@oh-my-pi/pi-coding-agent 17.0.0 → 17.0.2

package/src/cursor.ts

@@ -18,9 +18,20 @@ import { resolveToCwd } from "./tools/path-utils";
 
 interface CursorExecBridgeOptions {
 	cwd: string;
+	getCwd?: () => string;
 	tools: Map<string, AgentTool>;
+	getTool?: (name: string) => AgentTool | undefined;
 	getToolContext?: () => AgentToolContext | undefined;
 	emitEvent?: (event: AgentEvent) => void;
+	/**
+	 * Whether the Cursor native `delete` frame may remove files. Unlike every
+	 * other exec handler, `executeDelete` mutates the filesystem directly instead
+	 * of consulting {@link tools}, so a background read-only advisor could delete
+	 * workspace files it was never granted a mutating tool for (issue #5680
+	 * review). Defaults to allowed to preserve the primary agent's behavior;
+	 * callers with a restricted tool set (advisors) opt out.
+	 */
+	allowNativeDelete?: boolean;
 }
 
 function createToolResultMessage(
@@ -53,7 +64,7 @@ async function executeTool(
 	toolCallId: string,
 	args: Record<string, unknown>,
 ): Promise<ToolResultMessage> {
-	const tool = options.tools.get(toolName);
+	const tool = options.tools.get(toolName) ?? options.getTool?.(toolName);
 	if (!tool) {
 		const result = buildToolErrorResult(`Tool "${toolName}" not available`);
 		return createToolResultMessage(toolCallId, toolName, result, true);
@@ -106,9 +117,15 @@ async function executeTool(
 
 async function executeDelete(options: CursorExecBridgeOptions, pathArg: string, toolCallId: string) {
 	const toolName = "delete";
+
+	if (options.allowNativeDelete === false) {
+		const result = buildToolErrorResult(`Tool "${toolName}" not available`);
+		return createToolResultMessage(toolCallId, toolName, result, true);
+	}
+
 	options.emitEvent?.({ type: "tool_execution_start", toolCallId, toolName, args: { path: pathArg } });
 
-	const absolutePath = resolveToCwd(pathArg, options.cwd);
+	const absolutePath = resolveToCwd(pathArg, options.getCwd?.() ?? options.cwd);
 	let isError = false;
 	let result: AgentToolResult<unknown>;
 
@@ -327,7 +344,7 @@ export class CursorExecHandlers implements ICursorExecHandlers {
 	async mcp(call: CursorMcpCall) {
 		const toolName = call.toolName || call.name;
 		const toolCallId = decodeToolCallId(call.toolCallId);
-		const tool = this.options.tools.get(toolName);
+		const tool = this.options.tools.get(toolName) ?? this.options.getTool?.(toolName);
 		if (!tool) {
 			const availableTools = Array.from(this.options.tools.keys()).filter(name => name.startsWith("mcp__"));
 			const message = formatMcpToolErrorMessage(toolName, availableTools);

package/src/debug/report-bundle.ts

@@ -105,9 +105,10 @@ export async function createReportBundle(options: ReportBundleOptions): Promise<
 		files.push("config.json");
 	}
 
-	// Recent logs (last 1000 lines)
-	const logPath = getLogPath();
-	const logs = await readLastLines(logPath, 1000);
+	// Recent logs (last 1000 lines) across every same-day process. PID-qualified
+	// filenames mean a report generated from a later invocation must still gather
+	// the crashed process's log, so read all of today's files, not just our own.
+	const logs = await collectSameDayLogs(1000);
 	if (logs) {
 		data["logs.txt"] = logs;
 		files.push("logs.txt");
@@ -241,7 +242,42 @@ export async function getLogText(): Promise<string> {
 	return readLastLines(getLogPath(), MAX_LOG_LINES);
 }
 
