context-mode 1.0.135 → 1.0.137

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "1.0.135"
+    "version": "1.0.137"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "1.0.135",
+      "version": "1.0.137",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.135",
+  "version": "1.0.137",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",
@@ -27,5 +27,5 @@
       ]
     }
   },
-  "skills": "./skills/"
+  "skills": "./.claude/skills/"
 }

package/.codex-plugin/hooks.json

@@ -0,0 +1,65 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "local_shell|shell|shell_command|exec_command|Bash|Shell|apply_patch|Edit|Write|grep_files|ctx_execute|ctx_execute_file|ctx_batch_execute|ctx_fetch_and_index|ctx_search|ctx_index|mcp__",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/codex/pretooluse.mjs\""
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/codex/posttooluse.mjs\""
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/codex/sessionstart.mjs\""
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/codex/precompact.mjs\""
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/codex/userpromptsubmit.mjs\""
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/hooks/codex/stop.mjs\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/.codex-plugin/mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "context-mode": {
+      "command": "node",
+      "args": ["./start.mjs"],
+      "cwd": "."
+    }
+  }
+}

package/.codex-plugin/plugin.json

@@ -0,0 +1,31 @@
+{
+  "name": "context-mode",
+  "version": "1.0.137",
+  "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
+  "author": {
+    "name": "Mert Koseoğlu",
+    "url": "https://github.com/mksglu"
+  },
+  "homepage": "https://github.com/mksglu/context-mode#readme",
+  "repository": "https://github.com/mksglu/context-mode",
+  "license": "Elastic-2.0",
+  "keywords": [
+    "mcp",
+    "context-window",
+    "sandbox",
+    "code-execution",
+    "fts5",
+    "bm25",
+    "playwright",
+    "context7"
+  ],
+  "mcpServers": "./.codex-plugin/mcp.json",
+  "hooks": "./.codex-plugin/hooks.json",
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "context-mode",
+    "shortDescription": "98% context window savings via FTS5 + sandboxed execution",
+    "developerName": "Mert Koseoğlu",
+    "category": "Productivity"
+  }
+}

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "1.0.135",
+  "version": "1.0.137",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "1.0.135",
+  "version": "1.0.137",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/README.md

@@ -421,17 +421,11 @@ Full configs: [`configs/cursor/hooks.json`](configs/cursor/hooks.json) | [`confi
    ```json
    {
      "$schema": "https://opencode.ai/config.json",
-     "mcp": {
-       "context-mode": {
-         "type": "local",
-         "command": ["context-mode"]
-       }
-     },
      "plugin": ["context-mode"]
    }
    ```
 
-   The `mcp` entry registers all 11 MCP tools. The `plugin` entry enables hooks — OpenCode calls the plugin's TypeScript functions directly before and after each tool execution, blocking dangerous commands and enforcing sandbox routing.
+   The `plugin` entry registers all 11 `ctx_*` tools natively and enables hooks — OpenCode calls context-mode's TypeScript plugin in-process, so there is no redundant stdio MCP child per session.
 
 3. *(Optional)* Copy the routing rules file. The model needs an `AGENTS.md` file for routing awareness:
 
@@ -471,17 +465,11 @@ Full configs: [`configs/opencode/opencode.json`](configs/opencode/opencode.json)
    ```json
    {
      "$schema": "https://app.kilo.ai/config.json",
-     "mcp": {
-       "context-mode": {
-         "type": "local",
-         "command": ["context-mode"]
-       }
-     },
      "plugin": ["context-mode"]
    }
    ```
 
-   The `mcp` entry registers all 11 MCP tools. The `plugin` entry enables hooks — KiloCode calls the plugin's TypeScript functions directly before and after each tool execution, blocking dangerous commands and enforcing sandbox routing.
+   The `plugin` entry registers all 11 `ctx_*` tools natively and enables hooks — KiloCode calls context-mode's TypeScript plugin in-process, so there is no redundant stdio MCP child per session.
 
