pin. If
 the selected model is not listed, it adds an exact entry without removing other
 models or patterns.
 
-The old `~/.config/pi/extensions/pi-preferred-thinking.json` file is no longer
+The old `$PI_CODING_AGENT_DIR/extensions/pi-preferred-thinking.json` file is no longer
 read. Existing users must move preferences to `enabledModels` or set them with
 `/preferred-thinking`.
 

package/node_modules/@tifan/pi-preferred-thinking/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tifan/pi-preferred-thinking",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Set and apply per-model thinking levels from Pi's native settings.",
   "keywords": [
     "pi",

package/node_modules/@tifan/pi-preferred-thinking/src/index.ts

@@ -138,6 +138,15 @@ function showHint(ctx: ExtensionContext, modelKey: string): void {
   }, HINT_DURATION_MS)
 }
 
+function hasExplicitSubagentThinking(): boolean {
+  return (
+    Boolean(process.env["PI_SUBAGENT_ID"]) &&
+    process.argv.some(
+      (arg) => arg === "--thinking" || arg.startsWith("--thinking="),
+    )
+  )
+}
+
 function applyPreferredThinking(
   pi: ExtensionAPI,
   ctx: ExtensionContext,
@@ -210,11 +219,15 @@ export default function (pi: ExtensionAPI): void {
 
   pi.on("session_start", async (_event, ctx) => {
     nudgedModels.clear()
-    if (ctx.model) applyPreferredThinking(pi, ctx, ctx.model)
+    if (ctx.model && !hasExplicitSubagentThinking()) {
+      applyPreferredThinking(pi, ctx, ctx.model)
+    }
   })
 
   pi.on("model_select", async (event, ctx) => {
-    applyPreferredThinking(pi, ctx, event.model)
+    if (!hasExplicitSubagentThinking()) {
+      applyPreferredThinking(pi, ctx, event.model)
+    }
   })
 
   pi.on("session_shutdown", async (_event, ctx) => {

package/node_modules/pi-mcp-adapter/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.30.0] - 2026-08-28
+
+### Highlights
+- Other extensions can safely inspect one runtime MCP server without seeing the whole MCP config.
+- OAuth setup works better with providers that publish authorization metadata at a custom URL.
+- MCP tool names are safer for providers, including servers with non-ASCII names.
+- Token CLI commands and Windows request-header cleanup are less fragile in installed packages and long-running sessions.
+
+### Added
+
+- Added a fail-closed API for child extensions to inspect one selected runtime MCP server without exporting configured servers or persisting the registration. (#453)
+- Added `oauth.authServerMetadataUrl` for servers whose authorization-server metadata cannot be discovered through MCP protected-resource metadata. Thanks to [@fmoda3](https://github.com/fmoda3) for #458.
+
+### Fixed
+
+- Namespace proxy tool names now use provider-safe characters without making encoded-looking server names collide with non-ASCII server names. Thanks to [@nyankosama](https://github.com/nyankosama) for PR #463.
+- npm-installed token CLI commands now load their credential, config, and utility helpers from the published JavaScript build instead of package-local TypeScript files. Thanks to [@Qhilm](https://github.com/Qhilm) for #456.
+- Server-scoped MCP calls now resolve raw upstream tool names before normalized fallbacks without weakening ambiguity checks. Thanks to [@MikeLP](https://github.com/MikeLP) for #452.
+- Windows request-header command cleanup now treats an already-exited process (`taskkill` exit code 128) as successful cleanup. Thanks to [@peterxcx](https://github.com/peterxcx) for #457.
+
 ## [2.29.0] - 2026-08-26
 
 ### Highlights

package/node_modules/pi-mcp-adapter/README.md

@@ -276,6 +276,7 @@ In the configuration examples below, `30000` is illustrative only. If `requestTi
 | `oauth.clientName` | Client display name advertised during Dynamic Client Registration fallback |
 | `oauth.clientUri` | Client homepage URI advertised during Dynamic Client Registration fallback. Defaults to `piConfig.clientUri` from the host's manifest when set, and is omitted rather than guessed under a rebranded host |
 | `oauth.logoUri` | Client logo URL advertised during Dynamic Client Registration fallback (RFC 7591 `logo_uri`). Must be an absolute `http(s)` URL — consent screens fetch it server-side, so local paths render nothing. Omitted from the registration request when unset |
+| `oauth.authServerMetadataUrl` | HTTPS URL of an OAuth/OIDC authorization-server metadata document. When set, this document is authoritative instead of MCP protected-resource discovery; its issuer remains validated by default |
 | `oauth.skipIssuerMetadataValidation` | `true` disables the OAuth authorization-server metadata issuer check for this server. This weakens OAuth mix-up protection and should only be used for known-misconfigured internal servers while their metadata is being fixed. |
 | `bearerToken` / `bearerTokenEnv` | Token or env var name; `bearerToken` supports `${VAR}` and `$env:VAR` interpolation. A leading `!` in `bearerToken` runs a command when the HTTP server connects; use `!!` for a literal leading `!`. |
 | `bearerTokenStore` | Set to `true` to read a static bearer token from the adapter-owned OS credential store when `auth` is `"bearer"` and no `bearerToken` or `bearerTokenEnv` is configured. Stored records are keyed only by the server name, bind to the resolved server URL, and are never named by config. Store a token with `pi-mcp-adapter token set <server>`, which reads it from a masked prompt or stdin pipe and never from an argument. `/mcp token status <server>` and `/mcp token remove <server>` manage non-secret state inside Pi; `/mcp token set` stays disabled until Pi exposes masked secret input. |
@@ -307,6 +308,8 @@ For pre-registered browser OAuth clients, set `oauth.redirectUri` to the exact c
 