-const LOG_FILE_PATTERN = new RegExp(`^${APP_NAME}\\.(\\d{4}-\\d{2}-\\d{2})\\.log$`);
+/**
+ * Concatenate the tail of every same-day process log so a report generated
+ * after a crash still captures the fatal PID's `omp.<date>.<pid>.log`. Files
+ * are ordered oldest-first by mtime and separated by a filename header.
+ */
+async function collectSameDayLogs(linesPerFile: number): Promise<string> {
+	const logsDir = getLogsDir();
+	const today = new Date().toISOString().slice(0, 10);
+	const sameDay: Array<{ name: string; mtimeMs: number }> = [];
+	try {
+		const entries = await fs.readdir(logsDir, { withFileTypes: true });
+		for (const entry of entries) {
+			if (!entry.isFile()) continue;
+			const match = LOG_FILE_PATTERN.exec(entry.name);
+			if (!match || match[1] !== today) continue;
+			try {
+				const stat = await fs.stat(path.join(logsDir, entry.name));
+				sameDay.push({ name: entry.name, mtimeMs: stat.mtimeMs });
+			} catch {
+				// File may have rotated away between readdir and stat.
+			}
+		}
+	} catch {
+		return "";
+	}
+	sameDay.sort((a, b) => a.mtimeMs - b.mtimeMs);
+
+	const chunks: string[] = [];
+	for (const { name } of sameDay) {
+		const text = await readLastLines(path.join(logsDir, name), linesPerFile);
+		if (text) chunks.push(`===== ${name} =====\n${text}`);
+	}
+	return chunks.join("\n\n");
+}
+
+const LOG_FILE_PATTERN = new RegExp(`^${APP_NAME}\\.(\\d{4}-\\d{2}-\\d{2})\\.\\d+\\.log(?:\\.\\d+)?$`);
 
 export async function createDebugLogSource(): Promise<DebugLogSource> {
 	const logsDir = getLogsDir();

package/src/discovery/codex.ts

@@ -37,6 +37,7 @@ import {
 	SOURCE_PATHS,
 	scanSkillsFromDir,
 } from "./helpers";
+import { resolvePluginStdioPaths } from "./substitute-plugin-root";
 
 const PROVIDER_ID = "codex";
 const DISPLAY_NAME = "OpenAI Codex";
@@ -87,7 +88,7 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 
 	const items: MCPServer[] = [];
 	if (userConfig) {
-		const servers = extractMCPServersFromToml(userConfig);
+		const servers = extractMCPServersFromToml(userConfig, path.dirname(userConfigPath));
 		for (const [name, config] of Object.entries(servers)) {
 			items.push({
 				name,
@@ -97,7 +98,7 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 		}
 	}
 	if (projectConfig) {
-		const servers = extractMCPServersFromToml(projectConfig);
+		const servers = extractMCPServersFromToml(projectConfig, path.dirname(projectConfigPath));
 		for (const [name, config] of Object.entries(servers)) {
 			items.push({
 				name,
@@ -139,7 +140,10 @@ interface CodexMCPConfig {
 	disabled_tools?: string[];
 }
 
-function extractMCPServersFromToml(toml: Record<string, unknown>): Record<string, Partial<MCPServer>> {
+function extractMCPServersFromToml(
+	toml: Record<string, unknown>,
+	configDir: string,
+): Record<string, Partial<MCPServer>> {
 	// Check for [mcp_servers.*] sections (Codex format)
 	if (!toml.mcp_servers || typeof toml.mcp_servers !== "object") {
 		return {};
@@ -149,10 +153,16 @@ function extractMCPServersFromToml(toml: Record<string, unknown>): Record<string
 	const result: Record<string, Partial<MCPServer>> = {};
 
 	for (const [name, config] of Object.entries(codexServers)) {
+		// Root relative cwd/command against the Codex config directory. Codex
+		// spawns the process with the resolved cwd, so a relative command is
+		// resolved by the OS from there — pass "cwd" so e.g. cwd="server",
+		// command="./bin/mcp" resolves to <configDir>/server/bin/mcp.
+		const rooted = resolvePluginStdioPaths({ command: config.command, cwd: config.cwd }, configDir, "cwd");
 		const server: Partial<MCPServer> = {
-			command: config.command,
+			...(rooted.command !== undefined && { command: rooted.command }),
 			args: config.args,
 			url: config.url,
+			...(rooted.cwd !== undefined && { cwd: rooted.cwd }),
 		};
 
