@herbertgao/pi-extensions 2026.8.13 → 2026.8.15

package/README.md

@@ -8,33 +8,38 @@ Aggregate installer for HerbertGao-maintained Pi extensions and pinned upstream
 pi install npm:@herbertgao/pi-extensions
 ```
 
-Requires Node.js 24 or newer.
+Requires Node.js 24 or newer and Pi 0.84.4 or newer.
 
-The package bundles 4 active `@herbertgao/*` child packages—`pi-cc-extensions`, `resume-from`, `pi-stash`, and `pi-subagents`—plus the following upstream packages under their original names:
+The package bundles 4 active `@herbertgao/*` child packages—`pi-bark`, `pi-cc-extensions`, `resume-from`, and `pi-subagents`—plus the following upstream packages under their original names:
 
 - `@dietrichgebert/ponytail@4.9.0`
-- `@juicesharp/rpiv-ask-user-question@2.7.1`
+- `@juicesharp/rpiv-ask-user-question@2.8.0`
 - `@luxusai/pi-hindsight@0.12.0`
-- `@narumitw/pi-btw@0.55.4`
+- `@narumitw/pi-btw@0.56.0`
 - `@pi-plugins/fast-mode@0.1.10`
 - `@tifan/pi-copy-response@0.2.6`
-- `@tifan/pi-handoff@2.0.1`
+- `@tifan/pi-handoff@2.2.0`
 - `@tifan/pi-inline-skills@1.0.5`
 - `@tifan/pi-mermaid-open@0.2.0`
-- `@tifan/pi-preferred-thinking@1.0.0`
-- `@tifan/pi-recap@0.4.5`
-- `@tifan/pi-rename@0.5.1`
-- `@tifan/pi-titlebar-spinner@0.1.3`
-- `pi-mcp-adapter@2.29.0`
+- `@tifan/pi-preferred-thinking@1.0.1`
+- `@tifan/pi-recap@0.4.6`
+- `@tifan/pi-rename@0.6.0`
+- `pi-mcp-adapter@2.31.0`
 - `pi-footer@0.5.1`
-- `pi-lens@4.1.2`
-- `pi-web-access@0.25.0`
+- `pi-lens@4.1.3`
+- `pi-web-access@0.27.0`
 - `remote-pi@0.7.0`
-- `@czottmann/pi-automode@1.13.0`
+- `@czottmann/pi-automode@1.15.0`
 
 Pi loads their extensions and skills through `node_modules/` paths inside one package root. The upstream companions are pinned and bundled, not forked or renamed.
 
-`@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `pi-lens@4.1.2` improves delayed LSP diagnostics, stale-result cleanup, process cleanup, and snapshot completeness. `pi-automode@1.13.0` parses shell commands before applying policy and migrates legacy configuration safely. `pi-web-access@0.25.0` adds opt-in proxy and cloud-auth providers plus GitHub-aware fetching and a Defuddle extraction fallback.
+### Bark notifications
+
+`@herbertgao/pi-bark` sends localized Bark pushes when a user-facing Pi run fully settles or `@juicesharp/rpiv-ask-user-question` needs an answer. Notifications include emoji-labeled machine/path metadata and support the bundled official Pi badge through Bark's `icon` parameter. Configure it in `$PI_CODING_AGENT_DIR/bark.json` (normally `~/.pi/agent/bark.json`); see the [package README](../pi-bark/README.md). Without a valid endpoint it stays inactive.
+
+`@herbertgao/resume-from@0.2.0` keeps Claude Code sessions associated with their original repository when the active transcript later moves into a nested cwd. `pi-lens@4.1.3` expands language routing and bounds retained diagnostic facts across multi-root sessions. `pi-automode@1.15.0` preserves dynamic providers on legacy registries. `pi-web-access@0.27.0` adds configurable fetch deadlines and answer models plus isolated GitHub clone runtimes. Preferred Thinking 1.0.1 preserves an explicit subagent `--thinking` choice. Deprecated `@tifan/pi-titlebar-spinner` is no longer bundled; Rename remains the single owner of Herdr tab naming.