 3. *(Optional)* Copy the routing rules file. KiloCode shares the OpenCode plugin architecture, so the model needs an `AGENTS.md` file for routing awareness:
 
@@ -545,6 +533,45 @@ Full documentation: [`docs/adapters/openclaw.md`](docs/adapters/openclaw.md)
 
 **Install:**
 
+1. Add the context-mode marketplace and install the plugin from Codex's plugin UI:
+
+   ```bash
+   codex plugin marketplace add mksglu/context-mode
+   ```
+
+2. Enable plugin-provided hooks while the Codex feature is still gated:
+
+   ```toml
+   [features]
+   plugin_hooks = true
+   hooks = true
+   ```
+
+   > **Feature flag note:** Current Codex builds expose hooks under `[features].hooks`
+   > (or `codex --enable hooks`). Prefer `[features].hooks`; `[features].codex_hooks`
+   > remains accepted as a legacy alias in current Codex builds. Bundled plugin hooks
+   > additionally require `plugin_hooks` until Codex enables plugin hooks by default.
+
+3. Restart Codex CLI and verify MCP with `ctx stats`.
+
+   `ctx stats` proves the plugin MCP server is installed and reachable; it does
+   not prove hooks are trusted or running.
+
+4. Review and trust the context-mode plugin hooks if Codex prompts for hook
+   approval. Plugin hooks are only active after both feature flags are enabled
+   and Codex has accepted the hook commands.
+
+The Codex plugin manifest provides MCP via `.codex-plugin/mcp.json`, skills via
+`skills/`, and bundled hooks via `.codex-plugin/hooks.json`. No manual
+`[mcp_servers.context-mode]` block or `$CODEX_HOME/hooks.json` is needed when
+`plugin_hooks` is enabled and the plugin hooks are trusted.
+
+> **Node/PATH note:** context-mode still needs `node` visible to the Codex process.
+> The plugin removes manual Codex config, but it does not vendor Node or inherit
+> login-shell PATH fixes automatically.
+
+**Manual fallback for Codex builds without `plugin_hooks`:**
+
 1. Install context-mode globally:
 
    ```bash
@@ -561,11 +588,7 @@ Full documentation: [`docs/adapters/openclaw.md`](docs/adapters/openclaw.md)
    command = "context-mode"
    ```
 
-   > **Feature flag note:** Current Codex builds expose hooks under `[features].hooks`
-   > (or `codex --enable hooks`). Prefer `[features].hooks`; `[features].codex_hooks`
-   > remains accepted as a legacy alias in current Codex builds.
-
-3. Add hooks for routing enforcement and session tracking. Create `$CODEX_HOME/hooks.json` (or `~/.codex/hooks.json` when `CODEX_HOME` is unset):
+3. Create `$CODEX_HOME/hooks.json` (or `~/.codex/hooks.json` when `CODEX_HOME` is unset):
 
    ```json
    {
@@ -597,9 +620,9 @@ Full documentation: [`docs/adapters/openclaw.md`](docs/adapters/openclaw.md)
 
 5. Restart Codex CLI.
 
-**Verify:** Start a session and type `ctx stats`. Context-mode tools should appear and respond.
+**Verify:** Start a session and type `ctx stats` to verify MCP. To verify hook routing, confirm Codex lists/trusts the context-mode plugin hooks, then run a command that matches the routing rules.
 
-**Routing:** MCP tools work. Hook-based routing is active when `$CODEX_HOME/hooks.json` or `~/.codex/hooks.json` is configured. The `AGENTS.md` file provides routing instructions for model awareness.
+**Routing:** MCP tools work after plugin install. Plugin hook routing is active only when `hooks` and `plugin_hooks` are enabled and Codex trusts the plugin hook commands. Manual hook routing is active when `$CODEX_HOME/hooks.json` or `~/.codex/hooks.json` is configured. The `AGENTS.md` file provides routing instructions for model awareness.
 
 </details>
 
@@ -1157,6 +1180,7 @@ Detailed event data is also indexed into FTS5 for on-demand retrieval via `ctx_s
 **Kiro** — Partial coverage. Native `preToolUse` and `postToolUse` hooks capture tool events and enforce sandbox routing. `agentSpawn` (the Kiro equivalent of SessionStart) is not yet implemented, so session restore after compaction is not available. Requires manually copying `KIRO.md` to your project root. Auto-detected via MCP protocol handshake (`clientInfo.name`).
 
