context-mode 1.0.123 → 1.0.125

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.123"
+    "version": "1.0.125"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.123",
+      "version": "1.0.125",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.123",
+  "version": "1.0.125",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.123",
+  "version": "1.0.125",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.123",
+  "version": "1.0.125",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/README.md

@@ -570,7 +570,7 @@ Full documentation: [`docs/adapters/openclaw.md`](docs/adapters/openclaw.md)
    ```json
    {
      "hooks": {
-      "PreToolUse": [{ "matcher": "local_shell|shell|shell_command|exec_command|container.exec|functions\\.exec_command|Bash|Shell|apply_patch|functions\\.apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__.*__ctx_execute|mcp__.*__ctx_execute_file|mcp__.*__ctx_batch_execute|mcp__.*__ctx_fetch_and_index|mcp__.*__ctx_search|mcp__.*__ctx_index|mcp__(?!.*context-mode)", "hooks": [{ "type": "command", "command": "context-mode hook codex pretooluse" }] }],
+      "PreToolUse": [{ "matcher": "local_shell|shell|shell_command|exec_command|Bash|Shell|apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__", "hooks": [{ "type": "command", "command": "context-mode hook codex pretooluse" }] }],
        "PostToolUse": [{ "hooks": [{ "type": "command", "command": "context-mode hook codex posttooluse" }] }],
        "SessionStart": [{ "hooks": [{ "type": "command", "command": "context-mode hook codex sessionstart" }] }],
        "PreCompact": [{ "hooks": [{ "type": "command", "command": "context-mode hook codex precompact" }] }],
@@ -964,7 +964,7 @@ npm install -g context-mode
 | Tool | What it does | Context saved |
 |---|---|---|
 | `ctx_batch_execute` | Run multiple commands + search multiple queries in ONE call. Opt-in `concurrency: 1-8` for I/O-bound batches. | 986 KB → 62 KB |
-| `ctx_execute` | Run code in 11 languages. Only stdout enters context. | 56 KB → 299 B |
+| `ctx_execute` | Run code in 12 languages. Only stdout enters context. | 56 KB → 299 B |
 | `ctx_execute_file` | Process files in sandbox. Raw content never leaves. | 45 KB → 155 B |
 | `ctx_index` | Chunk markdown into FTS5 with BM25 ranking. | 60 KB → 40 B |
 | `ctx_search` | Query indexed content with multiple queries in one call. | On-demand retrieval |
@@ -978,7 +978,7 @@ npm install -g context-mode
 
 Each `ctx_execute` call spawns an isolated subprocess with its own process boundary. Scripts can't access each other's memory or state. The subprocess runs your code, captures stdout, and only that stdout enters the conversation context. The raw data — log files, API responses, snapshots — never leaves the sandbox.
 
-Eleven language runtimes are available: JavaScript, TypeScript, Python, Shell, Ruby, Go, Rust, PHP, Perl, R, and Elixir. Bun is auto-detected for 3-5x faster JS/TS execution.
+Twelve language runtimes are available: JavaScript, TypeScript, Python, Shell, Ruby, Go, Rust, PHP, Perl, R, Elixir, and C#. Bun is auto-detected for 3-5x faster JS/TS execution.
 
 Authenticated CLIs work through credential passthrough — `gh`, `aws`, `gcloud`, `kubectl`, `docker` inherit environment variables and config paths without exposing them to the conversation.
 