+
+`pi-stash` is no longer bundled: `/btw` already preserves the main editor draft while handling side questions outside the main conversation. Prior `@herbertgao/pi-stash` releases remain available but are no longer maintained here.
 
 If `pi-footer` was installed separately before upgrading to an aggregate release that includes it, remove the standalone source shown by `pi list` so only the bundled copy loads. For the pinned standalone install used while preparing this integration:
 

package/THIRD_PARTY_NOTICES.md

@@ -9,7 +9,6 @@ The aggregate package bundles the following packages from [tifandotme/pi-extensi
 - `@tifan/pi-preferred-thinking`
 - `@tifan/pi-recap`
 - `@tifan/pi-rename`
-- `@tifan/pi-titlebar-spinner`
 
 They are distributed under the following MIT license:
 

package/node_modules/@czottmann/pi-automode/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project are documented in this file.
 
+## [Unreleased]
+
+## [1.15.0] - 2026-08-28
+
+## Bug fixes
+
+- **OMP 18 classifier compatibility** — Support OMP 18 model registries that lack `complete()` and `getProvider()`. Load the legacy completion API only for these registries. Keep current Pi on its runtime registry path so extension-registered providers remain available. Thanks, @NarryG! (#29)
+
+## [1.14.0] - 2026-08-27
+
+## Bug fixes
+
+- **Classifier stream timeout** — Apply `classifierTimeoutMs` to the full response stream. Provider behavior cannot keep classifier calls pending after the deadline. Parent cancellation remains active. Reject values above the Node.js timer limit. (#30)
+- **OS temp-directory deletes** — Stop hard-denying recursive-delete subtrees under `os.tmpdir()` and `/tmp`. On macOS these resolve into `/private/tmp` and `/private/var/folders`, which matched the `/private` system root and blocked every temp cleanup. Deleting a temp root itself stays blocked. (#31)
+- **Validated temp-root declarations** — Derive the exempt temp roots only from launcher-declared values that stay safe: reject values such as `/`, empty strings, aliases of `HOME`, `/`, or a system root, and ancestors of `HOME`. Without validation, a malformed `TMPDIR` could disable deterministic denials for protected targets, and a broad `permissions.allow` rule could then allow the action without classifier review. Recompute candidates when the effective tmpdir changes. (#31)
+
 ## [1.13.0] - 2026-08-25
 
 ## New features
@@ -35,5 +51,8 @@ All notable changes to this project are documented in this file.
 - **Project config trust gate** — Ignore `.pi/automode.local.json` and `.pi/automode.json` until Pi trusts the project. Apply the trust gate during startup and config reloads. (#16)
 - **In-memory observability logs** — Write logs to an extension-owned directory (`~/.pi/agent/extensions/pi-automode/logs/`) instead of the launching project directory. Thanks, @HerbertGao! (#13)
 
+[Unreleased]: https://github.com/czottmann/pi-automode/compare/v1.15.0...HEAD
+[1.15.0]: https://github.com/czottmann/pi-automode/compare/v1.14.0...v1.15.0
+[1.14.0]: https://github.com/czottmann/pi-automode/compare/v1.13.0...v1.14.0
 [1.13.0]: https://github.com/czottmann/pi-automode/compare/v1.12.0...v1.13.0
 [1.12.0]: https://github.com/czottmann/pi-automode/compare/v1.11.0...v1.12.0

package/node_modules/@czottmann/pi-automode/README.md

@@ -8,6 +8,10 @@ It is not a sandbox. Extensions run in the Pi process. A malicious extension can
 
 Pi-automode does not guard user `!` or `!!` shell commands. It guards only agent tool calls. Use it to reduce unsafe autonomous tool use. Do not use it as an OS security boundary.
 
+## Compatibility
+
+Pi-automode supports Pi and Oh My Pi (OMP) 18. It automatically uses OMP's legacy completion API. The integration needs no OMP-specific configuration.