 		// Build env by merging explicit env and forwarded env_vars

package/src/discovery/helpers.ts

@@ -741,13 +741,16 @@ export function buildExtensionModuleItems(
  * Entry for an installed Claude Code plugin.
  */
 export interface ClaudePluginEntry {
-	scope: "user" | "project";
+	/** Claude registry scope; local entries are restricted to their project path. */
+	scope?: "user" | "project" | "local";
 	installPath: string;
 	version: string;
 	installedAt: string;
 	lastUpdated: string;
 	gitCommitSha?: string;
 	enabled?: boolean;
+	/** Project root recorded by Claude for a local installation. */
+	projectPath?: string;
 }
 
 /**
@@ -862,6 +865,14 @@ export async function resolveOrDefaultProjectRegistryPath(cwd: string): Promise<
 	return path.join(cwd, getConfigDirName(), "plugins", "installed_plugins.json");
 }
 
+async function canonicalClaudeProjectPath(projectPath: string): Promise<string | null> {
+	try {
+		return await fs.promises.realpath(path.resolve(projectPath));
+	} catch {
+		return null;
+	}
+}
+
 const pluginRootsCache = new Map<string, { roots: ClaudePluginRoot[]; warnings: string[] }>();
 
 const pluginCacheInvalidators = new Set<() => void>();
@@ -876,20 +887,23 @@ export function registerPluginCacheInvalidator(invalidator: () => void): void {
  * Reads ~/.claude/plugins/installed_plugins.json and ~/.omp/plugins/installed_plugins.json,
  * and optionally the nearest project-scoped registry resolved from `cwd`.
  *
- * Results are cached per `home:resolvedProjectPath` key to avoid repeated parsing.
+ * Results are cached per home, project registry, and canonical active project.
  */
 export async function listClaudePluginRoots(
 	home: string,
 	cwd?: string,
 ): Promise<{ roots: ClaudePluginRoot[]; warnings: string[] }> {
 	const resolvedProjectPath = cwd ? await resolveActiveProjectRegistryPath(cwd) : null;
-	const cacheKey = `${home}:${resolvedProjectPath ?? ""}`;
+	const projectRoot = resolvedProjectPath ? path.dirname(path.dirname(path.dirname(resolvedProjectPath))) : cwd;
+	const activeClaudeProjectPath = projectRoot ? await canonicalClaudeProjectPath(projectRoot) : null;
+	const cacheKey = `${home}:${resolvedProjectPath ?? ""}:${activeClaudeProjectPath ?? ""}`;
 	const cached = pluginRootsCache.get(cacheKey);
 	if (cached) return cached;
 
 	const roots: ClaudePluginRoot[] = [];
 	const warnings: string[] = [];
 	const projectRoots: ClaudePluginRoot[] = [];
+	const canonicalClaudeProjectPaths = new Map<string, string | null>();
 
 	// ── Claude Code registry ──────────────────────────────────────────────────
 	const registryPath = path.join(home, ".claude", "plugins", "installed_plugins.json");
@@ -921,6 +935,15 @@ export async function listClaudePluginRoots(
 						continue;
 					}
 					if (entry.enabled === false) continue;
+					if (entry.scope === "local") {
+						if (!entry.projectPath || !activeClaudeProjectPath) continue;
+						let entryProjectPath = canonicalClaudeProjectPaths.get(entry.projectPath);
+						if (entryProjectPath === undefined) {
+							entryProjectPath = await canonicalClaudeProjectPath(entry.projectPath);
+							canonicalClaudeProjectPaths.set(entry.projectPath, entryProjectPath);
+						}
+						if (entryProjectPath !== activeClaudeProjectPath) continue;
+					}
 