package/build/adapters/claude-code/hooks.d.ts

@@ -25,22 +25,21 @@ export declare const HOOK_TYPES: {
 };
 export type HookType = (typeof HOOK_TYPES)[keyof typeof HOOK_TYPES];
 /**
- * Negative-lookahead matcher for external MCP tool namespaces (#529).
+ * External MCP catch-all matcher for Claude Code (#529, #547 hotfix).
  *
- * Claude Code's hook matcher engine evaluates each entry as a regex against
- * the tool name. This pattern fires on any `mcp__<server>__<tool>` whose
- * server segment is NOT context-mode's own (`plugin_context-mode_...`).
- * Without it, large payloads from external MCPs (slack channel history,
- * telegram messages, gdrive content, notion pages, …) bypass PreToolUse
- * routing and flood the model's context window — PostToolUse runs too late
- * to keep the raw data out.
- *
- * The negative lookahead prevents this entry from double-firing on
- * context-mode's own ctx_* tools, which already have dedicated entries above.
+ * Claude Code's hook matcher engine treats this entry as a substring match
+ * (it also accepts regex, but `mcp__` alone is enough — every MCP tool
+ * surfaces as `mcp__<server>__<tool>`). v1.0.124 used a negative lookahead
+ * `mcp__(?!plugin_context-mode_)` to skip context-mode's own MCP tools,
+ * but this same hooks.json is bundled to Codex CLI which uses Rust's
+ * `regex` crate (no look-around support) — Codex rejected the matcher at
+ * boot, breaking every Codex user (#547). Drop the lookaround on both
+ * sides; the hook BODY (`isExternalMcpTool()` in hooks/core/routing.mjs)
+ * already filters context-mode's own tools, so semantics are preserved.
  */
-export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!plugin_context-mode_)";
+export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 /** Tools that context-mode's PreToolUse hook intercepts. */
-export declare const PRE_TOOL_USE_MATCHERS: readonly ["Bash", "WebFetch", "Read", "Grep", "Agent", "mcp__plugin_context-mode_context-mode__ctx_execute", "mcp__plugin_context-mode_context-mode__ctx_execute_file", "mcp__plugin_context-mode_context-mode__ctx_batch_execute", "mcp__(?!plugin_context-mode_)"];
+export declare const PRE_TOOL_USE_MATCHERS: readonly ["Bash", "WebFetch", "Read", "Grep", "Agent", "mcp__plugin_context-mode_context-mode__ctx_execute", "mcp__plugin_context-mode_context-mode__ctx_execute_file", "mcp__plugin_context-mode_context-mode__ctx_batch_execute", "mcp__"];
 /**
  * Combined matcher pattern for settings.json (pipe-separated).
  * Used by the upgrade command when writing a single consolidated entry.

package/build/adapters/claude-code/hooks.js

@@ -31,20 +31,19 @@ export const HOOK_TYPES = {
 // PreToolUse matchers
 // ─────────────────────────────────────────────────────────
 /**
- * Negative-lookahead matcher for external MCP tool namespaces (#529).
+ * External MCP catch-all matcher for Claude Code (#529, #547 hotfix).
  *
- * Claude Code's hook matcher engine evaluates each entry as a regex against
- * the tool name. This pattern fires on any `mcp__<server>__<tool>` whose
- * server segment is NOT context-mode's own (`plugin_context-mode_...`).
- * Without it, large payloads from external MCPs (slack channel history,
- * telegram messages, gdrive content, notion pages, …) bypass PreToolUse
- * routing and flood the model's context window — PostToolUse runs too late
- * to keep the raw data out.
- *
- * The negative lookahead prevents this entry from double-firing on
- * context-mode's own ctx_* tools, which already have dedicated entries above.
+ * Claude Code's hook matcher engine treats this entry as a substring match
+ * (it also accepts regex, but `mcp__` alone is enough — every MCP tool
+ * surfaces as `mcp__<server>__<tool>`). v1.0.124 used a negative lookahead
+ * `mcp__(?!plugin_context-mode_)` to skip context-mode's own MCP tools,
+ * but this same hooks.json is bundled to Codex CLI which uses Rust's
+ * `regex` crate (no look-around support) — Codex rejected the matcher at
+ * boot, breaking every Codex user (#547). Drop the lookaround on both
+ * sides; the hook BODY (`isExternalMcpTool()` in hooks/core/routing.mjs)
+ * already filters context-mode's own tools, so semantics are preserved.
  */
-export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!plugin_context-mode_)";
+export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 /** Tools that context-mode's PreToolUse hook intercepts. */
 export const PRE_TOOL_USE_MATCHERS = [
     "Bash",

