@oh-my-pi/pi-coding-agent 17.3.0 → 17.3.2

package/src/config.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { CONFIG_DIR_NAME, getConfigAgentDirName, getProjectDir } from "@oh-my-pi/pi-utils";
+import { resolveClaudePaths } from "./config/claude-paths";
 import { expandTilde } from "./tools/path-utils";
 
 export * from "./config/config-file";
@@ -76,12 +77,12 @@ export function getChangelogPath(): string | undefined {
 // =============================================================================
 
 /**
- * Config directory bases in priority order (highest first).
- * User-level: ~/.omp/agent, ~/.claude, ~/.codex, ~/.gemini
+ * User-level: ~/.omp/agent, Claude's active config directory, ~/.codex, ~/.gemini
  * Project-level: .omp, .claude, .codex, .gemini
  */
 const USER_CONFIG_BASES = priorityList.map(({ dir, globalAgentDir }) => ({
-	base: () => path.join(os.homedir(), globalAgentDir ? globalAgentDir() : dir),
+	base: () =>
+		dir === ".claude" ? resolveClaudePaths().configDir : path.join(os.homedir(), globalAgentDir?.() ?? dir),
 	name: dir,
 }));
 

package/src/discovery/agents.ts

@@ -67,18 +67,18 @@ const HOST_PROBE_TIMEOUT_MS = 500;
 
 /**
  * Run a best-effort discovery probe and return its trimmed stdout, or
- * `undefined` when the command fails, produces no output, or exceeds
- * {@link HOST_PROBE_TIMEOUT_MS}. On timeout the child is killed with SIGKILL so
- * a wedged interop pipe cannot hang startup; the killed/non-zero exit is then
- * reported as "unavailable" and discovery falls back to the Linux
- * `$HOME`/`~/.omp` candidates.
+ * `undefined` when the command fails, produces no output, or exceeds the
+ * timeout. On timeout the child is killed with SIGKILL so a wedged interop pipe
+ * cannot hang startup; the killed/non-zero exit is then reported as
+ * "unavailable" and discovery falls back to the Linux `$HOME`/`~/.omp`
+ * candidates.
  */
-export function runHostProbe(cmd: string[]): string | undefined {
+export function runHostProbe(cmd: string[], timeoutMs = HOST_PROBE_TIMEOUT_MS): string | undefined {
 	try {
 		const result = Bun.spawnSync(cmd, {
 			stdout: "pipe",
 			stderr: "ignore",
-			timeout: HOST_PROBE_TIMEOUT_MS,
+			timeout: timeoutMs,
 			killSignal: "SIGKILL",
 		});
 		if (result.exitCode !== 0) return undefined;

package/src/discovery/claude.ts

@@ -18,6 +18,7 @@ import { type SlashCommand, slashCommandCapability } from "../capability/slash-c
 import { type SystemPrompt, systemPromptCapability } from "../capability/system-prompt";
 import { type CustomTool, toolCapability } from "../capability/tool";
 import type { LoadContext, LoadResult } from "../capability/types";
+import { resolveClaudePaths } from "../config/claude-paths";
 import { settings } from "../config/settings";
 import {
 	calculateDepth,
@@ -34,11 +35,10 @@ const DISPLAY_NAME = "Claude Code";
 const PRIORITY = 80;
 const CONFIG_DIR = ".claude";
 
-/**
- * Get user-level .claude path.
- */
+/** Get the active user-level Claude Code directory. */
 function getUserClaude(ctx: LoadContext): string {
-	return path.join(ctx.home, CONFIG_DIR);
+	const { configDir } = resolveClaudePaths(ctx.home);
+	return configDir;
 }
 
 /**
@@ -60,8 +60,7 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 	const items: MCPServer[] = [];
 	const warnings: string[] = [];
 