 **Pi Coding Agent** — High coverage. The extension registers all key lifecycle events: `tool_call` (PreToolUse), `tool_result` (PostToolUse), `session_start` (SessionStart), and `session_before_compact` (PreCompact). File edits, git ops, errors, and tasks are fully tracked. Session restore after compaction works via the extension's event hooks.
+Tool call output can be collapsed/expanded with the default Pi's default keybinding (Ctrl+O)
 
 **OMP (Oh My Pi)** — High coverage. The plugin (installed via `omp plugin install context-mode`) registers all key lifecycle events: `tool_call` (PreToolUse), `tool_result` (PostToolUse), `session_start` (SessionStart), and `session_before_compact` (PreCompact). Storage roots cleanly under `~/.omp/context-mode/` so OMP and Pi installs never share state (issue [#473](https://github.com/mksglu/context-mode/issues/473)). Auto-detected via `PI_CODING_AGENT_DIR` env var or presence of `~/.omp/`.
 
@@ -1363,14 +1387,19 @@ That blocks loopback + RFC1918 + ULA in addition to the always-blocked ranges. U
 
 ### Lifecycle environment variables
 
-Two runtime knobs control how MCP server processes self-manage. Defaults are safe — only set these to opt-out of the leak-fix introduced in v1.0.132 ([#565](https://github.com/mksglu/context-mode/issues/565) / [#568](https://github.com/mksglu/context-mode/pull/568)).
+One runtime knob controls MCP sibling cleanup. Idle self-shutdown was removed after [#592](https://github.com/mksglu/context-mode/issues/592): hosts can keep registered tool handles after a clean MCP exit, making a timer-driven exit unsafe.
 
 | Variable | Default | Purpose |
 |---|---|---|
-| `CONTEXT_MODE_IDLE_TIMEOUT_MS` | `900000` (15 min) | An MCP child self-exits cleanly after this many milliseconds of stdin/request inactivity. Hosts like OpenCode and KiloCode open one MCP child per session and per subagent — without this, idle children accumulate to 25+ processes / 1.6 GB RSS in long-lived shells. Set to `0` to disable self-shutdown (rarely needed; useful only for daemons that must outlive their parent). |
 | `CONTEXT_MODE_STARTUP_SWEEP` | `1` (enabled) | At boot, a newly-spawned MCP child reaps any other context-mode MCP server pids that share its parent process (`sameParentOnly: true` — never touches MCP children of a different host). This reclaims accumulated siblings immediately instead of waiting for each idle timer to fire. Set to `0` or `false` to disable (useful when you intentionally want multiple concurrent MCP children under the same host, e.g. multi-tenant test runners). |
 
-Both vars are read fresh at MCP server start — no restart of the host CLI is required, just spawn a new MCP child (open a new session) for changes to take effect. Invalid values (non-numeric `CONTEXT_MODE_IDLE_TIMEOUT_MS`, unrecognized `CONTEXT_MODE_STARTUP_SWEEP`) fall back to defaults silently.
+`CONTEXT_MODE_STARTUP_SWEEP` is read fresh at MCP server start — no restart of the host CLI is required, just spawn a new MCP child (open a new session) for changes to take effect. Unrecognized values fall back to enabled.
+
+### Routing-guidance environment variables
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `CONTEXT_MODE_EXTERNAL_MCP_NUDGE_EVERY` | `10` | Cadence (in tool calls) at which the PreToolUse hook re-injects the "wrap large external-MCP payloads in `ctx_execute`" guidance. The original implementation ([#529](https://github.com/mksglu/context-mode/pull/529)) fired only once per session, which got lost after context compaction in MCP-heavy sessions (e.g. 50+ Jira/Slack/Notion calls — see [#567](https://github.com/mksglu/context-mode/issues/567) follow-up). The default re-fires every 10th matching call, keeping the guidance in the model's recent window. Range `[1, 100]`; invalid values fall back to `10`. Set to `1` for "every call" (most aggressive — adds ~250 tokens/call) or to a larger value for less frequent reminders. |
 