package/build/adapters/claude-code/index.js

@@ -67,7 +67,13 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
         return join(this.getConfigDir(), "settings.json");
     }
     generateHookConfig(pluginRoot) {
-        const preToolUseCommand = `node ${pluginRoot}/hooks/pretooluse.mjs`;
+        // Paths must be double-quoted so that hosts (or our own diagnostic
+        // regex) parse them correctly when pluginRoot contains spaces — common
+        // on Windows where the user folder is e.g. "C:\Users\First Last\...".
+        // Without quotes, extractHookScriptPath's `\S+\.mjs` fallback grabs
+        // only the tail after the last space, producing a doubled-path FAIL
+        // in `ctx doctor`. Matches the quoting style used in hooks/hooks.json.
+        const preToolUseCommand = `node "${pluginRoot}/hooks/pretooluse.mjs"`;
         const preToolUseMatchers = [...PRE_TOOL_USE_MATCHERS];
         return {
             PreToolUse: preToolUseMatchers.map((matcher) => ({
@@ -80,7 +86,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/posttooluse.mjs`,
+                            command: `node "${pluginRoot}/hooks/posttooluse.mjs"`,
                         },
                     ],
                 },
@@ -91,7 +97,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/precompact.mjs`,
+                            command: `node "${pluginRoot}/hooks/precompact.mjs"`,
                         },
                     ],
                 },
@@ -102,7 +108,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/userpromptsubmit.mjs`,
+                            command: `node "${pluginRoot}/hooks/userpromptsubmit.mjs"`,
                         },
                     ],
                 },
@@ -113,7 +119,7 @@ export class ClaudeCodeAdapter extends ClaudeCodeBaseAdapter {
                     hooks: [
                         {
                             type: "command",
-                            command: `node ${pluginRoot}/hooks/sessionstart.mjs`,
+                            command: `node "${pluginRoot}/hooks/sessionstart.mjs"`,
                         },
                     ],
                 },

package/build/adapters/codex/hooks.d.ts

@@ -27,24 +27,23 @@ export declare const HOOK_TYPES: {
     readonly STOP: "Stop";
 };
 /**
- * Negative-lookahead matcher for external MCP tool namespaces on Codex CLI (#529).
+ * External MCP catch-all matcher for Codex CLI (#529, #547 hotfix).
  *
  * Codex CLI's hook `tool_name` payload uses `mcp__<server>__<tool>` for any
- * MCP-namespaced tool — verified by configs/codex/hooks.json which already
- * matches `mcp__.*__ctx_execute` style for context-mode's OWN MCP tools. This
- * pattern fires PreToolUse for any external `mcp__<server>__<tool>` whose
- * server segment does NOT contain `context-mode`. Without it, large payloads
- * from slack / telegram / gdrive / notion-style MCPs bypass the routing nudge
- * and flood the model's context — PostToolUse runs too late to keep raw data
- * out.
+ * MCP-namespaced tool. Originally this constant used a negative lookahead
+ * `mcp__(?!.*context-mode)` to exclude context-mode's own MCP tools at the
+ * matcher layer. v1.0.124 shipped that pattern and Codex (Rust `regex` crate)
+ * rejected the matcher at boot with "look-around not supported", breaking
+ * every Codex user (#547).
  *
- * The negative lookahead `(?!.*context-mode)` covers both naming variants
- * Codex sees in practice: the canonical `mcp__context-mode__ctx_*` AND the
- * Claude Code plugin shim `mcp__plugin_context-mode_context-mode__ctx_*`.
- * Codex own bare names (ctx_execute, local_shell, …) are not `mcp__`-prefixed
- * and are unaffected.
+ * Fix: drop the lookaround. The matcher is now a charset-clean literal
+ * (`[A-Za-z0-9_|]` only), satisfying Codex's `is_exact_matcher`
+ * (refs/platforms/codex/codex-rs/hooks/src/events/common.rs:152) which
+ * short-circuits the regex engine entirely. context-mode's own MCP tools are
+ * already filtered in the hook BODY by `isExternalMcpTool()` in
+ * hooks/core/routing.mjs — semantics preserved.
  */
-export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!.*context-mode)";
+export declare const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 /**
  * Path to the routing instructions file for Codex CLI.
  * Used as fallback routing awareness alongside hook-based enforcement.