-	const userBase = getUserClaude(ctx);
-	const userClaudeJson = path.join(ctx.home, ".claude.json");
+	const { configDir: userBase, configFile: userClaudeJson } = resolveClaudePaths(ctx.home);
 	const userMcpJson = path.join(userBase, "mcp.json");
 
 	const projectBase = path.join(ctx.cwd, CONFIG_DIR);

package/src/discovery/helpers.ts

@@ -16,6 +16,7 @@ import { invalidate as invalidateFsCache, readDirEntries, readFile } from "../ca
 import { parseRuleConditionAndScope, type Rule, type RuleFrontmatter } from "../capability/rule";
 import type { Skill, SkillFrontmatter } from "../capability/skill";
 import type { LoadContext, LoadResult, SourceMeta } from "../capability/types";
+import { resolveClaudePaths } from "../config/claude-paths";
 import type { MCPRequestIdFormat } from "../mcp/types";
 import { type ConfiguredThinkingLevel, parseConfiguredThinkingLevel } from "../thinking";
 import { normalizeToolNames } from "../tools/builtin-names";
@@ -90,10 +91,9 @@ export type SourceId = keyof typeof SOURCE_PATHS;
  */
 export function getUserPath(ctx: LoadContext, source: SourceId, subpath: string): string | null {
 	// Native user config is profile-scoped via getAgentDir() (the active profile's
-	// agent dir), matching builtin.ts and getMCPConfigPath("user"). External tools
-	// (~/.claude, ~/.gemini, …) are intentionally not profile-scoped, so they keep
-	// resolving against ctx.home below.
+	// agent dir), matching builtin.ts and getMCPConfigPath("user").
 	if (source === "native") return path.join(getAgentDir(), subpath);
+	if (source === "claude") return path.join(resolveClaudePaths(ctx.home).configDir, subpath);
 	const paths = SOURCE_PATHS[source];
 	if (!paths.userAgent) return null;
 	return path.join(ctx.home, paths.userAgent, subpath);
@@ -903,20 +903,21 @@ export function registerPluginCacheInvalidator(invalidator: () => void): void {
 }
 
 /**
- * List all installed Claude Code plugin roots from the plugin cache.
- * Reads ~/.claude/plugins/installed_plugins.json and ~/.omp/plugins/installed_plugins.json,
- * and optionally the nearest project-scoped registry resolved from `cwd`.
+ * List all installed Claude Code plugin roots from its active plugin cache and
+ * ~/.omp/plugins/installed_plugins.json, plus the nearest project registry when present.
  *
- * Results are cached per home, project registry, and canonical active project.
+ * Results are cached per Claude and OMP config directories, project registry, and canonical active project.
  */
 export async function listClaudePluginRoots(
 	home: string,
 	cwd?: string,
 ): Promise<{ roots: ClaudePluginRoot[]; warnings: string[] }> {
+	const claudeConfigDir = resolveClaudePaths(home).configDir;
+	const ompRegistryPath = path.join(getPluginsDir(home), "installed_plugins.json");
 	const resolvedProjectPath = cwd ? await resolveActiveProjectRegistryPath(cwd) : null;
 	const projectRoot = resolvedProjectPath ? path.dirname(path.dirname(path.dirname(resolvedProjectPath))) : cwd;
 	const activeClaudeProjectPath = projectRoot ? await canonicalClaudeProjectPath(projectRoot) : null;
-	const cacheKey = `${home}:${resolvedProjectPath ?? ""}:${activeClaudeProjectPath ?? ""}`;
+	const cacheKey = `${claudeConfigDir}:${ompRegistryPath}:${resolvedProjectPath ?? ""}:${activeClaudeProjectPath ?? ""}`;
 	const cached = pluginRootsCache.get(cacheKey);
 	if (cached) return cached;
 
@@ -926,7 +927,7 @@ export async function listClaudePluginRoots(
 	const canonicalClaudeProjectPaths = new Map<string, string | null>();
 
 	// ── Claude Code registry ──────────────────────────────────────────────────
-	const registryPath = path.join(home, ".claude", "plugins", "installed_plugins.json");
+	const registryPath = path.join(claudeConfigDir, "plugins", "installed_plugins.json");
 	const content = await readFile(registryPath);
 