 ## Contributing
 

package/build/adapters/codex/index.js

@@ -402,7 +402,7 @@ export class CodexAdapter extends BaseAdapter {
                 }]);
         }
         const expected = this.generateHookConfig("");
-        return results.concat(Object.entries(expected).map(([hookName, entries]) => {
+        const hookChecks = Object.entries(expected).map(([hookName, entries]) => {
             const actualEntries = hookConfig.config.hooks?.[hookName];
             const expectedEntry = entries[0];
             const ok = Array.isArray(actualEntries)
@@ -410,7 +410,7 @@ export class CodexAdapter extends BaseAdapter {
             const missingStatus = hookName === "PreCompact" ? "warn" : "fail";
             return {
                 check: `${hookName} hook`,
-                status: ok ? "pass" : missingStatus,
+                status: (ok ? "pass" : missingStatus),
                 message: ok
                     ? `${hookName} hook configured in ${this.getHooksPath()}`
                     : hookName === "PreCompact"
@@ -418,7 +418,28 @@ export class CodexAdapter extends BaseAdapter {
                         : `${hookName} hook missing or not pointing to context-mode`,
                 fix: ok ? undefined : `Update ${this.getHooksPath()} to match configs/codex/hooks.json`,
             };
-        }));
+        });
+        // #603: surface duplicate context-mode entries per hook event. Codex fires
+        // every matching entry, so duplicates double the work, can saturate the
+        // MCP transport (`Transport closed`), and have been observed to inflate
+        // codex-tui.log into the multi-GB range. `context-mode upgrade` collapses
+        // them via `upsertManagedHookEntry`, so the fix is one command away.
+        const duplicateChecks = [];
+        for (const hookName of Object.keys(expected)) {
+            const actualEntries = hookConfig.config.hooks?.[hookName];
+            if (!Array.isArray(actualEntries))
+                continue;
+            const managedCount = actualEntries.filter((entry) => this.isManagedContextModeEntry(hookName, entry)).length;
+            if (managedCount > 1) {
+                duplicateChecks.push({
+                    check: `${hookName} duplicates`,
+                    status: "warn",
+                    message: `${managedCount} context-mode entries found for ${hookName} in ${this.getHooksPath()}; Codex will fire all of them`,
+                    fix: "context-mode upgrade (collapses duplicate context-mode entries; preserves unrelated hooks)",
+                });
+            }
+        }
+        return results.concat(hookChecks, duplicateChecks);
     }
     checkPluginRegistration() {
         // Check for context-mode in [mcp_servers] section of config.toml

package/build/adapters/opencode/index.d.ts

@@ -58,6 +58,7 @@ export declare class OpenCodeAdapter extends BaseAdapter implements HookAdapter
      * Check whether a settings object has the context-mode plugin registered.
      */
     private hasContextModePlugin;
+    private hasLegacyContextModeMcp;
     /**
      * Extract session ID from OpenCode hook input.
      * OpenCode uses camelCase sessionID.

package/build/adapters/opencode/index.js

@@ -310,6 +310,14 @@ export class OpenCodeAdapter extends BaseAdapter {
                 fix: "context-mode upgrade",
             });
         }
+        if (this.hasLegacyContextModeMcp(settings)) {
+            results.push({
+                check: "Legacy MCP registration",
+                status: "warn",
+                message: "mcp.context-mode is redundant: ctx_* tools are now provided by the plugin",
+                fix: "context-mode upgrade (removes only mcp.context-mode; preserves other MCP servers)",
+            });
+        }
         // Note: SessionStart handled via experimental.chat.system.transform surrogate
         results.push({
             check: "SessionStart hook",
@@ -368,6 +376,16 @@ export class OpenCodeAdapter extends BaseAdapter {
             changes.push("context-mode already in plugin array");
         }
         settings.plugin = plugins;
+        const mcp = settings.mcp;
+        if (mcp && typeof mcp === "object" && !Array.isArray(mcp)) {
+            const servers = mcp;
+            if (Object.prototype.hasOwnProperty.call(servers, "context-mode")) {
+                delete servers["context-mode"];
+                changes.push("Removed legacy context-mode MCP block (plugin-native tools)");
+            }
+            if (Object.keys(servers).length === 0)
+                delete settings.mcp;
+        }
         this.writeSettings(settings);
         return changes;
     }
@@ -405,6 +423,13 @@ export class OpenCodeAdapter extends BaseAdapter {
         const plugins = settings.plugin;
         return Array.isArray(plugins) && plugins.some((p) => typeof p === "string" && p.includes("context-mode"));
     }
+    hasLegacyContextModeMcp(settings) {
+        const mcp = settings.mcp;
+        return !!(mcp &&
+            typeof mcp === "object" &&
+            !Array.isArray(mcp) &&
+            Object.prototype.hasOwnProperty.call(mcp, "context-mode"));
+    }
     /**
      * Extract session ID from OpenCode hook input.
      * OpenCode uses camelCase sessionID.