package/build/adapters/codex/hooks.js

@@ -33,24 +33,23 @@ export const HOOK_TYPES = {
 // External MCP routing matcher (#529)
 // ─────────────────────────────────────────────────────────
 /**
- * Negative-lookahead matcher for external MCP tool namespaces on Codex CLI (#529).
+ * External MCP catch-all matcher for Codex CLI (#529, #547 hotfix).
  *
  * Codex CLI's hook `tool_name` payload uses `mcp__<server>__<tool>` for any
- * MCP-namespaced tool — verified by configs/codex/hooks.json which already
- * matches `mcp__.*__ctx_execute` style for context-mode's OWN MCP tools. This
- * pattern fires PreToolUse for any external `mcp__<server>__<tool>` whose
- * server segment does NOT contain `context-mode`. Without it, large payloads
- * from slack / telegram / gdrive / notion-style MCPs bypass the routing nudge
- * and flood the model's context — PostToolUse runs too late to keep raw data
- * out.
+ * MCP-namespaced tool. Originally this constant used a negative lookahead
+ * `mcp__(?!.*context-mode)` to exclude context-mode's own MCP tools at the
+ * matcher layer. v1.0.124 shipped that pattern and Codex (Rust `regex` crate)
+ * rejected the matcher at boot with "look-around not supported", breaking
+ * every Codex user (#547).
  *
- * The negative lookahead `(?!.*context-mode)` covers both naming variants
- * Codex sees in practice: the canonical `mcp__context-mode__ctx_*` AND the
- * Claude Code plugin shim `mcp__plugin_context-mode_context-mode__ctx_*`.
- * Codex own bare names (ctx_execute, local_shell, …) are not `mcp__`-prefixed
- * and are unaffected.
+ * Fix: drop the lookaround. The matcher is now a charset-clean literal
+ * (`[A-Za-z0-9_|]` only), satisfying Codex's `is_exact_matcher`
+ * (refs/platforms/codex/codex-rs/hooks/src/events/common.rs:152) which
+ * short-circuits the regex engine entirely. context-mode's own MCP tools are
+ * already filtered in the hook BODY by `isExternalMcpTool()` in
+ * hooks/core/routing.mjs — semantics preserved.
  */
-export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__(?!.*context-mode)";
+export const EXTERNAL_MCP_MATCHER_PATTERN = "mcp__";
 // ─────────────────────────────────────────────────────────
 // Routing instructions
 // ─────────────────────────────────────────────────────────

package/build/adapters/codex/index.js

@@ -18,14 +18,25 @@ import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BaseAdapter } from "../base.js";
 import { resolveCodexConfigDir } from "./paths.js";
-// PreToolUse matcher: canonical Codex tool names + context-mode own MCP tools
-// (both bare and `mcp__<server>__<tool>` forms) + external MCP catch-all (#529).
-// The final `mcp__(?!.*context-mode)` segment uses a negative lookahead that
-// excludes any `mcp__` tool whose server segment contains `context-mode` so
-// context-mode's own MCP tools (already wired by the explicit entries above)
-// are not double-routed. Keep this as a single string literal — `codex.test.ts`
-// drift-guard parses the source with a `"([^"]+)"` regex.
-const PRE_TOOL_USE_MATCHER_PATTERN = "local_shell|shell|shell_command|exec_command|container.exec|functions\\.exec_command|Bash|Shell|apply_patch|functions\\.apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__.*__ctx_execute|mcp__.*__ctx_execute_file|mcp__.*__ctx_batch_execute|mcp__.*__ctx_fetch_and_index|mcp__.*__ctx_search|mcp__.*__ctx_index|mcp__(?!.*context-mode)";
+// PreToolUse matcher: canonical Codex tool names + context-mode bare MCP tool
+// names + external MCP catch-all literal (#529, #547 hotfix).
+//
+// Codex CLI's Rust `regex` crate does NOT support look-around, and
+// `is_exact_matcher` (refs/platforms/codex/codex-rs/hooks/src/events/common.rs:152)
+// short-circuits the regex engine entirely when the matcher contains only
+// [A-Za-z0-9_|]. v1.0.124 shipped a matcher with `(?!.*context-mode)` AND
+// `mcp__.*__ctx_*` regex syntax — Codex rejected the file at boot with
+// "look-around not supported" → all v1.0.124 Codex users broken (#547).
+//
+// Fix: keep only literal tool names (charset-clean). The hook BODY already
+// filters context-mode's own MCP tools via `isExternalMcpTool()` in
+// hooks/core/routing.mjs, so dropping `mcp__.*__ctx_*` and the lookaround
+// preserves end-to-end semantics. The literal `mcp__` final segment is a
+// no-op under exact-matcher mode but kept for parity with hooks/hooks.json.
+//
+// Keep this as a single string literal — `codex.test.ts` drift-guard parses
+// the source with a `"([^"]+)"` regex.
+const PRE_TOOL_USE_MATCHER_PATTERN = "local_shell|shell|shell_command|exec_command|Bash|Shell|apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__";
 const CODEX_HOOK_COMMANDS = {
     PreToolUse: "context-mode hook codex pretooluse",
     PostToolUse: "context-mode hook codex posttooluse",