 	if (content) {
@@ -983,7 +984,7 @@ export async function listClaudePluginRoots(
 	// In production `home` is `os.homedir()`, so `getPluginsDir(home)` resolves to the
 	// same XDG-aware path the marketplace writer uses (reads and writes always agree).
 	// Tests pass a temp dir, which short-circuits the resolver for deterministic isolation.
-	const ompRegistryPath = path.join(getPluginsDir(home), "installed_plugins.json");
+	// Computed before the cache lookup because isolated SDK homes select distinct OMP registries.
 	const ompContent = await readFile(ompRegistryPath);
 	if (ompContent) {
 		const ompRegistry = parseClaudePluginsRegistry(ompContent);
@@ -1107,7 +1108,7 @@ export function clearClaudePluginRootsCache(): void {
  * installing/uninstalling/enabling/disabling plugins.
  */
 export function clearPluginRootsAndCaches(extraPaths?: readonly string[]): void {
-	invalidateFsCache(path.join(os.homedir(), ".claude", "plugins", "installed_plugins.json"));
+	invalidateFsCache(path.join(resolveClaudePaths().configDir, "plugins", "installed_plugins.json"));
 	invalidateFsCache(path.join(getPluginsDir(), "installed_plugins.json"));
 	for (const p of extraPaths ?? []) invalidateFsCache(p);
 	clearClaudePluginRootsCache();

package/src/extensibility/extensions/runner.ts

@@ -42,6 +42,7 @@ import type {
 	ExtensionError,
 	ExtensionEvent,
 	ExtensionFlag,
+	ExtensionMode,
 	ExtensionRuntime,
 	ExtensionShortcut,
 	ExtensionUIContext,
@@ -342,6 +343,7 @@ interface ToolRegistrationScope {
 
 export class ExtensionRunner {
 	#uiContext: ExtensionUIContext;
+	#mode: ExtensionMode = "print";
 	#toolApprovalPreviewWaiter?: (toolCallId: string) => Promise<void>;
 	#errorListeners: Set<ExtensionErrorListener> = new Set();
 	#getModel: () => Model | undefined = () => undefined;
@@ -525,6 +527,7 @@ export class ExtensionRunner {
 		contextActions: ExtensionContextActions,
 		commandContextActions?: ExtensionCommandContextActions,
 		uiContext?: ExtensionUIContext,
+		mode: ExtensionMode = "print",
 	): void {
 		// Copy actions into the shared runtime (all extension APIs reference this)
 		this.runtime.sendMessage = actions.sendMessage;
@@ -573,6 +576,7 @@ export class ExtensionRunner {
 		}
 
 		this.#uiContext = uiContext ?? noOpUIContext;
+		this.#mode = mode;
 		this.#initialized = true;
 
 		// Drain events buffered by emitCredentialDisabled() before initialize ran. The
@@ -953,6 +957,7 @@ export class ExtensionRunner {
 		const getModel = model ? () => model : this.#getModel;
 		return {
 			ui: this.#uiContext,
+			mode: this.#mode,
 			getContextUsage: () => this.#getContextUsageFn(),
 			compact: instructionsOrOptions => this.#compactFn(instructionsOrOptions),
 			getAsyncJobSnapshot: () => this.#getAsyncJobSnapshotFn(),

package/src/extensibility/extensions/types.ts

@@ -434,9 +434,14 @@ export interface ExtensionModelQuery {
 	family(model: Model): string;
 }
 
+/** Runtime host mode exposed to Pi-compatible extensions. */
+export type ExtensionMode = "tui" | "rpc" | "json" | "print";
+
 export interface ExtensionContext {
 	/** UI methods for user interaction */
 	ui: ExtensionUIContext;
+	/** Current run mode. Use `"tui"` to guard terminal-only UI such as custom components. */
+	mode: ExtensionMode;
 	/** Get current context usage for the active model. */
 	getContextUsage(): ContextUsage | undefined;
 	/** Get a read-only snapshot of async jobs owned by this session. */

package/src/extensibility/legacy-typebox.ts

@@ -1,4 +1,5 @@
 import { type } from "@oh-my-pi/omptype";
+import { IR_BRAND } from "@oh-my-pi/omptype/ir";
 import {
 	type AnySchema,
 	type ObjectOpts,
@@ -40,6 +41,44 @@ function isRuntimeSchema(value: unknown): value is AnySchema {
 	return typeof value === "function";
 }
 