+
 ## Install
 
 From npm:
@@ -101,7 +105,7 @@ The extension blocks these before any allow or classifier decision:
 - SSH `authorized_keys` writes
 - cron, launch agent, and system service persistence
 - TLS/certificate/auth weakening patterns
-- root, home, and system-path destructive deletes
+- root, home, and system-path destructive deletes. Subtrees of validated launcher-declared temp directories are treated as disposable. Declared roots that alias `HOME`, `/`, or a system root, or that contain `HOME`, are rejected instead.
 - edits to `.pi/automode*`, `.pi` auto-mode files, and this extension's safety-control files
 
 After these checks, pi-automode applies `permissions.allow`. Protected `write` and `edit` targets continue to the classifier.

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/classifier.ts

@@ -84,10 +84,9 @@ async function resolveClassifier(
     };
   }
 
-  const rawComplete: ClassifierCompletionFn = (callModel, context, options) =>
-    ctx.modelRegistry.complete(callModel, context, options);
-  const simpleComplete: ClassifierCompletionFn = (callModel, context, options) =>
-    completeSimpleWithRegistry(ctx, callModel, context, options);
+  const { rawComplete, simpleComplete } = createRegistryCompletionFns(
+    ctx.modelRegistry,
+  );
   const completionPlan = createClassifierCompletionPlan(
     model,
     config.classifierReasoningLevel,
@@ -125,6 +124,70 @@ export type ClassifierCompletionFn = (
   },
 ) => Promise<AssistantMessage>;
 
+type RegistryCompletionApi = {
+  complete?: ClassifierCompletionFn;
+  getProvider?: (provider: string) => {
+    streamSimple: (
+      model: Model<any>,
+      context: { systemPrompt: string; messages: UserMessage[] },
+      options: Parameters<ClassifierCompletionFn>[2],
+    ) => { result: () => Promise<AssistantMessage> };
+  } | undefined;
+};
+type ClassifierCompletionFallbacks = {
+  rawComplete: ClassifierCompletionFn;
+  simpleComplete: ClassifierCompletionFn;
+};
+
+type ClassifierCompletionFallbackLoader =
+  () => Promise<ClassifierCompletionFallbacks>;
+
+// Static import would initialize deprecated compat registries on current Pi;
+// OMP rewrites this literal dynamic import to its native pi-ai module.
+async function loadCompatCompletionFns(): Promise<ClassifierCompletionFallbacks> {
+  const { complete, completeSimple } = await import(
+    "@earendil-works/pi-ai/compat"
+  );
+  return {
+    rawComplete: complete as ClassifierCompletionFn,
+    simpleComplete: completeSimple as ClassifierCompletionFn,
+  };
+}
+
+/**
+ * Prefer the current runtime registry so extension-registered providers remain
+ * visible. Older Pi-family runtimes (including OMP 18) expose neither
+ * `complete` nor `getProvider`; lazily load the compat API they already use.