 					roots.push({
 						id: pluginId,
@@ -928,7 +951,7 @@ export async function listClaudePluginRoots(
 						plugin: pluginName,
 						version: entry.version || "unknown",
 						path: entry.installPath,
-						scope: entry.scope || "user",
+						scope: entry.scope === "local" ? "project" : entry.scope || "user",
 					});
 				}
 			}
@@ -976,7 +999,7 @@ export async function listClaudePluginRoots(
 						plugin: pluginName,
 						version: entry.version || "unknown",
 						path: entry.installPath,
-						scope: entry.scope || "user",
+						scope: entry.scope === "local" ? "project" : entry.scope || "user",
 					});
 				}
 			}

package/src/discovery/substitute-plugin-root.ts

@@ -31,23 +31,38 @@ export function substitutePluginRoot<T>(value: T, rootPath: string): T {
 }
 
 /**
- * Rebase relative filesystem values in a discovered plugin stdio config against
- * the directory of the `.mcp.json` that declared them.
+ * Where a relative, path-like `command` is rooted by {@link resolvePluginStdioPaths}.
  *
- * External plugin configs (bundled ChatGPT/Codex plugins, Claude marketplace
- * plugins) express `command`/`cwd` relative to their own config file, but MCP
- * stdio spawning roots relative values at the session cwd — so a plugin shipping
+ * - `"config-dir"` (default): the directory of the config file that declared the
+ *   server — the plugin package root for `.mcp.json`. A plugin can ship its
+ *   executable at the package root (`command: "./bin/server"`) yet run from a
+ *   data subdir (`cwd: "work"`); the command stays `<pkg>/bin/server`.
+ * - `"cwd"`: the rooted `cwd`, falling back to the config dir when no `cwd` is
+ *   set. This matches how the OS resolves a relative command against the
+ *   subprocess's working directory, which is the Codex `config.toml` contract:
+ *   `cwd = "server"`, `command = "./bin/mcp"` → `<configDir>/server/bin/mcp`.
+ */
+export type StdioCommandBase = "config-dir" | "cwd";
+
+/**
+ * Rebase relative filesystem values in a discovered stdio server config against
+ * the directory of the config file (`.mcp.json`/`config.toml`) that declared them.
+ *
+ * External configs (bundled ChatGPT/Codex plugins, Claude marketplace plugins)
+ * express `command`/`cwd` relative to their own config file, but MCP stdio
+ * spawning roots relative values at the session cwd — so a server shipping
  * `command: "./bin/server"`, `cwd: "."` launches from the wrong directory and
  * fails with ENOENT. This resolves those against `configDir` instead:
  *
  * - relative `cwd` → resolved against `configDir`;
  * - path-like `command` (`./`, `../`, or the Windows `.\`/`..\` forms) →
- *   resolved against `configDir`;
+ *   resolved against the base selected by `commandBase` (see {@link StdioCommandBase});
  * - bare executables (`npx`, `uvx`, …) and absolute paths are left untouched.
  */
 export function resolvePluginStdioPaths(
 	config: { command?: string; cwd?: string },
 	configDir: string,
+	commandBase: StdioCommandBase = "config-dir",
 ): { command?: string; cwd?: string } {
 	const resolved: { command?: string; cwd?: string } = {};
 	if (typeof config.cwd === "string") {
@@ -55,7 +70,8 @@ export function resolvePluginStdioPaths(
 	}
 	if (config.command !== undefined) {
 		const isPathLike = /^\.\.?[/\\]/.test(config.command);
-		resolved.command = isPathLike ? path.resolve(configDir, config.command) : config.command;
+		const base = commandBase === "cwd" ? (resolved.cwd ?? configDir) : configDir;
+		resolved.command = isPathLike ? path.resolve(base, config.command) : config.command;
 	}
 	return resolved;
 }