+/**
+ * Deep-copy a legacy `Type.Unsafe` document into a plain, structured-cloneable
+ * JSON Schema, lowering any embedded omptype schema to its wire JSON. Legacy
+ * Pi extensions were written against real TypeBox, whose `Type.*` builders
+ * return plain JSON-Schema objects; omptype's builders return callable schema
+ * values instead, which breaks two idioms extensions use inside raw documents:
+ *
+ *  - Direct embedding — `Type.Unsafe({ anyOf: [Type.Array(...), Other] })`.
+ *    The nested schema is a function; `structuredClone` throws
+ *    `DataCloneError: The object can not be cloned.` (issue #8420) and omptype
+ *    would drop its `toJsonSchema()` override during composition anyway.
+ *  - Spreading — `Type.Unsafe({ ...Schema, description })`. Spreading a
+ *    callable copies omptype's internal fields (`ir`, `run`, `$`, …) instead
+ *    of JSON keywords. The copied `run` is a self-reference to the original
+ *    schema, so its `toJsonSchema()` recovers the real wire document; the
+ *    caller's own additions (everything not an omptype internal) are overlaid.
+ */
+function lowerEmbeddedSchemas(value: unknown): unknown {
+	if (isRuntimeSchema(value)) return value.toJsonSchema();
+	if (Array.isArray(value)) return value.map(lowerEmbeddedSchemas);
+	if (value !== null && typeof value === "object") {
+		const source = value as Record<string, unknown>;
+		const canonical = source.run;
+		if (IR_BRAND in value && isRuntimeSchema(canonical)) {
+			const base = canonical.toJsonSchema();
+			const internalKeys = new Set(Object.keys(canonical));
+			for (const key in source) {
+				if (!internalKeys.has(key)) base[key] = lowerEmbeddedSchemas(source[key]);
+			}
+			return base;
+		}
+		const result: Record<string, unknown> = {};
+		for (const key in source) result[key] = lowerEmbeddedSchemas(source[key]);
+		return result;
+	}
+	return value;
+}
+
 function defineHidden(target: object, key: PropertyKey, value: unknown): void {
 	Object.defineProperty(target, key, {
 		value,
@@ -50,12 +89,14 @@ function defineHidden(target: object, key: PropertyKey, value: unknown): void {
 
 function unsafe<T = unknown>(jsonSchema: Record<string, unknown> = {}): LegacyUnsafeSchema<T> {
 	// `document` is the verbatim wire schema; keep it isolated from the validator.
+	// `lowerEmbeddedSchemas` returns a fresh plain-JSON copy (lowering any nested
+	// omptype builder to its wire form), so it doubles as the detaching clone.
 	// `upgradeJsonSchemaTo202012` returns its input untouched when no upgrade is
 	// needed, and `validateJsonSchemaValue` then annotates that object with JIT
 	// epoch metadata and normalized keywords — which would leak into emission if
-	// the two shared a reference.
-	const document = structuredClone(jsonSchema);
-	const upgradedSchema = upgradeJsonSchemaTo202012(structuredClone(jsonSchema));
+	// the two shared a reference, so give the validator its own structured clone.
+	const document = lowerEmbeddedSchemas(jsonSchema) as Record<string, unknown>;
+	const upgradedSchema = upgradeJsonSchemaTo202012(structuredClone(document));
 	const validate = (data: unknown): T | ValidationFailure => {
 		const result = validateJsonSchemaValue(upgradedSchema, data);
 		if (result.success) return data as T;
@@ -125,7 +166,7 @@ const object = ((properties: Record<string, unknown>, opts?: ObjectOpts) => {
 		const document = OmpType.Object(normalizedProperties, objectOpts).toJsonSchema();
 		document.additionalProperties = isRuntimeSchema(additionalProperties)
 			? additionalProperties.toJsonSchema()
-			: structuredClone(additionalProperties);
+			: lowerEmbeddedSchemas(additionalProperties);
 		return unsafe(document);
 	}
 	return OmpType.Object(normalizedProperties, normalizedOpts);