package/build/adapters/opencode/plugin.d.ts

@@ -44,6 +44,27 @@ type PluginContext = {
     client: PluginClient;
     directory: string;
 };
+type NativeToolContext = {
+    sessionID: string;
+    messageID: string;
+    agent: string;
+    directory: string;
+    worktree?: string;
+    abort?: AbortSignal;
+    metadata?: (input: {
+        title?: string;
+        metadata?: Record<string, unknown>;
+    }) => void;
+};
+type NativeToolDefinition = {
+    description: string;
+    args: Record<string, unknown>;
+    execute: (args: Record<string, unknown>, ctx: NativeToolContext) => Promise<string | {
+        title?: string;
+        output: string;
+        metadata?: Record<string, unknown>;
+    }>;
+};
 /** OpenCode tool.execute.before — first parameter */
 interface BeforeHookInput {
     tool: string;
@@ -130,6 +151,7 @@ declare function systemHasRoutingInstructions(system: string[]): boolean;
  * OpenCode expects: export const ContextModePlugin = (ctx) => Promise<Hooks>
  */
 declare function createContextModePlugin(ctx: PluginContext): Promise<{
+    tool: Record<string, NativeToolDefinition>;
     "tool.execute.before": (input: BeforeHookInput, output: BeforeHookOutput) => Promise<void>;
     "tool.execute.after": (input: AfterHookInput, output: AfterHookOutput) => Promise<void>;
     "chat.message": (input: ChatMessageHookInput, output: ChatMessageHookOutput) => Promise<void>;

package/build/adapters/opencode/plugin.js

@@ -231,7 +231,59 @@ async function createContextModePlugin(ctx) {
             // Never break the turn on debug-log failure.
         }
     }
+    async function buildNativeTools() {
+        // Import the existing MCP server registry without starting its stdio
+        // transport. This is the plugin-only bridge for #574: OpenCode/Kilo
+        // call ctx_* tools in-process through Hooks.tool instead of spawning
+        // a separate MCP child per session.
+        const prevEmbedded = process.env.CONTEXT_MODE_EMBEDDED_PLUGIN_TOOLS;
+        process.env.CONTEXT_MODE_EMBEDDED_PLUGIN_TOOLS = "1";
+        let mod;
+        try {
+            mod = await import("../../server.js");
+        }
+        finally {
+            if (prevEmbedded === undefined)
+                delete process.env.CONTEXT_MODE_EMBEDDED_PLUGIN_TOOLS;
+            else
+                process.env.CONTEXT_MODE_EMBEDDED_PLUGIN_TOOLS = prevEmbedded;
+        }
+        const tools = {};
+        for (const registered of mod.REGISTERED_CTX_TOOLS) {
+            const config = registered.config;
+            const schema = config.inputSchema;
+            const shape = typeof schema?.shape === "object" && schema.shape !== null
+                ? schema.shape
+                : typeof schema?._def?.shape === "function"
+                    ? schema._def.shape()
+                    : {};
+            tools[registered.name] = {
+                description: String(config.description ?? ""),
+                args: shape,
+                async execute(args, toolCtx) {
+                    toolCtx.metadata?.({ title: String(config.title ?? registered.name) });
+                    const project = toolCtx.directory || projectDir;
+                    const result = await mod.withProjectDirOverride({ projectDir: project, sessionId: toolCtx.sessionID }, async () => registered.handler(args ?? {}));
+                    const r = result;
+                    const text = Array.isArray(r?.content)
+                        ? r.content
+                            .filter((c) => c?.type === "text" && typeof c.text === "string")
+                            .map((c) => c.text)
+                            .join("\n")
+                        : typeof result === "string"
+                            ? result
+                            : JSON.stringify(result ?? "");
+                    if (r?.isError)
+                        throw new Error(text || `${registered.name} returned an error`);
+                    return { title: String(config.title ?? registered.name), output: text };
+                },
+            };
+        }
+        return tools;
+    }
+    const nativeTools = await buildNativeTools();
     return {
+        tool: nativeTools,
         // ── PreToolUse: Routing enforcement ─────────────────
         "tool.execute.before": async (input, output) => {
             const toolName = input.tool ?? "";

