@vanillagreen/pi-claude-bridge 3.2.2 → 4.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-claude-bridge",
-  "version": "3.2.2",
+  "version": "4.0.1",
   "description": "Pi provider bridge that runs Claude Code through the Claude Agent SDK, with opt-in forwarding for Pi prompt context.",
   "type": "module",
   "keywords": [
@@ -15,9 +15,9 @@
     "extensions": [
       "./bundle/index.js"
     ],
-    "image": "https://raw.githubusercontent.com/vanillagreencom/vstack/main/pi-extensions/pi-claude-bridge/assets/bridge-demo.png"
+    "image": "https://raw.githubusercontent.com/vanillagreencom/kendex/main/pi-extensions/pi-claude-bridge/assets/bridge-demo.png"
   },
-  "vstack": {
+  "kendex": {
     "extensionManager": {
       "displayName": "Pi Claude",
       "settings": [
@@ -133,7 +133,7 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.220",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.261",
     "@anthropic-ai/sdk": "^0.112.4",
     "cc-session-io": "^0.3.2",
     "change-case": "^5.4.4"
@@ -154,6 +154,7 @@
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --outfile=bundle/index.js --external:@earendil-works/pi-ai --external:@earendil-works/pi-coding-agent && esbuild src/connector-inventory.ts --bundle --platform=node --format=esm --target=node22 --outfile=bundle/connector-inventory.js",
     "prepack": "npm run build",
     "test:unit": "node --import tsx --test tests/unit-*.mjs",
+    "test:ci": "npm run build && npm run test:unit",
     "test": "set -a && [ -f .env.test ] && . ./.env.test; set +a && npm run test:unit && tests/int-smoke.sh && tests/int-multi-turn.sh && tests/int-cache.sh && node --import tsx --test tests/int-*.mjs",
     "test:usage": "tests/usage-test.sh",
     "typecheck": "tsc --noEmit"
@@ -168,12 +169,12 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/vanillagreencom/vstack.git",
+    "url": "git+https://github.com/vanillagreencom/kendex.git",
     "directory": "pi-extensions/pi-claude-bridge"
   },
-  "homepage": "https://github.com/vanillagreencom/vstack/tree/main/pi-extensions/pi-claude-bridge",
+  "homepage": "https://github.com/vanillagreencom/kendex/tree/main/pi-extensions/pi-claude-bridge",
   "bugs": {
-    "url": "https://github.com/vanillagreencom/vstack/issues"
+    "url": "https://github.com/vanillagreencom/kendex/issues"
   },
   "author": "vanillagreen",
   "publishConfig": {

package/src/account-router.ts

@@ -4,8 +4,8 @@
 // versioned symbol below to supply a subscription profile for each fresh
 // Claude request. The bridge passes only an opaque profile id, a display
 // label, and an optional CLAUDE_CONFIG_DIR; credentials remain owned by the
-// official Claude CLI. Incompatible future shapes must use a new
-// symbol/version instead of mutating this contract in place.
+// official Claude CLI. An incompatible shape must use a separate
+// symbol or version instead of mutating this contract in place.
 
 import type { AssistantMessageEvent, AssistantMessageEventStream } from "@earendil-works/pi-ai";
 import { homedir } from "node:os";
@@ -13,8 +13,8 @@ import { join } from "node:path";
 import { debug } from "./debug.js";
 import { resetTimestampMs } from "./rate-limit.js";
 
-export const CLAUDE_ACCOUNT_ROUTER_SYMBOL = Symbol.for("vstack.pi.claude-account-router.v1");
-export const CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL = Symbol.for("vstack.pi.claude-bridge.account-host.v1");
+export const CLAUDE_ACCOUNT_ROUTER_SYMBOL = Symbol.for("kendex.pi.claude-account-router.v1");
+export const CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL = Symbol.for("kendex.pi.claude-bridge.account-host.v1");
 
 export interface ClaudeAccountRoute {
 	profileId: string;
@@ -48,7 +48,7 @@ export interface ClaudeAccountRouterV1 {
 	recordFailure(profileId: string, kind: ClaudeAccountFailureKind, modelId: string): void;
 	recordSuccess(profileId: string, sessionId?: string): void;
 	current(modelId: string, sessionId?: string): ClaudeAccountRoute | undefined;
-	/** Resolve a previously issued profile id back to its route. The bridge
+	/** Resolve an issued profile id back to its route. The bridge
 	 *  persists ONLY the opaque profile id into Pi session entries (config-dir
 	 *  paths are account-identifying and travel with shared session archives),
 	 *  so restoring a session re-derives the config dir here. A missing router

package/src/assistant-stream.ts

@@ -5,14 +5,14 @@ import { connectorResultByteSize, recordConnectorCallResult } from "./connector-
 import { isChildExecutedTool } from "./connectors.js";
 import { debug, diagDump } from "./debug.js";
 import { ctx, failStrandedToolCall, type QueryContext } from "./query-state.js";
-import { mapToolArgs, mapToolName } from "./tool-mapping.js";
+import { isForeignMcpTool, isPiDispatchable, mapToolArgs, mapToolName } from "./tool-mapping.js";
 