package/src/launch/broker.ts

@@ -37,6 +37,7 @@ const MAX_LOG_BYTES = 25 * 1024 * 1024;
 const LOG_READ_BYTES = 2 * 1024 * 1024;
 const READINESS_BUFFER_CHARS = 64 * 1024;
 const RESTART_MAX_DELAY_MS = 30_000;
+const RESTART_BACKOFF_BASE_MS = 1_000;
 /**
  * Cap on terminal (exited/failed) daemons surfaced by `list`. Active daemons
  * are always shown in full; older history is truncated so the response stays
@@ -351,6 +352,7 @@ class DaemonBroker {
 	readonly #endpoint: string;
 	readonly #token: string;
 	readonly #idleGraceMs: number;
+	readonly #restartBackoffBaseMs: number;
 	readonly #records = new Map<string, ManagedDaemon>();
 	/**
 	 * Names reserved by an in-flight `start` before its record lands in
@@ -371,12 +373,19 @@ class DaemonBroker {
 	#idleTimer: NodeJS.Timeout | undefined;
 	#shuttingDown = false;
 
-	constructor(projectDir: string, runtimeDir: string, token: string, idleGraceMs: number) {
+	constructor(
+		projectDir: string,
+		runtimeDir: string,
+		token: string,
+		idleGraceMs: number,
+		restartBackoffBaseMs: number,
+	) {
 		this.#projectDir = projectDir;
 		this.#runtimeDir = runtimeDir;
 		this.#endpoint = daemonBrokerEndpoint(projectDir, runtimeDir);
 		this.#token = token;
 		this.#idleGraceMs = idleGraceMs;
+		this.#restartBackoffBaseMs = restartBackoffBaseMs;
 	}
 
 	async run(): Promise<void> {
@@ -955,7 +964,10 @@ class DaemonBroker {
 			record.snapshot.readyAt = undefined;
 			record.snapshot.readyMatch = undefined;
 			record.snapshot.state = "restarting";
-			const delay = Math.min(1_000 * 2 ** Math.min(record.consecutiveFailures, 5), RESTART_MAX_DELAY_MS);
+			const delay = Math.min(
+				this.#restartBackoffBaseMs * 2 ** Math.min(record.consecutiveFailures, 5),
+				RESTART_MAX_DELAY_MS,
+			);
 			record.log?.append(
 				`\n[daemon exited${exitCode === undefined ? "" : ` with code ${exitCode}`}; restarting in ${delay}ms]\n`,
 			);
@@ -1347,8 +1359,13 @@ class DaemonBroker {
 	}
 }
 
+export interface DaemonBrokerStartOptions {
+	/** Base of the exponential child-restart backoff. */
+	restartBackoffBaseMs?: number;
+}
+
 /** Start the detached project or global daemon broker selected by the CLI worker host. */
-export async function startDaemonBrokerFromEnvironment(): Promise<void> {
+export async function startDaemonBrokerFromEnvironment(options: DaemonBrokerStartOptions = {}): Promise<void> {
 	const projectDir = process.env[DAEMON_PROJECT_DIR_ENV];
 	const runtimeDir = process.env[DAEMON_RUNTIME_DIR_ENV];
 	if (!projectDir || !runtimeDir) throw new Error("Daemon broker environment is incomplete");
@@ -1358,13 +1375,18 @@ export async function startDaemonBrokerFromEnvironment(): Promise<void> {
 	delete process.env[DAEMON_IDLE_GRACE_ENV];
 	const parsedGrace = rawGrace === undefined ? DEFAULT_IDLE_GRACE_MS : Number.parseInt(rawGrace, 10);
 	const idleGraceMs = Number.isFinite(parsedGrace) && parsedGrace >= 0 ? parsedGrace : DEFAULT_IDLE_GRACE_MS;
+	const requestedRestartBackoffBaseMs = options.restartBackoffBaseMs ?? RESTART_BACKOFF_BASE_MS;
+	const restartBackoffBaseMs =
+		Number.isFinite(requestedRestartBackoffBaseMs) && requestedRestartBackoffBaseMs >= 0
+			? requestedRestartBackoffBaseMs
+			: RESTART_BACKOFF_BASE_MS;
 	await fs.mkdir(runtimeDir, { recursive: true, mode: 0o700 });
 	const lease = await acquireBrokerLease(runtimeDir);
 	if (!lease) return;
 	setProcessName("omp daemon broker");
 	const token = (await Bun.file(path.join(runtimeDir, TOKEN_FILE)).text()).trim();
 	if (!token) throw new Error("Daemon broker token is empty");
-	const broker = new DaemonBroker(projectDir, runtimeDir, token, idleGraceMs);
+	const broker = new DaemonBroker(projectDir, runtimeDir, token, idleGraceMs, restartBackoffBaseMs);
 	const cancelCleanup = postmortem.register("daemon-broker", () => broker.shutdown());
 	try {
 		await broker.run();