package/src/exec/bash-executor.ts

@@ -45,6 +45,8 @@ export interface BashResult {
 	output: string;
 	exitCode: number | undefined;
 	cancelled: boolean;
+	/** True when the command was killed by its timeout deadline (not a user abort). */
+	timedOut?: boolean;
 	truncated: boolean;
 	totalLines: number;
 	totalBytes: number;
@@ -70,6 +72,9 @@ const shellSessionsInUse = new Set<string>();
  */
 const retainedShells = new Set<Shell>();
 const RETAIN_REAP_INTERVAL_MS = 5_000;
+// Native cancellation may spend two seconds unwinding the shell before its
+// N-API chunk bridge drains. The JS watchdog must not race that teardown.
+const NATIVE_TIMEOUT_FALLBACK_GRACE_MS = 5_000;
 
 async function retainShellWithLiveBackgroundJobs(shell: Shell): Promise<void> {
 	let live: number;
@@ -306,16 +311,18 @@ export async function executeBash(command: string, options?: BashExecutorOptions
 	const nativeTimeoutMs = requestedTimeoutMs !== undefined && requestedTimeoutMs > 0 ? requestedTimeoutMs : undefined;
 	const nativeOwnsTimeout = nativeTimeoutMs !== undefined;
 	if (deadlineTimeoutMs !== undefined) {
+		const fallbackTimeoutMs = nativeOwnsTimeout
+			? deadlineTimeoutMs + NATIVE_TIMEOUT_FALLBACK_GRACE_MS
+			: deadlineTimeoutMs;
 		timeoutTimer = setTimeout(() => {
-			// Explicit timeouts are already enforced inside pi-natives via
-			// `timeoutMs`. Do not also abort the JS AbortSignal here: on Windows,
-			// aborting that signal while a piped command is still forwarding output
-			// can terminate the Bun host before the native timeout result resolves.
+			// Explicit timeouts are enforced inside pi-natives via `timeoutMs`.
+			// Give native cancellation time to flush pipeline output and drain the
+			// N-API bridge before this result-only watchdog quarantines the run.
 			if (!nativeOwnsTimeout) {
 				abortCurrentExecution();
 			}
 			timeoutDeferred.resolve("timeout");
-		}, deadlineTimeoutMs);
+		}, fallbackTimeoutMs);
 	}
 
 	let resetSession = false;
@@ -357,6 +364,7 @@ export async function executeBash(command: string, options?: BashExecutorOptions
 			return {
 				exitCode: undefined,
 				cancelled: true,
+				...(winner.kind === "timeout" ? { timedOut: true } : {}),
 				...(await sink.dump(
 					winner.kind === "timeout" && deadlineTimeoutMs !== undefined
 						? `Command timed out after ${Math.round(deadlineTimeoutMs / 1000)} seconds`
@@ -381,6 +389,7 @@ export async function executeBash(command: string, options?: BashExecutorOptions
 			return {
 				exitCode: undefined,
 				cancelled: true,
+				timedOut: true,
 				...(await sink.dump(annotation)),
 			};
 		}

package/src/export/html/template.js

@@ -1082,6 +1082,8 @@
                   <div class="thinking-text">${escapeHtml(thinking)}</div>
                   <div class="thinking-collapsed">Thinking ...</div>
                 </div>`;
+              } else if (block.type === 'image') {
+                html += `<div class="message-images"><img src="data:${block.mimeType};base64,${block.data}" class="message-image" /></div>`;
               }
             }
             for (const block of msg.content) {

package/src/extensibility/custom-tools/loader.ts

@@ -18,7 +18,7 @@ import { getAllPluginToolPaths } from "../../extensibility/plugins/loader";
 // Runtime self-reference: dereference this namespace only inside loader functions to keep the index.ts cycle safe.
 import * as PiCodingAgent from "../../index";
 import * as typebox from "../typebox";
-import { createNoOpUIContext, resolvePath, withExitGuard } from "../utils";
+import { createNoOpUIContext, resolvePath, withHostGuard } from "../utils";
 import type { CustomToolAPI, CustomToolFactory, LoadedCustomTool, ToolLoadError } from "./types";
 