 // --- Usage helpers ---
 
 function updateUsage(output: AssistantMessage, usage: Record<string, number | undefined>, model: Model<any>, c: QueryContext): void {
 	// Anthropic reports per-message counters and RE-reports them as the message
-	// grows, so the in-flight message's figures are replaced, not added. What is
-	// added is every child message already finished in this Pi turn — see
+	// grows, so the in-flight message's figures replace, never accumulate. What
+	// accumulates is every child message already finished in this Pi turn — see
 	// `turnUsageCarry` in query-state.ts for why a turn can span several.
 	const current = c.currentMessageUsage;
 	const carry = c.turnUsageCarry;
@@ -70,25 +70,24 @@ export function finalizeCurrentStream(stopReason?: string, c: QueryContext = ctx
 //
 // The Claude Code CLI dispatches MCP tool calls (and the SDK yields the
 // completed assistant message) BEFORE the stream's message_delta arrives — and
-// message_delta is what carries the message's REAL output-token count (measured:
-// handler invoked ~45ms before message_delta on every tool-use turn). Ending
-// the pi stream at either of those early signals therefore froze usage at the
-// message_start placeholder values, which is why pi sessions recorded 1–7
-// output tokens per tool-use turn while the final text turn recorded hundreds
-// (2026-07-28 token test, both bridge panes).
+// message_delta is what carries the message's REAL output-token count (the
+// handler fires tens of milliseconds ahead of it on every tool-use turn).
+// Ending the pi stream at either of those early signals freezes usage at the
+// message_start placeholder values: a handful of output tokens per tool-use
+// turn while the final text turn records hundreds.
 //
-// So the turn now ends at message_stop, exactly like the streamed-text case,
-// and the early signals only ARM a grace timer. The timer is the deadlock
-// backstop for the one observed case where the terminal events never arrive
-// (pi 0.80 steer draining): pi cannot execute tools before the stream ends, and
-// the MCP handler cannot resolve before pi executes, so a stream that has gone
-// silent must be ended by force — just 1.5s later instead of immediately.
+// So the turn ends at message_stop, exactly like the streamed-text case, and
+// the early signals only ARM a grace timer. The timer is the deadlock backstop
+// for a stream whose terminal events never arrive (pi's steer draining
+// produces one): pi cannot execute tools before the stream ends, and the MCP
+// handler cannot resolve before pi executes, so a stream that has gone silent
+// must be ended by force — TOOL_USE_END_GRACE_MS later instead of immediately.
 
 const TOOL_USE_END_GRACE_MS = 1500;
 