package/build/adapters/pi/extension.js

@@ -288,6 +288,11 @@ export default function piExtension(pi) {
         pwd: process.env.PWD,
         cwd: process.cwd(),
     });
+    // Attribution object for project isolation — ensures every event recorded
+    // by the pi adapter carries the correct project_dir. Without this, all
+    // events default to project_dir="" which causes cross-project data leakage
+    // in shared SessionDB instances.
+    const _attribution = { projectDir, source: "workspace_root", confidence: 0.98 };
     const db = getOrCreateDB();
     // ── 1. session_start — Initialize session ──────────────
     pi.on("session_start", (_event, ctx) => {
@@ -351,7 +356,7 @@ export default function piExtension(pi) {
             const events = extractEvents(hookInput);
             if (events.length > 0) {
                 for (const ev of events) {
-                    db.insertEvent(_sessionId, ev, "PostToolUse");
+                    db.insertEvent(_sessionId, ev, "PostToolUse", _attribution);
                 }
             }
             else if (rawToolName) {
@@ -369,7 +374,7 @@ export default function piExtension(pi) {
                         .update(data)
                         .digest("hex")
                         .slice(0, 16),
-                }, "PostToolUse");
+                }, "PostToolUse", _attribution);
             }
         }
         catch {
@@ -398,7 +403,7 @@ export default function piExtension(pi) {
             if (prompt) {
                 const userEvents = extractUserEvents(prompt);
                 for (const ev of userEvents) {
-                    db.insertEvent(_sessionId, ev, "UserPromptSubmit");
+                    db.insertEvent(_sessionId, ev, "UserPromptSubmit", _attribution);
                 }
             }
             const existingPrompt = String(event?.systemPrompt ?? "");
@@ -420,6 +425,7 @@ export default function piExtension(pi) {
                 minPriority: 3,
                 limit: 50,
             });
+            let behavioralDirective = "";
             if (activeEvents.length > 0) {
                 const buildAuto = await getAutoInjection(pluginRoot);
                 let memoryContext = "";
@@ -428,6 +434,14 @@ export default function piExtension(pi) {
                         category: String(e.category ?? ""),
                         data: String(e.data ?? ""),
                     })));
+                    const bdMatch = memoryContext.match(/(<behavioral_directive>\n[^<]*\n<\/behavioral_directive>)/);
+                    if (bdMatch) {
+                        behavioralDirective = bdMatch[1];
+                        memoryContext = memoryContext.replace(bdMatch[1], "");
+                        if (memoryContext.match(/^<session_state[^>]*>\s*<\/session_state>\s*$/)) {
+                            memoryContext = "";
+                        }
+                    }
                 }
                 // Fallback (or if helper produced empty output): inline 500-token cap.
                 if (!memoryContext) {
@@ -453,6 +467,8 @@ export default function piExtension(pi) {
                 parts.push(resume.snapshot);
                 db.markResumeConsumed(_sessionId);
             }
+            if (behavioralDirective)
+                parts.push(behavioralDirective);
             // Return modified systemPrompt only if we added something beyond existing.
             const baseLen = existingPrompt ? 1 : 0;
             if (parts.length > baseLen) {
@@ -491,7 +507,7 @@ export default function piExtension(pi) {
                 data,
                 priority: 1,
                 data_hash: createHash("sha256").update(data).digest("hex").slice(0, 16),
-            }, "PostToolUse");
+            }, "PostToolUse", _attribution);
         }
         catch {
             // best effort — never break provider response