 interface LoadToolResult {
@@ -75,14 +75,14 @@ async function loadTool(
 	}
 
 	try {
-		const module = await withExitGuard(() => import(resolvedPath));
+		const module = await withHostGuard(() => import(resolvedPath));
 		const factory = (module.default ?? module) as CustomToolFactory;
 
 		if (typeof factory !== "function") {
 			return { tools: [], errors: [{ path: toolPath, error: "Tool must export a default function", source }] };
 		}
 
-		const toolResult: unknown = await withExitGuard(async () => factory(sharedApi));
+		const toolResult: unknown = await withHostGuard(async () => factory(sharedApi));
 		const toolsArray = Array.isArray(toolResult) ? toolResult : [toolResult];
 
 		const loadedTools: LoadedCustomTool[] = [];

package/src/extensibility/custom-tools/wrapper.ts

@@ -4,6 +4,7 @@
 import type { AgentTool, AgentToolUpdateCallback, ToolLoadMode } from "@oh-my-pi/pi-agent-core";
 import type { Static, TSchema } from "@oh-my-pi/pi-ai";
 import type { Theme } from "../../modes/theme/theme";
+import { defaultLoadModeForToolName } from "../../tools/essential-tools";
 import { applyToolProxy } from "../tool-proxy";
 import type { CustomTool, CustomToolContext } from "./types";
 
@@ -23,7 +24,7 @@ export class CustomToolAdapter<TParams extends TSchema = TSchema, TDetails = any
 	) {
 		applyToolProxy(tool, this);
 		this.strict = tool.strict;
-		this.loadMode = tool.loadMode ?? "discoverable";
+		this.loadMode = defaultLoadModeForToolName(tool.name, tool.loadMode);
 	}
 
 	execute(

package/src/extensibility/extensions/loader.ts

@@ -24,7 +24,7 @@ import { installLegacyPiSpecifierShim, loadLegacyPiModule } from "../plugins/leg
 import { getAllPluginExtensionPaths } from "../plugins/loader";
 import * as TypeBox from "../typebox";
 
-import { resolvePath, withExitGuard } from "../utils";
+import { resolvePath, withHostGuard } from "../utils";
 import type {
 	AssistantThinkingRenderer,
 	Extension,
@@ -290,7 +290,7 @@ async function loadExtension(
 ): Promise<{ extension: Extension | null; error: string | null }> {
 	const resolvedPath = resolvePath(extensionPath, cwd);
 	try {
-		const module = (await withExitGuard(() => loadLegacyPiModule(resolvedPath))) as LoadedExtensionModule;
+		const module = (await withHostGuard(() => loadLegacyPiModule(resolvedPath))) as LoadedExtensionModule;
 		const factory = getExtensionFactory(module);
 
 		if (typeof factory !== "function") {
@@ -302,7 +302,7 @@ async function loadExtension(
 
 		const extension = createExtension(extensionPath, resolvedPath);
 		const api = new ConcreteExtensionAPI(PiCodingAgent, extension, runtime, cwd, eventBus);
-		await withExitGuard(async () => {
+		await withHostGuard(async () => {
 			await factory(api);
 		});
 