+ */
+export function createRegistryCompletionFns(
+  registry: RegistryCompletionApi,
+  fallbackLoader: ClassifierCompletionFallbackLoader =
+    loadCompatCompletionFns,
+): ClassifierCompletionFallbacks {
+  let fallbackPromise: Promise<ClassifierCompletionFallbacks> | undefined;
+  const rawComplete: ClassifierCompletionFn =
+    typeof registry.complete === "function"
+      ? (model, context, options) =>
+        registry.complete!.call(registry, model, context, options)
+      : async (model, context, options) =>
+        (await (fallbackPromise ??= fallbackLoader())).rawComplete(
+          model,
+          context,
+          options,
+        );
+  const simpleComplete: ClassifierCompletionFn =
+    typeof registry.getProvider === "function"
+      ? (model, context, options) =>
+        completeSimpleWithRegistry(registry, model, context, options)
+      : async (model, context, options) =>
+        (await (fallbackPromise ??= fallbackLoader())).simpleComplete(
+          model,
+          context,
+          options,
+        );
+  return { rawComplete, simpleComplete };
+}
+
 export type RetryOptions = {
   maxAttempts?: number;
   maxTokens?: number;
@@ -155,19 +218,67 @@ export type ClassifierCompletionPlan = {
   reasoningLevel?: Exclude<EffectiveClassifierReasoningLevel, "off">;
 };
 
+async function completeClassifierAttempt(
+  completeFn: ClassifierCompletionFn,
+  model: Model<any>,
+  prompt: Parameters<ClassifierCompletionFn>[1],
+  parentSignal: AbortSignal | undefined,
+  options: Omit<Parameters<ClassifierCompletionFn>[2], "signal">,
+): Promise<AssistantMessage> {
+  if (options.timeoutMs === undefined) {
+    return completeFn(model, prompt, {
+      ...options,
+      ...(parentSignal === undefined ? {} : { signal: parentSignal }),
+    });
+  }
+
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parentSignal?.reason);
+  if (parentSignal?.aborted) onParentAbort();
+  else parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      const reason = controller.signal.reason;
+      reject(reason instanceof Error ? reason : new Error("Classifier request aborted."));
+    };
+    if (controller.signal.aborted) onAbort();
+    else controller.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  const timer = setTimeout(() => {
+    controller.abort(
+      new Error(`Classifier request timed out after ${options.timeoutMs} ms.`),
+    );
+  }, options.timeoutMs);
+
+  try {
+    return await Promise.race([
+      completeFn(model, prompt, {
+        ...options,
+        signal: controller.signal,
+      }),
+      aborted,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) controller.signal.removeEventListener("abort", onAbort);
+    parentSignal?.removeEventListener("abort", onParentAbort);
+  }
+}
+
 /**
  * Run normalized Pi AI completion through the provider in Pi's runtime registry.
- * This temporary bridge is only valid until Pi exposes
- * `ctx.modelRegistry.completeSimple(...)` natively. Replace this function with
- * that API when the project's minimum supported Pi version includes it.
+ * Callers use this only when the registry exposes `getProvider`; legacy
+ * registries take the compat completion path instead.
  */
 async function completeSimpleWithRegistry(
-  ctx: ExtensionContext,
+  registry: RegistryCompletionApi,
   model: Model<any>,
   context: { systemPrompt: string; messages: UserMessage[] },
   options: Parameters<ClassifierCompletionFn>[2],
 ): Promise<AssistantMessage> {
-  const provider = ctx.modelRegistry.getProvider(model.provider);
+  const provider = registry.getProvider?.(model.provider);
   if (!provider) throw new Error(`Unknown provider: ${model.provider}`);
   return provider.streamSimple(model, context, options).result();
 }
@@ -435,14 +546,15 @@ export async function classifyWithRetry(
     const started = Date.now();
     let response: AssistantMessage;
     try {
-      response = await completeFn(
+      response = await completeClassifierAttempt(
+        completeFn,
         classifier.model,
         prompt,
+        signal,
         {
           apiKey: classifier.apiKey,
           headers: classifier.headers,
           env: classifier.env,
-          signal,
           maxTokens,
           ...(temperature === undefined ? {} : { temperature }),
           ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
@@ -505,7 +617,8 @@ export async function classifyInStages(
   const fastStarted = Date.now();
   let fastResponse: AssistantMessage;
   try {
-    fastResponse = await completeFn(
+    fastResponse = await completeClassifierAttempt(
+      completeFn,
       classifier.model,
       {
         systemPrompt: prompt.systemPrompt,
@@ -515,11 +628,11 @@ export async function classifyInStages(
           stageMessage(CLASSIFIER_FAST_INSTRUCTION),
         ],
       },
+      signal,
       {
         apiKey: classifier.apiKey,
         headers: classifier.headers,
         env: classifier.env,
-        signal,
         // Reasoning and OpenAI-compatible models may consume hidden reasoning,
         // control, and EOS tokens before emitting the required visible digit.
         maxTokens: options.fastClassifierMaxTokens ??