 /** End the current pi stream as a tool_use turn boundary. Safe to call when the
  *  turn already ended (no-op). Every end path funnels here, so this is where
- *  two invariants are enforced by construction (vstack#1469): a block still
+ *  two invariants are enforced by construction: a block still
  *  carrying partialJson never ships — Pi executes the done message's content,
  *  and truncated arguments must never execute — and every call that DOES ship
  *  is stamped forwarded so no lagging replay can dispatch it again. */
@@ -105,7 +104,7 @@ export function endToolUseTurn(c: QueryContext): void {
 	}
 	// Every tool call Pi is about to execute from this turn is owed a result and
 	// must never be dispatched again: a lagging stream replays the same tool_use
-	// into the NEXT turn, whose per-message dedup cannot see it (vstack#1469).
+	// into the NEXT turn, whose per-message dedup cannot see it.
 	for (const block of c.turnOutput.content as Array<{ type?: string; id?: unknown }>) {
 		if (block?.type === "toolCall" && typeof block.id === "string") c.forwardedToolCallIds.add(block.id);
 	}
@@ -146,12 +145,11 @@ export function scheduleToolUseTurnEnd(c: QueryContext, action: () => void, sour
  * Park queued tool results whose handler has not fired by a child message
  * boundary, and say so everywhere it matters. The boundary is where stale
  * entries would start poisoning mismatch reports — but it does NOT prove the
- * handler gave up: the SDK staggers handler invocations, and in the 2026-08-17
- * deadlock session three of five parallel handlers fired after this point
- * (vstack#1469). Parked results stay consumable through
- * takeQueuedOrParkedResult; one that is never consumed belongs to a call the
- * SDK abandoned client-side (permission denial), which is exactly what the
- * notice describes.
+ * handler gave up: the SDK staggers handler invocations, and handlers in a
+ * parallel batch routinely fire after this point. Parked results stay
+ * consumable through takeQueuedOrParkedResult; one that is never consumed
+ * belongs to a call the SDK abandoned client-side (permission denial), which
+ * is exactly what the notice describes.
  */
 export function reapStaleQueuedResults(c: QueryContext): void {
 	const stale = c.takeStaleQueuedResults();
@@ -180,14 +178,14 @@ export const FINALIZE_MAX_REARMS = 3;
  *  stream events never arrived (the grace-timer action armed by an MCP handler
  *  invocation — see scheduleToolUseTurnEnd).
  *
- *  Observed with Claude Code under pi 0.80's steer draining (tool result and
- *  drained steer arrive in one provider call): the NEXT tool turn's tool_use
- *  streams in, the SDK invokes the MCP handler — and neither terminal event
- *  ever arrives. The invocation itself proves the assistant turn is committed,
- *  so end the pi stream like the `message_stop` path — with this handler's
- *  schema-validated arguments, never a partial parse — after settling every
- *  sibling whose handler has fired and giving a merely-lagging stream up to
- *  FINALIZE_MAX_REARMS extra grace periods for the rest (vstack#1469).
+ *  The producer is pi's steer draining (tool result and drained steer arrive
+ *  in one provider call): the NEXT tool turn's tool_use streams in, the SDK
+ *  invokes the MCP handler — and neither terminal event ever arrives. The
+ *  invocation itself proves the assistant turn is committed, so end the pi
+ *  stream like the `message_stop` path — with this handler's schema-validated
+ *  arguments, never a partial parse — after settling every sibling whose
+ *  handler has fired and giving a merely-lagging stream up to
+ *  FINALIZE_MAX_REARMS extra grace periods for the rest.
  *
  *  The dead-stream guard is a backstop: the grace timer's own stream-identity
  *  check means this normally never runs after the turn ended. The primary
@@ -204,8 +202,8 @@ export function finalizeToolUseTurnFromMcpInvocation(
 		// The turn ended without this call. An unforwarded handler here can never
 		// be answered — the yield that could have replayed its call was consumed
 		// against a null stream, and the dead-mark below suppresses any replay
-		// that has not happened yet. Failing it now is what turns the observed
-		// multi-hour session deadlock into one retryable error (vstack#1469).
+		// that has not happened yet. Failing it here turns what would be a
+		// session-long deadlock into one retryable error.
 		if (failStrandedToolCall(queryCtx, toolCallId)) {
 			debug(`mcp handler: ${toolName} [${toolCallId}] stranded — turn ended before its call reached Pi; resolved with error`);
 			diagDump("tool_handler_stranded", { toolCallId, toolName, site: "finalize-no-stream" });
@@ -220,9 +218,9 @@ export function finalizeToolUseTurnFromMcpInvocation(
 			// Stream ended before content_block_stop. The SDK invoked this handler
 			// with the COMPLETE schema-validated input, so the handler's copy is
 			// authoritative — the streamed partial JSON is by definition behind it.
-			// Settling from the partial is what forwarded `{}`-argument calls that
-			// Pi then executed and errored (vstack#1469), exactly the divergence
-			// the synthesize branch below never had.
+			// Settling from the partial forwards `{}`-argument calls that Pi then
+			// executes and errors on, a divergence the synthesize branch below
+			// cannot have.
 			block.arguments = mappedArgs;
 			queryCtx.updateToolCallArgs(block.id, block.arguments);
 			delete block.partialJson;
@@ -230,13 +228,13 @@ export function finalizeToolUseTurnFromMcpInvocation(
 			queryCtx.currentPiStream.push({ type: "toolcall_end", contentIndex: idx, toolCall: block, partial: queryCtx.turnOutput });
 		}
 	} else if (queryCtx.forwardedToolCallIds.has(toolCallId) || queryCtx.deadToolCallIds.has(toolCallId)) {
-		// Pi already executed this call in an earlier turn (its result arrives or
-		// sits parked), or the handler was already failed — either way a second
-		// dispatch is the one outcome worse than waiting. Do NOT return: this
-		// firing consumed the stream's only grace timer, so the current turn's own
-		// blocks must still be settled and the turn still ended below, or a turn
-		// that loses its terminal events afterwards has no backstop left and Pi
-		// sits busy until manual abort.
+		// Pi already executed this call in a turn that has ended (its result
+		// arrives or sits parked), or the handler was already failed — either
+		// way a second dispatch is the one outcome worse than waiting. Do NOT
+		// return: this firing consumed the stream's only grace timer, so the
+		// current turn's own blocks must still be settled and the turn still
+		// ended below, or a turn that loses its terminal events afterwards has
+		// no backstop left and Pi sits busy until manual abort.
 		debug(`mcp handler: ${toolName} [${toolCallId}] already ${queryCtx.forwardedToolCallIds.has(toolCallId) ? "forwarded" : "dead"} — not re-emitting`);
 	} else {
 		// The invocation can arrive before the tool_use is streamed at all
@@ -314,13 +312,14 @@ export function processStreamEvent(
 	}
 