package/src/extensibility/extensions/managed-timers.ts

@@ -0,0 +1,83 @@
+/**
+ * Managed timers for extensions.
+ *
+ * Extensions scheduling their own background work through raw `setInterval` /
+ * `setTimeout` used to be able to take down the whole session: a throw inside
+ * the callback runs on a fresh stack outside the handler-dispatch try/catch,
+ * surfaces as a process-level `uncaughtException`, and the global postmortem
+ * handler treats that as fatal (issue #5664).
+ *
+ * {@link ManagedTimers} backs the sanctioned `ctx.setInterval` /
+ * `ctx.setTimeout` helpers. Each callback runs inside the same isolation the
+ * runner already applies to handler dispatch — a synchronous throw or a
+ * rejected promise is reported through `onError` and swallowed — and every
+ * outstanding handle is `unref`'d (never keeps the process alive) and cleared
+ * on session teardown via {@link clearAll}.
+ */
+import { logger } from "@oh-my-pi/pi-utils";
+
+/** Callback invoked when a managed timer's callback throws or rejects. */
+export type ManagedTimerErrorHandler = (event: string, error: string, stack?: string) => void;
+
+export class ManagedTimers {
+	readonly #timers = new Set<Timer>();
+
+	constructor(private readonly onError: ManagedTimerErrorHandler) {}
+
+	/** Schedule a repeating callback whose throws are contained. */
+	setInterval(callback: (...args: unknown[]) => void, ms?: number, ...args: unknown[]): Timer {
+		const timer = setInterval(() => this.#run("interval", callback, args), ms, ...args);
+		timer.unref?.();
+		this.#timers.add(timer);
+		return timer;
+	}
+
+	/** Schedule a one-shot callback whose throws are contained. Deregisters after it fires. */
+	setTimeout(callback: (...args: unknown[]) => void, ms?: number, ...args: unknown[]): Timer {
+		const timer = setTimeout(
+			() => {
+				this.#timers.delete(timer);
+				this.#run("timeout", callback, args);
+			},
+			ms,
+			...args,
+		);
+		timer.unref?.();
+		this.#timers.add(timer);
+		return timer;
+	}
+
+	/** Clear one managed timer. Accepts an interval or timeout handle. */
+	clear(timer: Timer): void {
+		if (!this.#timers.delete(timer)) return;
+		clearInterval(timer);
+		clearTimeout(timer);
+	}
+
+	/** Clear every outstanding managed timer. Called on session teardown. */
+	clearAll(): void {
+		for (const timer of this.#timers) {
+			clearInterval(timer);
+			clearTimeout(timer);
+		}
+		this.#timers.clear();
+	}
+
+	#run(kind: "interval" | "timeout", callback: (...args: unknown[]) => void, args: unknown[]): void {
+		try {
+			const result = callback(...args) as unknown;
+			if (result instanceof Promise) {
+				result.catch((err: unknown) => this.#report(kind, err));
+			}
+		} catch (err) {
+			this.#report(kind, err);
+		}
+	}
+
+	#report(kind: "interval" | "timeout", err: unknown): void {
+		const message = err instanceof Error ? err.message : String(err);
+		const stack = err instanceof Error ? err.stack : undefined;
+		logger.warn("Extension timer callback threw", { event: `${kind}_callback`, error: message });
+		this.onError(`${kind}_callback`, message, stack);
+	}
+}

package/src/extensibility/extensions/runner.ts

@@ -12,6 +12,7 @@ import type { MemoryRuntimeContext } from "../../memory-backend";
 import { type Theme, theme } from "../../modes/theme/theme";
 import type { SessionManager } from "../../session/session-manager";
 import type { BranchHandler, NavigateTreeHandler, NewSessionHandler } from "../session-handler-types";
+import { ManagedTimers } from "./managed-timers";
 import { createExtensionModelQuery } from "./model-api";
 import type {
 	AfterProviderResponseEvent,
@@ -249,6 +250,18 @@ export class ExtensionRunner {
 	 */
 	#pendingCredentialDisabled: CredentialDisabledEvent[] = [];
 