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/config.ts

@@ -22,6 +22,7 @@ import {
   DEFAULT_MAX_USER_TRANSCRIPT_TOKENS,
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
+  MAX_CLASSIFIER_TIMEOUT_MS,
   PI_GLOBAL_SETTINGS,
   PI_LEGACY_GLOBAL_SETTINGS,
   PI_PROJECT_LOCAL_SETTINGS,
@@ -324,10 +325,11 @@ export function validateSettingsFile(
       if (
         hasOwn(autoMode, "classifierTimeoutMs") &&
         (!Number.isInteger(autoMode.classifierTimeoutMs) ||
-          (autoMode.classifierTimeoutMs as number) < 1000)
+          (autoMode.classifierTimeoutMs as number) < 1000 ||
+          (autoMode.classifierTimeoutMs as number) > MAX_CLASSIFIER_TIMEOUT_MS)
       ) {
         diagnostics.push(
-          `${source}: autoMode.classifierTimeoutMs must be an integer of at least 1000`,
+          `${source}: autoMode.classifierTimeoutMs must be an integer from 1000 through ${MAX_CLASSIFIER_TIMEOUT_MS}`,
         );
       }
       if (
@@ -591,7 +593,9 @@ function validFastClassifierBudget(value: unknown): value is number {
 }
 
 function validClassifierTimeout(value: unknown): value is number {
-  return Number.isInteger(value) && Number(value) >= 1000;
+  return Number.isInteger(value) &&
+    Number(value) >= 1000 &&
+    Number(value) <= MAX_CLASSIFIER_TIMEOUT_MS;
 }
 
 function applyAutoModeScalars(

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/constants.ts

@@ -61,6 +61,8 @@ export const DENIAL_HISTORY_LIMIT = 12;
 
 /** Per-request timeout for classifier completions (fast and detailed stages). */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20_000;
+/** Largest timeout that Node can represent without reducing it to 1 ms. */
+export const MAX_CLASSIFIER_TIMEOUT_MS = 2_147_483_647;
 
 /** Built-in trusted environment. Users extend this with `$defaults`. */
 export const DEFAULT_ENVIRONMENT = [

package/node_modules/@czottmann/pi-automode/extensions/auto-mode/hard-deny.ts

@@ -1,4 +1,5 @@
 import { statSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import {
   analyzeBash,
@@ -77,9 +78,115 @@ function matchesPathRoot(path: string, root: string): boolean {
   return isSameExistingPath(path.slice(0, root.length), root);
 }
 
+/**
+ * Top-level directories whose deletion or wholesale modification is a
+ * system-wide event. Shared between candidate validation and path
+ * classification; do not inline copies.
+ */
+const SYSTEM_ROOTS: ReadonlyArray<string> = [
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib64",
+  "/Library",
+  "/private",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/sys",
+  "/System",
+  "/usr",
+  "/var",
+];
+
+/**
+ * Normalize a proposed temp-root value into a comparable absolute path.
+ * Returns undefined for values that cannot denote a subdirectory: the
+ * empty string, `/`, and slash-only artifacts.
+ */
+function normalizeRootCandidate(value: string): string | undefined {
+  const stripped = value.replace(/\/+$/, "");
+  // An empty stripped value must not fall through to `resolve()`, which
+  // would silently turn `/` into the process working directory.
+  if (!stripped) return undefined;
+  const normalized = resolve(stripped);
+  if (normalized === "/") return undefined;
+  return normalized;
+}
+
+/**
+ * True when a candidate temp root would weaken the deterministic deny tiers:
+ * it aliases (exact, case-folded, or dev/inode) `HOME`, `/`, or any system
+ * root, or it is a proper ancestor of the canonical home directory.
+ *
+ * Dev/inode identity covers symlinked spellings of existing directories;
+ * string comparison alone handles candidates that do not exist yet. See
+ * issue #31: without these guards, `TMPDIR=/` reduced every absolute path
+ * below an empty-string prefix match, and `TMPDIR=/private` made
+ * `/private/etc/**` disposable.