package/src/lsp/mux/server.ts

@@ -687,7 +687,13 @@ export class LspMuxServer {
 		server.pending.set(id, { resolveInternal: resolve });
 		try {
 			await this.#writeServer(server, { jsonrpc: "2.0", id, method: "shutdown", params: null });
-			await Promise.race([promise, Bun.sleep(SHUTDOWN_BUDGET_MS)]);
+			const timeout = Promise.withResolvers<void>();
+			const timer = setTimeout(timeout.resolve, SHUTDOWN_BUDGET_MS);
+			try {
+				await Promise.race([promise, timeout.promise]);
+			} finally {
+				clearTimeout(timer);
+			}
 			await this.#writeServer(server, { jsonrpc: "2.0", method: "exit" });
 		} catch (error) {
 			logger.warn("LSP mux graceful server shutdown failed", { server: server.key, error: String(error) });

package/src/main.ts

@@ -23,7 +23,7 @@ import {
 } from "@oh-my-pi/pi-utils";
 import chalk from "@oh-my-pi/pi-utils/chalk";
 import { reset as resetCapabilities } from "./capability";
-import { type Args, reportUnrecognizedFlags } from "./cli/args";
+import { type Args, reportUnrecognizedFlags, validateToolNames } from "./cli/args";
 import { applyExtensionFlags, type ExtensionFlagSink } from "./cli/extension-flags";
 import { processFileArguments } from "./cli/file-processor";
 import { buildInitialMessage } from "./cli/initial-message";
@@ -349,7 +349,7 @@ export interface AcpSessionFactoryOptions {
 	sessionDir?: string;
 	authStorage: AuthStorage;
 	modelRegistry: ModelRegistry;
-	parsedArgs: Pick<Args, "apiKey" | "trustedExtensions">;
+	parsedArgs: Pick<Args, "apiKey" | "trustedExtensions" | "tools">;
 	rawArgs: string[];
 	createSession: (options: CreateAgentSessionOptions) => Promise<CreateAgentSessionResult>;
 }
@@ -425,7 +425,27 @@ export function createAcpSessionFactory(args: AcpSessionFactoryOptions): AcpSess
 		if (args.parsedArgs.apiKey && !args.baseOptions.model && nextSession.model) {
 			args.authStorage.setRuntimeApiKey(nextSession.model.provider, args.parsedArgs.apiKey);
 		}
-		applyExtensionFlags(nextSession.extensionRunner, args.rawArgs);
+		const runner = nextSession.extensionRunner;
+		const reparsedArgs = applyExtensionFlags(
+			runner
+				? {
+						getFlags: () => runner.getFlags(),
+						setFlagValue: (name, value) => {
+							runner.setFlagValue(name, value);
+						},
+					}
+				: undefined,
+			args.rawArgs,
+		);
+		const requestedTools = reparsedArgs?.tools ?? args.parsedArgs.tools;
+		if (requestedTools) {
+			try {
+				validateToolNames(requestedTools, nextSession.getAllToolNames());
+			} catch (error) {
+				await nextSession.dispose();
+				throw error;
+			}
+		}
 		return nextSession;
 	};
 }
@@ -1685,6 +1705,13 @@ export async function runRootCommand(
 			preloadedExtensions: extensionsResult,
 		});
 