+	/**
+	 * Timers scheduled by extensions through the sanctioned `ctx.setInterval` /
+	 * `ctx.setTimeout` helpers. Callbacks run with the same isolation as handler
+	 * dispatch — a throw is logged and routed through {@link onError} instead of
+	 * escaping to the process `uncaughtException` handler and tearing down the
+	 * whole session (issue #5664). Handles are `unref`'d and every outstanding
+	 * timer is cleared on session teardown via {@link clearManagedTimers}.
+	 */
+	#managedTimers = new ManagedTimers((event, error, stack) =>
+		this.emitError({ extensionPath: "<timer>", event, error, stack }),
+	);
+
 	constructor(
 		private readonly extensions: Extension[],
 		private readonly runtime: ExtensionRuntime,
@@ -542,6 +555,9 @@ export class ExtensionRunner {
 			getSystemPrompt: () => this.#getSystemPromptFn(),
 			localProtocolOptions: this.localProtocolOptions,
 			memory: this.#getMemoryFn?.(),
+			setInterval: (callback, ms, ...args) => this.#managedTimers.setInterval(callback, ms, ...args),
+			setTimeout: (callback, ms, ...args) => this.#managedTimers.setTimeout(callback, ms, ...args),
+			clearTimer: timer => this.#managedTimers.clear(timer),
 		};
 	}
 
@@ -552,6 +568,16 @@ export class ExtensionRunner {
 		this.#shutdownHandler();
 	}
 
+	/**
+	 * Clear every timer scheduled through `ctx.setInterval` / `ctx.setTimeout`.
+	 * Called during session teardown so extension background work does not
+	 * outlive the session (a self-scheduling interval would otherwise keep
+	 * firing against a disposed session).
+	 */
+	clearManagedTimers(): void {
+		this.#managedTimers.clearAll();
+	}
+
 	createCommandContext(): ExtensionCommandContext {
 		return {
 			...this.createContext(),

package/src/extensibility/extensions/types.ts

@@ -440,6 +440,24 @@ export interface ExtensionContext {
 	getSystemPrompt(): string[];
 	/** Structured memory runtime for status/search/save across the configured backend. */
 	memory?: MemoryRuntimeContext;
+	/**
+	 * Schedule a repeating callback whose throws are contained. Unlike raw
+	 * `setInterval`, a synchronous throw or rejected promise from `callback` is
+	 * logged and surfaced through the extension error channel instead of
+	 * escaping as a process-fatal `uncaughtException` — one misbehaving timer
+	 * can no longer take down the whole session. The handle is `unref`'d and
+	 * cleared automatically on `session_shutdown`. Prefer this over raw
+	 * `setInterval` for any extension background work.
+	 */
+	setInterval(callback: (...args: unknown[]) => void, ms?: number, ...args: unknown[]): Timer;
+	/**
+	 * Schedule a one-shot callback whose throws are contained, mirroring
+	 * {@link setInterval}. Cleared automatically on `session_shutdown` if it has
+	 * not yet fired.
+	 */
+	setTimeout(callback: (...args: unknown[]) => void, ms?: number, ...args: unknown[]): Timer;
+	/** Clear a timer scheduled via {@link setInterval} or {@link setTimeout}. */
+	clearTimer(timer: Timer): void;
 }
 
 /**

package/src/extensibility/extensions/wrapper.ts

@@ -12,6 +12,7 @@ import type { ImageContent, Static, TextContent, TSchema } from "@oh-my-pi/pi-ai
 import type { Settings } from "../../config/settings";
 import type { Theme } from "../../modes/theme/theme";
 import { type ApprovalMode, formatApprovalPrompt, resolveApproval } from "../../tools/approval";
+import { defaultLoadModeForToolName } from "../../tools/essential-tools";
 import { normalizeToolEventInput, resolveToolEventInput } from "../tool-event-input";
 import { applyToolProxy } from "../tool-proxy";
 import type { ExtensionRunner } from "./runner";
@@ -36,7 +37,7 @@ export class RegisteredToolAdapter implements AgentTool<any, any, any> {
 		private runner: ExtensionRunner,
 	) {
 		applyToolProxy(registeredTool.definition, this);
-		this.loadMode = registeredTool.definition.loadMode ?? "discoverable";
+		this.loadMode = defaultLoadModeForToolName(registeredTool.definition.name, registeredTool.definition.loadMode);
 
 		// Only define render methods when the underlying definition provides them.
 		// If these exist unconditionally on the prototype, ToolExecutionComponent