+ */
+function conflictsWithProtectedRoots(candidate: string, home: string): boolean {
+  if (candidate === "/") return true;
+  for (const protectedRoot of ["/", home, ...SYSTEM_ROOTS]) {
+    const canonical = resolve(protectedRoot);
+    if (
+      candidate === canonical ||
+      candidate.toLowerCase() === canonical.toLowerCase()
+    ) {
+      return true;
+    }
+    if (isSameExistingPath(candidate, canonical)) return true;
+  }
+  const homeCanonical = resolvePathForPolicy(home) ?? resolve(home);
+  return homeCanonical.toLowerCase().startsWith(`${candidate.toLowerCase()}/`);
+}
+
+let cachedTempRoots: ReadonlyArray<string> | undefined;
+let cachedTmpdirValue: string | undefined;
+
+/**
+ * Validated launcher-declared temp-dir roots whose subtrees are treated as
+ * disposable by `isRootHomeOrSystemPath`: the platform tmpdir, plus `/tmp` on
+ * macOS where it exists independently of `os.tmpdir()`. Each root appears in
+ * canonical and resolved spelling because callers pass symlink-resolved
+ * policy paths (`/tmp` → `/private/tmp` on macOS) and unresolved fallbacks
+ * alike. Values from `os.tmpdir()` are not trusted blindly; see
+ * `conflictsWithProtectedRoots`. The roots themselves are never exempt:
+ * deleting one is a system-wide delete.
+ *
+ * The memoization keys on the effective `os.tmpdir()` return value so tests
+ * can mutate `TMPDIR`, `TMP`, or `TEMP` between calls.
+ */
+export function tempRootCandidates(): ReadonlyArray<string> {
+  const currentTmpdir = tmpdir();
+  if (cachedTempRoots && cachedTmpdirValue === currentTmpdir) {
+    return cachedTempRoots;
+  }
+  cachedTmpdirValue = currentTmpdir;
+  cachedTempRoots = (() => {
+    const roots = new Set<string>();
+    const consider = (value: string) => {
+      const candidate = normalizeRootCandidate(value);
+      if (!candidate || conflictsWithProtectedRoots(candidate, HOME)) return;
+      roots.add(candidate);
+      const resolved = resolvePathForPolicy(candidate);
+      if (resolved) roots.add(resolved);
+    };
+    consider(currentTmpdir);
+    if (process.platform === "darwin") consider("/tmp");
+    return [...roots];
+  })();
+  return cachedTempRoots;
+}
+
 /**
  * True for `/`, the user's home root, or a top-level system root such as
- * `/etc`, `/usr`, or `/var`. Excludes the home *subtree*.
+ * `/etc`, `/usr`, or `/var`. Excludes the home *subtree* and the subtrees of
+ * platform temp directories (`os.tmpdir()` and `/tmp` on macOS).
  *
  * On some distros (e.g. Fedora Silverblue) HOME lives under `/var`, which is
  * in `systemRoots`. Without the subtree exemption, `path.startsWith("/var/")`
@@ -87,32 +194,36 @@ function matchesPathRoot(path: string, root: string): boolean {
  * `rm -rf ~/...`. HOME itself is still matched below, so `rm -rf ~` stays
  * blocked. `home` is a parameter so this can be unit-tested with a synthetic
  * `/var/home/...` value.
+ *
+ * The temp exemption mirrors the home one and covers cleanup of directories
+ * created with `mktemp`, `os.tmpdir()`, or plain `/tmp` paths. On macOS these
+ * resolve into `/private/tmp` or `/private/var/folders`, which used to match
+ * the `/private` system root and hard-deny every temp cleanup. Deleting a
+ * temp root itself still returns true; `tempRoots` is injectable for tests.
+ *
+ * Protection order matters (issue #31): exact `/`, the exact home root, and
+ * system roots win over every exemption. Injected `tempRoots` values are
+ * validated per call so hostile or malformed candidates cannot weaken the
+ * deterministic tiers.