package/build/adapters/detect.d.ts

@@ -29,11 +29,55 @@ export declare function __resetClaudeCodePluginCacheForTests(): void;
  */
 export declare function __seedClaudeCodePluginCacheMissForTests(): void;
 /**
- * High-confidence env vars per platform, checked in priority order.
- * Single source of truth — consumed by detectPlatform() below and by
- * tests that need to clear platform-related env vars deterministically.
+ * Tag for each PLATFORM_ENV_VARS row.
+ *   - `workspace`: env var names a project/working directory. Used by
+ *     `resolveProjectDir({ strictPlatform })` to form the candidate list,
+ *     and by Pi's bridge to scrub foreign workspace vars on child spawn.
+ *   - `identification`: env var only signals which host is running; carries
+ *     no project path. NEVER scrubbed (some are load-bearing, e.g.
+ *     CLAUDE_PLUGIN_ROOT for hook integrations).
+ *
+ * Issue #545 — algorithmic env-leak fix. The split allows resolveProjectDir
+ * to derive ALLOW (own workspace vars) and BAN (other platforms' workspace
+ * vars) sets from a single registry, satisfying MUST-3 (15 adapters equal).
+ */
+export type EnvVarRole = "workspace" | "identification";
+export interface PlatformEnvEntry {
+    readonly name: string;
+    readonly role: EnvVarRole;
+    /**
+     * When `false`, this entry is NOT used as a high-confidence detection
+     * signal — only consumed by `workspaceEnvVarsFor`/`foreignWorkspaceEnv`
+     * (project-dir cascade and bridge env scrub). Use for consumer-set
+     * workspace vars that the host runtime never emits itself, so that a
+     * stale env var on an unrelated host does not misclassify the platform.
+     * Default: `true` (entry participates in detection).
+     *
+     * Issue #542 — PI_PROJECT_DIR / PI_WORKSPACE_DIR are consumer-set and
+     * MUST NOT trigger Pi detection on their own.
+     */
+    readonly detect?: boolean;
+}
+export declare const PLATFORM_ENV_VARS: ReadonlyMap<PlatformId, readonly PlatformEnvEntry[]>;
+/**
+ * Backwards-compat shim: legacy `string[]` shape used by detection logic and
+ * by tests that iterate the registry to clear env vars. Always returns the
+ * names in registry order.
+ */
+export declare function getEnvVarNames(platform: PlatformId): string[];
+/**
+ * Issue #545 — return only role=workspace env var names for a platform, in
+ * registry order. Empty array for adapters with no workspace var (e.g.
+ * codex, kilo, zed, antigravity, openclaw, kiro). Consumed by
+ * `resolveProjectDir({ strictPlatform })` to build the cascade.
+ */
+export declare function workspaceEnvVarsFor(platform: PlatformId): string[];
+/**
+ * Issue #545 — return the union of workspace env vars from ALL platforms
+ * EXCEPT the given one. Consumed by Pi's bridge env scrub (strip foreign
+ * workspace vars from spawned MCP child) and by the matrix regression test.
  */
-export declare const PLATFORM_ENV_VARS: readonly [readonly ["claude-code", readonly ["CLAUDE_CODE_ENTRYPOINT", "CLAUDE_PLUGIN_ROOT", "CLAUDE_PROJECT_DIR", "CLAUDE_SESSION_ID"]], readonly ["antigravity", readonly ["ANTIGRAVITY_CLI_ALIAS"]], readonly ["cursor", readonly ["CURSOR_TRACE_ID", "CURSOR_CLI"]], readonly ["kilo", readonly ["KILO", "KILO_PID"]], readonly ["opencode", readonly ["OPENCODE", "OPENCODE_PID"]], readonly ["zed", readonly ["ZED_SESSION_ID", "ZED_TERM"]], readonly ["codex", readonly ["CODEX_THREAD_ID", "CODEX_CI"]], readonly ["gemini-cli", readonly ["GEMINI_PROJECT_DIR", "GEMINI_CLI"]], readonly ["vscode-copilot", readonly ["VSCODE_PID", "VSCODE_CWD"]], readonly ["jetbrains-copilot", readonly ["IDEA_INITIAL_DIRECTORY"]], readonly ["qwen-code", readonly ["QWEN_PROJECT_DIR"]], readonly ["omp", readonly ["PI_CODING_AGENT_DIR"]], readonly ["pi", readonly ["PI_CONFIG_DIR", "PI_SESSION_FILE", "PI_COMPILED"]]];
+export declare function foreignWorkspaceEnv(platform: PlatformId): Set<string>;
 /**
  * Sync map from platform identifier → home-relative path segments where that
  * platform stores its config. Mirrors the `super([...])` argument passed by