 	if (event?.type === "message_start") {
-		// The child moving to a new message proves every result for the previous
-		// one reached it; anything still queued can never be consumed.
+		// The child moving on to another message is where a still-queued result
+		// would start poisoning mismatch reports: park it, consumable by a late
+		// handler (see reapStaleQueuedResults).
 		reapStaleQueuedResults(c);
 		c.resetToolTracking();
-		// A new child message begins: bank what the previous one billed before its
-		// counters are replaced. No-op on the turn's first, and no-op if this same
-		// message was already declared (see beginChildMessage).
+		// Another child message begins: bank what the previous one billed before
+		// its counters are replaced. No-op on the turn's first, and no-op if this
+		// same message was already declared (see beginChildMessage).
 		c.beginChildMessage(event.message?.id);
 		updateTurnOutputModel(event.message?.model, c);
 		if (event.message?.usage) updateUsage(c.turnOutput, event.message.usage, model, c);
@@ -330,7 +329,7 @@ export function processStreamEvent(
 	if (event?.type === "content_block_start") {
 		c.turnSawStreamEvent = true;
 		ensureTurnStarted(c);
-		// A new block owns this index from here on, so release any child-executed
+		// This block owns its index from here on, so release any child-executed
 		// or suppressed claim on it. Belt-and-braces against a missed
 		// message_start: without this a stale index could silently swallow a later
 		// text block's deltas.
@@ -344,6 +343,12 @@ export function processStreamEvent(
 			debug(`processStreamEvent: child-executed tool ${event.content_block.name} [${event.content_block.id}] — not mirrored as a Pi tool call`);
 			return;
 		}
+		if (event.content_block?.type === "tool_use" && !isPiDispatchable(event.content_block.name, customToolNameToPi)) {
+			c.suppressedStreamIndexes.add(event.index);
+			if (isForeignMcpTool(event.content_block.name)) c.markOutputCommitted();
+			debug(`processStreamEvent: non-dispatchable tool ${event.content_block.name} [${event.content_block.id}] — not mirrored as a Pi tool call`);
+			return;
+		}
 		if (event.content_block?.type === "text") {
 			c.turnBlocks.push({ type: "text", text: "", index: event.index });
 			c.currentPiStream!.push({ type: "text_start", contentIndex: c.turnBlocks.length - 1, partial: c.turnOutput });
@@ -355,7 +360,7 @@ export function processStreamEvent(
 			if (typeof streamedId === "string" && (c.forwardedToolCallIds.has(streamedId) || c.deadToolCallIds.has(streamedId))) {
 				// A lagging stream replaying a call Pi already executed — or one whose
 				// handler was already failed as stranded — into a later turn. Mirroring
-				// it would make Pi dispatch it a second time (vstack#1469).
+				// it would make Pi dispatch it a second time.
 				c.suppressedStreamIndexes.add(event.index);
 				debug(`processStreamEvent: tool_use ${streamedId} already ${c.forwardedToolCallIds.has(streamedId) ? "forwarded" : "dead"} — suppressing duplicate stream block`);
 				return;
@@ -364,7 +369,7 @@ export function processStreamEvent(
 				// Same turn, same id: the completed-message yield beat the stream (its
 				// block is already recorded with complete arguments). A second
 				// partialJson copy would ship the id twice in one done message — and
-				// if its stop never arrives, ship it truncated (vstack#1469).
+				// if its stop never arrives, ship it truncated.
 				c.suppressedStreamIndexes.add(event.index);
 				debug(`processStreamEvent: tool_use ${streamedId} already recorded in this turn — suppressing duplicate stream block`);
 				return;
@@ -494,7 +499,7 @@ function appendMissingToolUsesFromAssistant(
 	// array of a turnOutput that endToolUseTurn already handed Pi BY REFERENCE
 	// in its done event, so a push here appends calls into a delivered message
 	// behind Pi's back — whether Pi's dispatch enumerates before or after the
-	// push is a microtask race (vstack#1469).
+	// push is a microtask race.
 	const streamLive = Boolean(c.currentPiStream && c.turnOutput);
 	let sawToolUse = false;
 	for (const block of assistantMsg.content) {
@@ -507,11 +512,16 @@ function appendMissingToolUsesFromAssistant(
 			debug(`assistant message: child-executed tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
 			continue;
 		}
+		if (!isPiDispatchable(block.name, customToolNameToPi)) {
+			if (isForeignMcpTool(block.name)) c.markOutputCommitted();
+			debug(`assistant message: non-dispatchable tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
+			continue;
+		}
 		const existingIdx = c.turnBlocks.findIndex((b: any) => b.type === "toolCall" && b.id === block.id);
 		if (existingIdx < 0 && (c.forwardedToolCallIds.has(block.id) || c.deadToolCallIds.has(block.id))) {
-			// Completed-message replay of a call Pi already executed in an earlier
-			// turn (or one already failed as stranded). Not a live Pi turn boundary:
-			// sawToolUse stays false for it, and no block is emitted (vstack#1469).
+			// Completed-message replay of a call Pi already executed in a turn that
+			// has ended (or one already failed as stranded). Not a live Pi turn
+			// boundary: sawToolUse stays false for it, and no block is emitted.
 			debug(`assistant message: tool_use ${block.id} already ${c.forwardedToolCallIds.has(block.id) ? "forwarded" : "dead"} — skipping duplicate`);
 			continue;
 		}
@@ -545,9 +555,9 @@ function appendMissingToolUsesFromAssistant(
 		c.currentPiStream?.push({ type: "toolcall_end", contentIndex: idx, toolCall: toolBlock as any, partial: c.turnOutput });
 	}
 	// Only while the stream is still live: the SDK's assistant yields carry the
-	// message_start placeholder usage (output ≈ 1–7), and once the done event has
-	// delivered turnOutput to pi, overwriting its usage with those placeholders