 If an internal authorization server publishes mismatched OAuth metadata and cannot be fixed immediately, set `oauth.skipIssuerMetadataValidation: true` on that server only. This is security-weakening. It disables the RFC 8414 issuer echo check and should not be used for public or untrusted servers.
 
+If an MCP server does not publish usable protected-resource metadata, set `oauth.authServerMetadataUrl` to its HTTPS OAuth/OIDC authorization-server metadata document. The configured document is used authoritatively, while issuer validation remains enabled by default. This is trusted configuration; use it only for a metadata endpoint you control or explicitly trust.
+
 Secret values in `headers`, `bearerToken`, `oauth.clientSecret`, and stdio `env` may use a leading `!command` to obtain their value at connection or authentication time. The command runs with stdin and stderr suppressed, stdout is limited to 1 MiB and trimmed, and it must finish within 10 seconds with non-empty output; failures stop the connection or authentication flow. Commands are not run during OAuth discovery or while reading, merging, previewing, hashing, or rendering configuration. Use `!!` to escape a literal leading `!`; ordinary and escaped values retain environment interpolation.
 
 For local desktop bearer tokens, `bearerTokenStore: true` can opt in to the adapter-owned credential-store namespace. It never falls back to plaintext if the store is unavailable, if the stored record is malformed, or if the stored URL differs from the effective server URL. Literal tokens, command tokens, and environment tokens keep precedence so existing configs do not change. Create or rotate a stored token with `pi-mcp-adapter token set <server>` (masked prompt on a terminal, or piped stdin such as `security find-generic-password -s my-token -w | pi-mcp-adapter token set <server>`); the record binds to the effective configured URL at write time. Token commands need Node 22.18+.

package/node_modules/pi-mcp-adapter/cli.js

@@ -202,13 +202,13 @@ async function runInit(argv, log = console.log) {
 async function importTokenModules(error) {
   try {
     const [store, config, utils] = await Promise.all([
-      import("./mcp-bearer-store.ts"),
-      import("./config.ts"),
-      import("./utils.ts"),
+      import("./dist/mcp-bearer-store.js"),
+      import("./dist/config.js"),
+      import("./dist/utils.js"),
     ]);
     return { store, config, utils };
   } catch (err) {
-    error("Token commands need a Node.js version that can load TypeScript modules (Node 22.18+ or 23+).");
+    error("Unable to load token command modules.");
     error(`Import failed: ${err instanceof Error ? err.message : String(err)}`);
     return undefined;
   }

package/node_modules/pi-mcp-adapter/config.ts

@@ -845,6 +845,7 @@ function extractServers(config: unknown, kind: ImportKind): Record<string, Serve
             ...(typeof oauth.clientId === "string" ? { clientId: oauth.clientId } : {}),
             ...(typeof oauth.clientSecret === "string" ? { clientSecret: oauth.clientSecret } : {}),
             ...(typeof oauth.scope === "string" ? { scope: oauth.scope } : {}),
+            ...(typeof oauth.authServerMetadataUrl === "string" ? { authServerMetadataUrl: oauth.authServerMetadataUrl } : {}),
             ...(typeof oauth.skipIssuerMetadataValidation === "boolean"
               ? { skipIssuerMetadataValidation: oauth.skipIssuerMetadataValidation }
               : {}),

package/node_modules/pi-mcp-adapter/dist/config.js

@@ -693,6 +693,7 @@ function extractServers(config, kind) {
                         ...(typeof oauth.clientId === "string" ? { clientId: oauth.clientId } : {}),
                         ...(typeof oauth.clientSecret === "string" ? { clientSecret: oauth.clientSecret } : {}),
                         ...(typeof oauth.scope === "string" ? { scope: oauth.scope } : {}),
+                        ...(typeof oauth.authServerMetadataUrl === "string" ? { authServerMetadataUrl: oauth.authServerMetadataUrl } : {}),
                         ...(typeof oauth.skipIssuerMetadataValidation === "boolean"
                             ? { skipIssuerMetadataValidation: oauth.skipIssuerMetadataValidation }
                             : {}),