+		try {
+			validateToolNames(initialArgs.tools, session.getAllToolNames());
+		} catch (error) {
+			await session.dispose();
+			throw error;
+		}
+
 		// Cold-revive support: a `parked` subagent ref restored from disk (Agent Hub
 		// scan, collab mirror, resumed process) has a sessionFile but no in-memory
 		// reviver, so `ensureLive` (IRC sends, hub focus) would refuse it. Install a

package/src/mcp/transports/stdio.ts

@@ -495,7 +495,7 @@ function signalStdioProcess(
 
 /**
  * Terminate an MCP stdio subprocess: SIGTERM (process-group when `detached`
- * on POSIX, direct child otherwise), wait up to `TERM_GRACE_MS` for a
+ * on POSIX, direct child otherwise), wait up to `termGraceMs` for a
  * cooperative exit, then escalate to SIGKILL — waiting up to `KILL_GRACE_MS`
  * more only when the leader itself hadn't already exited. A detached
  * leader's cooperative exit does not prove the whole process group is gone
@@ -508,15 +508,19 @@ function signalStdioProcess(
  * `detached`/`platform` pair: `StdioTransport.connect()` derives `detached`
  * from `resolveStdioSpawnCommand()`, which is tied to the host's real
  * `process.platform`, so a POSIX detached session cannot be reproduced
- * end-to-end through `connect()` on a non-Linux dev/CI host.
+ * end-to-end through `connect()` on a non-Linux dev/CI host. `termGraceMs`
+ * preserves the production grace by default while allowing those real
+ * subprocess tests to cover the same transition without sleeping for a
+ * production-length shutdown window.
  */
 export async function terminateStdioProcess(
 	proc: KillableSubprocess,
 	detached: boolean,
 	platform: NodeJS.Platform = process.platform,
+	termGraceMs = TERM_GRACE_MS,
 ): Promise<void> {
 	signalStdioProcess(proc, detached, "SIGTERM", platform);
-	const exitedOnTerm = await waitForProcessExit(proc.exited, TERM_GRACE_MS);
+	const exitedOnTerm = await waitForProcessExit(proc.exited, termGraceMs);
 	// A non-detached transport has no process group beyond the leader itself:
 	// once it exits, there is nothing left to signal. A detached transport's
 	// leader exiting is NOT proof the group is empty — a grandchild it spawned

package/src/modes/acp/acp-agent.ts

@@ -2419,6 +2419,7 @@ export class AcpAgent implements Agent {
 				compact: instructionsOrOptions => runExtensionCompact(record.session, instructionsOrOptions),
 			},
 			uiContext,
+			"rpc",
 		);
 		await extensionRunner.emit({ type: "session_start" });
 		record.extensionsConfigured = true;

package/src/modes/components/footer.ts

@@ -1,5 +1,3 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
 import { stripVTControlCharacters } from "node:util";
 import { ThinkingLevel } from "@oh-my-pi/pi-agent-core";
 import { type Component, padding, truncateToWidth, visibleWidth } from "@oh-my-pi/pi-tui";
@@ -17,7 +15,7 @@ import { formatContextUsage, getContextUsageLevel, getContextUsageThemeColor } f
  */
 export class FooterComponent implements Component {
 	#cachedBranch: string | null | undefined = undefined; // undefined = not checked yet, null = not in git repo, string = branch name
-	#gitWatcher: fs.FSWatcher | null = null;
+	#gitUnwatch: (() => void) | null = null;
 	#onBranchChange: (() => void) | null = null;
 	#autoCompactEnabled: boolean = true;
 	#extensionStatuses: Map<string, string> = new Map();
@@ -44,8 +42,9 @@ export class FooterComponent implements Component {
 	}
 
 	/**
-	 * Set up a file watcher on .git/HEAD to detect branch changes.
-	 * Call the provided callback when branch changes.
+	 * Watch the repository HEAD for branch changes; invokes the callback so the
+	 * footer repaints with the new branch. Uses `git.head.watch` (stat-poll) —
+	 * see that helper for why `fs.watch` cannot track git's atomic HEAD swaps.
 	 */
 	watchBranch(onBranchChange: () => void): void {
 		this.#onBranchChange = onBranchChange;
@@ -53,46 +52,29 @@ export class FooterComponent implements Component {
 	}
 
 	#setupGitWatcher(): void {
-		// Clean up existing watcher
-		if (this.#gitWatcher) {
-			this.#gitWatcher.close();
-			this.#gitWatcher = null;
-		}
+		this.#gitUnwatch?.();
+		this.#gitUnwatch = null;
 
 		if (!settings.get("git.enabled")) return;
+		const repository = git.repo.resolveSync(getProjectDir());
+		if (!repository) return;
 