package/build/adapters/detect.js

@@ -59,10 +59,15 @@ export function __seedClaudeCodePluginCacheMissForTests() {
 }
 /**
  * High-confidence env vars per platform, checked in priority order.
- * Single source of truth — consumed by detectPlatform() below and by
- * tests that need to clear platform-related env vars deterministically.
+ * Single source of truth — consumed by detectPlatform() below, by
+ * `resolveProjectDir({ strictPlatform })` for cascade construction, and by
+ * Pi's bridge env scrub. Tests also iterate this map to clear platform-
+ * related env vars deterministically.
+ *
+ * The map shape is `Map<PlatformId, ReadonlyArray<PlatformEnvEntry>>`. Use
+ * `getEnvVarNames(p)` to get just the names (legacy `string[]` shape).
  */
-export const PLATFORM_ENV_VARS = [
+const _PLATFORM_ENV_VARS_RAW = [
     // Order matters: forks listed BEFORE the fork's parent so collision
     // detection works. Every entry verified against platform's own runtime
     // source code (PR #376 follow-up: full audit, May 2026 — see git blame).
@@ -75,49 +80,84 @@ export const PLATFORM_ENV_VARS = [
     // are the disambiguators for issue #539 (Claude Code running inside a
     // VS Code integrated terminal that has VSCODE_PID set). They MUST be
     // checked here so detect resolves to claude-code BEFORE falling through
-    // to vscode-copilot at line 70 below.
+    // to vscode-copilot below.
     ["claude-code", [
-            "CLAUDE_CODE_ENTRYPOINT",
-            "CLAUDE_PLUGIN_ROOT",
-            "CLAUDE_PROJECT_DIR",
-            "CLAUDE_SESSION_ID",
+            { name: "CLAUDE_CODE_ENTRYPOINT", role: "identification" },
+            { name: "CLAUDE_PLUGIN_ROOT", role: "identification" },
+            { name: "CLAUDE_PROJECT_DIR", role: "workspace" },
+            { name: "CLAUDE_SESSION_ID", role: "identification" },
         ]],
     // antigravity (Electron/VSCode fork) — google-gemini/gemini-cli
     // packages/core/src/ide/detect-ide.ts checks ANTIGRAVITY_CLI_ALIAS as the
     // canonical Antigravity marker. Listed before vscode-copilot.
-    ["antigravity", ["ANTIGRAVITY_CLI_ALIAS"]],
+    ["antigravity", [
+            { name: "ANTIGRAVITY_CLI_ALIAS", role: "identification" },
+        ]],
     // cursor (VSCode fork) — listed before vscode-copilot. CURSOR_TRACE_ID has
     // 800+ hits in major OSS detection libs (Vercel Next.js, Bun, Google
-    // gemini-cli, Nx, CrewAI).
-    ["cursor", ["CURSOR_TRACE_ID", "CURSOR_CLI"]],
+    // gemini-cli, Nx, CrewAI). CURSOR_CWD is the documented workspace var
+    // (issue #521) — listed first so workspace cascade picks it up.
+    ["cursor", [
+            { name: "CURSOR_CWD", role: "workspace" },
+            { name: "CURSOR_TRACE_ID", role: "identification" },
+            { name: "CURSOR_CLI", role: "identification" },
+        ]],
     // kilo (OpenCode fork) — Kilo-Org/kilocode packages/opencode/src/index.ts:138 + 139
-    // sets `process.env.KILO = 1` + `process.env.KILO_PID = String(process.pid)`. 
-    ["kilo", ["KILO", "KILO_PID"]],
+    // sets `process.env.KILO = 1` + `process.env.KILO_PID = String(process.pid)`.
+    ["kilo", [
+            { name: "KILO", role: "identification" },
+            { name: "KILO_PID", role: "identification" },
+        ]],
     // opencode — sst/opencode packages/opencode/src/index.ts:108-109 sets
     // OPENCODE=1 + OPENCODE_PID=<pid> on every CLI invocation.
-    ["opencode", ["OPENCODE", "OPENCODE_PID"]],
+    // OPENCODE_PROJECT_DIR is the documented workspace var (consumed by the
+    // legacy resolver cascade) — listed first so the workspace cascade picks