-	// would corrupt the very figure message_delta got right.
+	// message_start placeholder usage, and once the done event has delivered
+	// turnOutput to pi, overwriting its usage with those placeholders would
+	// corrupt the very figure message_delta got right.
 	if (assistantMsg.usage && c.turnOutput && c.currentPiStream) updateUsage(c.turnOutput, assistantMsg.usage, model, c);
 	return sawToolUse;
 }
@@ -592,14 +602,14 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	updateTurnOutputModel(assistantMsg.model, c);
 	if (c.turnSawStreamEvent) {
 		// The SDK yields the completed assistant message BEFORE the stream's
-		// message_delta/message_stop on every tool-use turn (measured — this is
-		// the norm, not a fallback). Record any tool_use blocks the stream hasn't
-		// delivered yet, but do NOT end the pi stream here: message_delta, which
-		// arrives tens of ms later, carries the message's real output-token count,
-		// and message_stop is the normal turn end. Ending here froze usage at the
-		// message_start placeholders (1–7 output tokens per tool turn). The grace
-		// timer force-ends the turn if the terminal events never arrive, so pi
-		// still gets to execute the tools and unblock the MCP handlers.
+		// message_delta/message_stop on every tool-use turn (the norm, not a
+		// fallback). Record any tool_use blocks the stream hasn't delivered yet,
+		// but do NOT end the pi stream here: message_delta, which arrives tens of
+		// ms later, carries the message's real output-token count, and
+		// message_stop is the normal turn end. Ending here freezes usage at the
+		// message_start placeholders. The grace timer force-ends the turn if the
+		// terminal events never arrive, so pi still gets to execute the tools and
+		// unblock the MCP handlers.
 		if (appendMissingToolUsesFromAssistant(assistantMsg, model, customToolNameToPi, c)) {
 			c.turnSawToolCall = true;
 			scheduleToolUseTurnEnd(c, () => endToolUseTurn(c), "assistant-boundary");
@@ -609,11 +619,11 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	// The SDK yields the SAME assistant message more than once (per-block
 	// partial copies and the completed message share one id). With stream
 	// events, the streamed path already renders content and the duplicates are
-	// naturally ignored; on this no-stream-events path each yield used to be
-	// re-rendered wholesale — a rate-limited turn printed "You've hit your
-	// weekly limit" twice. Same-message yields keep the turn's tracking (a
-	// reset mid-message would wipe live tool-claim state) and render only
-	// blocks not already rendered.
+	// naturally ignored; on this no-stream-events path, re-rendering each
+	// yield wholesale prints a rate-limited turn's "You've hit your weekly
+	// limit" twice. Same-message yields keep the turn's tracking (a reset
+	// mid-message would wipe live tool-claim state) and render only blocks not
+	// already rendered.
 	const sameMessage = typeof assistantMsg.id === "string" && assistantMsg.id.length > 0 && assistantMsg.id === c.currentMessageId;
 	if (!sameMessage) {
 		reapStaleQueuedResults(c);
@@ -627,9 +637,9 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	debug(`processAssistantMessage fallback: ${assistantMsg.content.length} blocks, types=${assistantMsg.content.map((b: any) => b.type).join(",")}${sameMessage ? " (same message re-yield)" : ""}`);
 	// Deduped against the WHOLE current turn, not just same-id re-yields: a
 	// rejected turn's synthesized error message ("You've hit your weekly limit")
-	// arrives as multiple assistant yields whose ids DIFFER or are absent
-	// (measured 2026-07-28: one pi message, two byte-identical text blocks), so
-	// an id-keyed guard alone still rendered it twice. A model legitimately
+	// arrives as multiple assistant yields whose ids DIFFER or are absent (one
+	// pi message, two byte-identical text blocks), so an id-keyed guard alone
+	// still renders it twice. A model legitimately
 	// producing two byte-identical full blocks in one turn is vanishingly rare;
 	// rendering such a duplicate once is the better failure mode.
 	const alreadyRendered = (type: string, content: string): boolean =>
@@ -659,14 +669,19 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 				debug(`processAssistantMessage fallback: child-executed tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
 				continue;
 			}
+			if (!isPiDispatchable(block.name, customToolNameToPi)) {
+				if (isForeignMcpTool(block.name)) c.markOutputCommitted();
+				debug(`processAssistantMessage fallback: non-dispatchable tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
+				continue;
+			}
 			if (!c.turnBlocks.some((b: any) => b.type === "toolCall" && b.id === block.id)
 				&& (c.forwardedToolCallIds.has(block.id) || c.deadToolCallIds.has(block.id))) {
 				// A cross-turn replay of a call Pi already executed (or one whose
-				// handler was already failed as stranded). This exact path produced
-				// the observed duplicate dispatches: the completed-message yield lands
-				// in the callback AFTER a grace finalize already ended the call's
-				// turn, and per-message dedup cannot see across turns (vstack#1469).
-				// Not recorded either — a forwarded call must not be claimable again.
+				// handler was already failed as stranded). This is the path a
+				// duplicate dispatch takes: the completed-message yield lands in the
+				// callback AFTER a grace finalize already ended the call's turn, and
+				// per-message dedup cannot see across turns. Not recorded either — a
+				// forwarded call must not be claimable again.
 				debug(`processAssistantMessage fallback: tool_use ${block.id} already ${c.forwardedToolCallIds.has(block.id) ? "forwarded" : "dead"} — skipping duplicate`);
 				continue;
 			}