package/build/adapters/pi/mcp-bridge.d.ts

@@ -47,6 +47,13 @@ export interface MCPCallResult {
     }>;
     isError?: boolean;
 }
+interface PiRenderTheme {
+    bold(text: string): string;
+    fg(color: string, text: string): string;
+}
+interface PiRenderContext {
+    lastComponent?: unknown;
+}
 /**
  * Minimal stdio JSON-RPC client targeting the context-mode MCP server.
  *
@@ -69,6 +76,15 @@ export declare class MCPStdioClient {
     private buffer;
     private initialized;
     private exited;
+    /**
+     * In-flight respawn promise — set while {@link respawn} runs so
+     * concurrent callers awaiting `request()` after an idle exit observe
+     * the SAME respawn, not N parallel ones. Without this guard, two
+     * simultaneous `callTool` calls would each see `this.exited === true`,
+     * each fire their own `respawn()`, and the loser leaks an orphaned
+     * child process the GC cannot reach (no `.kill()` reference).
+     */
+    private respawnPromise;
     /**
      * Live env passed to the spawned child — exposed (read-only intent)
      * so tests can pin the fork-bomb-prevention env counter (#516)
@@ -81,16 +97,31 @@ export declare class MCPStdioClient {
     private onExit;
     private onData;
     request<T = unknown>(method: string, params: unknown, timeoutMs?: number): Promise<T>;
+    private writeFrame;
     notify(method: string, params: unknown): void;
     initialize(): Promise<void>;
     listTools(): Promise<MCPTool[]>;
     callTool(name: string, args: unknown): Promise<MCPCallResult>;
     /**
-     * Respawn the MCP child after an exit (clean idle shutdown or crash).
+     * Respawn the MCP child after an exit (clean shutdown or crash).
      * Resets state so a fresh `start()` + `initialize()` cycle runs, then
      * the caller's pending request flows through the new child.
      *
-     * Internal — exposed only via the public `callTool()` happy path.
+     * Single-flight — concurrent callers share one in-flight respawn via
+     * {@link respawnPromise}. Internal — only entered via {@link request}.
+     *
+     * Sequencing pinned (do not reorder without updating the regression
+     * test in tests/adapters/pi-mcp-bridge.test.ts):
+     *   1. `this.child = null`     — drop stale handle
+     *   2. `this.buffer = ""`       — discard leftover bytes from old child
+     *   3. `this.exited = false`    — must precede `start()` + `initialize()`,
+     *                                 because `request("initialize", …)`
+     *                                 inside `initialize()` re-checks this
+     *                                 flag and would otherwise re-enter
+     *                                 respawn in an infinite loop
+     *   4. `this.initialized = false`
+     *   5. `this.start()`
+     *   6. `await this.initialize()` — flows through `request()` recursively
      */
     private respawn;
     shutdown(): void;
@@ -106,6 +137,11 @@ export interface PiToolRegistration {
     label: string;
     description: string;
     parameters: unknown;
+    renderCall?: (args: unknown, theme: PiRenderTheme, context: PiRenderContext) => unknown;
+    renderResult?: (result: MCPCallResult, options: {
+        expanded: boolean;
+        isPartial: boolean;
+    }, theme: PiRenderTheme, context: PiRenderContext) => unknown;
     execute: (toolCallId: string, params: Record<string, unknown>) => Promise<{
         content: Array<{
             type: "text";
@@ -144,3 +180,4 @@ export interface BootstrapOptions {
     _resolveJsRuntime?: () => string | null;
 }
 export declare function bootstrapMCPTools(pi: PiLikeAPI, serverScript: string, options?: BootstrapOptions): Promise<BridgeHandle>;
+export {};