+    // it up under strict mode.
+    ["opencode", [
+            { name: "OPENCODE_PROJECT_DIR", role: "workspace" },
+            { name: "OPENCODE", role: "identification" },
+            { name: "OPENCODE_PID", role: "identification" },
+        ]],
     // zed — zed-industries/zed crates/terminal/src/terminal.rs sets ZED_TERM=true
     // in `insert_zed_terminal_env()`. Google's gemini-cli uses ZED_SESSION_ID.
-    ["zed", ["ZED_SESSION_ID", "ZED_TERM"]],
+    ["zed", [
+            { name: "ZED_SESSION_ID", role: "identification" },
+            { name: "ZED_TERM", role: "identification" },
+        ]],
     // codex — openai/codex codex-rs/core/src/exec_env.rs sets CODEX_THREAD_ID
     // per exec; unified_exec/process_manager.rs sets CODEX_CI in CI mode.
-    ["codex", ["CODEX_THREAD_ID", "CODEX_CI"]],
+    ["codex", [
+            { name: "CODEX_THREAD_ID", role: "identification" },
+            { name: "CODEX_CI", role: "identification" },
+        ]],
     // gemini-cli — GEMINI_PROJECT_DIR per google-gemini/gemini-cli
     // docs/hooks/index.md; GEMINI_CLI is the MCP-server sentinel.
-    ["gemini-cli", ["GEMINI_PROJECT_DIR", "GEMINI_CLI"]],
+    ["gemini-cli", [
+            { name: "GEMINI_PROJECT_DIR", role: "workspace" },
+            { name: "GEMINI_CLI", role: "identification" },
+        ]],
     // vscode-copilot — VSCODE_PID + VSCODE_CWD set by microsoft/vscode bootstrap.
     // Listed AFTER cursor and antigravity since they inherit these vars as forks.
-    ["vscode-copilot", ["VSCODE_PID", "VSCODE_CWD"]],
+    ["vscode-copilot", [
+            { name: "VSCODE_CWD", role: "workspace" },
+            { name: "VSCODE_PID", role: "identification" },
+        ]],
     // jetbrains-copilot — IDEA_INITIAL_DIRECTORY set by JetBrains launcher.
     // (IDEA_HOME and JETBRAINS_CLIENT_ID removed — no source-line evidence.)
-    ["jetbrains-copilot", ["IDEA_INITIAL_DIRECTORY"]],
+    ["jetbrains-copilot", [
+            { name: "IDEA_INITIAL_DIRECTORY", role: "workspace" },
+        ]],
     // qwen-code — QWEN_PROJECT_DIR per QwenLM/qwen-code docs/users/features/hooks.md.
     // (QWEN_SESSION_ID removed — 0 hits in qwen-code repository.)
-    ["qwen-code", ["QWEN_PROJECT_DIR"]],
+    ["qwen-code", [
+            { name: "QWEN_PROJECT_DIR", role: "workspace" },
+        ]],
     // omp (can1357/oh-my-pi). PI_CODING_AGENT_DIR is the upstream
     // agent-dir override per `packages/utils/src/dirs.ts:193`. Listed
     // BEFORE pi so OMP is not misclassified as Pi when both are installed.
-    ["omp", ["PI_CODING_AGENT_DIR"]],
+    ["omp", [
+            { name: "PI_CODING_AGENT_DIR", role: "workspace" },
+        ]],
     // pi — Issue #542 marker correction. PI_PROJECT_DIR is a consumer-set
     // var (read by src/adapters/pi/extension.ts) but is NOT auto-set by
     // the Pi runtime — verified against
@@ -126,11 +166,62 @@ export const PLATFORM_ENV_VARS = [
     // PI_CONFIG_DIR (config dir override), PI_SESSION_FILE (active session
     // path), and PI_COMPILED (binary build marker). PI_CODING_AGENT_DIR is
     // owned by OMP above; keep it there.
-    ["pi", ["PI_CONFIG_DIR", "PI_SESSION_FILE", "PI_COMPILED"]],
+    //
+    // Issue #545 — PI_WORKSPACE_DIR / PI_PROJECT_DIR are workspace vars set
+    // by Pi's bridge so the resolver picks them up under strict mode.
+    // PI_WORKSPACE_DIR comes first (extension-set, freshest) before
+    // PI_PROJECT_DIR (user override) per registry-author cascade order.
+    ["pi", [
+            // Issue #545 — workspace vars set by Pi's bridge so resolveProjectDir