package/src/auth-presence.ts

@@ -85,7 +85,7 @@ function hasApiKeyHelper(configDir: string): boolean {
  * Keychain, NOT in `.credentials.json`, so file-absence is NOT evidence of
  * logged-out and we cannot cheaply/safely probe the Keychain here. On darwin,
  * when no other signal is present, we default to credentialed=true — preserving
- * the pre-fix "always available" behavior for Mac subscription users. Honesty
+ * an "always available" result for Mac subscription users. Honesty
  * enforcement therefore applies on Linux/Windows, where `.credentials.json`
  * existence is an observable, truthful proxy (empirically, `claude auth logout`
  * unlinks it).
@@ -111,4 +111,3 @@ export function hasClaudeCredentials(
 
 	return false;
 }
-

package/src/bridge-commands.ts

@@ -17,7 +17,7 @@ function commandCwd(ctx: unknown): string {
 
 async function tryOpenExtensionManagerSettings(ctx: { ui: ExtensionUIContext }): Promise<boolean> {
 	const host = globalThis as unknown as Record<PropertyKey, unknown>;
-	const openQuickSettings = host[Symbol.for("vstack.pi.extension-manager.open-quick-settings")];
+	const openQuickSettings = host[Symbol.for("kendex.pi.extension-manager.open-quick-settings")];
 	if (typeof openQuickSettings !== "function") return false;
 	try {
 		await (openQuickSettings as (ctx: unknown, hint?: string) => Promise<void>)(ctx, "@vanillagreen/pi-claude-bridge");
@@ -35,7 +35,7 @@ function showBridgeStatus(ctx: { ui: ExtensionUIContext; cwd?: string }): void {
 	].join("\n"), "info");
 }
 
-// Deterministic connector enumeration for the host app (vstack#838). Reports the
+// Deterministic connector enumeration for the host app. Reports the
 // failure reason rather than an empty list, so "no connectors" and "could not
 // check" stay distinguishable.
 async function reportConnectorInventory(ctx: {

package/src/bridge-state.ts

@@ -23,7 +23,7 @@ export interface SessionState {
 	// never rewrite those opening messages — compact/tree-nav mutations set
 	// needsRebuild instead — so a component mismatch marks a FOREIGN
 	// conversation (a subagent-shaped query arriving while the parent is idle,
-	// vstack#1001) that must run as a clean one-shot without touching this
+	//) that must run as a clean one-shot without touching this
 	// record. The user component must always match; the assistant component is
 	// compared only when BOTH sides carry one, so a record stamped on turn 1
 	// (no assistant yet) still matches its own grown conversation and upgrades
@@ -56,7 +56,7 @@ interface SharedSessionLaneStoreV1 {
 	sessions: Map<string, SessionState | null>;
 }
 