  */
-export function isRootHomeOrSystemPath(path: string, home: string): boolean {
-  const systemRoots = [
-    "/bin",
-    "/boot",
-    "/dev",
-    "/etc",
-    "/home",
-    "/lib",
-    "/lib64",
-    "/Library",
-    "/private",
-    "/proc",
-    "/root",
-    "/run",
-    "/sbin",
-    "/sys",
-    "/System",
-    "/usr",
-    "/var",
-  ];
+export function isRootHomeOrSystemPath(
+  path: string,
+  home: string,
+  tempRoots: ReadonlyArray<string> = tempRootCandidates(),
+): boolean {
+  if (path === "/") return true;
+  if (path === home || isSameExistingPath(path, home)) return true;
   if (matchesPathRoot(path, home) && path.length > home.length) return false;
+  for (const root of tempRoots) {
+    const candidate = normalizeRootCandidate(root);
+    if (!candidate || conflictsWithProtectedRoots(candidate, home)) continue;
+    if (!matchesPathRoot(path, candidate)) continue;
+    // Subtree: disposable. Exact match: the temp root stays protected.
+    return path.length > candidate.length ? false : true;
+  }
   return (
-    path === "/" ||
     matchesPathRoot(path, home) ||
-    systemRoots.some((root) => matchesPathRoot(path, root))
+    SYSTEM_ROOTS.some((root) => matchesPathRoot(path, root))
   );
 }
 

package/node_modules/@czottmann/pi-automode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@czottmann/pi-automode",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Claude Code-style auto mode guardrail for pi.",
   "repository": {
     "url": "https://github.com/czottmann/pi-automode"

package/node_modules/@herbertgao/{pi-stash → pi-bark}/LICENSE

@@ -1,6 +1,5 @@
 MIT License
 
-Copyright (c) 2026 Tifan Dwi Avianto
 Copyright (c) 2026 Herbert Gao
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -10,13 +9,13 @@ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@herbertgao/pi-bark/README.md

@@ -0,0 +1,44 @@
+# @herbertgao/pi-bark
+
+Bark notifications for user-facing Pi sessions. It sends a notification when Pi fully settles and when [`@juicesharp/rpiv-ask-user-question`](https://github.com/juicesharp/rpiv-mono) opens a questionnaire. Requests follow Bark's official [POST form API](https://github.com/Finb/Bark/blob/master/docs/en-us/tutorial.md#request-methods).
+
+## Install
+
+```bash
+pi install npm:@herbertgao/pi-bark
+```
+
+The extension is also included in `@herbertgao/pi-extensions`.
+
+## Configure
+
+Create `$PI_CODING_AGENT_DIR/bark.json` (normally `~/.pi/agent/bark.json`):
+
+```json
+{
+  "endpoint": "https://api.day.app/your-device-key",
+  "machine": "MacBook Pro M1 Max",
+  "locale": "zh-CN",
+  "events": {
+    "agentSettled": true,
+    "askUserQuestion": true
+  },
+  "params": {
+    "group": "pi",
+    "icon": "https://raw.githubusercontent.com/HerbertGao/pi-extensions/master/packages/pi-bark/assets/pi-icon.png"
+  },
+  "timeoutMs": 4000
+}
+```
+
+`endpoint` is required. `locale` accepts `auto` (default), `zh-CN`, `zh-TW`, or `en`; unsupported languages fall back to English. `params` accepts additional Bark POST parameters such as `group`, `sound`, `icon`, and `level`; dynamic `title` and `body` values always take precedence. Set `"enabled": false` to disable all notifications without removing the package.
+
+The notification body uses `💻` for the configured machine name and `📁` for Pi's full working directory. Questionnaire text is intentionally not sent because it may contain sensitive context. Only sessions with a user-facing UI notify, so nested `pi-subagents` sessions do not create duplicate pushes.
+
+The bundled [`assets/pi-icon.png`](assets/pi-icon.png) is a 512×512 rasterization of Pi's official [square badge](https://pi.dev/favicon.svg) from the [Pi Press Kit](https://pi.dev/press-kit), suitable for Bark's iOS 15+ `icon` parameter.
+
+Keep `bark.json` private because the endpoint normally contains the Bark device key. Restart Pi or run `/reload` after changing it.
+
+## License
+
+[MIT](LICENSE)