+            // under strict mode picks them up. detect=false because PI_*_DIR are
+            // consumer-set and must NOT misclassify a non-Pi host as Pi (#542).
+            { name: "PI_WORKSPACE_DIR", role: "workspace", detect: false },
+            { name: "PI_PROJECT_DIR", role: "workspace", detect: false },
+            { name: "PI_CONFIG_DIR", role: "identification" },
+            { name: "PI_SESSION_FILE", role: "identification" },
+            { name: "PI_COMPILED", role: "identification" },
+        ]],
     // openclaw — removed (runtime never sets OPENCLAW_HOME or OPENCLAW_CLI;
     // detection falls through to ~/.openclaw/ config-dir tier below).
     // kiro — not listed (no auto-set process env vars; ~/.kiro/ config-dir tier).
 ];
+export const PLATFORM_ENV_VARS = new Map(_PLATFORM_ENV_VARS_RAW);
+/**
+ * Backwards-compat shim: legacy `string[]` shape used by detection logic and
+ * by tests that iterate the registry to clear env vars. Always returns the
+ * names in registry order.
+ */
+export function getEnvVarNames(platform) {
+    return (PLATFORM_ENV_VARS.get(platform) ?? []).map((e) => e.name);
+}
+/**
+ * Issue #545 — return only role=workspace env var names for a platform, in
+ * registry order. Empty array for adapters with no workspace var (e.g.
+ * codex, kilo, zed, antigravity, openclaw, kiro). Consumed by
+ * `resolveProjectDir({ strictPlatform })` to build the cascade.
+ */
+export function workspaceEnvVarsFor(platform) {
+    return (PLATFORM_ENV_VARS.get(platform) ?? [])
+        .filter((e) => e.role === "workspace")
+        .map((e) => e.name);
+}
+/**
+ * Issue #545 — return the union of workspace env vars from ALL platforms
+ * EXCEPT the given one. Consumed by Pi's bridge env scrub (strip foreign
+ * workspace vars from spawned MCP child) and by the matrix regression test.
+ */
+export function foreignWorkspaceEnv(platform) {
+    const ban = new Set();
+    for (const [p, vars] of PLATFORM_ENV_VARS) {
+        if (p === platform)
+            continue;
+        for (const v of vars) {
+            if (v.role === "workspace")
+                ban.add(v.name);
+        }
+    }
+    return ban;
+}
 /**
  * Sync map from platform identifier → home-relative path segments where that
  * platform stores its config. Mirrors the `super([...])` argument passed by
@@ -204,7 +295,7 @@ export function detectPlatform(clientInfo) {
     }
     // ── High confidence: environment variables ─────────────
     for (const [platform, vars] of PLATFORM_ENV_VARS) {
-        if (vars.some((v) => process.env[v])) {
+        if (vars.some((v) => v.detect !== false && process.env[v.name])) {
             // Issue #539 belt-and-suspenders: VSCODE_PID/VSCODE_CWD are exported
             // by VS Code into EVERY child process — including a Claude Code CLI
             // launched from the integrated terminal. If env vars alone want to
@@ -224,7 +315,7 @@ export function detectPlatform(clientInfo) {
             return {
                 platform,
                 confidence: "high",
-                reason: `${vars.join(" or ")} env var set`,
+                reason: `${vars.filter((v) => v.detect !== false).map((v) => v.name).join(" or ")} env var set`,
             };
         }
     }

package/build/adapters/opencode/plugin.js

@@ -102,7 +102,7 @@ function getPlatform() {
     for (const [platform, vars] of PLATFORM_ENV_VARS) {
         if (platform !== "kilo" && platform !== "opencode")
             continue;
-        if (vars.some((v) => process.env[v])) {
+        if (vars.some((v) => process.env[v.name])) {
             return platform;
         }
     }