-const SHARED_SESSION_LANES_SYMBOL = Symbol.for("vstack.pi.claude-bridge.shared-session-lanes.v1");
+const SHARED_SESSION_LANES_SYMBOL = Symbol.for("kendex.pi.claude-bridge.shared-session-lanes.v1");
 
 function sharedSessionLaneStore(): SharedSessionLaneStoreV1 {
 	const host = globalThis as Record<symbol, unknown>;
@@ -107,7 +107,7 @@ export function clearSharedSessionLanes(): void {
 // registry above because session_start and session_shutdown can reach different
 // module instances (`/reload` mid-session, a child agent's own copy) and both
 // must see the same entry.
-const STARTED_LANES_SYMBOL = Symbol.for("vstack.pi.claude-bridge.started-lanes.v1");
+const STARTED_LANES_SYMBOL = Symbol.for("kendex.pi.claude-bridge.started-lanes.v1");
 
 function startedLaneStore(): WeakMap<object, string> {
 	const host = globalThis as Record<symbol, unknown>;
@@ -169,10 +169,9 @@ export const INTEGRITY_CUSTOM_TYPE = "claude-bridge-integrity";
 /**
  * Persist a bridge integrity event into the pi session transcript.
  *
- * The diag log and a piUI toast both die with the machine or the render cycle:
- * the 2026-07-28 post-mortem found `Error: Claude bridge: …` messages that were
- * SHOWN but existed nowhere in the pi session file, making analysis from the
- * session alone impossible. A `CustomEntry` closes that gap the same way the
+ * The diag log and a piUI toast both die with the machine or render cycle, so
+ * they cannot support analysis from the session alone. A `CustomEntry` persists
+ * the record in the same way the
  * connector-call audit does — persisted, never part of built context, never
  * dispatchable by pi's agent loop. Payloads must stay compact metadata (ids,
  * counts, tool names), never tool output.
@@ -242,7 +241,7 @@ export function reportToolResultMismatch(
 		queryCtx.reportedToolResultMismatch = true;
 		// The single choke point every mismatch path funnels through (abort,
 		// unmatched result, stream-idle, teardown). A context with no claim on
-		// the shared record (reentrant subagent or foreign one-shot, vstack#1001)
+		// the shared record (reentrant subagent or foreign one-shot,)
 		// still gets the full diagnostics below, but its unresolved tool state is
 		// its own — marking the PARENT's record needsRebuild/forceRotate here
 		// would flush the parent's prompt cache for a query that never touched

package/src/config.ts

@@ -1,5 +1,5 @@
 // User-facing extension config. Legacy config is loaded from
-// ~/.pi/agent/claude-bridge.json and .pi/claude-bridge.json. vstack extension
+// ~/.pi/agent/claude-bridge.json and .pi/claude-bridge.json. kendex extension
 // manager config is loaded from settings.json and overrides legacy files in
 // normal Pi sessions. Isolated embedding hosts consume only the authoritative
 // user claude-bridge.json and never read extension-manager settings.
@@ -13,11 +13,11 @@ import { debug } from "./debug.js";
 export const PACKAGE_ID = "@vanillagreen/pi-claude-bridge";
 
 /**
- * Registry the vstack extension manager reads to display the value an
+ * Registry the kendex extension manager reads to display the value an
  * extension actually resolves for a manifest key, for extensions whose config
  * has channels the manager does not own. Keyed by package id.
  */
-const EXTERNAL_CONFIG_RESOLVER_SYMBOL = Symbol.for("vstack.pi.extension-config-resolver");
+const EXTERNAL_CONFIG_RESOLVER_SYMBOL = Symbol.for("kendex.pi.extension-config-resolver");
 
 export type BridgeEffortLevel = "low" | "medium" | "high" | "xhigh" | "max";
 
@@ -44,7 +44,7 @@ export interface Config {
 		modelEffortOverrides?: Record<string, BridgeEffortLevel>;
 		/**
 		 * Verbatim override for the child's filesystem setting sources.
-		 * Defaults (see settingSourcesForQuery in connectors.ts): connectors
+		 * Defaults (see settingSourcesForQuery in connectors.ts) : connectors
 		 * mode uses ["user"] only, so repo-controlled `.claude/settings.json`
 		 * (project/local scope) cannot inject `env`/`apiKeyHelper` into the
 		 * child. Listing "project"/"local" here reopens that surface — only do
@@ -95,17 +95,25 @@ function expandHome(input: string): string {
 	return input;
 }
 