-		void git.head
-			.resolve(getProjectDir())
-			.then(head => {
-				if (!head) {
-					return;
-				}
-
-				try {
-					const watchPath = head.isReftable ? path.join(head.gitDir, "reftable") : head.headPath;
-					this.#gitWatcher = fs.watch(watchPath, () => {
-						this.#cachedBranch = undefined; // Invalidate cache
-						if (this.#onBranchChange) {
-							this.#onBranchChange();
-						}
-					});
-				} catch {
-					// Silently fail if we can't watch
-				}
-			})
-			.catch(() => {
-				this.#cachedBranch = null;
+		try {
+			this.#gitUnwatch = git.head.watch(repository, () => {
+				this.#cachedBranch = undefined; // Invalidate cache
+				this.#onBranchChange?.();
 			});
+		} catch {
+			// Silently fail if we can't watch
+		}
 	}
 
 	/**
 	 * Clean up the file watcher
 	 */
 	dispose(): void {
-		if (this.#gitWatcher) {
-			this.#gitWatcher.close();
-			this.#gitWatcher = null;
-		}
+		this.#gitUnwatch?.();
+		this.#gitUnwatch = null;
 	}
 
 	invalidate(): void {

package/src/modes/components/status-line/component.ts

@@ -1,4 +1,3 @@
-import * as fs from "node:fs";
 import * as path from "node:path";
 import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
 import type { AssistantMessage, UsageLimit, UsageReport } from "@oh-my-pi/pi-ai";
@@ -320,8 +319,7 @@ export class StatusLineComponent implements Component {
 	// dropped rather than overwrite the value the newer resolve committed.
 	// Mirrors #jjCacheGeneration / #getJjBranch in this file.
 	#branchCacheGeneration = 0;
-	#gitWatcher: fs.FSWatcher | null = null;
-	#gitWatcherErrorListener: (() => void) | undefined = undefined;
+	#gitUnwatch: (() => void) | null = null;
 	#gitWatcherUnavailable = false;
 	#onBranchChange: (() => void) | null = null;
 	#disposed = false;
@@ -665,40 +663,29 @@ export class StatusLineComponent implements Component {
 			return;
 		}
 
-		const watchPath = git.repo.isReftableSync(repository)
-			? path.join(repository.gitDir, "reftable")
-			: repository.headPath;
-
+		// git swaps HEAD via `HEAD.lock` + atomic rename. That both unlinks the
+		// HEAD inode (freezing a file-bound `fs.watch` after the first switch —
+		// issue #8412) and, on Bun/Linux, permanently wedges an inotify-backed
+		// directory watch after the first rename event (oven-sh/bun#24875).
+		// `git.head.watch` stat-polls the HEAD path (or the reftable dir), which
+		// survives inode swaps on every platform. A vanished repo surfaces as a
+		// stat change too, so there is no separate watcher error path.
 		try {
-			const watcher = fs.watch(watchPath, () => {
-				if (this.#disposed || this.#gitWatcher !== watcher) return;
+			const unwatch = git.head.watch(repository, () => {
+				if (this.#disposed || this.#gitUnwatch !== unwatch) return;
 				this.invalidateGitCaches();
 				this.#onBranchChange?.();
 			});
-			const onError = () => {
-				if (this.#gitWatcher !== watcher) return;
-				this.#retireGitWatcher();
-				this.#gitWatcherUnavailable = true;
-				if (this.#disposed) return;
-				this.invalidateGitCaches();
-				this.#onBranchChange?.();
-			};
-			this.#gitWatcher = watcher;
-			this.#gitWatcherErrorListener = onError;
-			watcher.on("error", onError);
+			this.#gitUnwatch = unwatch;
 		} catch {
 			this.#gitWatcherUnavailable = true;
 		}
 	}
 
 	#retireGitWatcher(): void {
-		const watcher = this.#gitWatcher;
-		const onError = this.#gitWatcherErrorListener;
-		this.#gitWatcher = null;
-		this.#gitWatcherErrorListener = undefined;
-		if (!watcher) return;
-		if (onError) watcher.off("error", onError);
-		watcher.close();
+		const unwatch = this.#gitUnwatch;
+		this.#gitUnwatch = null;
+		unwatch?.();
 	}
 
 	dispose(): void {