+/** Root-anchored as `crates/core/src/harness/pi.rs::pi_root_is_absolute_for`
+ * means it, which `isAbsolute` is not: it calls a driveless `\root` absolute
+ * where the renderer does not, putting the two on different roots. Hoisted, so
+ * a circular import cannot reach it inside a temporal dead zone. */
+function rootAnchored(path: string, windows: boolean): boolean { return windows ? /^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/][^\\/]+)/.test(path) : path.startsWith("/"); }
+
 /**
- * The Pi agent config dir: `PI_CODING_AGENT_DIR` when set, else `~/.pi/agent`.
- * Every bridge default that used to hardcode `~/.pi/agent` routes through this
- * so a host app that owns the agent dir owns those paths too.
+ * The Pi agent config dir: `PI_CODING_AGENT_DIR` when it names a root-anchored
+ * path, else `~/.pi/agent`. Every bridge default routes through this function
+ * so a host app that owns the agent dir owns
+ * those paths too.
  */
 export function piUserDir(): string {
-	return resolve(expandHome(process.env.PI_CODING_AGENT_DIR?.trim() || "~/.pi/agent"));
+	const override = expandHome(process.env.PI_CODING_AGENT_DIR?.trim() || "");
+	return resolve(rootAnchored(override, process.platform === "win32") ? override : expandHome("~/.pi/agent"));
 }
 
 /**
- * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`): a host app embedding the bridge
+ * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`) : a host app embedding the bridge
  * declares that nothing outside its explicitly configured dirs may be read.
  * Disables every cwd/home discovery fallback — all AGENTS.md discovery,
  * extension-manager settings, project `.pi/` settings + claude-bridge.json,
@@ -138,14 +146,14 @@ function projectSettingsPath(cwd: string): string {
 	while (true) {
 		const candidate = join(current, ".pi", "settings.json");
 		if (existsSync(candidate)) return candidate;
-		if (existsSync(join(current, ".pi")) || existsSync(join(current, ".git")) || existsSync(join(current, ".vstack-lock.json"))) return candidate;
+		if (existsSync(join(current, ".pi")) || existsSync(join(current, ".git")) || existsSync(join(current, ".kendex-lock.json"))) return candidate;
 		const parent = dirname(current);
 		if (parent === current) return join(resolve(cwd), ".pi", "settings.json");
 		current = parent;
 	}
 }
 
-const PROJECT_TRUST_SYMBOL = Symbol.for("vstack.pi.project-trust");
+const PROJECT_TRUST_SYMBOL = Symbol.for("kendex.pi.project-trust");
 
 interface ProjectTrustRegistry {
 	projectSettings?: Map<string, boolean>;
@@ -212,7 +220,7 @@ function readManagerConfig(cwd: string): SettingsRecord {
 		if (!existsSync(path)) continue;
 		try {
 			const parsed = JSON.parse(readFileSync(path, "utf8"));
-			const configRoot = asRecord(asRecord(asRecord(parsed?.vstack)?.extensionManager)?.config);
+			const configRoot = asRecord(asRecord(asRecord(parsed?.kendex)?.extensionManager)?.config);
 			const config = asRecord(configRoot?.[PACKAGE_ID]);
 			if (config) mergeDeep(merged, path === userPath ? config : withoutUserScopeOnlyKeys(config));
 		} catch (error) {

package/src/connector-audit.ts

@@ -2,11 +2,9 @@
 //
 // A claude.ai connector tool runs INSIDE the child, on the child's own MCP
 // servers, and is deliberately never mirrored into the Pi stream (see
-// isChildExecutedTool). That is the honest behaviour — mirroring wrote
-// `Tool <name> not found` into the transcript for calls that had SUCCEEDED
-// (drovr#311 / memsira#320) — but it leaves the Pi session with no record that
-// the call happened at all, so "did it really look that up?" could only be
-// answered from the child's own transcript.
+// isChildExecutedTool). Mirroring would write `Tool <name> not found` into the
+// transcript for a successful call. Not mirroring leaves the Pi session with no
+// record that the call happened, so the audit entry records it without dispatch.
 //
 // A pi `CustomEntry` closes that gap without reintroducing the bug: it is
 // persisted in the session file, is NOT a content block, and is documented as
@@ -91,17 +89,15 @@ let auditSink: ConnectorCallAuditSink | undefined;
  * Install (or clear, with `undefined`) a host sink for connector-call records.
  *
  * **The sink ADDS a destination, it never replaces `appendEntry`.** A host that
- * drives real `AgentSession`s gets the transcript-local entries for free, and a
- * replacing sink would take those away and reopen the very audit gap this
- * feature closes (memsira, 2026-07-28 — their `apps/sidecar/src/runtime.ts` is
- * session-backed, and 122 of their app-chat session files carry the bridge's
- * `claude-bridge-session` markers). A host with both a session and a sink has
+ * drives real `AgentSession`s gets transcript-local entries automatically. A
+ * replacing sink would remove those entries and make the session record
+ * incomplete. A host with both a session and a sink has
  * asked for both and gets both.
  *
  * It exists because the OTHER embedding shape gets nothing at all: drovr loads
  * the bundle through a throwaway resource loader over
  * `createAgentSessionServices` with no session, so `extensionApi` is undefined
- * and every record it appended went nowhere (drovr #317, measured live). The
+ * and every record it appended went nowhere (measured live). The
  * sink is the seam such a host can reach without one.
  *
  * A callback rather than another `Symbol.for` global on purpose: the bundle